hxxps://modmenuz[.]com/fivem/eulen-mod-menu/

Analysis

max time kernel
656s
max time network
661s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
20/02/2024, 19:27

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

https://modmenuz.com/fivem/eulen-mod-menu/

Score

6^/10

Malware Config

Signatures

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\Lang\az.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sa.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ta.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nn.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tt.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\es.txt	msiexec.exe
File created	C:\Program Files\7-Zip\Lang\gl.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\7-zip.chm	msiexec.exe
File created	C:\Program Files\7-Zip\Lang\mk.txt	msiexec.exe
File created	C:\Program Files\7-Zip\Lang\it.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ka.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\bg.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\vi.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sq.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\az.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ga.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\co.txt	msiexec.exe
File created	C:\Program Files\7-Zip\Lang\et.txt	msiexec.exe
File created	C:\Program Files\7-Zip\Lang\lt.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sr-spl.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fi.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mng2.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kab.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\zh-cn.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ka.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mr.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ext.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\eo.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lij.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sv.txt	msiexec.exe
File created	C:\Program Files\7-Zip\Lang\kab.txt	msiexec.exe
File created	C:\Program Files\7-Zip\Lang\ku-ckb.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lij.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\an.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lv.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\an.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fa.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tr.txt	msiexec.exe
File created	C:\Program Files\7-Zip\Lang\nb.txt	msiexec.exe
File created	C:\Program Files\7-Zip\Lang\ps.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\id.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nb.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kaa.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ky.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ja.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pa-in.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sk.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\es.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mr.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\en.ttt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sr-spc.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ast.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kk.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\be.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ca.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\gl.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sl.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sr-spl.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mng2.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\an.txt	msiexec.exe
File created	C:\Program Files\7-Zip\Lang\ca.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nl.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\af.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\es.txt	msiexec.exe

Drops file in Windows directory 26 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e5e45f0.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\96F071321C0420722210000010000000\22.1.0\_7zFM.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\96F071321C0420722210000010000000\22.1.0\_7z.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI534E.tmp	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\96F071321C0420722210000010000000\22.1.0\_7zG.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\96F071321C0420722210000010000000\22.1.0\_7zCon.sfx	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\96F071321C0420722210000010000000\22.1.0\_7zFM.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\96F071321C0420722210000010000000\22.1.0\_7zG.exe	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\96F071321C0420722210000010000000\22.1.0\_7z.dll	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\96F071321C0420722210000010000000\22.1.0\_7zCon.sfx	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\96F071321C0420722210000010000000\22.1.0\_7z.sfx	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\96F071321C0420722210000010000000\22.1.0	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\96F071321C0420722210000010000000\22.1.0\_7zip32.dll	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\96F071321C0420722210000010000000\22.1.0\_7z.dll	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\96F071321C0420722210000010000000\22.1.0\_7z.exe	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\96F071321C0420722210000010000000\22.1.0\_7zip32.dll	msiexec.exe
File created	C:\Windows\Installer\e5e463e.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5e45f0.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\96F071321C0420722210000010000000	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\96F071321C0420722210000010000000\22.1.0\_7zip.dll	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\96F071321C0420722210000010000000\22.1.0\_7zip.dll	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{23170F69-40C1-2702-2201-000001000000}	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\96F071321C0420722210000010000000\22.1.0\_7z.sfx	msiexec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000003462af5746133e160000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800003462af570000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff0000000007000100006809003462af57000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d3462af57000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000003462af5700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 20 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\23	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133529308459226468"	chrome.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\22\52C64B7E	msiexec.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "235"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe

Modifies registry class 35 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Directory\shellex\DragDropHandlers\7-Zip	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\96F071321C0420722210000010000000\Program = "Complete"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\96F071321C0420722210000010000000\LanguageFiles = "Complete"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96F071321C0420722210000010000000\Version = "369164288"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96F071321C0420722210000010000000\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\96F071321C0420722210000010000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96F071321C0420722210000010000000\PackageCode = "96F071321C0420722210000020000000"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96F071321C0420722210000010000000\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96F071321C0420722210000010000000\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Directory\shellex\ContextMenuHandlers\7-Zip	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96F071321C0420722210000010000000\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96F071321C0420722210000010000000\SourceList	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\MACHINE\Software\Classes\*\shellex\ContextMenuHandlers\7-Zip	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\96F071321C0420722210000010000000\Complete	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96F071321C0420722210000010000000\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Drive\shellex\DragDropHandlers\7-Zip	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96F071321C0420722210000010000000	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96F071321C0420722210000010000000\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96F071321C0420722210000010000000\SourceList\Net\1 = "C:\\Users\\Admin\\Downloads\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Folder\shellex\ContextMenuHandlers\7-Zip	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96F071321C0420722210000010000000\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96F071321C0420722210000010000000\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96F071321C0420722210000010000000\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\96F071321C0420720000000040000000\96F071321C0420722210000010000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96F071321C0420722210000010000000\SourceList\PackageName = "7z2201-x64.msi"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96F071321C0420722210000010000000\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96F071321C0420722210000010000000\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\Downloads\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96F071321C0420722210000010000000\ProductName = "7-Zip 22.01 (x64 edition)"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\96F071321C0420720000000040000000	msiexec.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
396	chrome.exe
396	chrome.exe
4756	chrome.exe
4756	chrome.exe
3060	msiexec.exe
3060	msiexec.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 23 IoCs

pid	Process
396	chrome.exe
396	chrome.exe
396	chrome.exe
396	chrome.exe
396	chrome.exe
396	chrome.exe
396	chrome.exe
396	chrome.exe
396	chrome.exe
396	chrome.exe
396	chrome.exe
396	chrome.exe
396	chrome.exe
396	chrome.exe
396	chrome.exe
396	chrome.exe
396	chrome.exe
396	chrome.exe
396	chrome.exe
396	chrome.exe
396	chrome.exe
396	chrome.exe
396	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	396	chrome.exe
Token: SeCreatePagefilePrivilege	396	chrome.exe
Token: SeShutdownPrivilege	396	chrome.exe
Token: SeCreatePagefilePrivilege	396	chrome.exe
Token: SeShutdownPrivilege	396	chrome.exe
Token: SeCreatePagefilePrivilege	396	chrome.exe
Token: SeShutdownPrivilege	396	chrome.exe
Token: SeCreatePagefilePrivilege	396	chrome.exe
Token: SeShutdownPrivilege	396	chrome.exe
Token: SeCreatePagefilePrivilege	396	chrome.exe
Token: SeShutdownPrivilege	396	chrome.exe
Token: SeCreatePagefilePrivilege	396	chrome.exe
Token: SeShutdownPrivilege	396	chrome.exe
Token: SeCreatePagefilePrivilege	396	chrome.exe
Token: SeShutdownPrivilege	396	chrome.exe
Token: SeCreatePagefilePrivilege	396	chrome.exe
Token: SeShutdownPrivilege	396	chrome.exe
Token: SeCreatePagefilePrivilege	396	chrome.exe
Token: SeShutdownPrivilege	396	chrome.exe
Token: SeCreatePagefilePrivilege	396	chrome.exe
Token: SeShutdownPrivilege	396	chrome.exe
Token: SeCreatePagefilePrivilege	396	chrome.exe
Token: SeShutdownPrivilege	396	chrome.exe
Token: SeCreatePagefilePrivilege	396	chrome.exe
Token: SeShutdownPrivilege	396	chrome.exe
Token: SeCreatePagefilePrivilege	396	chrome.exe
Token: SeShutdownPrivilege	396	chrome.exe
Token: SeCreatePagefilePrivilege	396	chrome.exe
Token: SeShutdownPrivilege	396	chrome.exe
Token: SeCreatePagefilePrivilege	396	chrome.exe
Token: SeShutdownPrivilege	396	chrome.exe
Token: SeCreatePagefilePrivilege	396	chrome.exe
Token: SeShutdownPrivilege	396	chrome.exe
Token: SeCreatePagefilePrivilege	396	chrome.exe
Token: SeShutdownPrivilege	396	chrome.exe
Token: SeCreatePagefilePrivilege	396	chrome.exe
Token: SeShutdownPrivilege	396	chrome.exe
Token: SeCreatePagefilePrivilege	396	chrome.exe
Token: SeShutdownPrivilege	396	chrome.exe
Token: SeCreatePagefilePrivilege	396	chrome.exe
Token: SeShutdownPrivilege	396	chrome.exe
Token: SeCreatePagefilePrivilege	396	chrome.exe
Token: SeShutdownPrivilege	396	chrome.exe
Token: SeCreatePagefilePrivilege	396	chrome.exe
Token: SeShutdownPrivilege	396	chrome.exe
Token: SeCreatePagefilePrivilege	396	chrome.exe
Token: SeShutdownPrivilege	396	chrome.exe
Token: SeCreatePagefilePrivilege	396	chrome.exe
Token: SeShutdownPrivilege	396	chrome.exe
Token: SeCreatePagefilePrivilege	396	chrome.exe
Token: SeShutdownPrivilege	396	chrome.exe
Token: SeCreatePagefilePrivilege	396	chrome.exe
Token: SeShutdownPrivilege	396	chrome.exe
Token: SeCreatePagefilePrivilege	396	chrome.exe
Token: SeShutdownPrivilege	396	chrome.exe
Token: SeCreatePagefilePrivilege	396	chrome.exe
Token: SeShutdownPrivilege	396	chrome.exe
Token: SeCreatePagefilePrivilege	396	chrome.exe
Token: SeShutdownPrivilege	396	chrome.exe
Token: SeCreatePagefilePrivilege	396	chrome.exe
Token: SeShutdownPrivilege	396	chrome.exe
Token: SeCreatePagefilePrivilege	396	chrome.exe
Token: SeShutdownPrivilege	396	chrome.exe
Token: SeCreatePagefilePrivilege	396	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
396	chrome.exe
396	chrome.exe
396	chrome.exe
396	chrome.exe
396	chrome.exe
396	chrome.exe
396	chrome.exe
396	chrome.exe
396	chrome.exe
396	chrome.exe
396	chrome.exe
396	chrome.exe
396	chrome.exe
396	chrome.exe
396	chrome.exe
396	chrome.exe
396	chrome.exe
396	chrome.exe
396	chrome.exe
396	chrome.exe
396	chrome.exe
396	chrome.exe
396	chrome.exe
396	chrome.exe
396	chrome.exe
396	chrome.exe
396	chrome.exe
396	chrome.exe
396	chrome.exe
396	chrome.exe
396	chrome.exe
396	chrome.exe
396	chrome.exe
396	chrome.exe
396	chrome.exe
396	chrome.exe
396	chrome.exe
396	chrome.exe
396	chrome.exe
396	chrome.exe
396	chrome.exe
396	chrome.exe
396	chrome.exe
396	chrome.exe
396	chrome.exe
396	chrome.exe
396	chrome.exe
396	chrome.exe
396	chrome.exe
396	chrome.exe
396	chrome.exe
396	chrome.exe
396	chrome.exe
396	chrome.exe
396	chrome.exe
396	chrome.exe
1064	msiexec.exe
1260	msiexec.exe
1260	msiexec.exe
396	chrome.exe
396	chrome.exe
396	chrome.exe
396	chrome.exe
396	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
396	chrome.exe
396	chrome.exe
396	chrome.exe
396	chrome.exe
396	chrome.exe
396	chrome.exe
396	chrome.exe
396	chrome.exe
396	chrome.exe
396	chrome.exe
396	chrome.exe
396	chrome.exe
396	chrome.exe
396	chrome.exe
396	chrome.exe
396	chrome.exe
396	chrome.exe
396	chrome.exe
396	chrome.exe
396	chrome.exe
396	chrome.exe
396	chrome.exe
396	chrome.exe
396	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4544	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 396 wrote to memory of 3508	396	chrome.exe	84
PID 396 wrote to memory of 3508	396	chrome.exe	84
PID 396 wrote to memory of 1944	396	chrome.exe	86
PID 396 wrote to memory of 1944	396	chrome.exe	86
PID 396 wrote to memory of 1944	396	chrome.exe	86
PID 396 wrote to memory of 1944	396	chrome.exe	86
PID 396 wrote to memory of 1944	396	chrome.exe	86
PID 396 wrote to memory of 1944	396	chrome.exe	86
PID 396 wrote to memory of 1944	396	chrome.exe	86
PID 396 wrote to memory of 1944	396	chrome.exe	86
PID 396 wrote to memory of 1944	396	chrome.exe	86
PID 396 wrote to memory of 1944	396	chrome.exe	86
PID 396 wrote to memory of 1944	396	chrome.exe	86
PID 396 wrote to memory of 1944	396	chrome.exe	86
PID 396 wrote to memory of 1944	396	chrome.exe	86
PID 396 wrote to memory of 1944	396	chrome.exe	86
PID 396 wrote to memory of 1944	396	chrome.exe	86
PID 396 wrote to memory of 1944	396	chrome.exe	86
PID 396 wrote to memory of 1944	396	chrome.exe	86
PID 396 wrote to memory of 1944	396	chrome.exe	86
PID 396 wrote to memory of 1944	396	chrome.exe	86
PID 396 wrote to memory of 1944	396	chrome.exe	86
PID 396 wrote to memory of 1944	396	chrome.exe	86
PID 396 wrote to memory of 1944	396	chrome.exe	86
PID 396 wrote to memory of 1944	396	chrome.exe	86
PID 396 wrote to memory of 1944	396	chrome.exe	86
PID 396 wrote to memory of 1944	396	chrome.exe	86
PID 396 wrote to memory of 1944	396	chrome.exe	86
PID 396 wrote to memory of 1944	396	chrome.exe	86
PID 396 wrote to memory of 1944	396	chrome.exe	86
PID 396 wrote to memory of 1944	396	chrome.exe	86
PID 396 wrote to memory of 1944	396	chrome.exe	86
PID 396 wrote to memory of 1944	396	chrome.exe	86
PID 396 wrote to memory of 1944	396	chrome.exe	86
PID 396 wrote to memory of 1944	396	chrome.exe	86
PID 396 wrote to memory of 1944	396	chrome.exe	86
PID 396 wrote to memory of 1944	396	chrome.exe	86
PID 396 wrote to memory of 1944	396	chrome.exe	86
PID 396 wrote to memory of 1944	396	chrome.exe	86
PID 396 wrote to memory of 1944	396	chrome.exe	86
PID 396 wrote to memory of 4456	396	chrome.exe	87
PID 396 wrote to memory of 4456	396	chrome.exe	87
PID 396 wrote to memory of 1512	396	chrome.exe	88
PID 396 wrote to memory of 1512	396	chrome.exe	88
PID 396 wrote to memory of 1512	396	chrome.exe	88
PID 396 wrote to memory of 1512	396	chrome.exe	88
PID 396 wrote to memory of 1512	396	chrome.exe	88
PID 396 wrote to memory of 1512	396	chrome.exe	88
PID 396 wrote to memory of 1512	396	chrome.exe	88
PID 396 wrote to memory of 1512	396	chrome.exe	88
PID 396 wrote to memory of 1512	396	chrome.exe	88
PID 396 wrote to memory of 1512	396	chrome.exe	88
PID 396 wrote to memory of 1512	396	chrome.exe	88
PID 396 wrote to memory of 1512	396	chrome.exe	88
PID 396 wrote to memory of 1512	396	chrome.exe	88
PID 396 wrote to memory of 1512	396	chrome.exe	88
PID 396 wrote to memory of 1512	396	chrome.exe	88
PID 396 wrote to memory of 1512	396	chrome.exe	88
PID 396 wrote to memory of 1512	396	chrome.exe	88
PID 396 wrote to memory of 1512	396	chrome.exe	88
PID 396 wrote to memory of 1512	396	chrome.exe	88
PID 396 wrote to memory of 1512	396	chrome.exe	88
PID 396 wrote to memory of 1512	396	chrome.exe	88
PID 396 wrote to memory of 1512	396	chrome.exe	88

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://modmenuz.com/fivem/eulen-mod-menu/
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0x9c,0x108,0x7ffe353d9758,0x7ffe353d9768,0x7ffe353d9778
  2⤵
  PID:3508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1732 --field-trial-handle=1936,i,15871713833048402245,5532226070844144851,131072 /prefetch:2
  2⤵
  PID:1944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2128 --field-trial-handle=1936,i,15871713833048402245,5532226070844144851,131072 /prefetch:8
  2⤵
  PID:4456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2188 --field-trial-handle=1936,i,15871713833048402245,5532226070844144851,131072 /prefetch:8
  2⤵
  PID:1512
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3224 --field-trial-handle=1936,i,15871713833048402245,5532226070844144851,131072 /prefetch:1
  2⤵
  PID:420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3004 --field-trial-handle=1936,i,15871713833048402245,5532226070844144851,131072 /prefetch:1
  2⤵
  PID:3292
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5320 --field-trial-handle=1936,i,15871713833048402245,5532226070844144851,131072 /prefetch:8
  2⤵
  PID:516
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5424 --field-trial-handle=1936,i,15871713833048402245,5532226070844144851,131072 /prefetch:8
  2⤵
  PID:1480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=4560 --field-trial-handle=1936,i,15871713833048402245,5532226070844144851,131072 /prefetch:1
  2⤵
  PID:1484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1696 --field-trial-handle=1936,i,15871713833048402245,5532226070844144851,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=3236 --field-trial-handle=1936,i,15871713833048402245,5532226070844144851,131072 /prefetch:1
  2⤵
  PID:1300
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=3212 --field-trial-handle=1936,i,15871713833048402245,5532226070844144851,131072 /prefetch:1
  2⤵
  PID:3208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=4640 --field-trial-handle=1936,i,15871713833048402245,5532226070844144851,131072 /prefetch:1
  2⤵
  PID:2560
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=4924 --field-trial-handle=1936,i,15871713833048402245,5532226070844144851,131072 /prefetch:1
  2⤵
  PID:3612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=2472 --field-trial-handle=1936,i,15871713833048402245,5532226070844144851,131072 /prefetch:1
  2⤵
  PID:2504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=4036 --field-trial-handle=1936,i,15871713833048402245,5532226070844144851,131072 /prefetch:1
  2⤵
  PID:2276
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=5540 --field-trial-handle=1936,i,15871713833048402245,5532226070844144851,131072 /prefetch:1
  2⤵
  PID:2580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5688 --field-trial-handle=1936,i,15871713833048402245,5532226070844144851,131072 /prefetch:8
  2⤵
  PID:1196
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4592 --field-trial-handle=1936,i,15871713833048402245,5532226070844144851,131072 /prefetch:8
  2⤵
  PID:2792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5732 --field-trial-handle=1936,i,15871713833048402245,5532226070844144851,131072 /prefetch:8
  2⤵
  PID:884
- C:\Windows\System32\msiexec.exe
  "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\Downloads\7z2201-x64.msi"
  2⤵
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Suspicious use of FindShellTrayWindow
  PID:1064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --mojo-platform-channel-handle=1832 --field-trial-handle=1936,i,15871713833048402245,5532226070844144851,131072 /prefetch:1
  2⤵
  PID:3856
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --mojo-platform-channel-handle=4688 --field-trial-handle=1936,i,15871713833048402245,5532226070844144851,131072 /prefetch:1
  2⤵
  PID:4568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --mojo-platform-channel-handle=5640 --field-trial-handle=1936,i,15871713833048402245,5532226070844144851,131072 /prefetch:1
  2⤵
  PID:4572
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --mojo-platform-channel-handle=4708 --field-trial-handle=1936,i,15871713833048402245,5532226070844144851,131072 /prefetch:1
  2⤵
  PID:4252
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --mojo-platform-channel-handle=3888 --field-trial-handle=1936,i,15871713833048402245,5532226070844144851,131072 /prefetch:1
  2⤵
  PID:4756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4024 --field-trial-handle=1936,i,15871713833048402245,5532226070844144851,131072 /prefetch:8
  2⤵
  PID:3076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --mojo-platform-channel-handle=6104 --field-trial-handle=1936,i,15871713833048402245,5532226070844144851,131072 /prefetch:1
  2⤵
  PID:3216
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --mojo-platform-channel-handle=5004 --field-trial-handle=1936,i,15871713833048402245,5532226070844144851,131072 /prefetch:1
  2⤵
  PID:4108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --mojo-platform-channel-handle=6236 --field-trial-handle=1936,i,15871713833048402245,5532226070844144851,131072 /prefetch:1
  2⤵
  PID:3576
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6244 --field-trial-handle=1936,i,15871713833048402245,5532226070844144851,131072 /prefetch:8
  2⤵
  PID:1056
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\3008 [2.7] ADMIN SPOOFER - FREE SCRIPT - UNFINISHED.txt
  2⤵
  PID:936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --mojo-platform-channel-handle=2548 --field-trial-handle=1936,i,15871713833048402245,5532226070844144851,131072 /prefetch:1
  2⤵
  PID:2364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --mojo-platform-channel-handle=3968 --field-trial-handle=1936,i,15871713833048402245,5532226070844144851,131072 /prefetch:1
  2⤵
  PID:1652
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --mojo-platform-channel-handle=996 --field-trial-handle=1936,i,15871713833048402245,5532226070844144851,131072 /prefetch:1
  2⤵
  PID:2724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --mojo-platform-channel-handle=5664 --field-trial-handle=1936,i,15871713833048402245,5532226070844144851,131072 /prefetch:1
  2⤵
  PID:3824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --mojo-platform-channel-handle=6548 --field-trial-handle=1936,i,15871713833048402245,5532226070844144851,131072 /prefetch:1
  2⤵
  PID:1428

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:4764

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3060
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:2892

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:3876

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3976

C:\Windows\System32\msiexec.exe
"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\Downloads\7z2201-x64.msi"
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
PID:1260

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa395d855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:4544

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e5e45f1.rbs

Filesize
28KB

MD5
b5c1c560acc21eb2abb5e5beabb1c417

SHA1
67fcab279fe6b06b952d8c460bccb1d317015b58

SHA256
74fd11d3b70c0c25b21130ce3286829a2bb7d435e58040c68c9e6fe769c87afa

SHA512
676fc4047b01154d543e9258a98a60f20840d31d5c19c6c256aa025563b99e3e970f931b699a8f5be6d0a978c0877f3cc3e819822f40b49feef0a97e3f067f53

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000d

Filesize
194KB

MD5
ac84f1282f8542dee07f8a1af421f2a7

SHA1
261885284826281a99ff982428a765be30de9029

SHA256
193b8f571f3fd65b98dc39601431ff6e91ade5f90ee7790bfc1fba8f7580a4b0

SHA512
9f4f58ab43ddadad903cea3454d79b99a750f05e4d850de5f25371d5bec16fc312015a875b8f418154f1124c400ae1c82e2efd862870cd35c3f0961426c8cd82

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000e

Filesize
24KB

MD5
b82ca47ee5d42100e589bdd94e57936e

SHA1
0dad0cd7d0472248b9b409b02122d13bab513b4c

SHA256
d3c59060e591b3839ec59cad150c0a38a2a2a6ba4cc4dc5530f68be54f14ef1d

SHA512
58840a773a3a6cb0913e6a542934daecaef9c0eeab626446a29a70cd6d063fdb012229ff2ccfa283e3c05bc2a91a7cac331293965264715bdb9020f162dc7383

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000010

Filesize
18KB

MD5
1126911735a92575380aaf5ab8c6ad75

SHA1
e955e5dc94c562cac0bf78073f584b89c19db53b

SHA256
4dfe7697f8ce5ddb9f0b93ee2bca44f36e5bc2dbae5a3cd885d56814ec802261

SHA512
44f9872e33e81f74bbb40c96c79b4664f509c6e40f723ca1c90d03f299f08fab0066d0a80b199d485cc3f27e253363cb1bfa8fc3e3f2c9cac94b1e17f837befc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00004f

Filesize
24KB

MD5
5366c57b20a86f1956780da5e26aac90

SHA1
927dca34817d3c42d9647a846854dad3cbcdb533

SHA256
f254eb93b015455a3c89aaf970631bc989fe2bd387f79e871b514992359651aa

SHA512
15d7127970436f2510344600f3acecc19c39a05f8e82c8a7950095386382b2e2da55883a5a9faa97b84452e67315b9ac1693b6592274c8c1c35c813dfeb543a2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000050

Filesize
24KB

MD5
344ee6eaad74df6b72dec90b1b888aab

SHA1
490e2d92c7f8f3934c14e6c467d8409194bb2c9a

SHA256
a3cf4861c7d0c966f0ed6564f6aad6b28cbd3421a9ca4f60e2246848d249f196

SHA512
2a9a9162d610376512a8fae2cf9eb7e5146cc44c8ebde7a12e9a3985da1718c62ae517c25b00de7c0269efab61b4850a0becfbf04382a25730dbe9cf59825a62

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000051

Filesize
40KB

MD5
54ad7d727c84c2bbf07f53b0b6f17204

SHA1
e261e3fb14cfcfbac2fc45523281f0acfbd1d4cc

SHA256
f4bda9b17089c8cbf16121afdbe9bd27b013268b3833ff3f26024468d74c94c8

SHA512
ffdad281c8f180c52031207f263f382c53fe540ec5fae92edb8ad107712e780b0589f20b307d2a52641fdb62034af695e67dff397a76342038d82ed210702dd5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000052

Filesize
64KB

MD5
6275794bae7c1c8e85f9bb9ca7d5b1d6

SHA1
6c84c27d6ffd2e91c9af538864c125da87653fac

SHA256
05558d8f7ea32e4f3e9f62a49ff0fbfdf48adc71c6b4f6d6f1cb85500faf6172

SHA512
38832379488d29cf25d5dceb9eaa97baa785dce9588f053ec11e3f577896429eb416e5682c61d43907f04aeeb91f9e1f928fa74ce5bd42088df07b798890aba6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000055

Filesize
89KB

MD5
eabd66353a730313a27117c2255fa68d

SHA1
d9c52e684ac86b3583ee6bcdb88940cb0e77a162

SHA256
1e85d3cc9fad9b9cdf525fefb91c238176829d996af85af258f18bc3c521ef27

SHA512
f16eb6204a17008a732b46ec30c26fe2f42f305fc78de89cbdf9a02a8c45c2c638bfcceead7b87c10805104f94cc844e0cb36b3350424668da3d90afd69a8375

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000056

Filesize
17KB

MD5
77a06985d5edb14cd4b04a5e658aa7e9

SHA1
9b5c4475d82b81c92d72fca0c38717996ab052ea

SHA256
c1ac8a583d235ded85d07c5c71e40d463e37f4fa08f3a3a7d528d68b78c41756

SHA512
c9314b3879c18f18696dab65f1062708dad4eaab715ae2685c048a2c178f61f0c90ffebf42cc971ad8c83182df380984a40351080e4ad260975eacbda1d7b824

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000057

Filesize
28KB

MD5
10b541bfe4d23a6a19b88b444df64125

SHA1
7cfc1dcaff6b83eb82fbb3bea200a9c5bba6df75

SHA256
1bcaf58566b293b65d27911c96c08638d72c6b8583611b5dc2bcb5e00a94f194

SHA512
650c51fa8cd08f36b26b1305d6c30b18ab100e4583106c2e730a7b3964c5b7d4e6cb01874943ab87b9eacc1ae86dd8745329ebd5b531dde83fc4e0491061741a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000058

Filesize
17KB

MD5
a35f108164d7ab7aa9ce316948ecb021

SHA1
2150a2d3a9f2f0cbb77ab0b572d4961f19b292a9

SHA256
420f4edb47d221f1a00e6bbeeadfcf448c8a8b6c4994ad017893d525b827c43a

SHA512
29b239877381c1a62588fda1913aae21d454040f612a445e396b2876b01970657268984177141dd02fc064c37324cde853758238c9b43ddf7395ebc780580857

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000059

Filesize
134KB

MD5
4787dd34ac59f7876fc7a3e8c4d3c01c

SHA1
0a2fa42f0b64a361f9404802fc4eea75da616df5

SHA256
cebb59025c724f97697d4cfabceb05bb69c991351ef578467104cf1cbb35beee

SHA512
fcfe75082898e159cbd1b0a2d449df81c577c04822ba598431c179d40fd9c87e9f01376691993b8c1860c189543c1a16cb8512d60d01270bb411eec229b5caed

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00005a

Filesize
63KB

MD5
34d5015941e4901485c7974667b85162

SHA1
cf032e42cf197dcc3022001a0bde9d74eb11ac15

SHA256
5c166a5d40aeefd0679a14f95e47ff28824e66abba82adfa30be41803cc25632

SHA512
42cef1d6847f535a6e8afc0469b9f5ef79ce4ab21512ac7eeda8ef9667d5f24bb33b30aba9a29824b3d853d41d4addf6bdee2042cf4fbd0a033b61657c671f0c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00005d

Filesize
61KB

MD5
a1eb05b2e53b4908558d8ff04593ba0d

SHA1
cf7fc2706462d69876d05b3a8485a5b5ff71bfdd

SHA256
d95fd728438d7db547d3f5aa714b2bc81add8cce4dd03b0ce479d2dcfc61bd52

SHA512
108ab871d7bb98b5feb0fcbf6705710b34976da63ffe1033c8b3fe9ef2723238d9686f3a1d49f64b6f11dacb69953effd81badcf4ff42d3506bf0e85fcbe9b1a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\336a68eaaf209f48_0

Filesize
309B

MD5
412a1f66faa76c9677d41a7442418b5e

SHA1
7d949a1dc61b9ed54b468b419a953ee053b54aa8

SHA256
d7dc663c3edad30076db46c3577ebdc590a5385a8f02d2665054d6080f313cfa

SHA512
b8d27e9443c6d1e31c454f4d162a6028f57e34a85f12448be5e72242156d50abd600c07b41ad2a862f69086c69c498c48ab5c4e0ea70281be1ec2dfb2c41316f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\3d4e82c0ef450fb1_0

Filesize
328KB

MD5
9b3f1b9825c5d6927688e0e91c2e27fb

SHA1
e4bc506bf2cd4b7f9d393d4ee1977dacf0252764

SHA256
916608c5bf931fd47e95e852f34c1b51765a2766aa1d35a71b245e25380928af

SHA512
f66f6d3a486863d5f2fa50de8801d4d478b54f0f1e1bcafb1175d45f5b468fce0e23607a81e7db76b5ed6f5566f279c7c296e552d247922c12a8a0e4d9e4fe82

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\440f51f94ce36512_0

Filesize
40KB

MD5
1feb5cac20bf1e4684ede2c1d02bd709

SHA1
c367f9ff5abe276413bdf4f21f0a27d961348695

SHA256
cb6359dfd111327ace4ce7a3ae595f534351be0dcd5288db05398b557510b86d

SHA512
8992dbd5af81cee29e3f379e4a13a3dacc91f669f9789650c49f8acb6089eda56acdfb925c3d38ce2338cbafb14c5abe3c5d812e563c8e6f74123b7f9745de98

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\582a50a24a9dd87d_0

Filesize
32KB

MD5
43dddf786573353dd309d0bfc52297ed

SHA1
d1f97e135bc068841af2130545b2081b0871732a

SHA256
012e79b9cdc5453f4c46ab1988b122ce562f12ee8b64106fa0b2c09625d1e0d2

SHA512
be740a2f93dd04fd84c2f184acd349b641295203d9eabbf333b1f822306d67d406eab86978ead14cbde9e2b6d28071d8ee2d3cdfa0883b55d8a79eb378bee05f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\708781d9eb1f8c48_0

Filesize
298B

MD5
3b42bf7e59312160091507ff257ca284

SHA1
089ffd3dc807ff98555f873873088722138ceed3

SHA256
9e17d5e7c846583eda9c23a511b0dabf458bfeccf91cf0a872ca38979b799b50

SHA512
1245d4cf3cfb70311c4fe4cf97d2615c9e04a055bebf8c20652d66e684f767eed2fd500cb3fbcf2740b705dbe9bd32286ef769a089145783a56a6f2fcc17a0a6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\7408f1461634e545_0

Filesize
266B

MD5
f8a1651dc0878bb7a31ee1cb2725558e

SHA1
fae40575940f454359a59cf9a8cd35ff75f15402

SHA256
7f2d1ddab0e66d19813d3f7a6640f9f5df70d9f8d4220ff5f3807f3ce7c765e5

SHA512
6a95f472c318f90c234d2eb5e971387ce18804f2399ef9bb7677e2975cc9e51f528e062cd14f541ca2bb1409cf461285daf5ad6381dcc4e5b1b6657b3b243606

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\b7cfa217ca396656_0

Filesize
372KB

MD5
8454879533ce559836ae6e209099eeff

SHA1
5764469a91b1158fafe5f64893704e508edba69b

SHA256
1658743a60596c201bace309e0eeafafc4dac9af0eff6113f7b44e429de06e9a

SHA512
c808d8316e24f912e07a1329635e6e42708dc457152510891b9c2cdce664eef43cb2a4c0eb465c27a8236528be2b49b4421cb82eaa050d6bded63bb344c0cefe

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\c39ace19f6ddf2dd_0

Filesize
54KB

MD5
e37f0110e19c5956527966249064febe

SHA1
c5cbdd01c206ab8ecfbde3031936f920b5787a6a

SHA256
af6baff40bbf7e5447da5cb70306f0b831a6966562edb3ff2ac776b7290ea49c

SHA512
3bb63d4ca9fbcf4d08e4104e4bffc14d4d9056fe00b3718abaff44a09bdb850aa5a0d1d487d6815a8ffbfcc1d8a6e02e9c657c272d69bc333982324199abec15

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\c5f2e5764e4a83f0_0

Filesize
303B

MD5
c4786646a6a3af68eeb0b55e3c0f17b5

SHA1
091fc081c9f6a2a3567fb17484305f378e993881

SHA256
5b89637fefa12b6adb343e1bcffc3d3c5801ddf634e360796043ba204b70cd56

SHA512
0c285243faddc47bcf0cb5563c80991e2965bf436b111eee8071a370c5ab40c8c5b933c9d62fa99a9a6a5f5487534acee819d9c781eb0a416cdc87489e4c6d35

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\e10e3d257a105931_0

Filesize
3KB

MD5
485c43afb3a69c949e742c667cbdf9a5

SHA1
c5a375b49d34fdfdc3184bbbf6f454c9f0733876

SHA256
ad0cec9e10623eb10096c6109422aa28290b4fd3829de07ac4dcf343e3e10333

SHA512
ed1250782046e1db57089c04bd7b53df89038d60694a7691c327dd74bc293ed9f1f5b9972da5bf1d2156bd8d8c29567f62e7091acd7052383ff72428eb4bf2c2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\f043fc37cce6f0ab_0

Filesize
334B

MD5
8bde1bac8b3a266c726378bed1aac3e0

SHA1
5c9179bc7c85dc1f067e01f314423d424ab8c9c3

SHA256
e9c1d3e7b56086bdce477f284f60f4459bef6f415ee3d693c0d66eef1718dc36

SHA512
ae0fcc7d6d84ba38ad8203f388037aa4fe602b5dfd20bcbca8895382c600ea1e5f664c1ae33565011877738e2bbaaf5725069d303a0157e126e47c2476f38575

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index

Filesize
2KB

MD5
151d26987d56384425796c0745cdb019

SHA1
40cd61b4e1de16360aa9f88edbc3446fc3b655f3

SHA256
84bd5fe2256143e5b24cef5ee373fffee40a01287456daa6729e660d2a47cd89

SHA512
5af6e494ef664d144a5e74b0e1e21bf98e9f1b9c5a24262cd51577209043b462e411d0fb5f7df32190afe30950f21e7fd9f7ff1ee2bfe641f57cc3967f68bc65

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
360B

MD5
c917684fe58bdcb86b48104d4c7c7872

SHA1
25607ba0a461068ab4034274a9bf1ae6fe4fd898

SHA256
3cca93be6e8c9f4b9be97c9fda0ef43b6be602a615d582be0603f46b886123b7

SHA512
267b5d6218ed29a8570b5a8f27fcb2bc401e51a377c8e366ca18923914067a7907a274a37b4b4fa5278c9cac4bab0e34b35974691f5a451a15fe26a675842297

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
336B

MD5
18ee4c56545483fb40247e9b6e1b1d02

SHA1
32fe8be36d58f27af84b7c94cdcbc4e2e61a3a23

SHA256
a532b5d60f8297fa67c35ef29517de0cc978eb38520b45568abd4d8ae2c923c7

SHA512
93d7345a6cadfdffc2989468ace656a3ef5ceabb2fac39cc94996354f4378bd06d984b60971f5111d79567a86958c7251865a3e055bccb66475c79add645801d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
384B

MD5
a39404886ce2a25788a43702755a1566

SHA1
110641cb0063940dcc8501a8945eeca22ba174ca

SHA256
a4f33ad789fca324e255e7546c55f79e258306577df19a163fc00194f3e0a43c

SHA512
4da087ae9dc785416d3213fb4a421165fec2c2b7aad1c730cd75d64c13a4d35ffa35966934b9d157a78d717f9d1dab81899feacc7c35d1df11274a4dda286b77

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
71c0a852aab6c54514df33566e150e08

SHA1
92a3436058c5eb1933fb94b0845d5eb45be39317

SHA256
d27fa2c0d3a83226ce73d51b128fb8be5d3e77173678688e600b6af2da768782

SHA512
7bb09bf0c2a266a8fff721f6af308ab884b0901bfd2e8a544a7889f78cd5da8728cd102f844ec66023ab186923989cd9565b90ee6eec6f2585e5d7e60ced8a3c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
ab6a3161aa7d20e5521a580834eb8ed0

SHA1
e125d84956d01721ea36061d4e054dc363c24b2c

SHA256
dddf6587d4a0493d5c94991a6a898b0759b4926a68ae91954762e3a7e4a92d6e

SHA512
f0c1bf8ebdb9cc68832a241954860426a6eb3d5df7d97c9052783293f4cbb772da30928342e141813df6c6671e52d444a3fa45024afcb8503bbfe001698902bc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
778bf91c79d0d77d6a71e8767b5282c2

SHA1
922bf42436ebacce1f0af3ed1551c96b8c7eb1f6

SHA256
5402e00ac161f4e01e00761ed6faf6b6fa11a81975a2947a0bd3369e9aa9829f

SHA512
0ae62f81e8a7ad34e36843479e4757195a5846601c73d2b510e86c495e1890bdfe99b231d1ce7b4836ad7d0d154c216defed5ab1ece017e3ea5cb8b99cef6ffa

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
384B

MD5
b417d1d2edbbe6257cde065c9676d1c3

SHA1
d448cc3206a0e2181f5f84e7c1af0bec8b3d91f6

SHA256
462a2706241b87dd24b45b74ece4579d3fb9f845d35c1c358e3c9addc608a157

SHA512
87602f1e728f7336ca431f3ccb6e9a94be200203a6f02133d022a61ff4b42fb58db3bd55a7eaabeb03399f6e1771aba58010701268c5ea9b497bff547cea8d49

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
42877849f16815f87295759f6eadef6e

SHA1
c5f9b565701d5dcb25489f1c9f91fa80b9677a6c

SHA256
16db0d2ec10f53f235d268cdf4aa64c8aaa5f5b9cdfa3dc85562a9b14f1cc5e0

SHA512
2f2f6f357c21a368fe0c9c4089800b1344141db048e8a8cadc18f2344a53aff3a0eb0900d6d610eb5ec44d3e4085cc552449c906c8ad7f9b7a69f425b1fc31ff

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
584013b0a9e4e50fffe071261c0ad857

SHA1
06da612cc337c3fcbe9c45e07a07c0bfac7bbc0c

SHA256
e092ee804fa594cc038582c40c5601654c2c7e94fc31a97961f4b701a94048a9

SHA512
c8cb8e5b07c6cc4e5937861c4769666920e41adcefcdaa7ea671119b03ce5fc9af3e77204f8357670be2d29eeaca572d7eb47f405f43d8d8daeb4db1a2f61874

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
7KB

MD5
ed16278e64302ead931c1dc58b3256e3

SHA1
5660f944de3fce5175e28f2328c113b858df63f7

SHA256
2bd5ef0c32d3987cfcb684bc0a5d133017e3f83dd2de4e1789cd1a7ed24f9da2

SHA512
2bd36722967db4fdc312e4c8aea174e9e9a1aa550d9223b2caac6112a5dc022ebba0e41118f81796e68308abbe476829df29cf45138d9144ff1c6fc77af1cd6b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
11KB

MD5
035a676ada4ef0f4221abc49cac7acd5

SHA1
d5aa90d194873e6143dc3ce0a5f491a1bc7ccc7f

SHA256
4c5741897a55eb593fa5833d0e3874cc1bca84aac00ba3393196302e6f7b42ea

SHA512
9db6d71d04a5b9bb4046ac1473221d20637930fff82a5e25cdce4cb6e27b10cdcf327fb81c3c5219208e7ad5fa6f1969c6c684f773ace5e153f29231e35a58d0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
f0c926e3bb81ae72e545b86ec9ff9192

SHA1
2aab66a74bcb021e5d5539852a5200fd6bb6cfb3

SHA256
f2237acd1d2e8abf566348fdef35f1361e9824693638a5a6714c0b7223099b9f

SHA512
8a02bfbb1ffc2261c0dd5890eaddbb0b3fa206952a90b6c649509a848fcb547c79697f985fd9ec6ac957c69d85fa725a0e00864d897b48788c5f2bfb4ee92edf

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
e3a3fbbdbeecdb4f2e2f41b4f2667e4d

SHA1
baa56e89bff1d0047446e48afe965f1371d8cb73

SHA256
59407d612ce42879cf0ae1ed19472cf26c12fc849445fd436c9cfbeacd642480

SHA512
8e50c3c94035129944fa5dc3428c34e44c75a4007bef2ff166d7e78190621b21736d86404d6a5b5c7a70a3bae83927c8dc55a2e473a04ae9e01bde5c5152d651

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
03f073bed32f82f272d3a6f807a58bed

SHA1
f66b115233074c0d8235cf09dea8a973c807755a

SHA256
edba4fb55488b3db254844210a1b505fabda8d08daeacef7645d6da56ea677a6

SHA512
a2df2f3f1bbe8f2daba70e2ae38254832f90761fc6a33c6176de8b90b59979f7e79e36a7930cae17eec11fca47cc1e48ad463da017583fec4bf85dab2e0b1a00

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
4KB

MD5
a1611755c9455e35b483a65b71b4bd43

SHA1
435f2522a8e1bbd774536461b804c8f0049bdd60

SHA256
4865e74cd57cd02e5d2a9591d528d041d3cb00907fe1745b7c9af47b30ee5476

SHA512
22bdb714a1849071a0bb47cf3e215655d7538bd9bc460a8aaf39a2465c3d39cd47efec452d2b5ad6d713f33775ec581a3565e3ee1085628f1821120735dda989

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
872B

MD5
3a2042091e4a7cc4e354e086b7adc8e0

SHA1
7ca280658aab62bcfa8080e7303be69652bfaa8b

SHA256
f8713bcc9fe5ddea59ea1787762387c991fbb62fe3e7e45751905f3ab3bb625e

SHA512
a6e4a86e2dd0311862208ae8bcb7bcad64d57a6a5ff760a403b7fe1cd0a54e16967791e54d2c9a842b85262e1b38a13d5c61a5c0b5ddb430b03a5674a056c5b0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
872B

MD5
b2735811016777b03797cdcc29b045f6

SHA1
3e0e9007139edd88dae0a8356cdc3c8933ea1ae0

SHA256
78284cf73f996f532285c5cfc4690efb5a21bd28038b2d1b3b9d346fd613bbe1

SHA512
ee295f4bfba96210a3fa00c0d638c0be4e46295b36d09f29ec356338b029c0a0f36082ba528c5a9312f47c839592684b3aba2e64c832b42d6fb84b556ff5b006

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
705B

MD5
b221b3819eeb432356a739db64c26eb6

SHA1
dfc9cf6e9e45192da2dc1bd68a8833034aee8f7e

SHA256
b80781ad6a920ea912f8e89e7a31076e55ffa26976ca47ca8dda542644f982cc

SHA512
f06de9cbca2641773e9e53656214c9cdfc99ff68af7524194ba7f8176b90ccd110da6eb5cef101f5ab0be98c955ba5c6018a456bb9e3626cbec00a64f2c678d2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
f0fbb228cc00d34f3bbc8594e1dbf469

SHA1
545ce969f6e4091148203f3b5057d7e109f0cf30

SHA256
1288a173bb723a6cfbbd5ffbd17ef2bb5defec45727b4ac4743acbd6c63f6e2d

SHA512
a208a9239ec1b4e86b79e4c7def54e9ef0a7b474460b9817c170848aec8b6a7ee3cb780821a8a1bb504e10695e25cdbccb6ed8af116f1618c6f84a653cc7942e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
263d465adeefdb391d7d09f205d1de44

SHA1
35f400e6b4015bf4c96d4e7167effb6368a0d587

SHA256
f10b7218e42b46f672b3b50f383940abf50a20e565c935a6ea267e27ad868f6c

SHA512
7c31fc1fb28c5b047378138d2366f8c9c6480382ac371bc1da0f0998575b37e2d5d71790931053ee58834d7a2b415f04392994baa1d48e196b4488133b314f0d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
cd4684085ccbb7180506e20847610d8c

SHA1
f94ea0a99c83abf58386ecbf850ff1f652233803

SHA256
40f0450cf375903f6b8d43dd37a667971530bb3dc3d4cd24871e9df975414720

SHA512
0087a484d06cee79f950a9440e9672cac30eda463020d452dbd3ca4716346d8fd502fd9d8fbdc0639a7e86c91080eec94903e54ef943e1aefc7c03ab66db5a41

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
2853fe49eac908ce9115e9cc8b0f9f01

SHA1
390a4a9c6e064d6539dd8949defd73d15b3bd523

SHA256
7b5d2a1d66ff068d33d347d5df19c6000978316387e79d924f6d48a9a6f6caca

SHA512
3f5d35b952f3077b4a4cc0fe2770c48a66b7c786c0df42fe269ed8db43b84432fbab1d817542b500f769c1c8ca9a7043288d1754af8bf78e0c878d3b893a280b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
5e04c4ec10b4caa647b74ef1269f1c23

SHA1
3cf3148f8cf66c03decd966d34ed2f5b1a11eac8

SHA256
ffb6bdf68b45fe379cb90ff132fb3b2c165f93abdbb36d1d5a228a959f3cdf69

SHA512
21496d29eea20c373fd12f775f71c7f8c17bfee6b057142e0e4634d57e9b4fee531666af8f7f3756f69fa87880f63345829a636914cf11e534e5a2d3792c6ff7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
369B

MD5
b1f6db61d73c4cfdd248dec9b7ff25c6

SHA1
9365be8810a52c3ca2bce145f144bc778f3e67df

SHA256
b00939604799a2781bf5c8bd43df1480d5d4df28d49eefd9f134c13c80384d7a

SHA512
17ff5bf3bd172eb2029292ae925835fe1ef0cea96d2e4a9b94fe998b7a3681507b783822f5175c3844078e74dccd40134ac2c6bb938991375587b7dc94e37c01

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
e860ef1af6a76ddbb3252a841b24fd6e

SHA1
69860fd3be5047148ad1cb4d135dedf484c5a147

SHA256
45ad238e12b550a36c1781eebb617ed6291572a574493c8d5ade13b70b20e8b9

SHA512
caf8b33ed6ffaeadfc459aec2ef71e9837755abd437a9fa1b51912d1a38b716723f8efab720812d0aa92ba99e78dd20bb6728929eca584e67cee37f6017f828d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
872B

MD5
5e5d82371c8d6f2712344d680ceaf091

SHA1
62024f9827f9017061b242430ee49e105df56f16

SHA256
2009804108df6a8cb95806ba9aaef1a8e8cef0e8d12fc9d0d0ffe29d24d73a1e

SHA512
7f22e8101cc0c8106ae6286526598552d2a9b97c662792ebb6dd746a2a218dec93f3669c6fc2ae1e5890c0c5bb60eb79cc8f9f047afa4c8e18f9746640160aab

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
872B

MD5
73d25706dc3d04196714d3c404eb7aed

SHA1
e7f0274cfcc2d665910fda85afa21a5414288a7b

SHA256
c693b3272d799071ffb191832460793f53fb98711ed788c20e076276c649cc2a

SHA512
ae8fc3a84bd9cdab62cc0be47a62d7e92b3b8477c2caab80067087b79adbfec545441ba02e6d2bd3c5ce4f69b77023b2990b1fd9b3667d6ee7a15cf80533038e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
6e52454ea31c5600cf21dcfd3a7d0e61

SHA1
9a976bbc3f9aba33dac3a7046c306c8fd688d51a

SHA256
e2f481ea8d460ae32d2a4de9076b9dd891ada33db402215f6d26723fb67403a6

SHA512
eaa220014fd2a932c2a6a3910cc390cc1b006711e88c3291d52ff996186084ef35731b34e4bbcb27a3a50e57450231abc36169524e6972fce8857562b8f5ae31

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
ef325c08102b15ffef3f705a06c507d1

SHA1
994b83646bafacd4088881918e4a237a417a17af

SHA256
9ea059f70fa210f3d2ca9ebafb50e099cc078d6cca929700da77e47927357b70

SHA512
44c1f70871635ba451f5a399bf20e2469114578beac607bcdd8f015868ce06d6d3040fd2794ecfb51c3306c8a87c99777de744041cc1049e121076f371694768

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
8da9c4562609642744b6c3922d2744fa

SHA1
1e4f5c4e2c77a895e6fdf534b4bc8372d03938d1

SHA256
e097c7b5802403f4a61411870f3a01d0146b5ec764defb2a52d978ebd46ab498

SHA512
901217b22bb66485ea4fd2471d4d981db70a2c468bcf2dea84dc049ecd146ec8770821bb7ca7d9a3d8e43fc6040bfec6b50893fcd5786196c1cfe5b454762877

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
2e4ffb3250ddef45c4d5cf2816e67d26

SHA1
46954f4bb91c28cd1889bb31a3e35db39d403d35

SHA256
713e151f88b68301caa785c89cc56cd429a74f02ded7dfddb1864166ad3c65b7

SHA512
37bb4b31cf4d4347c5c11ff83f32857a8092e82998b67b5f1e72c870c082272c56341795a9a4ba8ea0413e01733db3226617418401132b8c9fbb355ea787f340

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
c2ec20204ae99c762ad687bb2b393b55

SHA1
6c3a6b00293e6a5d9df075f44ae7a5d71a7af84a

SHA256
7c0631576202bb12101a3fd207fa5f6b5a7b6ee496e1e3df1e9a234165b73d36

SHA512
ab8eda54de469d2893052149fd0d7b550018986262bd3fa9afe1a226fe54e1ab8687ada94ec1ed1f68be7ce0248d03d35849ad56a8073e5be903f3fb1d59fdb0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
190c1e58f677f15ebb1adb9ca68d78e4

SHA1
43d97fe347225a95e23e0e83f9f227ae3bc48eac

SHA256
57d04985ede768077fe1862e1a1c074007fbb56f26494746816a4b0d837bf1ba

SHA512
01c4853f19d75bfbd578422cdecc02303899a23a3b476ddc7501f60e90a7e65d5c7951d2ffeb20e2743c2c7d08df5710e006d5568eea27095a1bb00d9efcdbb6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
9e3a833620ef3fd7653001010c441144

SHA1
5dad94d751ec1e0f2335c1a693a9ba9e9c15d9c8

SHA256
489aaa45d18d0fe57ea23b4f38986c7749eabfdfb81d4636f96b2e00097b6f22

SHA512
52c67ed7792d4ca226ff529179a35ab531daf31360fb8a8aa94476daa6f8527c3915a9a8db573a40d9ec5fff53c286762cf4aa7ca5a18f1a107232e5c03466c4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
f484a79315eb4da3b8ddc519f80f3dc7

SHA1
76d1d62a37db5e28b9e47d1dd412f803a42976ce

SHA256
7d8c93f0bfbcff19e4eb949fa785a64eb63f4e9f01e31fb3d3240a5792bc8c35

SHA512
4578fd15b6e067b11369a31690832d96727c310eebc4c5c1e6a291ba843155aa9c480759d03e8fe3e0ec85c88405a4d70abf9c3feb613278957cb589d9e24704

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
6996d30e79f683a733f3098ab153f4c9

SHA1
914796c539edad3c86db337e0825ca97722f5325

SHA256
b54a0ba533f3987c1561cd6def13014070cc321e9f1666c28a91a32d70252cb3

SHA512
7d0e63743dd32cac9227335e47822bbbf182e55e497a6a8703d1c886a7ebea7180a846880344f04c928cfd24690974269e2bb903e752667460ef7c2b62f82899

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
e6c4aa716091a043885151e35441b6fb

SHA1
f31e6635ef2c40be3cca32d746fa65d645f475fc

SHA256
501c17a6a50f9e55b3f4f530b3b0d316ef6471d700ab21acba5864675cf2f9d8

SHA512
056224d33720b627a15e795710a4d185cfc25808c5a14517924f7721b3462bade3e5e29e07e25f5380dcffac24499924d0cdaafcfdfc2b2ab5d2240bcc24df34

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
54681a597acd460c1a3af588ec89ed3f

SHA1
0b1353c1943d20d5f717a538fbd021492f5acc46

SHA256
08b663512f86c776021ee346d6db973efa21d82d5ea22c8c6d7c8bbd702685a8

SHA512
9599951bbbc16c11760422f82b85b4192aa72073f7ee5e124c44030c226c8485649eb558ee0cdaa6fc5af8f5d9a8fe68f2e3b303878c6af036c33522913bb210

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
9aa6ddda16a084effc4b260b0b881e92

SHA1
530d658aca4a732515c5920184ae7b89b0619d87

SHA256
157fb864d1acb153c664bed5aaf119b1f88fb621f614b6380fbc6ff6a14223ac

SHA512
948f008af22533b7784d5acb3992322f8b98eaa1095eb5fc465c659daabe1e006804e938ec991577637154f6e26a04cf9b760f69e669131af71333dd16c2f25b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
114KB

MD5
c878019778a93c4109b2608b21602ff3

SHA1
f23c38a1bc50e25caf4e01588c6a7fa8b8e54c7e

SHA256
bfb6b717c8252cc0f0c25b4c40a365bb6c893299d4692ebd24914794fa60e078

SHA512
00662fa5e1d2be4f5f9c8905fe0837da7b06a2bc530dd5d7428d7e2e31eef892f411106fe5628579d94ddb8c240f1ca9d14260127b6a7cc0e600dc2ced29e9bb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
114KB

MD5
e64a90a5ee4cedcf558280d9647dfd92

SHA1
e7705d551e83216ab1b3cee00b2f45e737c84fe3

SHA256
9ad82f4fd526d7cff99e7773e976599f8f98f9d0ac6af6c9ee6c3e007a480bff

SHA512
cc0fe4f6e1c6fe8b42909f0684ffe8700ad3ca2cef5b9b8634532f2eb69fde0360581a895515adff10369138f5f4fca1f1c46458949f1202b7e191846ebfcc2e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
114KB

MD5
6745ab7180e4a80b1b06ef829ea6c3f2

SHA1
9caf9b01f19e03213b38cc58d214896424a0799f

SHA256
5cd36a0894daa2b86849612a52ca45ba017811a57ddbf3437ab4f9aba895be45

SHA512
265d783e15416824b4f52a224af4c64ca4c8edcf35d7844cd0575daeb2d667af989c91636f2814a017789617ca4209850045d774f77e0ed896ee36945ca50a29

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
114KB

MD5
c173316ad176c9fa830bee37cb69fd1c

SHA1
2b0f496f1791fb869c82d73230594c112661a56a

SHA256
df7d3754d8ec22387c342bbecba726928d82c20c8f8de2d4ebb5ca40c0656b2d

SHA512
fedcde1674b01f812e773f7eb49064d97ac3a6e69f7ec5ad199c54a847adc2aa4a40f9c90a481e67d85601127e8b7eba9fcaf4a9247d5a0a442fdd9723d6844a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
114KB

MD5
b5e008d24a97e14ea86399c11a085929

SHA1
1c9677bc837f2358146ce3be9a95ec8530c12547

SHA256
e9940768e198429a928a68654c84d69642e1770cf95ad11dc525183376e6cee5

SHA512
fbfe90ea6b3b0f404ba6b78e349d9dea1193785c268ac4cd989e160e070cf4bfa1401fed9de490cb570b70fac11c6eb3f4e9b1b0aeb9daf9b31d8293d6a99bb5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
117KB

MD5
7e27208c85780a51cc97a228437e3679

SHA1
7b7d0ebeea191ee81a41d24c7cd17467d72e48df

SHA256
7d1616a9eae635a499b41d940a91e8bf472c9f944bebe40137235509ecc7db4d

SHA512
eeb8bc0d14420a5694cb754068f78ae1ac66fa4a6593588a704d12943156ac748893e9594b910709ba79898875e2a655823f6f8919b05b86d37315c4befb2ffb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
114KB

MD5
e6b3872fe364180f1661ec993cc2ec4f

SHA1
4fb8329328d8d0484280f236f4b9ea681d80f0dc

SHA256
5c0a359ab5c06e2578c3413d7ef2ac2ef43a9a59d9e55f617f7a13779312d959

SHA512
5f6486782f35e0a0ce6975a3460a2b056e1f662d1f269f533d0992a728b29d96edb9d0e30d8dd2e85fba48ed3c78c296cd45ccbe9ac6f62bae5bca9841112969

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
107KB

MD5
df01b3f814aab5f0c37f996f8a543c91

SHA1
8bf6b52f37bdbf2597c65f73a5089afca140919b

SHA256
828c7d7d8f4faf5469309efa9494fd73b06cbc45ca45bc8ff6529823a4c8d543

SHA512
255b2dbc388c434fd8cb7ecf6bec63be3e42cece56c96c1b05643e9179ebaad302e52e808f4b8692325fbef1e7fd27d5d58eb87a5ef9f8a3186bf9d1e9bba47e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe5d2240.TMP

Filesize
101KB

MD5
a68968c3ab3724c0d206ecba63aacff8

SHA1
4ab281ee3d9599a3a362d055bc2a14d20f0394f8

SHA256
b56bdbfa681c6b52d19638f301a4f9d53a3ca077abf38769a89e857de8a4cf76

SHA512
3218804528f5d90b9c0c878f87ff9536822bc7a4032fb8553ee6a8eec01791833958c3b0ca63667229eaf84a76f93ed912f7b2521e380405443776be02314b07

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\Downloads\3008 [2.7] ADMIN SPOOFER - FREE SCRIPT - UNFINISHED.txt

Filesize
725B

MD5
e5430118da347bb822eb9c22e1669936

SHA1
f3bdd826d1bf88643c21e47da7a0dc23931ae2f9

SHA256
e479dae4484ca2fad56e92df49ad26f20ba40c51a9e48a5aa091e084bf003bef

SHA512
cb8779f40357ede3afcf903dd9a433da0f80307ecc2d0bde6c085f66e2799ec5c4a7a87cca2396d84aeb91d64b538791e34c95f795ceeb1137ecd029d98ed4e8

Download Submit
C:\Users\Admin\Downloads\7z2201-x64.msi

Filesize
1.8MB

MD5
50515f156ae516461e28dd453230d448

SHA1
3209574e09ec235b2613570e6d7d8d5058a64971

SHA256
f4afba646166999d6090b5beddde546450262dc595dddeb62132da70f70d14ca

SHA512
14593ca96d416a2fbb6bbbf8adec51978e6c0fb513882d5442ab5876e28dd79be14ca9dd77acff2d3d329cb7733f7e969e784c57e1f414d00f3c7b9d581638e5

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 448289.crdownload

Filesize
1.2MB

MD5
8fb1c2cf7eaaf672bb95068fe708f19a

SHA1
48d066fc1791389317242b0bc28f93abd6890e32

SHA256
8e2ac3d40bb328a34547d7f93587d09c9453b60808354a2cbe913444d0e8b63e

SHA512
0cdf14a4561c51d68842e5b6352e6a1c548ef100b435f837a54f2cc0d0c900c2be17b81d8b7d608af56209dc041f4ac3605dc6fa9a891cbc415965a8f1927b32

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

Filesize
740KB

MD5
f2c8dd2b24c029ce20c15305e5084bf6

SHA1
f31a26492abc1b0d36189cef2a572569d6cb0781

SHA256
04e8f79a6f9c17fa6279697dab11363e4fdf4b3a9a64ff9b9cb77bacbbea4b1f

SHA512
7c5487fc3ed6700e4b2f6ea71b928d43b7731f6284b5ac62187d6e29dedbdb3d6fac814da2f21fc5df34788d31a0f5b794fc8b258ed2438fb75d0e8c4d2b6c47

Download Submit
\??\Volume{57af6234-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{7a84fef3-1a55-47ca-9d0a-d144248bc3e5}_OnDiskSnapshotProp

Filesize
6KB

MD5
c843ad14f5e039f098d9a00ad9b59af2

SHA1
766272b243ffaef9e3bf34bf30705d16bee97f75

SHA256
d0deeb82221c250e400aa3e8a91245e6a055f2b8d99ca9c7ebd46f7f8d51b290

SHA512
6c7d1fe81e50aa40220043beb5061c2f23bfbd01f4dfa444169acec781d1fb43858dd526b2292b8d37ca1888bc54b5f8aa06b43278f6c6f49cebd52d4f738726

Download Submit

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads