blacknet | hxxps://github[.]com

Resubmissions

06-09-2023 18:16

230906-wwwlasaf5z 10

01-09-2023 23:14

230901-28f92aac5w 10

Analysis

max time kernel
120s
max time network
306s
platform
windows10-1703_x64
resource
win10-20230703-en
resource tags

arch:x64arch:x86image:win10-20230703-enlocale:en-usos:windows10-1703-x64system
submitted
01-09-2023 23:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com

Score

10^/10

blacknet darkcomet modiloader bot guest16 aspackv2 persistence rat trojan upx

Malware Config

Extracted

Family

blacknet

Version

v3.6.0 Public

Botnet

Bot

http://f0483357.xsph.ru/

Mutex

BN[PHfunXGI-6235724]

Attributes

antivm
true
elevate_uac
false
install_name
jusched.exe
splitter
|BN|
start_name
a5b002eacf54590ec8401ff6d3f920ee
startup
true
usb_spread
true

Extracted

Family

darkcomet

Botnet

Guest16

gameservice.ddns.net:4320

Mutex

DC_MUTEX-WBUNVXD

Attributes

InstallPath
AudioDriver\taskhost.exe
gencode
EWSsWwgyJrUD
install
true
offline_keylogger
true
persistence
false
reg_key
AudioDriver

Signatures

BlackNET
BlackNET is an open source remote access tool written in VB.NET.
trojan blacknet

BlackNET payload 6 IoCs

Processes:

resource	yara_rule
behavioral1/files/0x000900000001b077-825.dat	family_blacknet
behavioral1/files/0x000900000001b077-838.dat	family_blacknet
behavioral1/files/0x000900000001b077-837.dat	family_blacknet
behavioral1/memory/3372-840-0x0000000000730000-0x000000000123C000-memory.dmp	family_blacknet
behavioral1/files/0x000600000001b0ac-883.dat	family_blacknet
behavioral1/files/0x000600000001b0ac-886.dat	family_blacknet

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

upx_compresser.exe

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\AudioDriver\\taskhost.exe"	upx_compresser.exe

ModiLoader Second Stage 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/4360-495-0x0000000000400000-0x0000000000545000-memory.dmp	modiloader_stage2
behavioral1/memory/4360-868-0x0000000000400000-0x0000000000545000-memory.dmp	modiloader_stage2

Downloads MZ/PE file

ASPack v2.12-2.42 3 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

Processes:

resource	yara_rule
behavioral1/files/0x000600000001b09a-431.dat	aspack_v212_v242
behavioral1/files/0x000600000001b09a-476.dat	aspack_v212_v242
behavioral1/files/0x000600000001b09a-478.dat	aspack_v212_v242

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

upx_compresser.exe

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1148472871-1113856141-1322182616-1000\Control Panel\International\Geo\Nation	upx_compresser.exe

Executes dropped EXE 13 IoCs

Processes:

WinLocker Builder v1.4.exeWinlockerBuilderv5.exejusched.exesvshost.exeWinlockerBuilderv5.exeupx_compresser.exeupx_compresser.exetaskhost.exetaskhost.exesvshost.exeWinlockerBuilderv5.exeupx_compresser.exeupx_compresser.exe

pid	Process
4360	WinLocker Builder v1.4.exe
3372	WinlockerBuilderv5.exe
1020	jusched.exe
1300	svshost.exe
4816	WinlockerBuilderv5.exe
2088	upx_compresser.exe
2788	upx_compresser.exe
2812	taskhost.exe
420	taskhost.exe
1700	svshost.exe
4076	WinlockerBuilderv5.exe
5116	upx_compresser.exe
5008	upx_compresser.exe

UPX packed file 10 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/files/0x000600000001b0ae-899.dat	upx
behavioral1/memory/4816-903-0x0000000000400000-0x0000000000C89000-memory.dmp	upx
behavioral1/files/0x000600000001b0ae-900.dat	upx
behavioral1/memory/4816-941-0x0000000000400000-0x0000000000C89000-memory.dmp	upx
behavioral1/memory/4816-955-0x0000000000400000-0x0000000000C89000-memory.dmp	upx
behavioral1/files/0x000600000001b0ae-961.dat	upx
behavioral1/files/0x000600000001b0ae-971.dat	upx
behavioral1/files/0x000600000001b0ae-969.dat	upx
behavioral1/memory/4076-976-0x0000000000400000-0x0000000000C89000-memory.dmp	upx
behavioral1/memory/4076-991-0x0000000000400000-0x0000000000C89000-memory.dmp	upx

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

WinlockerBuilderv5.exeupx_compresser.exejusched.exe

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1148472871-1113856141-1322182616-1000\Software\Microsoft\Windows\CurrentVersion\Run\a5b002eacf54590ec8401ff6d3f920ee = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Microsoft\\MyClient\\jusched.exe"	WinlockerBuilderv5.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1148472871-1113856141-1322182616-1000\Software\Microsoft\Windows\CurrentVersion\Run\AudioDriver = "C:\\Users\\Admin\\Documents\\AudioDriver\\taskhost.exe"	upx_compresser.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1148472871-1113856141-1322182616-1000\Software\Microsoft\Windows\CurrentVersion\Run\a5b002eacf54590ec8401ff6d3f920ee = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Microsoft\\MyClient\\jusched.exe"	jusched.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1148472871-1113856141-1322182616-1000\Software\Microsoft\Windows\CurrentVersion\Run\a5b002eacf54590ec8401ff6d3f920ee = "C:\\Users\\Admin\\Downloads\\WinlockerBuilderv5.exe"	WinlockerBuilderv5.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious use of SetThreadContext 3 IoCs

Processes:

upx_compresser.exetaskhost.exeupx_compresser.exe

description	pid	Process	procid_target
PID 2088 set thread context of 2788	2088	upx_compresser.exe	107
PID 2812 set thread context of 420	2812	taskhost.exe	109
PID 5116 set thread context of 5008	5116	upx_compresser.exe	113

Drops file in Windows directory 2 IoCs

Processes:

taskmgr.exe

description	ioc	Process
File created	C:\Windows\rescache\_merged\4183903823\810424605.pri	taskmgr.exe
File created	C:\Windows\rescache\_merged\1601268389\3877292338.pri	taskmgr.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

taskmgr.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

chrome.exe

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133380837162621919"	chrome.exe

Modifies registry class 1 IoCs

Processes:

upx_compresser.exe

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance	upx_compresser.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

chrome.exetaskmgr.exeWinlockerBuilderv5.exeupx_compresser.exejusched.exetaskhost.exeupx_compresser.exe

pid	Process
4112	chrome.exe
4112	chrome.exe
4424	taskmgr.exe
4424	taskmgr.exe
4424	taskmgr.exe
4424	taskmgr.exe
4424	taskmgr.exe
4424	taskmgr.exe
3372	WinlockerBuilderv5.exe
3372	WinlockerBuilderv5.exe
3372	WinlockerBuilderv5.exe
3372	WinlockerBuilderv5.exe
3372	WinlockerBuilderv5.exe
3372	WinlockerBuilderv5.exe
3372	WinlockerBuilderv5.exe
3372	WinlockerBuilderv5.exe
3372	WinlockerBuilderv5.exe
3372	WinlockerBuilderv5.exe
3372	WinlockerBuilderv5.exe
3372	WinlockerBuilderv5.exe
3372	WinlockerBuilderv5.exe
3372	WinlockerBuilderv5.exe
3372	WinlockerBuilderv5.exe
4424	taskmgr.exe
4424	taskmgr.exe
3372	WinlockerBuilderv5.exe
3372	WinlockerBuilderv5.exe
4424	taskmgr.exe
4424	taskmgr.exe
4424	taskmgr.exe
4424	taskmgr.exe
4424	taskmgr.exe
2088	upx_compresser.exe
2088	upx_compresser.exe
4424	taskmgr.exe
4424	taskmgr.exe
4424	taskmgr.exe
1020	jusched.exe
1020	jusched.exe
1020	jusched.exe
1020	jusched.exe
1020	jusched.exe
1020	jusched.exe
1020	jusched.exe
1020	jusched.exe
1020	jusched.exe
1020	jusched.exe
1020	jusched.exe
1020	jusched.exe
1020	jusched.exe
1020	jusched.exe
2812	taskhost.exe
2812	taskhost.exe
4424	taskmgr.exe
4424	taskmgr.exe
1020	jusched.exe
1020	jusched.exe
4424	taskmgr.exe
4424	taskmgr.exe
5116	upx_compresser.exe
5116	upx_compresser.exe
4424	taskmgr.exe
4424	taskmgr.exe
4424	taskmgr.exe

Suspicious behavior: MapViewOfSection 3 IoCs

Processes:

upx_compresser.exetaskhost.exeupx_compresser.exe

pid	Process
2088	upx_compresser.exe
2812	taskhost.exe
5116	upx_compresser.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

Processes:

chrome.exe

pid	Process
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

chrome.exe

description	pid	Process
Token: SeShutdownPrivilege	4112	chrome.exe
Token: SeCreatePagefilePrivilege	4112	chrome.exe
Token: SeShutdownPrivilege	4112	chrome.exe
Token: SeCreatePagefilePrivilege	4112	chrome.exe
Token: SeShutdownPrivilege	4112	chrome.exe
Token: SeCreatePagefilePrivilege	4112	chrome.exe
Token: SeShutdownPrivilege	4112	chrome.exe
Token: SeCreatePagefilePrivilege	4112	chrome.exe
Token: SeShutdownPrivilege	4112	chrome.exe
Token: SeCreatePagefilePrivilege	4112	chrome.exe
Token: SeShutdownPrivilege	4112	chrome.exe
Token: SeCreatePagefilePrivilege	4112	chrome.exe
Token: SeShutdownPrivilege	4112	chrome.exe
Token: SeCreatePagefilePrivilege	4112	chrome.exe
Token: SeShutdownPrivilege	4112	chrome.exe
Token: SeCreatePagefilePrivilege	4112	chrome.exe
Token: SeShutdownPrivilege	4112	chrome.exe
Token: SeCreatePagefilePrivilege	4112	chrome.exe
Token: SeShutdownPrivilege	4112	chrome.exe
Token: SeCreatePagefilePrivilege	4112	chrome.exe
Token: SeShutdownPrivilege	4112	chrome.exe
Token: SeCreatePagefilePrivilege	4112	chrome.exe
Token: SeShutdownPrivilege	4112	chrome.exe
Token: SeCreatePagefilePrivilege	4112	chrome.exe
Token: SeShutdownPrivilege	4112	chrome.exe
Token: SeCreatePagefilePrivilege	4112	chrome.exe
Token: SeShutdownPrivilege	4112	chrome.exe
Token: SeCreatePagefilePrivilege	4112	chrome.exe
Token: SeShutdownPrivilege	4112	chrome.exe
Token: SeCreatePagefilePrivilege	4112	chrome.exe
Token: SeShutdownPrivilege	4112	chrome.exe
Token: SeCreatePagefilePrivilege	4112	chrome.exe
Token: SeShutdownPrivilege	4112	chrome.exe
Token: SeCreatePagefilePrivilege	4112	chrome.exe
Token: SeShutdownPrivilege	4112	chrome.exe
Token: SeCreatePagefilePrivilege	4112	chrome.exe
Token: SeShutdownPrivilege	4112	chrome.exe
Token: SeCreatePagefilePrivilege	4112	chrome.exe
Token: SeShutdownPrivilege	4112	chrome.exe
Token: SeCreatePagefilePrivilege	4112	chrome.exe
Token: SeShutdownPrivilege	4112	chrome.exe
Token: SeCreatePagefilePrivilege	4112	chrome.exe
Token: SeShutdownPrivilege	4112	chrome.exe
Token: SeCreatePagefilePrivilege	4112	chrome.exe
Token: SeShutdownPrivilege	4112	chrome.exe
Token: SeCreatePagefilePrivilege	4112	chrome.exe
Token: SeShutdownPrivilege	4112	chrome.exe
Token: SeCreatePagefilePrivilege	4112	chrome.exe
Token: SeShutdownPrivilege	4112	chrome.exe
Token: SeCreatePagefilePrivilege	4112	chrome.exe
Token: SeShutdownPrivilege	4112	chrome.exe
Token: SeCreatePagefilePrivilege	4112	chrome.exe
Token: SeShutdownPrivilege	4112	chrome.exe
Token: SeCreatePagefilePrivilege	4112	chrome.exe
Token: SeShutdownPrivilege	4112	chrome.exe
Token: SeCreatePagefilePrivilege	4112	chrome.exe
Token: SeShutdownPrivilege	4112	chrome.exe
Token: SeCreatePagefilePrivilege	4112	chrome.exe
Token: SeShutdownPrivilege	4112	chrome.exe
Token: SeCreatePagefilePrivilege	4112	chrome.exe
Token: SeShutdownPrivilege	4112	chrome.exe
Token: SeCreatePagefilePrivilege	4112	chrome.exe
Token: SeShutdownPrivilege	4112	chrome.exe
Token: SeCreatePagefilePrivilege	4112	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

chrome.exetaskmgr.exe

pid	Process
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4424	taskmgr.exe
4424	taskmgr.exe
4424	taskmgr.exe
4424	taskmgr.exe
4424	taskmgr.exe
4424	taskmgr.exe
4424	taskmgr.exe
4424	taskmgr.exe
4424	taskmgr.exe
4424	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

chrome.exetaskmgr.exe

pid	Process
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4424	taskmgr.exe
4424	taskmgr.exe
4424	taskmgr.exe
4424	taskmgr.exe
4424	taskmgr.exe
4424	taskmgr.exe
4424	taskmgr.exe
4424	taskmgr.exe
4424	taskmgr.exe
4424	taskmgr.exe
4424	taskmgr.exe
4424	taskmgr.exe
4424	taskmgr.exe
4424	taskmgr.exe
4424	taskmgr.exe
4424	taskmgr.exe
4424	taskmgr.exe
4424	taskmgr.exe
4424	taskmgr.exe
4424	taskmgr.exe
4424	taskmgr.exe
4424	taskmgr.exe
4424	taskmgr.exe
4424	taskmgr.exe
4424	taskmgr.exe
4424	taskmgr.exe
4424	taskmgr.exe
4424	taskmgr.exe
4424	taskmgr.exe
4424	taskmgr.exe
4424	taskmgr.exe
4424	taskmgr.exe

Suspicious use of SetWindowsHookEx 9 IoCs

Processes:

chrome.exeWinlockerBuilderv5.exeWinlockerBuilderv5.exejusched.exetaskhost.exeWinlockerBuilderv5.exe

pid	Process
4112	chrome.exe
4112	chrome.exe
3372	WinlockerBuilderv5.exe
3372	WinlockerBuilderv5.exe
4816	WinlockerBuilderv5.exe
1020	jusched.exe
1020	jusched.exe
420	taskhost.exe
4076	WinlockerBuilderv5.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	Process	procid_target
PID 4112 wrote to memory of 520	4112	chrome.exe	70
PID 4112 wrote to memory of 520	4112	chrome.exe	70
PID 4112 wrote to memory of 1696	4112	chrome.exe	76
PID 4112 wrote to memory of 1696	4112	chrome.exe	76
PID 4112 wrote to memory of 1696	4112	chrome.exe	76
PID 4112 wrote to memory of 1696	4112	chrome.exe	76
PID 4112 wrote to memory of 1696	4112	chrome.exe	76
PID 4112 wrote to memory of 1696	4112	chrome.exe	76
PID 4112 wrote to memory of 1696	4112	chrome.exe	76
PID 4112 wrote to memory of 1696	4112	chrome.exe	76
PID 4112 wrote to memory of 1696	4112	chrome.exe	76
PID 4112 wrote to memory of 1696	4112	chrome.exe	76
PID 4112 wrote to memory of 1696	4112	chrome.exe	76
PID 4112 wrote to memory of 1696	4112	chrome.exe	76
PID 4112 wrote to memory of 1696	4112	chrome.exe	76
PID 4112 wrote to memory of 1696	4112	chrome.exe	76
PID 4112 wrote to memory of 1696	4112	chrome.exe	76
PID 4112 wrote to memory of 1696	4112	chrome.exe	76
PID 4112 wrote to memory of 1696	4112	chrome.exe	76
PID 4112 wrote to memory of 1696	4112	chrome.exe	76
PID 4112 wrote to memory of 1696	4112	chrome.exe	76
PID 4112 wrote to memory of 1696	4112	chrome.exe	76
PID 4112 wrote to memory of 1696	4112	chrome.exe	76
PID 4112 wrote to memory of 1696	4112	chrome.exe	76
PID 4112 wrote to memory of 1696	4112	chrome.exe	76
PID 4112 wrote to memory of 1696	4112	chrome.exe	76
PID 4112 wrote to memory of 1696	4112	chrome.exe	76
PID 4112 wrote to memory of 1696	4112	chrome.exe	76
PID 4112 wrote to memory of 1696	4112	chrome.exe	76
PID 4112 wrote to memory of 1696	4112	chrome.exe	76
PID 4112 wrote to memory of 1696	4112	chrome.exe	76
PID 4112 wrote to memory of 1696	4112	chrome.exe	76
PID 4112 wrote to memory of 1696	4112	chrome.exe	76
PID 4112 wrote to memory of 1696	4112	chrome.exe	76
PID 4112 wrote to memory of 1696	4112	chrome.exe	76
PID 4112 wrote to memory of 1696	4112	chrome.exe	76
PID 4112 wrote to memory of 1696	4112	chrome.exe	76
PID 4112 wrote to memory of 1696	4112	chrome.exe	76
PID 4112 wrote to memory of 1696	4112	chrome.exe	76
PID 4112 wrote to memory of 1696	4112	chrome.exe	76
PID 4112 wrote to memory of 1832	4112	chrome.exe	72
PID 4112 wrote to memory of 1832	4112	chrome.exe	72
PID 4112 wrote to memory of 4916	4112	chrome.exe	75
PID 4112 wrote to memory of 4916	4112	chrome.exe	75
PID 4112 wrote to memory of 4916	4112	chrome.exe	75
PID 4112 wrote to memory of 4916	4112	chrome.exe	75
PID 4112 wrote to memory of 4916	4112	chrome.exe	75
PID 4112 wrote to memory of 4916	4112	chrome.exe	75
PID 4112 wrote to memory of 4916	4112	chrome.exe	75
PID 4112 wrote to memory of 4916	4112	chrome.exe	75
PID 4112 wrote to memory of 4916	4112	chrome.exe	75
PID 4112 wrote to memory of 4916	4112	chrome.exe	75
PID 4112 wrote to memory of 4916	4112	chrome.exe	75
PID 4112 wrote to memory of 4916	4112	chrome.exe	75
PID 4112 wrote to memory of 4916	4112	chrome.exe	75
PID 4112 wrote to memory of 4916	4112	chrome.exe	75
PID 4112 wrote to memory of 4916	4112	chrome.exe	75
PID 4112 wrote to memory of 4916	4112	chrome.exe	75
PID 4112 wrote to memory of 4916	4112	chrome.exe	75
PID 4112 wrote to memory of 4916	4112	chrome.exe	75
PID 4112 wrote to memory of 4916	4112	chrome.exe	75
PID 4112 wrote to memory of 4916	4112	chrome.exe	75
PID 4112 wrote to memory of 4916	4112	chrome.exe	75
PID 4112 wrote to memory of 4916	4112	chrome.exe	75

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffa5f489758,0x7ffa5f489768,0x7ffa5f489778
  2⤵
  PID:520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1832 --field-trial-handle=1776,i,2456757907772236355,4188583522331898630,131072 /prefetch:8
  2⤵
  PID:1832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2872 --field-trial-handle=1776,i,2456757907772236355,4188583522331898630,131072 /prefetch:1
  2⤵
  PID:4704
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2880 --field-trial-handle=1776,i,2456757907772236355,4188583522331898630,131072 /prefetch:1
  2⤵
  PID:2252
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2092 --field-trial-handle=1776,i,2456757907772236355,4188583522331898630,131072 /prefetch:8
  2⤵
  PID:4916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1552 --field-trial-handle=1776,i,2456757907772236355,4188583522331898630,131072 /prefetch:2
  2⤵
  PID:1696
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4648 --field-trial-handle=1776,i,2456757907772236355,4188583522331898630,131072 /prefetch:8
  2⤵
  PID:4604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3840 --field-trial-handle=1776,i,2456757907772236355,4188583522331898630,131072 /prefetch:8
  2⤵
  PID:5008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4488 --field-trial-handle=1776,i,2456757907772236355,4188583522331898630,131072 /prefetch:8
  2⤵
  PID:4092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=1628 --field-trial-handle=1776,i,2456757907772236355,4188583522331898630,131072 /prefetch:1
  2⤵
  PID:2200
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=5012 --field-trial-handle=1776,i,2456757907772236355,4188583522331898630,131072 /prefetch:1
  2⤵
  PID:2808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4568 --field-trial-handle=1776,i,2456757907772236355,4188583522331898630,131072 /prefetch:8
  2⤵
  PID:4072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5348 --field-trial-handle=1776,i,2456757907772236355,4188583522331898630,131072 /prefetch:8
  2⤵
  PID:4508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5268 --field-trial-handle=1776,i,2456757907772236355,4188583522331898630,131072 /prefetch:8
  2⤵
  PID:744
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5288 --field-trial-handle=1776,i,2456757907772236355,4188583522331898630,131072 /prefetch:8
  2⤵
  PID:200
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5416 --field-trial-handle=1776,i,2456757907772236355,4188583522331898630,131072 /prefetch:8
  2⤵
  PID:3284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5628 --field-trial-handle=1776,i,2456757907772236355,4188583522331898630,131072 /prefetch:8
  2⤵
  PID:5036
- C:\Users\Admin\Downloads\WinLocker Builder v1.4.exe
  "C:\Users\Admin\Downloads\WinLocker Builder v1.4.exe"
  2⤵
  - Executes dropped EXE
  PID:4360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --mojo-platform-channel-handle=2216 --field-trial-handle=1776,i,2456757907772236355,4188583522331898630,131072 /prefetch:1
  2⤵
  PID:3892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --mojo-platform-channel-handle=5788 --field-trial-handle=1776,i,2456757907772236355,4188583522331898630,131072 /prefetch:1
  2⤵
  PID:4740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --mojo-platform-channel-handle=6084 --field-trial-handle=1776,i,2456757907772236355,4188583522331898630,131072 /prefetch:1
  2⤵
  PID:364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5384 --field-trial-handle=1776,i,2456757907772236355,4188583522331898630,131072 /prefetch:8
  2⤵
  PID:500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5272 --field-trial-handle=1776,i,2456757907772236355,4188583522331898630,131072 /prefetch:8
  2⤵
  PID:2060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5628 --field-trial-handle=1776,i,2456757907772236355,4188583522331898630,131072 /prefetch:8
  2⤵
  PID:220
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4488 --field-trial-handle=1776,i,2456757907772236355,4188583522331898630,131072 /prefetch:8
  2⤵
  PID:5008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5896 --field-trial-handle=1776,i,2456757907772236355,4188583522331898630,131072 /prefetch:8
  2⤵
  PID:604
- C:\Users\Admin\Downloads\WinlockerBuilderv5.exe
  "C:\Users\Admin\Downloads\WinlockerBuilderv5.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:3372
- - C:\Users\Admin\AppData\Local\Temp\Microsoft\MyClient\jusched.exe
    "C:\Users\Admin\AppData\Local\Temp\Microsoft\MyClient\jusched.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:1020
  - - C:\Users\Admin\AppData\Local\Temp\svshost.exe
      "C:\Users\Admin\AppData\Local\Temp\svshost.exe"
      4⤵
      Executes dropped EXE
      PID:1700
    - - C:\Users\Admin\AppData\Local\Temp\WinlockerBuilderv5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WinlockerBuilderv5.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4076
    - - C:\Users\Admin\AppData\Local\Temp\upx_compresser.exe
        
        "C:\Users\Admin\AppData\Local\Temp\upx_compresser.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        
        PID:5116
      - C:\Users\Admin\AppData\Local\Temp\upx_compresser.exe
        
        "C:\Users\Admin\AppData\Local\Temp\upx_compresser.exe"
        6⤵
        Executes dropped EXE
        
        PID:5008
- - C:\Users\Admin\AppData\Local\Temp\svshost.exe
    "C:\Users\Admin\AppData\Local\Temp\svshost.exe"
    3⤵
    - Executes dropped EXE
    PID:1300
  - - C:\Users\Admin\AppData\Local\Temp\WinlockerBuilderv5.exe
      "C:\Users\Admin\AppData\Local\Temp\WinlockerBuilderv5.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4816
  - - C:\Users\Admin\AppData\Local\Temp\upx_compresser.exe
      "C:\Users\Admin\AppData\Local\Temp\upx_compresser.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      PID:2088
    - - C:\Users\Admin\AppData\Local\Temp\upx_compresser.exe
        
        "C:\Users\Admin\AppData\Local\Temp\upx_compresser.exe"
        5⤵
        Modifies WinLogon for persistence
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Modifies registry class
        
        PID:2788
      - C:\Users\Admin\Documents\AudioDriver\taskhost.exe
        
        "C:\Users\Admin\Documents\AudioDriver\taskhost.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        
        PID:2812
        
        C:\Users\Admin\Documents\AudioDriver\taskhost.exe
        
        "C:\Users\Admin\Documents\AudioDriver\taskhost.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3152 --field-trial-handle=1776,i,2456757907772236355,4188583522331898630,131072 /prefetch:2
  2⤵
  PID:3484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --mojo-platform-channel-handle=5968 --field-trial-handle=1776,i,2456757907772236355,4188583522331898630,131072 /prefetch:1
  2⤵
  PID:3372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --mojo-platform-channel-handle=5492 --field-trial-handle=1776,i,2456757907772236355,4188583522331898630,131072 /prefetch:1
  2⤵
  PID:4768

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:1916

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4424

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
PID:3984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xd4,0xd8,0xdc,0xb0,0xe0,0x7ffa5f489758,0x7ffa5f489768,0x7ffa5f489778
  2⤵
  PID:192

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

Filesize
40B

MD5
b88809281d821f48b8a5da8ce7ff87d2

SHA1
06c4703db1818c707fa255642f0f5a1e01094d56

SHA256
509f904fe1e5c46245c6c349d4b813aa95a52678ed16aac6bc26d5d548415077

SHA512
ade0e122a42d403ccda18fa303f9f51f72b869704cb005d2338a794abe17435263e067ab46e3588048c53d13a1d9851ca50b48e08f77f345f3181b83235514f9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

Filesize
40B

MD5
b88809281d821f48b8a5da8ce7ff87d2

SHA1
06c4703db1818c707fa255642f0f5a1e01094d56

SHA256
509f904fe1e5c46245c6c349d4b813aa95a52678ed16aac6bc26d5d548415077

SHA512
ade0e122a42d403ccda18fa303f9f51f72b869704cb005d2338a794abe17435263e067ab46e3588048c53d13a1d9851ca50b48e08f77f345f3181b83235514f9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

Filesize
40B

MD5
b88809281d821f48b8a5da8ce7ff87d2

SHA1
06c4703db1818c707fa255642f0f5a1e01094d56

SHA256
509f904fe1e5c46245c6c349d4b813aa95a52678ed16aac6bc26d5d548415077

SHA512
ade0e122a42d403ccda18fa303f9f51f72b869704cb005d2338a794abe17435263e067ab46e3588048c53d13a1d9851ca50b48e08f77f345f3181b83235514f9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000006

Filesize
32KB

MD5
04cb676d26899df8beca1fb9da675b11

SHA1
ef369339c3643b564d8c5234dc24060c8f027700

SHA256
0112d431af82a350fbbf05dc09f67eb57639e82959d31488fef908cfc4df60c2

SHA512
55579fbad58fb0d45c6b077627954acac1772bfec2ee6b91f03e9ebcca046eee4c1fc5de4abadf4af117a43be25a10384f08689daddd7a2ae88cfb6f7337c5da

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000007

Filesize
44KB

MD5
d716b6013bc03f1e4fe2d5cd719c595c

SHA1
01347f66988db64e410b5ce8b8a8c353ff059296

SHA256
fc8a8b1cf010979eb77a33e4c8fcc744a884fed8147a326bcb39f7ee9aeeb32b

SHA512
cad4f0b076fe741297b4d1845013cdb7e7f092202f1e8b9c23532623d7b73bfe8c7c37af5078bc6d571e4b7276e6510a340838d34e84c470f6405281c7f2e9ab

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000009

Filesize
39KB

MD5
bfe589d7b7e3f06cee5351e805ea1af2

SHA1
0880735ee4e30ac4dc25fc2d4d03cd5a45bf9c1e

SHA256
2ff2bcbcff531b220ba593814fbaa833de9d1f72d1a8036d46b3f5b766aec3c6

SHA512
dd183e01261385f2d1602561f51253c37e785d7ca8572d1a1a059a6d9ff723baea014fb3cc2ac39918622d0d3db7dace315d472ff1c403fe21c60e691880a1b8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000c

Filesize
26KB

MD5
03f23dea324e6a2027c146d66037d1e2

SHA1
1ddca456e407fc3d07db78be9decb1bb36ccf77a

SHA256
4ad3cbb2f12576fe8a1250c5688ea8a1c29f120f0755c2f66b76d36c9bd7f05e

SHA512
18320e666de94edbaac8df776b3b762449b3daebddb5e99ccfa25b9c02c217878759d0d586c9d72fe10d29b52cf4fc7e96a00bcf270c2d49de92d919df2c5099

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000d

Filesize
19KB

MD5
49943bc015e9713f646c021a2f9a7f48

SHA1
7bcd637eb823b04c425775fa8c914e8b8f2ac2a5

SHA256
f6e0b13ad81727a0d9317a3049fd06ecf2c473060e9d6e4f8eb564a1d82ad289

SHA512
2203c2dbe9482b0b351a3f70ea0ba9f63dcc87a66d4a4db63a060dd7dd04cb73a73bced407d57c2bcf26cf7ed78b18c7555c87b22db9bd744cb6491cd040305d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000e

Filesize
59KB

MD5
6df02575632bb48bc10f831da29d9f5a

SHA1
246f48caa1b19010f66390f4e139ba01ab5888f6

SHA256
1dcfb0bcabb2e70cb297734ffd0d9ab1d5199be56c8fc913240025b060e83c4a

SHA512
731a212bec5eac8e4234fca76b4c85ff16ad975c4e9e3fe220f9df2a485186c03ad0e9c458e8e5390330d0a2bc8bcf363599610dbc25351205624772973afbda

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000011

Filesize
17KB

MD5
99ebbe83e525652c9732d9bb94fd6a89

SHA1
cb70a4781886ffe5c013d8c23444271a61b0720e

SHA256
b1e3b57191c27079b513a300bac829cd5bcb46d0a644470aebe9d2a6ff70be85

SHA512
bafdfec00e1b0dca441e52d05a414f9f90a1653194c4b29e26a06fad566afb53a17f7c5db40736eae652b4fd2021fa287f2ae61d788e89bbb0c8e01845b87287

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000014

Filesize
65KB

MD5
762441b6d2b22fb0dd1d59441a23fff8

SHA1
f527def10dcf260cee110223d95cd0318ace87d6

SHA256
46ebd4a0bf9b9bcea12b9784868ef461a7d07c3e5dba57f25877991282fb3ee7

SHA512
3bdf4aa98b732d3be0d2f79e76ce7f8bf262f65d99dfaaaa33f508c95194351c758c86f71a5720fec93e1788d2fc18157bbef79eb79040dea107d034f2814cf2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000016

Filesize
111KB

MD5
90fc2441ea9518874eddd191832e73ee

SHA1
8d6f23446cf3dbd870f1fb95f4c46f7cd64b07f0

SHA256
ae5f469ba93dd5c8d47ff70b91ba6f42d7a2befb91104f89ef241055e7f6a4c8

SHA512
d1298f2691c0ed6d41069a865a53e6b6f3fb0887b9aecc20ad5b985b6e3bfc574bbf4d3016223a76883c461a2965ea08c382ff03c6bf0722611cbdc22657a409

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000018

Filesize
27KB

MD5
b3651e618098746c8784d8f2feb975da

SHA1
f84dc5e2231456a8eb6741f0a7d3d737d64abc14

SHA256
78faf57d9f3ab2ef0a7acf46fac725982c6fc12602464119adcc8a13d8374c13

SHA512
ae540878b51a58b19c50ec17f1a80cb9ad242e9fda9ce8cba67c7f5f982ffd9a3befba651c45bd2efa99a78811c3ed850ec3ef27846457099ab043a48454f682

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000019

Filesize
19KB

MD5
c32520f88e9a2706bf30bade0cd137ec

SHA1
b3cc901b533fb0bd77da03502c748114d87b8b91

SHA256
0861dd49a443ed0611f8ca39d833742cb04703af35280eba4ad6be5e7a6ff17b

SHA512
cd63a24ab81e60ccf9040437485769787a6dcffd4887895e89a0687880003e1cd5cbde2a332985821b1aac24740880f29bf4a699680929cbd720b698c1d9e804

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
784f774ccd63eb44ddd9defed2546bef

SHA1
890c69383a0a47ad9007e8e33dcaab72e0ba9b4e

SHA256
72e37390d2d20d12af9d868a290abf63927b68c841a1accc3f86a97f9ce151d6

SHA512
b81d111386f86691bd39e0259703dde4e245c34f9f56a84bf696fcf7c771f1adbf8f0942b17d6ab4db69f7fadcd73981676683c7f6bf5a4a343da825989950c1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
adaa6d85dc2fd55e7f0b4dc28cb5bc6e

SHA1
07f09975ba9fb19272dfc14066505cbe3c6e61f7

SHA256
d11937b0f0a8799b22fedc4f1c7e09bf41a1109cba601c38d415642add5f8ada

SHA512
5b2a44fe561b3995af5582f4ca032a41326555578b3acf5afe99ea9bd13cabb615c5a42288b582fea7f83658a723a59325c9c14e20287329ca97b08601520bcd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
a92ca49600beb0cf39e8ed19826ee9b9

SHA1
e556e1406cd0c2ef22a5fd89d976d7475f3740fe

SHA256
1e06d2113596e1a71cee12ad0b31fba7e2f5ba775f3dc2ab294121a979044ab0

SHA512
c1acc2616c6f6e5cb33a76abc6cc0668f9c9ab6f39d474fcd2ec0e9a25371e2e8f24dd4e3048f4730775ce76c0f45b42e31bf5842186b6a427600eb642911e72

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
3419b1cb0e32b7463d75fb17285b0be8

SHA1
ba6ab9561a70fdce488f0ff3be09b001396cf429

SHA256
dd8225c7e707873101ddf4d210664f8db94332a7d2e093916f2c3cf4d9f38634

SHA512
f33caa2e53342e54913e1edadaa219b7829e6604f52fa9f1feaedfc003b3b632068e1593b20314e5ea38b84324983928ee3399a71312c9498d80bac7a15f2563

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
34b4fb3e19ab555dd708384bc1487acb

SHA1
54f18a5368adaf054adad06bb180f16915a97831

SHA256
fa73ee71e56faafa075e8426cc67890fa240a910e754aca8620241abbe9df4ce

SHA512
88819e090190e09e8bd15bfbfc37b3031c609710ebea73cf6e77d6d048dcc58da5c4f60abbf87280288a428f6422c864bbdc294a0d135fc7717fab2c032cd7f9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
7d04dd462c96e43e76f3408511ebe7d7

SHA1
b0fc66e98b958610c612ce0580157205c9b96a44

SHA256
c0a3aa7fabe634833b8b981d81d2819631e63ab8fbae8f4964d2d536ae03c980

SHA512
e82dea7e00ede1fc2125a32b5d9b9dca635ee315e1adfaa888617fd66b91d9aceb6e7bf7d249688e2c2852e39f12c5adcb33ab91cb4e4d3b86c2672becdada67

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
fc4c046466a490ce62f0904e94eea8a5

SHA1
aa6c36ad9da0a60c6da47ef89beab41c7814ea17

SHA256
47d55f5435fbab256d1b2a335dd1dc67cf76cf0cb09903d10f6a17c6712f20df

SHA512
6eeadd16748ce4ef73d32ee6d534563c3e16b4481be166b0ba05298a2ceea6fe969df7aa5a98bbe8524c8489dc5bcef3d1c282d3ccf4def4286e0e08f3e179a8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
f1c22bed3bb804db6b6f932210e33393

SHA1
dfe107496389d0aa458fd54f71d334adb17c346b

SHA256
3cc047dc96578830eda8b8994dc6a8d4817a1be3aed7ff46e3d35b142d3edddd

SHA512
9af8c013c53f0de1f22d81f63b3c4235c330967ba893a66076b146cf0729eeef99d4711656191d385cb2750d8305906b50d055b7b651e0f496bb7205f0dca1c3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
75651fbe733fa9448aa1a3b305f53c4c

SHA1
1847ab76d90c38c62fbfcf8d1ff80268e239e4a9

SHA256
06bae1df954f532131b5fa87e49ef1bf7f71d4f29f7f6d02b18fcde829100c45

SHA512
a0cc85f16396a9450cd5fc77f579882ed698df998e353ab53b0c9c9f0e60f7f4a2c2970c6aca4f4c4d83bdaff9f512cedcbfb0d951b297011ef5b19063230ce9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
968387e9277c71870c47755f2c0943b2

SHA1
f8f3ded589db7c4b8ba8e3d5961d031de19e7084

SHA256
b10ca25e95603ea83bbdf950a41e4c259903a0fb9832638492465b4b47600f7a

SHA512
ccf0f54a5655f6b35a5ab69fdcf2cd402ef4d542ba3f23275e14e65dec203fa2de1635736637b4b857c13e57bac518c7f2cbd5141b6c5bbf44421300235ee248

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
10c4bd112457ee0383ea808dfd2172f3

SHA1
a0faf78e32ed6b01f23510b4246eb844c2c48d5b

SHA256
0cee99f4314b3e2237909e6bc3c99dae425ce2645771b17b175755cd7e3419c8

SHA512
eaebb0014067390ef7c5cfb58244f9148cda38650904602356be760c0f0522d0746b5f6094a6a47a4a532c1f52dbda46dc8e16681b93eb76414466fb5484282a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
62e731c54871f6247dd08776c7483c2f

SHA1
15d465f063ca81e1eef29e495b9055f7f489ae33

SHA256
914ac301192d69dfca8cc01558a0b810fd51c3e90d85fa173b46b0cac4907062

SHA512
872fb67a86c318bc47f03421b345789581115bff8e5d0d4f346cfa3842451cefadb21a622bcb2209d63764d35c01388e27c2ce5f2bc76dd888e451a126bd8b1e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
0c46a9c35e02de383dd71c6893b9d157

SHA1
28fa25b73665a176f07f227009202740f36897b2

SHA256
e16666b9987eb26673dbe61c27b1bbef9a4259fd5abbcc8d762db2c2c1c8c92e

SHA512
ae5cdaf40f7ae9bbc7af56b3830510c157872a6b59d76c7706f131661570d5d99bb211122ef6523dd34a4710dd173094615defea216f1b3cf3714241f7d4cd2e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
1b3de863e2b14d8bb3dddec8a4dc892d

SHA1
ec81adcc28fc8e89e14f9821667de87271206606

SHA256
aaa01c3f43c6c15e229dd2ab3e795e8fdc71ce559582683d226bd78828fe6d36

SHA512
7767102a5f92171d519f0fd8cf7d921808c9d1561bbe9648d15e1942b6d32f81b06a6f1e811ebdeabd9616a4acf00cccb0eb6918f7c6c8cf4eb62cc27cb9f4ff

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
53dc91ee2828a7528d503ab09431cf56

SHA1
30f717059071101096a458b455fb930a644acb3f

SHA256
9e32ea46d999e3670b9e24a0caa009404d7da6e19f0c32f11971b45d45ab58c8

SHA512
b702512fc740739110c41e2d82b6985479411a8a583cc1687a7f57d70ad04ca5e75ecc5393f98100841fc3ea22f5d99c7a96b2a9a5ad29eaa806f16a95b2c676

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
0b9cf73f60894f8c94e28b642fd8b544

SHA1
29b13c5d58313549fe4bb411655b302ab711d96b

SHA256
dc391da0c05c75fab7221656637d19be0839c9d2538a95390115662de5226b6a

SHA512
6eedf23d691b0b83b17873fe9c0f8be833af10325a4b8a0ea7f817aa9f631e3ef87241860c5c1998a4d45bdd5fb48a5ae021532f351a04f48521f0d318b699ff

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
2d2cf76dc6fbd457a407619f27a90ab1

SHA1
40b669e81d33873b0b79bea0a3b8717193a5f28a

SHA256
ea79ad09377fca3fd2612f4d3dd0b061649ba43fc8c38da80a2be2a52cf65b06

SHA512
57ff00a21d9a2934a42351b0dcde850f913cad85976028e9e2ad6e22e26ce56acbaa17e319a4630fe2e99d56ab94a8173f206125cc59da970c131242abc1727c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
87KB

MD5
6f3551d67730c72a20aff851decfdb54

SHA1
14b3bf033eed4479ff2090416e6e0404d9043a23

SHA256
08f4c07ef6f265154814d0b8ad273e54fcafd8dca0d37c3c5971698b33b0ed22

SHA512
aad67317dcfe172de2f2a757ecb9fb1fa33cde2c7bc1ed045c1013c03ed25d23c52b26845f233445f500a2770386d21600832508d37c40d648d7206936744190

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
87KB

MD5
b8d8caa829ae7f426ed381fb801df650

SHA1
486ec95595afa1b65d9ebc9ac6ffa2f56260a70a

SHA256
24ea92756195910f8c5e491932909d7bf7b47d1e8bd9f8fa2ed8af0ead0f9a2f

SHA512
756914e4a0b7d3603468a2eaf3a28ee258c368f02bc83080c7ef4e3260a7176bc2ff8cb800abdcc6707a1f42b92d08c1e9ac3a783bf1ca3eff4896fa06b1f14f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
87KB

MD5
e51a018a823c103c67e0ca7f73a74d04

SHA1
63e172892705517ab98cfc96bfeff37bc562ae5a

SHA256
da95e18eef9a8901b390577e9374d80be30fc685244c42f2a18921d457adcd0c

SHA512
2cda1703da99e05fceec6a4a3e1cd6886906e56846af14c1dc1a29feb1a73112ba62a256de4320321e4d2f2a17c7a7452cc1d2b2154b98724c0e6706fd760005

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
87KB

MD5
4a98ba9131ccc286be3ccd105af128b0

SHA1
36994851faba8b841fccf3f8a3458e95ddc9e89f

SHA256
02304003f43d464d123ddc1eb6a48a7a724388d81fa10050fb82d07b526c289c

SHA512
90aad54372bf3a1a070993ad7ffaba10b832bc4f77207eb4b43bebcd63d2e4a6184ffe9d1e4d8f201554e57806749915e19a881f2958824d2773f904fd89dc7a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
106KB

MD5
b5477aadd974b9c9f0eab070e10b3042

SHA1
0108b8151d1c537ca026907b1e828bfb494d2f54

SHA256
d9dcd1c31ebdca34db0af09cb9fe0026404cf4094dca43d2c0fe802def92055a

SHA512
448eba60c14df89be654ef5995f9f5889555ede98e874a332813092c712592df4834fdd2e6aeb2dc5392a40651c0dcf3fd3330db409a2e400865f5d4cd87233c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe588587.TMP

Filesize
93KB

MD5
00a8a5757cb15c0944bb615351d8211d

SHA1
7cc49c7b43ebff13f6e9971219d8f3c964ae790e

SHA256
ad08736554aab587c55ab5fc7fb0d0f6b2405ee50c1d28b805a780b8c9511315

SHA512
7bb062aec3533899103eea1fa581d9741f74f6fb41fe55f516dd02b9191871843d67bf459393322b2863598edb63cfb1abc0e00ea107cfaddfc0cc9152816370

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft\MyClient\jusched.exe

Filesize
11.0MB

MD5
5891817266ffedc10d4a84a3bd483239

SHA1
b59d365a91b50ec55ccc1c1b2a70cbf858382aa3

SHA256
51c45fb238881bd25fd7435d8b8e44eee9cc56887a56a7e5f5bdef8ec8392465

SHA512
517c5d785f069ce566c1d89fcc998968a5cdfc6d85bcc7e42cc2e720b4be9b543065cc1c7967635948595fdbb4af3fc7714c8b90aa6035953bca40cba7272c23

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft\MyClient\jusched.exe

Filesize
11.0MB

MD5
5891817266ffedc10d4a84a3bd483239

SHA1
b59d365a91b50ec55ccc1c1b2a70cbf858382aa3

SHA256
51c45fb238881bd25fd7435d8b8e44eee9cc56887a56a7e5f5bdef8ec8392465

SHA512
517c5d785f069ce566c1d89fcc998968a5cdfc6d85bcc7e42cc2e720b4be9b543065cc1c7967635948595fdbb4af3fc7714c8b90aa6035953bca40cba7272c23

Download Submit
C:\Users\Admin\AppData\Local\Temp\WinlockerBuilderv5.exe

Filesize
3.0MB

MD5
0df533cb9a581de63e3522954a681603

SHA1
be46afa245289e0d9a84bd1fd1faea8d8c96da5e

SHA256
e3570b276e526f6fb6a289da32583b36cfbd98ec2f59d09c0243fbd0fc0805a3

SHA512
c973e3a8476879dad79f8b37f476d379b90f27cf64ecd359256df94fb811d69226dc50d1e8168d34787cc2d6abf407d8097e37cd60155650dad007a68263661e

Download Submit
C:\Users\Admin\AppData\Local\Temp\WinlockerBuilderv5.exe

Filesize
3.0MB

MD5
0df533cb9a581de63e3522954a681603

SHA1
be46afa245289e0d9a84bd1fd1faea8d8c96da5e

SHA256
e3570b276e526f6fb6a289da32583b36cfbd98ec2f59d09c0243fbd0fc0805a3

SHA512
c973e3a8476879dad79f8b37f476d379b90f27cf64ecd359256df94fb811d69226dc50d1e8168d34787cc2d6abf407d8097e37cd60155650dad007a68263661e

Download Submit
C:\Users\Admin\AppData\Local\Temp\WinlockerBuilderv5.exe

Filesize
3.0MB

MD5
0df533cb9a581de63e3522954a681603

SHA1
be46afa245289e0d9a84bd1fd1faea8d8c96da5e

SHA256
e3570b276e526f6fb6a289da32583b36cfbd98ec2f59d09c0243fbd0fc0805a3

SHA512
c973e3a8476879dad79f8b37f476d379b90f27cf64ecd359256df94fb811d69226dc50d1e8168d34787cc2d6abf407d8097e37cd60155650dad007a68263661e

Download Submit
C:\Users\Admin\AppData\Local\Temp\WinlockerBuilderv5.exe

Filesize
3.0MB

MD5
0df533cb9a581de63e3522954a681603

SHA1
be46afa245289e0d9a84bd1fd1faea8d8c96da5e

SHA256
e3570b276e526f6fb6a289da32583b36cfbd98ec2f59d09c0243fbd0fc0805a3

SHA512
c973e3a8476879dad79f8b37f476d379b90f27cf64ecd359256df94fb811d69226dc50d1e8168d34787cc2d6abf407d8097e37cd60155650dad007a68263661e

Download Submit
C:\Users\Admin\AppData\Local\Temp\WinlockerBuilderv5.exe

Filesize
3.0MB

MD5
0df533cb9a581de63e3522954a681603

SHA1
be46afa245289e0d9a84bd1fd1faea8d8c96da5e

SHA256
e3570b276e526f6fb6a289da32583b36cfbd98ec2f59d09c0243fbd0fc0805a3

SHA512
c973e3a8476879dad79f8b37f476d379b90f27cf64ecd359256df94fb811d69226dc50d1e8168d34787cc2d6abf407d8097e37cd60155650dad007a68263661e

Download Submit
C:\Users\Admin\AppData\Local\Temp\svshost.exe

Filesize
4.0MB

MD5
2df0daacf8be5126ddbaa7ba9a83be58

SHA1
0889fcd78f5bf71ca04280fe97b7507b6b114ba3

SHA256
0936e508e142466b6d83e49b27513be2207822f91ac2d038023a86d6ccd29b2a

SHA512
0348f7511803198d5d81b10bac08b9e9e79bfd1d193c9a72b1bf3883bd49d18ec21a998e4a056206fac539c73843b31c10437838eb38746bd062e682f2df120e

Download Submit
C:\Users\Admin\AppData\Local\Temp\svshost.exe

Filesize
4.0MB

MD5
2df0daacf8be5126ddbaa7ba9a83be58

SHA1
0889fcd78f5bf71ca04280fe97b7507b6b114ba3

SHA256
0936e508e142466b6d83e49b27513be2207822f91ac2d038023a86d6ccd29b2a

SHA512
0348f7511803198d5d81b10bac08b9e9e79bfd1d193c9a72b1bf3883bd49d18ec21a998e4a056206fac539c73843b31c10437838eb38746bd062e682f2df120e

Download Submit
C:\Users\Admin\AppData\Local\Temp\svshost.exe

Filesize
4.0MB

MD5
2df0daacf8be5126ddbaa7ba9a83be58

SHA1
0889fcd78f5bf71ca04280fe97b7507b6b114ba3

SHA256
0936e508e142466b6d83e49b27513be2207822f91ac2d038023a86d6ccd29b2a

SHA512
0348f7511803198d5d81b10bac08b9e9e79bfd1d193c9a72b1bf3883bd49d18ec21a998e4a056206fac539c73843b31c10437838eb38746bd062e682f2df120e

Download Submit
C:\Users\Admin\AppData\Local\Temp\svshost.exe

Filesize
4.0MB

MD5
2df0daacf8be5126ddbaa7ba9a83be58

SHA1
0889fcd78f5bf71ca04280fe97b7507b6b114ba3

SHA256
0936e508e142466b6d83e49b27513be2207822f91ac2d038023a86d6ccd29b2a

SHA512
0348f7511803198d5d81b10bac08b9e9e79bfd1d193c9a72b1bf3883bd49d18ec21a998e4a056206fac539c73843b31c10437838eb38746bd062e682f2df120e

Download Submit
C:\Users\Admin\AppData\Local\Temp\svshost.exe

Filesize
4.0MB

MD5
2df0daacf8be5126ddbaa7ba9a83be58

SHA1
0889fcd78f5bf71ca04280fe97b7507b6b114ba3

SHA256
0936e508e142466b6d83e49b27513be2207822f91ac2d038023a86d6ccd29b2a

SHA512
0348f7511803198d5d81b10bac08b9e9e79bfd1d193c9a72b1bf3883bd49d18ec21a998e4a056206fac539c73843b31c10437838eb38746bd062e682f2df120e

Download Submit
C:\Users\Admin\AppData\Local\Temp\upx_compresser.exe

Filesize
1.1MB

MD5
0d833c6509f350e0a15492597df2bda6

SHA1
1f77b7eb4410f6e1c0e0f7b971a3c98b3f0a5f9f

SHA256
d280fdf95c57cba365c15fc9c6371ada79734480812497c2244246cfdac52ca7

SHA512
9e7ec8f4a756a2546c64850e0ca390788b9817984c1a91af55ffddfd3a010d7629478c2665c03a8a15d46377d66223f6937ac9d8d3d6bda5f9a1ee549ef16118

Download Submit
C:\Users\Admin\AppData\Local\Temp\upx_compresser.exe

Filesize
1.1MB

MD5
0d833c6509f350e0a15492597df2bda6

SHA1
1f77b7eb4410f6e1c0e0f7b971a3c98b3f0a5f9f

SHA256
d280fdf95c57cba365c15fc9c6371ada79734480812497c2244246cfdac52ca7

SHA512
9e7ec8f4a756a2546c64850e0ca390788b9817984c1a91af55ffddfd3a010d7629478c2665c03a8a15d46377d66223f6937ac9d8d3d6bda5f9a1ee549ef16118

Download Submit
C:\Users\Admin\AppData\Local\Temp\upx_compresser.exe

Filesize
1.1MB

MD5
0d833c6509f350e0a15492597df2bda6

SHA1
1f77b7eb4410f6e1c0e0f7b971a3c98b3f0a5f9f

SHA256
d280fdf95c57cba365c15fc9c6371ada79734480812497c2244246cfdac52ca7

SHA512
9e7ec8f4a756a2546c64850e0ca390788b9817984c1a91af55ffddfd3a010d7629478c2665c03a8a15d46377d66223f6937ac9d8d3d6bda5f9a1ee549ef16118

Download Submit
C:\Users\Admin\AppData\Local\Temp\upx_compresser.exe

Filesize
1.1MB

MD5
0d833c6509f350e0a15492597df2bda6

SHA1
1f77b7eb4410f6e1c0e0f7b971a3c98b3f0a5f9f

SHA256
d280fdf95c57cba365c15fc9c6371ada79734480812497c2244246cfdac52ca7

SHA512
9e7ec8f4a756a2546c64850e0ca390788b9817984c1a91af55ffddfd3a010d7629478c2665c03a8a15d46377d66223f6937ac9d8d3d6bda5f9a1ee549ef16118

Download Submit
C:\Users\Admin\AppData\Local\Temp\upx_compresser.exe

Filesize
1.1MB

MD5
0d833c6509f350e0a15492597df2bda6

SHA1
1f77b7eb4410f6e1c0e0f7b971a3c98b3f0a5f9f

SHA256
d280fdf95c57cba365c15fc9c6371ada79734480812497c2244246cfdac52ca7

SHA512
9e7ec8f4a756a2546c64850e0ca390788b9817984c1a91af55ffddfd3a010d7629478c2665c03a8a15d46377d66223f6937ac9d8d3d6bda5f9a1ee549ef16118

Download Submit
C:\Users\Admin\AppData\Local\Temp\upx_compresser.exe

Filesize
1.1MB

MD5
0d833c6509f350e0a15492597df2bda6

SHA1
1f77b7eb4410f6e1c0e0f7b971a3c98b3f0a5f9f

SHA256
d280fdf95c57cba365c15fc9c6371ada79734480812497c2244246cfdac52ca7

SHA512
9e7ec8f4a756a2546c64850e0ca390788b9817984c1a91af55ffddfd3a010d7629478c2665c03a8a15d46377d66223f6937ac9d8d3d6bda5f9a1ee549ef16118

Download Submit
C:\Users\Admin\Documents\AudioDriver\taskhost.exe

Filesize
1.1MB

MD5
0d833c6509f350e0a15492597df2bda6

SHA1
1f77b7eb4410f6e1c0e0f7b971a3c98b3f0a5f9f

SHA256
d280fdf95c57cba365c15fc9c6371ada79734480812497c2244246cfdac52ca7

SHA512
9e7ec8f4a756a2546c64850e0ca390788b9817984c1a91af55ffddfd3a010d7629478c2665c03a8a15d46377d66223f6937ac9d8d3d6bda5f9a1ee549ef16118

Download Submit
C:\Users\Admin\Documents\AudioDriver\taskhost.exe

Filesize
1.1MB

MD5
0d833c6509f350e0a15492597df2bda6

SHA1
1f77b7eb4410f6e1c0e0f7b971a3c98b3f0a5f9f

SHA256
d280fdf95c57cba365c15fc9c6371ada79734480812497c2244246cfdac52ca7

SHA512
9e7ec8f4a756a2546c64850e0ca390788b9817984c1a91af55ffddfd3a010d7629478c2665c03a8a15d46377d66223f6937ac9d8d3d6bda5f9a1ee549ef16118

Download Submit
C:\Users\Admin\Documents\AudioDriver\taskhost.exe

Filesize
1.1MB

MD5
0d833c6509f350e0a15492597df2bda6

SHA1
1f77b7eb4410f6e1c0e0f7b971a3c98b3f0a5f9f

SHA256
d280fdf95c57cba365c15fc9c6371ada79734480812497c2244246cfdac52ca7

SHA512
9e7ec8f4a756a2546c64850e0ca390788b9817984c1a91af55ffddfd3a010d7629478c2665c03a8a15d46377d66223f6937ac9d8d3d6bda5f9a1ee549ef16118

Download Submit
C:\Users\Admin\Documents\AudioDriver\taskhost.exe

Filesize
1.1MB

MD5
0d833c6509f350e0a15492597df2bda6

SHA1
1f77b7eb4410f6e1c0e0f7b971a3c98b3f0a5f9f

SHA256
d280fdf95c57cba365c15fc9c6371ada79734480812497c2244246cfdac52ca7

SHA512
9e7ec8f4a756a2546c64850e0ca390788b9817984c1a91af55ffddfd3a010d7629478c2665c03a8a15d46377d66223f6937ac9d8d3d6bda5f9a1ee549ef16118

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 992619.crdownload

Filesize
699KB

MD5
81dd862410af80c9d2717af912778332

SHA1
8f1df476f58441db5973ccfdc211c8680808ffe1

SHA256
60e76eda46185d1d2e9463d15e31d4c87eb03535d368cc3471c55992bc99ad5f

SHA512
8dd014b91fb1e2122d2e4da444db78dd551513c500d447bb1e94ceb7f2f8d45223a8a706e2156102f8c8850d2bb02ae6b8ea0c9282abd7baaa2c84130112af15

Download Submit
C:\Users\Admin\Downloads\WinLocker Builder v1.4.exe

Filesize
699KB

MD5
81dd862410af80c9d2717af912778332

SHA1
8f1df476f58441db5973ccfdc211c8680808ffe1

SHA256
60e76eda46185d1d2e9463d15e31d4c87eb03535d368cc3471c55992bc99ad5f

SHA512
8dd014b91fb1e2122d2e4da444db78dd551513c500d447bb1e94ceb7f2f8d45223a8a706e2156102f8c8850d2bb02ae6b8ea0c9282abd7baaa2c84130112af15

Download Submit
C:\Users\Admin\Downloads\WinLocker Builder v1.4.exe

Filesize
699KB

MD5
81dd862410af80c9d2717af912778332

SHA1
8f1df476f58441db5973ccfdc211c8680808ffe1

SHA256
60e76eda46185d1d2e9463d15e31d4c87eb03535d368cc3471c55992bc99ad5f

SHA512
8dd014b91fb1e2122d2e4da444db78dd551513c500d447bb1e94ceb7f2f8d45223a8a706e2156102f8c8850d2bb02ae6b8ea0c9282abd7baaa2c84130112af15

Download Submit
C:\Users\Admin\Downloads\WinlockerBuilderv5.exe

Filesize
11.0MB

MD5
5891817266ffedc10d4a84a3bd483239

SHA1
b59d365a91b50ec55ccc1c1b2a70cbf858382aa3

SHA256
51c45fb238881bd25fd7435d8b8e44eee9cc56887a56a7e5f5bdef8ec8392465

SHA512
517c5d785f069ce566c1d89fcc998968a5cdfc6d85bcc7e42cc2e720b4be9b543065cc1c7967635948595fdbb4af3fc7714c8b90aa6035953bca40cba7272c23

Download Submit
C:\Users\Admin\Downloads\WinlockerBuilderv5.exe

Filesize
11.0MB

MD5
5891817266ffedc10d4a84a3bd483239

SHA1
b59d365a91b50ec55ccc1c1b2a70cbf858382aa3

SHA256
51c45fb238881bd25fd7435d8b8e44eee9cc56887a56a7e5f5bdef8ec8392465

SHA512
517c5d785f069ce566c1d89fcc998968a5cdfc6d85bcc7e42cc2e720b4be9b543065cc1c7967635948595fdbb4af3fc7714c8b90aa6035953bca40cba7272c23

Download Submit
C:\Users\Admin\Downloads\WinlockerBuilderv5.exe

Filesize
11.0MB

MD5
5891817266ffedc10d4a84a3bd483239

SHA1
b59d365a91b50ec55ccc1c1b2a70cbf858382aa3

SHA256
51c45fb238881bd25fd7435d8b8e44eee9cc56887a56a7e5f5bdef8ec8392465

SHA512
517c5d785f069ce566c1d89fcc998968a5cdfc6d85bcc7e42cc2e720b4be9b543065cc1c7967635948595fdbb4af3fc7714c8b90aa6035953bca40cba7272c23

Download Submit
\??\pipe\crashpad_4112_ZDFENRMBQDGSKTCZ

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/420-1020-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/420-1018-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/420-1025-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/420-951-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/420-1022-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/420-952-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/420-949-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/420-1021-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/420-950-0x0000000002120000-0x0000000002121000-memory.dmp

Filesize
4KB

Download
memory/420-997-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/420-1019-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/420-1033-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/420-992-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/420-1017-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/420-1016-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/420-1015-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/420-1014-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/420-1013-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/420-1012-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/420-993-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/420-1010-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/420-1009-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/420-996-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/420-998-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1020-921-0x00000000030A0000-0x00000000030B0000-memory.dmp

Filesize
64KB

Download
memory/1020-986-0x00000000030A0000-0x00000000030B0000-memory.dmp

Filesize
64KB

Download
memory/1020-936-0x00000000030A0000-0x00000000030B0000-memory.dmp

Filesize
64KB

Download
memory/1020-938-0x00000000030A0000-0x00000000030B0000-memory.dmp

Filesize
64KB

Download
memory/1020-937-0x00000000030A0000-0x00000000030B0000-memory.dmp

Filesize
64KB

Download
memory/1020-924-0x00000000030A0000-0x00000000030B0000-memory.dmp

Filesize
64KB

Download
memory/1020-975-0x00000000030A0000-0x00000000030B0000-memory.dmp

Filesize
64KB

Download
memory/1020-974-0x00000000030A0000-0x00000000030B0000-memory.dmp

Filesize
64KB

Download
memory/1020-985-0x00000000030A0000-0x00000000030B0000-memory.dmp

Filesize
64KB

Download
memory/1020-935-0x00007FFA4A820000-0x00007FFA4B1C0000-memory.dmp

Filesize
9.6MB

Download
memory/1020-891-0x00007FFA4A820000-0x00007FFA4B1C0000-memory.dmp

Filesize
9.6MB

Download
memory/1020-892-0x00000000030A0000-0x00000000030B0000-memory.dmp

Filesize
64KB

Download
memory/1020-895-0x00007FFA4A820000-0x00007FFA4B1C0000-memory.dmp

Filesize
9.6MB

Download
memory/1020-1024-0x00007FFA4A820000-0x00007FFA4B1C0000-memory.dmp

Filesize
9.6MB

Download
memory/2088-911-0x00000000007A0000-0x00000000007A1000-memory.dmp

Filesize
4KB

Download
memory/2088-912-0x00000000007D0000-0x00000000007D9000-memory.dmp

Filesize
36KB

Download
memory/2088-917-0x0000000000400000-0x000000000052A000-memory.dmp

Filesize
1.2MB

Download
memory/2088-914-0x0000000000800000-0x0000000000801000-memory.dmp

Filesize
4KB

Download
memory/2788-920-0x0000000002260000-0x0000000002261000-memory.dmp

Filesize
4KB

Download
memory/2788-916-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2788-918-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2788-913-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2788-919-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2788-953-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2812-946-0x0000000000400000-0x000000000052A000-memory.dmp

Filesize
1.2MB

Download
memory/2812-942-0x00000000006A0000-0x00000000006A1000-memory.dmp

Filesize
4KB

Download
memory/2812-945-0x00000000023A0000-0x00000000023A1000-memory.dmp

Filesize
4KB

Download
memory/3372-867-0x000000001FB20000-0x000000001FB82000-memory.dmp

Filesize
392KB

Download
memory/3372-844-0x00000000032A0000-0x00000000032B0000-memory.dmp

Filesize
64KB

Download
memory/3372-870-0x00007FFA4A820000-0x00007FFA4B1C0000-memory.dmp

Filesize
9.6MB

Download
memory/3372-869-0x00007FFA4A820000-0x00007FFA4B1C0000-memory.dmp

Filesize
9.6MB

Download
memory/3372-845-0x000000001CC90000-0x000000001CD2C000-memory.dmp

Filesize
624KB

Download
memory/3372-909-0x00007FFA4A820000-0x00007FFA4B1C0000-memory.dmp

Filesize
9.6MB

Download
memory/3372-842-0x000000001C0B0000-0x000000001C156000-memory.dmp

Filesize
664KB

Download
memory/3372-841-0x00007FFA4A820000-0x00007FFA4B1C0000-memory.dmp

Filesize
9.6MB

Download
memory/3372-843-0x000000001C700000-0x000000001CBCE000-memory.dmp

Filesize
4.8MB

Download
memory/3372-910-0x00000000032A0000-0x00000000032B0000-memory.dmp

Filesize
64KB

Download
memory/3372-866-0x00000000032A0000-0x00000000032B0000-memory.dmp

Filesize
64KB

Download
memory/3372-865-0x00000000032A0000-0x00000000032B0000-memory.dmp

Filesize
64KB

Download
memory/3372-888-0x00000000032A0000-0x00000000032B0000-memory.dmp

Filesize
64KB

Download
memory/3372-839-0x00007FFA4A820000-0x00007FFA4B1C0000-memory.dmp

Filesize
9.6MB

Download
memory/3372-840-0x0000000000730000-0x000000000123C000-memory.dmp

Filesize
11.0MB

Download
memory/3372-846-0x000000001C170000-0x000000001C178000-memory.dmp

Filesize
32KB

Download
memory/3372-847-0x000000001CDF0000-0x000000001CE3C000-memory.dmp

Filesize
304KB

Download
memory/3372-863-0x00000000032A0000-0x00000000032B0000-memory.dmp

Filesize
64KB

Download
memory/3372-864-0x00000000032A0000-0x00000000032B0000-memory.dmp

Filesize
64KB

Download
memory/4076-976-0x0000000000400000-0x0000000000C89000-memory.dmp

Filesize
8.5MB

Download
memory/4076-991-0x0000000000400000-0x0000000000C89000-memory.dmp

Filesize
8.5MB

Download
memory/4076-978-0x0000000001010000-0x0000000001011000-memory.dmp

Filesize
4KB

Download
memory/4360-495-0x0000000000400000-0x0000000000545000-memory.dmp

Filesize
1.3MB

Download
memory/4360-506-0x0000000000560000-0x0000000000561000-memory.dmp

Filesize
4KB

Download
memory/4360-479-0x0000000000560000-0x0000000000561000-memory.dmp

Filesize
4KB

Download
memory/4360-868-0x0000000000400000-0x0000000000545000-memory.dmp

Filesize
1.3MB

Download
memory/4360-477-0x0000000000400000-0x0000000000545000-memory.dmp

Filesize
1.3MB

Download
memory/4816-906-0x0000000001110000-0x0000000001111000-memory.dmp

Filesize
4KB

Download
memory/4816-941-0x0000000000400000-0x0000000000C89000-memory.dmp

Filesize
8.5MB

Download
memory/4816-955-0x0000000000400000-0x0000000000C89000-memory.dmp

Filesize
8.5MB

Download
memory/4816-903-0x0000000000400000-0x0000000000C89000-memory.dmp

Filesize
8.5MB

Download
memory/4816-948-0x0000000001110000-0x0000000001111000-memory.dmp

Filesize
4KB

Download
memory/5008-988-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/5008-987-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/5008-989-0x0000000000640000-0x0000000000641000-memory.dmp

Filesize
4KB

Download
memory/5116-983-0x0000000000400000-0x000000000052A000-memory.dmp

Filesize
1.2MB

Download
memory/5116-982-0x00000000022E0000-0x00000000022E1000-memory.dmp

Filesize
4KB

Download
memory/5116-977-0x00000000006B0000-0x00000000006B1000-memory.dmp

Filesize
4KB

Download