Analysis

  • max time kernel
    288s
  • max time network
    300s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    30/05/2024, 14:12

General

  • Target

    New Text Document.txt

  • Size

    91B

  • MD5

    914c6636a49d8fc86abcd99483dccaf4

  • SHA1

    7ea0a22b7563b398157946880c34c303fabfc85e

  • SHA256

    2870e26f93e1f447a8f39d6924ddfc95895232a06508a5c5bd67f2e89631bf71

  • SHA512

    27460a25ffb640afd04a2a9439ac597d2a5670be9c6097a704f8838d665df242461b2caa15a7952ebf3cd81ce1f4f3891943b11ccd17aa0afec010564cc62625

Score
4/10

Malware Config

Signatures

  • Drops file in Program Files directory 14 IoCs
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 13 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 30 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\NOTEPAD.EXE
    C:\Windows\system32\NOTEPAD.EXE "C:\Users\Admin\AppData\Local\Temp\New Text Document.txt"
    1⤵
      PID:1368
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      1⤵
      • Enumerates system info in registry
      • Modifies data under HKEY_USERS
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:192
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffcb6319758,0x7ffcb6319768,0x7ffcb6319778
        2⤵
          PID:2984
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1544 --field-trial-handle=1796,i,3262136905392719810,7525476463089165196,131072 /prefetch:2
          2⤵
            PID:4240
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1844 --field-trial-handle=1796,i,3262136905392719810,7525476463089165196,131072 /prefetch:8
            2⤵
              PID:3088
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2120 --field-trial-handle=1796,i,3262136905392719810,7525476463089165196,131072 /prefetch:8
              2⤵
                PID:2620
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2920 --field-trial-handle=1796,i,3262136905392719810,7525476463089165196,131072 /prefetch:1
                2⤵
                  PID:1276
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2928 --field-trial-handle=1796,i,3262136905392719810,7525476463089165196,131072 /prefetch:1
                  2⤵
                    PID:1660
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3648 --field-trial-handle=1796,i,3262136905392719810,7525476463089165196,131072 /prefetch:1
                    2⤵
                      PID:4408
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4444 --field-trial-handle=1796,i,3262136905392719810,7525476463089165196,131072 /prefetch:8
                      2⤵
                        PID:4524
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4616 --field-trial-handle=1796,i,3262136905392719810,7525476463089165196,131072 /prefetch:8
                        2⤵
                          PID:712
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=4744 --field-trial-handle=1796,i,3262136905392719810,7525476463089165196,131072 /prefetch:1
                          2⤵
                            PID:5116
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3212 --field-trial-handle=1796,i,3262136905392719810,7525476463089165196,131072 /prefetch:8
                            2⤵
                              PID:3636
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5452 --field-trial-handle=1796,i,3262136905392719810,7525476463089165196,131072 /prefetch:8
                              2⤵
                                PID:2084
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5352 --field-trial-handle=1796,i,3262136905392719810,7525476463089165196,131072 /prefetch:8
                                2⤵
                                  PID:3544
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=5636 --field-trial-handle=1796,i,3262136905392719810,7525476463089165196,131072 /prefetch:1
                                  2⤵
                                    PID:4968
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=5708 --field-trial-handle=1796,i,3262136905392719810,7525476463089165196,131072 /prefetch:1
                                    2⤵
                                      PID:4912
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3156 --field-trial-handle=1796,i,3262136905392719810,7525476463089165196,131072 /prefetch:8
                                      2⤵
                                        PID:5096
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5828 --field-trial-handle=1796,i,3262136905392719810,7525476463089165196,131072 /prefetch:8
                                        2⤵
                                          PID:5088
                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --mojo-platform-channel-handle=3232 --field-trial-handle=1796,i,3262136905392719810,7525476463089165196,131072 /prefetch:1
                                          2⤵
                                            PID:2612
                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4604 --field-trial-handle=1796,i,3262136905392719810,7525476463089165196,131072 /prefetch:8
                                            2⤵
                                              PID:3188
                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5640 --field-trial-handle=1796,i,3262136905392719810,7525476463089165196,131072 /prefetch:8
                                              2⤵
                                                PID:4732
                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4712 --field-trial-handle=1796,i,3262136905392719810,7525476463089165196,131072 /prefetch:8
                                                2⤵
                                                  PID:2688
                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 --field-trial-handle=1796,i,3262136905392719810,7525476463089165196,131072 /prefetch:8
                                                  2⤵
                                                    PID:5084
                                                • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                                                  "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                                                  1⤵
                                                    PID:2480
                                                  • C:\Windows\System32\rundll32.exe
                                                    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                    1⤵
                                                      PID:4036
                                                    • C:\Users\Admin\Desktop\dnSpy.exe
                                                      "C:\Users\Admin\Desktop\dnSpy.exe"
                                                      1⤵
                                                        PID:4016
                                                        • C:\Users\Admin\Desktop\No Escape.exe
                                                          "C:\Users\Admin\Desktop\No Escape.exe"
                                                          2⤵
                                                          • Drops file in Program Files directory
                                                          PID:1404
                                                          • C:\Windows\System32\wscript.exe
                                                            "C:\Windows\sysnative\wscript.exe" C:\Users\Admin\AppData\Local\Temp\F090.tmp\F091.tmp\F092.vbs //Nologo
                                                            3⤵
                                                              PID:5084
                                                        • C:\Users\Admin\Desktop\dnSpy.Console.exe
                                                          "C:\Users\Admin\Desktop\dnSpy.Console.exe"
                                                          1⤵
                                                            PID:3320
                                                          • C:\Users\Admin\Desktop\dnSpy.Console.exe
                                                            "C:\Users\Admin\Desktop\dnSpy.Console.exe"
                                                            1⤵
                                                              PID:2780
                                                            • C:\Windows\system32\mspaint.exe
                                                              "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Desktop\ReadTest.jfif" /ForceBootstrapPaint3D
                                                              1⤵
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              • Suspicious use of SetWindowsHookEx
                                                              PID:5032
                                                            • C:\Program Files\WindowsApps\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\PaintStudio.View.exe
                                                              "C:\Program Files\WindowsApps\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\PaintStudio.View.exe" -ServerName:Microsoft.MSPaint.AppX437q68k2qc2asvaagas2prv9tjej6ja9.mca
                                                              1⤵
                                                              • Modifies registry class
                                                              • Suspicious behavior: AddClipboardFormatListener
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              • Suspicious use of SetWindowsHookEx
                                                              PID:2680
                                                            • C:\Users\Admin\Desktop\No Escape.exe
                                                              "C:\Users\Admin\Desktop\No Escape.exe"
                                                              1⤵
                                                              • Drops file in Program Files directory
                                                              • Suspicious use of SetWindowsHookEx
                                                              PID:2080
                                                              • C:\Windows\System32\wscript.exe
                                                                "C:\Windows\sysnative\wscript.exe" C:\Users\Admin\AppData\Local\Temp\C37B.tmp\C37C.tmp\C37D.vbs //Nologo
                                                                2⤵
                                                                  PID:200

                                                              Network

                                                              MITRE ATT&CK Enterprise v15

                                                              Replay Monitor

                                                              Loading Replay Monitor...

                                                              Downloads

                                                              • C:\Program Files (x86)\date.txt

                                                                Filesize

                                                                120B

                                                                MD5

                                                                255a8e245b6ad378558b90cbe3dbc3d0

                                                                SHA1

                                                                6eb73f9f2034c113a2a6b1aab9a440a21928cfc2

                                                                SHA256

                                                                d3195bde888f9b8a71f2eb840222f1586b652d0ede9f39841a180ead03633ca9

                                                                SHA512

                                                                67e03d7bffa0dec32535b6da46d5b7f38d94a7c9a231aa2fa625b81485d41c1ecac95b08fe5b7a605fcfe1c7e37c55ee716c9045df90ea6e030b86e52ec09edf

                                                              • C:\Program Files (x86)\erode.exe

                                                                Filesize

                                                                10KB

                                                                MD5

                                                                918e75eccb1e25e1d73994b975ef252c

                                                                SHA1

                                                                22b2a0823c0e8109323a405906bd5abe1df7319b

                                                                SHA256

                                                                cba73a620b7d4143830320f0878a473d1195d2c8aeee65f0aeee235a689de48c

                                                                SHA512

                                                                333208195dc4dba0abb357a53d77593f9818822187f7da86db1dda423e02d4d68fd77044b21d18808bd8acfae4e93d7c41bf34f1c29f78e5ba5d642cd6587147

                                                              • C:\Program Files (x86)\hello.bat

                                                                Filesize

                                                                1KB

                                                                MD5

                                                                b86fddd2b764f079615be5d4dc3e158d

                                                                SHA1

                                                                2510479054db1fe52cc2dcd3c7033d91204cb367

                                                                SHA256

                                                                2b2114784d15b0b0d5475256851b4d0d4da7181198c2a93a304ecedb98eaf091

                                                                SHA512

                                                                915363bc9f6e665358c8d25f5f5f51d64c53cb755be999013217162b126705ce641ea809047bc84511db7e3e383b848ec3932924baa8926d51a51d0037a5ca63

                                                              • C:\Program Files (x86)\hello.jpg

                                                                Filesize

                                                                110KB

                                                                MD5

                                                                057ea45c364eb2994808a47b118556a2

                                                                SHA1

                                                                1d48c9c15ea5548af1475b5a369a4f7b8db42858

                                                                SHA256

                                                                6e1115188aa00fb5ff031899100bacb0d34819707e069bca3eb53935ebb39836

                                                                SHA512

                                                                582c7ecf2d0c33c8706ff3f39aa926780aa8f0dc0ff5d563905a5100254b81b89def22206abee0871ab339a3d463de9e6ec1782d92198e8f386f173654b6e760

                                                              • C:\Program Files (x86)\hello.reg

                                                                Filesize

                                                                3KB

                                                                MD5

                                                                81427e9d5d10657b9edffd22e7b405bb

                                                                SHA1

                                                                f27ab62f77f827dbb32c66a35ac48006c47f4374

                                                                SHA256

                                                                bb21001c1c468e6e372d836952c3efb7fbdc98e9a20a1bfdcc4beb1b7a1e7f83

                                                                SHA512

                                                                b0ee65bcef13be7c17db6e06b96cd44774fcebe6f4a411b0073493ff53f795e3b7c49e921c3bd2e41256638bc161f5218d1c51b589c3e10164f8f2c0d1db1592

                                                              • C:\Program Files (x86)\launch.exe

                                                                Filesize

                                                                92KB

                                                                MD5

                                                                b4acc41d0e55b299ffeec11a8a20cf08

                                                                SHA1

                                                                bbee20882bdd9dcd24b54b6af6c48cf5efc8c6fa

                                                                SHA256

                                                                34bc0d5b6029a74b9cda56b72434ec1b55b6742ff5ef832d36027a987a63cd42

                                                                SHA512

                                                                d4fa9900d703ea12d508929718433f97581a23b63458e5070ff7749871a7f60889db45098ec2972687b864ba97ab4fc307e8c80c4450dee79c0a5738818d2794

                                                              • C:\Program Files (x86)\mover.exe

                                                                Filesize

                                                                514KB

                                                                MD5

                                                                ddcf5d5ce2600c1137445019ed8b465b

                                                                SHA1

                                                                49ed7183e91d362fff023ccb51af9a1ea86d9b95

                                                                SHA256

                                                                bfbc70655122e7f6d11ec954d8e2836771ad6aec78e70a5564d03202de4f07a3

                                                                SHA512

                                                                15b3f91cf370b6742041a5dcec4395193ed0f45546a9bd7109f9e699be8c133472630f8193e5c7e97566048e66478e99fdbc10af077d6f9212dfbd6ad0839d69

                                                              • C:\Program Files (x86)\msg.exe

                                                                Filesize

                                                                9KB

                                                                MD5

                                                                331a0667b11e02330357565427dc1175

                                                                SHA1

                                                                d84c1ae0bf2c8ca1f433f0086ca86e07f61204c2

                                                                SHA256

                                                                fc7174e44a1d34040c3bc05ce24e648742a38a3accce22e8300d7059e4d12431

                                                                SHA512

                                                                1c47f0438dce58d473d93c10f233650df3e86d7e762a08b3a933da37683e76a079d275db4a1b4028d903f7e43f487173ba8bb25c4cff6f3e1161d0a5b2b18cec

                                                              • C:\Program Files (x86)\mypc.exe

                                                                Filesize

                                                                10KB

                                                                MD5

                                                                3cf9a7a431df42a5758133da6236ea8c

                                                                SHA1

                                                                fffc40f796107f69c367d9381bb45d0902459f5e

                                                                SHA256

                                                                bf21063cbd788f2dcd06b5fe925e9a2bc5f26fdd6869c6260464e8cc6e0cfb60

                                                                SHA512

                                                                20909c792d5ba7a0f2b86f7e5fe6d7d91d5674be5108378cd26c11fb5688d5ceeee0a960e72f7b59d6db80f693f637af6c19b89491b97ea918e996ff200d76bb

                                                              • C:\Program Files (x86)\shaking.exe

                                                                Filesize

                                                                10KB

                                                                MD5

                                                                414b8d5fe6f1884a9c7d2091b03f8057

                                                                SHA1

                                                                cd9ebd4dde7f57386d1cf74799a09bca6c42d4a1

                                                                SHA256

                                                                993bb01dbdea38e63ff38b27907d0955e45a9cb340fd2e3f335e928b5e051172

                                                                SHA512

                                                                d8ec34e14f00403341fcb7ee3b3ba6ea2e400fac3cd6258d6de1180ddd21fd3d5efaf1b0d43ca3172e9e4b7735d4ba36964253bc9992924a9cf9f24a7f1be7d8

                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                Filesize

                                                                2KB

                                                                MD5

                                                                4743f1d652cf490ba84528b86c8bb0fe

                                                                SHA1

                                                                5924713021cc692a58fc7addebb8ec3dfbbdb6e3

                                                                SHA256

                                                                8d094f37e8ef846cca39841a6651906a7089d3be817386fa7e1fbaac9d9f4b50

                                                                SHA512

                                                                230484082eb79cf5015ce11ae921f3aaf9eee340512da846866d5f0c1ad550a0dc72f814c12dc2556d99a2dd597327875a78d6550e2c29969b13adad8fe33d98

                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

                                                                Filesize

                                                                264KB

                                                                MD5

                                                                672243ce3ceb7937f9cb2cf639bf5d1a

                                                                SHA1

                                                                7581253e6e141a3067be79aad72b5a140a6a465c

                                                                SHA256

                                                                eaf127a759d70e3aa058c44027457892195d9c7dc5005f8e6c103bb71d477438

                                                                SHA512

                                                                75fdea3edc9d359daf7f95b8bc1bf95bfc5df05df050c6c72e981af2ae082fce3ec9d48eab02995b992574f3371fa211fdd1411577c280c96ec2d765101e0b7a

                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                                                Filesize

                                                                1KB

                                                                MD5

                                                                36434d4f33b3e74535a4ec27c9165841

                                                                SHA1

                                                                ee7fc4e89eb7f546390cdb80c28739881c8b3523

                                                                SHA256

                                                                19488f4dab722d120859e1f43f351dbef27f195b529d9efc04baabf1355621b4

                                                                SHA512

                                                                e1a4202071b5462ebedd4848fa218736cec049321c36c892e15a49dec4346d358ac5039252694a6dd07d41ee8e652a403fc7d4e70bd216f30f598ddd413624cb

                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                                                Filesize

                                                                2KB

                                                                MD5

                                                                b396ec8a983ecefff0789d55d1afc619

                                                                SHA1

                                                                9b83b7b3266886162c6b416d2c2b4eacf25f1219

                                                                SHA256

                                                                86ebc8a8daeea4903b293035aaf59b0d5e575569a514d5f06d6626db5ef14e2e

                                                                SHA512

                                                                7f39de9c96f8092867e88306fd257841095626353003fc4892d7894db7b6ebc7cf599dd25d62b00e8a787931c2910d857b3ee96bbcdcd277540a2d1dd2bc1759

                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                                                Filesize

                                                                1KB

                                                                MD5

                                                                8301c335c4a9db22059722cf30a5e752

                                                                SHA1

                                                                dca59b2cbf22b5687a0b7de19fac976cfb3eed4d

                                                                SHA256

                                                                c392c1cf087c38c686c1fae50f062395272da6791c964e43bf3a05d6a236e124

                                                                SHA512

                                                                5a36182ab10b2b4535be7c2d0c18e4b7c018175faf183c20130e79547e03fc4db6229c3f952f7002ff211fa8ee4af51644037ce3a3427c6feac6dfd132a8680b

                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                                                Filesize

                                                                1KB

                                                                MD5

                                                                eb35cefeeb25c85f34767189388a953e

                                                                SHA1

                                                                58250e239ef9049a250d3d3ad01ceedd1a7856b4

                                                                SHA256

                                                                c8d4ef2e55a90435a86438cfc126d0f101898d8f1263778d97a0a7646f52705a

                                                                SHA512

                                                                10a21975bda9cf6afd7fc3849adf41df4569e7f9643a5b19d45a79160334cd4feb57bbe9075ae18683ccbc15dc7cb32a55ca05f6fd44a6cc56a1d4fea27c8cae

                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                Filesize

                                                                6KB

                                                                MD5

                                                                32b06a5e05326d12c0edca589dc64044

                                                                SHA1

                                                                1462285936632cd753fda69938ef0840f7ebc8ab

                                                                SHA256

                                                                c6d900c2427a63ddf9f9ce3f4434e429a41bdc1ce604a687739666ff61a1b04d

                                                                SHA512

                                                                4a61fc5d3f91ab35ac2a15e40f0a711395b2495ecd8aa8b8aa94d270f8a81d86c1ae46d046a63b3cdf0c49b2db1dbdd1a1f928b59ecced3413e6af6301c0988c

                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                Filesize

                                                                6KB

                                                                MD5

                                                                0c26bb7bc4709e45c6cb3a08f01d8541

                                                                SHA1

                                                                99dcd3f409d646636d70e20178968594fd984818

                                                                SHA256

                                                                c53c3e00d8609adc1068a3f5f5eb98de5c70eb4c1be10186ff82e11810cb4313

                                                                SHA512

                                                                6170d84f419468962d4f5c7c9d964cd740f6986c6d09afc4447f6af0561f5372bf42dfabea671e6998bb7b68d33b027b29e42cd40334f6c74eff581be9557f2c

                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                Filesize

                                                                5KB

                                                                MD5

                                                                25a032c33b74ee11c7819effab118b1d

                                                                SHA1

                                                                23f11bc50c7f5f1516eef06f3c5f4b60d263c27b

                                                                SHA256

                                                                f33c77cc997c04633278a5a55e58bc9230d6fe9935544005f7a1c6383be33c25

                                                                SHA512

                                                                04d58eb6f34b1c1bb9ecf7773e309711b1bf5a26175775f2fd9d1301119fa2297517977e169c1d69fc671cb0e6ead84335720159b8026e63adb978c4b7ccef84

                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                Filesize

                                                                5KB

                                                                MD5

                                                                90502bbb28b805a355487a578f826227

                                                                SHA1

                                                                e644baf33d0bb712273ac41cf1937e823a6482d8

                                                                SHA256

                                                                83a2b1698e8803d0cc3e1ef9e77104124a48bfeeb305674a16ad0ce4ecd63b9e

                                                                SHA512

                                                                14b33494b05b5cc861e51586748be7508c48650b7d3bbcab994f0e8c27fc500395094540e677918bff15864e25f213fb056ad1b765e15cab6e79434ff408b7c4

                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

                                                                Filesize

                                                                12KB

                                                                MD5

                                                                d5eda6f7bc8d35da4f0d14baebe36f5f

                                                                SHA1

                                                                a637c548698edf66feecd8d8ae696e855f048278

                                                                SHA256

                                                                60cfe7f177baaf3e797ee2fb9e12380e1db70bf82d5eb20c4ceb86a2556d4a8c

                                                                SHA512

                                                                e93ea4c574745c54ea38dc33603b12c6503d8f41ad450eea410b089e8bfc8ab79cce52e7b434c19167db3bdf995cb9aff52d7ee99cf1a0de814dfc8843e6a900

                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                                                Filesize

                                                                277KB

                                                                MD5

                                                                66a60a681141a5bff9a5ac393055b27f

                                                                SHA1

                                                                55bc1fe0fec29491c64f4daf06e9a647b284265e

                                                                SHA256

                                                                3de6b39041b742b0567a1ccb53b8863f41c9160564340f5b84c9144f7b8565f1

                                                                SHA512

                                                                3163935d9eedfb0cd7aee0ccc818fb1bb01a4b45bf802043fe04877849679f5578ee75b0bd9d1d84591b89073e2cda04e277ee212a58ea06c4efeec2c42f8fbf

                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                                                Filesize

                                                                278KB

                                                                MD5

                                                                08c88b5426e2c8afc21c5f9bbbed8173

                                                                SHA1

                                                                ad8501208effe94440e032396d884ed1b783465a

                                                                SHA256

                                                                6d152c6cb9208beee78e41c9a812277190fecd3210f21980b49d058615b4ef9a

                                                                SHA512

                                                                3e0b28dfe6b1cbc21230912c68f94b7411e421e7b6b5fe13ad02724b17e817a21cdb27d1e611e4a1a2bf85a346960b66e397573e618bb326249cfa72bf4fb6dd

                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe5800d6.TMP

                                                                Filesize

                                                                98KB

                                                                MD5

                                                                c8034626e49ce89c653bb2971f37a65e

                                                                SHA1

                                                                7afbd21d54ee65f6820b6b888d0f6f8d7bc3c959

                                                                SHA256

                                                                e04bc7de1f01e6ada9de0b238c0169c73bef03031ade70b6feefadc797ff5f70

                                                                SHA512

                                                                9b457cf048ba694161ffbd44a571bacad0bad42251ee3183847a8903a0d749d2bed021b4f25225c84b6e6d8b4ccccfae83f06ef8a707b4a676c55442923eee26

                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\af2df036-5cb0-4fd5-8dcb-31eb63abaf24.tmp

                                                                Filesize

                                                                105KB

                                                                MD5

                                                                939bbacc9101e87e62b3c058eb90f0e6

                                                                SHA1

                                                                8a794f8a8cd71c2d5ef05b0adb8cb92d1e933ff4

                                                                SHA256

                                                                6b3a8b4b34b7c5365fe8d6f00324b62548750ac24af183f05b083468049ac361

                                                                SHA512

                                                                e2f945ff7ae1cf8c24bff793411e2f508d55f9b9e7314820648837154448e403fa88670350f963de74f0181a53d05067b0bf1db8b9baf478ab2b11132b5f7779

                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

                                                                Filesize

                                                                2B

                                                                MD5

                                                                99914b932bd37a50b983c5e7c90ae93b

                                                                SHA1

                                                                bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                                                                SHA256

                                                                44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                                                                SHA512

                                                                27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

                                                              • C:\Users\Admin\AppData\Local\Packages\Microsoft.MSPaint_8wekyb3d8bbwe\LocalState\Projects\Projects.json

                                                                Filesize

                                                                2B

                                                                MD5

                                                                d751713988987e9331980363e24189ce

                                                                SHA1

                                                                97d170e1550eee4afc0af065b78cda302a97674c

                                                                SHA256

                                                                4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                                                                SHA512

                                                                b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                                                              • C:\Users\Admin\AppData\Local\Packages\Microsoft.MSPaint_8wekyb3d8bbwe\LocalState\Projects\Projects.json

                                                                Filesize

                                                                233B

                                                                MD5

                                                                8a905436e93b70cb2d01a128bb958829

                                                                SHA1

                                                                d8275216e7de3489a3414f842375003829421687

                                                                SHA256

                                                                aa3cea12a708e640b12d87d7f3d91ba54f7f654f34c2b6659a509f311f647b92

                                                                SHA512

                                                                a8c3e1ee8481a3dc0e5464b50670551398d74f94eff5e97ca82fcee2bcadfe144ae98537fd15c9a3951b154a3fe9da43c87d1b88ed56ae01d6e76d5989572b64

                                                              • C:\Users\Admin\AppData\Local\Packages\Microsoft.MSPaint_8wekyb3d8bbwe\LocalState\cloudCommunitySettings.json

                                                                Filesize

                                                                2KB

                                                                MD5

                                                                404a3ec24e3ebf45be65e77f75990825

                                                                SHA1

                                                                1e05647cf0a74cedfdeabfa3e8ee33b919780a61

                                                                SHA256

                                                                cc45905af3aaa62601a69c748a06a2fa48eca3b28d44d8ec18764a7e8e4c3da2

                                                                SHA512

                                                                a55382b72267375821b0a229d3529ed54cef0f295f550d1e95661bafccec606aa1cd72e059d37d78e7d2927ae72e2919941251d233152f5eeb32ffdfc96023e5

                                                              • C:\Users\Admin\AppData\Local\Temp\F090.tmp\F091.tmp\F092.vbs

                                                                Filesize

                                                                588B

                                                                MD5

                                                                67706bca9ceaba11530e05d351487003

                                                                SHA1

                                                                3a5ed77f81b14093a5f18c4d46895bc7ea770fee

                                                                SHA256

                                                                190a0d994512ed000cf74bd40fb0502988c2ac48855b23a73fd905c0305fc30f

                                                                SHA512

                                                                902ac91678d85801a779acbc212c75beba72f8da996b0ed1b148a326c2dd635b88210f9a503fbbffa5271335483eae972e6a00acbc01ec013cf355c080444598

                                                              • C:\Users\Admin\Downloads\NO-ESCAPE-main.zip

                                                                Filesize

                                                                732KB

                                                                MD5

                                                                9172731ba3f16b578bcb14000ccbccd4

                                                                SHA1

                                                                e7ab716661ed88ecf060dc5d53720877b141eac9

                                                                SHA256

                                                                ce0a32e35b7c79e7e2ffe7bd3c7566a6fb843341268ad50f4a594e56e17a5110

                                                                SHA512

                                                                3a35995b6dadf408ca69699220120bba5f70fb3c2a850165ab11dad03821c8ce316bf7e9662f8976e0bf659cdb9adf0c8d0d7beca22b59480e4830dc5e02666c