Resubmissions
28-06-2024 20:12
240628-yzbfms1blg 1028-06-2024 20:10
240628-yxrpvatenl 1028-06-2024 20:02
240628-yr991atdlp 10Analysis
-
max time kernel
2160s -
max time network
1887s -
platform
windows11-21h2_x64 -
resource
win11-20240419-en -
resource tags
-
submitted
28-06-2024 20:12
General
-
Target
Client-built.exe
-
Size
78KB
-
MD5
c053ebb3f0f90a7705729579d25dd194
-
SHA1
fe045f0584ee3656af1e89a6ca37ef68e7f252a3
-
SHA256
85a287edb6eeb66eeada945ff71c946a76171be92244071c07d0ac5553d96cf2
-
SHA512
a5beac0ec0b1ecad655f52555ff83d756169335be383bd2dd4310b4e9d2120fb939ed42116554ae1544ed9db56a3846d6ca0369d2af0430a8d7c3717e2223854
-
SSDEEP
1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+nPIC:5Zv5PDwbjNrmAE+PIC
Malware Config
Extracted
discordrat
-
discord_token
MTI0NzYzMjcxMjk1Nzk1NjE4Nw.G3MXNZ.B896PWyca43CGShZp7WvFVoaKLYOSP1no8IyaM
-
server_id
1247637478639271976
Signatures
-
Discord RAT
A RAT written in C# using Discord as a C2.
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
-
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Modifies Windows Firewall 2 TTPs 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 28 IoCs
-
Drops file in System32 directory 3 IoCs
-
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Drops file in Windows directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Modifies Internet Explorer settings 1 TTPs 4 IoCs
-
Modifies data under HKEY_USERS 13 IoCs
-
Modifies registry class 44 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 27 IoCs
-
Suspicious use of SendNotifyMessage 22 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵
-
C:\Windows\system32\dwm.exe"dwm.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\dllhost.exeC:\Windows\System32\dllhost.exe /Processid:{186b24cf-f8ca-443b-8d7b-02cb24c246f1}2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s nsi1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netprofm -p -s netprofm1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager1⤵
-
C:\Windows\system32\sihost.exesihost.exe2⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog1⤵
- Drops file in System32 directory
- Drops file in Windows directory
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s Themes1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s SENS1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository1⤵
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\sysmon.exeC:\Windows\sysmon.exe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Client-built.exe"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Sets desktop wallpaper using registry
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.pornhub.com/3⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffa791b3cb8,0x7ffa791b3cc8,0x7ffa791b3cd84⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1840,4865888366059660709,17790995100864661263,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1916 /prefetch:24⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1840,4865888366059660709,17790995100864661263,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2392 /prefetch:34⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1840,4865888366059660709,17790995100864661263,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2692 /prefetch:84⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,4865888366059660709,17790995100864661263,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3180 /prefetch:14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,4865888366059660709,17790995100864661263,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3176 /prefetch:14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,4865888366059660709,17790995100864661263,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4524 /prefetch:14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,4865888366059660709,17790995100864661263,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4016 /prefetch:14⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -Command Add-MpPreference -ExclusionPath "C:\"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
C:\Windows\SYSTEM32\NetSh.exe"NetSh.exe" Advfirewall set allprofiles state off3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k osprivacy -p -s camsvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc1⤵
- Modifies data under HKEY_USERS
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵
- Modifies data under HKEY_USERS
-
C:\Windows\system32\SppExtComObj.exeC:\Windows\system32\SppExtComObj.exe -Embedding1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5d0f84c55517d34a91f12cccf1d3af583
SHA152bd01e6ab1037d31106f8bf6e2552617c201cea
SHA2569a24c67c3ec89f5cf8810eba1fdefc7775044c71ed78a8eb51c8d2225ad1bc4c
SHA51294764fe7f6d8c182beec398fa8c3a1948d706ab63121b8c9f933eef50172c506a1fd015172b7b6bac898ecbfd33e00a4a0758b1c8f2f4534794c39f076cd6171
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5ade01a8cdbbf61f66497f88012a684d1
SHA19ff2e8985d9a101a77c85b37c4ac9d4df2525a1f
SHA256f49e20af78caf0d737f6dbcfc5cc32701a35eb092b3f0ab24cf339604cb049b5
SHA512fa024bd58e63402b06503679a396b8b4b1bc67dc041d473785957f56f7d972317ec8560827c8008989d2754b90e23fc984a85ed7496f05cb4edc2d8000ae622b
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
816B
MD55d3839edc0def46be5366a573d213c89
SHA11c82aed1c360013876f0df2aa7425938f9e9936e
SHA256e1db6b8a17b545e2d3e3b6b849fb06994d1496e0a2f1047ae0b3fc64692f54ce
SHA51230fe8e225329585ab50f488757d074e3a4ffe05f6043bbbd069713c875656c0be0911decb0f1f994812258d4c832bd27be66a70eda5c1c934bb2a5d085d1344d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateFilesize
1KB
MD5e2020b9c99dfc794853af7ce4d70ebd5
SHA1ede4def955cac0955ee0bfaaea316c9a65d2986f
SHA256b176740cea9670485e8176af32f34bbc8adb0ec18ad390dee375cb84d62a6edd
SHA51246aecb53e1d0593359cebcc8e7e75a63f9b1561889f2c7189b1a8791bff3229ad8f92ea891b4e58798ce90c36d6e9434a8edc54434ade815fd34cc8f45a6263b
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
5KB
MD512b66a51119837decf9a4eac538f60a1
SHA1feb073a1241925e2d95ab5efac4c91f882121c0b
SHA256942335973ad098a61082a6cb8bf438034e8182eee70e201e88fe9df702fe0d77
SHA512dfd8449aa97ca312fda8671f02006baa43b05b86a3b0e95e22000e3f48ee08d4ac89f8322a88a5eac47a7cb5f862b06a948b6f16ea7278dd96940ff7b59a8c47
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD52a21164224195e9c504e68578304100a
SHA19d6c4e0e690c81c164356c1fc9d0f1a91fea1674
SHA2562eac7b323b7c525b3f9245e534111f81f03c2f167eb9918b9b70707d43d5447f
SHA512df2899ec11db054e170da89065f86d9f56ed5f494aa715c9aa30cd5c46ed067766226e4a29afdf84a77932df9131523b2e82788737b4cb3ee46f4372758ba2d6
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-indexFilesize
96B
MD55c4121438f10ed06f28fc8ea3a15ee07
SHA1ceaa7e9f1878f7586af6b24de548114a5ef87357
SHA25620c89d5ea3eaaeeb8956b55c3e03d64bc84ee0ccd9a5914b6be21e3d0ea430b5
SHA51241d3b8cc252c85e2a277546336c08096de14cd1e0b7fd578bac2372b052d9a85e45aa8c7e1cecb6daf311e27a658a65c97047743f4ca91f97891656eef486a80
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe587f2e.TMPFilesize
48B
MD5b9bddbc305d9a73a856ee95888a797de
SHA1c67ab82da7adbf8671437e5654958a5b47f5f609
SHA25621302d6de066848461e244a1fc8978285d92f10d33787d87fd6d5f3fdf440630
SHA512f4e8dc65aa9376ebd7e5bb0670dc6a54aad4008a5d1504e8421cb953cf2221a1535c24cb319df264a77789df7396fab87a88d5cb60d1480bf79c998e09c7bb0c
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
10KB
MD56d94eb4178d695b91b2f1199c610dbc7
SHA16535f284154406088ca63470b9d71fe6bf11c957
SHA256a87d979d5f249caba4b9eec886d3e2bc1516d7f74796646af8bbfd4c9b6f05fb
SHA512893f20d47245899e7f2ed21d42da1f4e3bc11d1038a317905c6728419f6ff40ebeb148ab8e775fa037c8787845363e5e5a43866fee9cb2967ea88fcbb535e8fc
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_i5ujueii.trr.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\tmpD43E.tmp.pngFilesize
40KB
MD55fc2f9ad7b2e58828577319379faf963
SHA15f0d8a3e38ba9e4ab98ce576daa5be1103209de3
SHA256462228cb298dd2512b5df3ec31d1b1bbe7136fe6a480f3643e64b29586893e7c
SHA51244e460325244a3994cfb4d839dbb16baa64dfe97de511ee5a2e1a87d1f6ee9897fca662501459b738ca13aa6fa939c63952ef8d2540318a7afff46e1abd52fb2
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpgFilesize
62KB
MD5e07a089a977c46136f6dbbcfc7be3693
SHA13b2dc89ce6c9269732f2c324b4b3f86eb82aed62
SHA25671b6d4b1cb456f0956e9205d670fff20387ca17eab8f80b8bab2eec034f7557a
SHA512947001f0a8ef1db8891afda6f58776e30cbe844d7799de934879a9f415fbeb6cb5d6c0ff7999db6685bde1264efdfea06cffc0e604797a467b9281c6c7c20b61
-
C:\Users\Admin\Desktop\AddResolve.eprtxFilesize
195KB
MD525edfaf1c076754e9f099d2b384fd436
SHA1c8ffbf8ec6a624745872297e01370169974d6bec
SHA25613f8149b2334387d85644a1b4bff9fe6ff51c9fc4a7cea37f0c0960bebf973f7
SHA512154337f13074bd6f1d904af4d32ac10dca4659409e55fb23c9b392844f7339e12ec21d12904df0b6649181e877fcfe7aa567f74d30f0a4ca375f6a2e2e701d68
-
C:\Users\Admin\Desktop\BlockImport.xltFilesize
297KB
MD5e534dc088c2af4015513af36c0105144
SHA164d919c40284b0e0dbab011593c5ae9b903df900
SHA256cd579f2760da2cbb5d1a2daf6aa05e89843d2d307d8e9c4acd1b8febfd8fc964
SHA5122c7f650e2859692c3bc35978ebe96fd609df4d1ab202de5acb489c06ce8ac4f7b7cee0f16aa44f3accacaf2b77e602be08f283717fcdd186564edcd8006abde3
-
C:\Users\Admin\Desktop\CheckpointConvertFrom.htmFilesize
188KB
MD5ec16832764d9721edddfc0926f94bef7
SHA1014f9fb7573da6a5f1eea81073f047f9a417de1b
SHA25622e48731d5b0c8973565e05ba31d652e91636d5b4aceab3029e6d4a4c6b1314b
SHA51270e006ababa481b3c467e2c118e9b1a07b86bd69dcadf6e88871e0b5b421b3ddae65c3f75917b6b3b710bd593cbe52c0188a36e4dc7cae3c2cd2b1124c465084
-
C:\Users\Admin\Desktop\ClearUndo.movFilesize
203KB
MD521d2fd7b35bc21bfb42fee270c8048f7
SHA1b454f1eee144a8165e222f5b9f99397ebaed642e
SHA25683d8a56e7eb1cd92c6f512e02f02b76b1ac4251a00d4fabc715e196dca8434bb
SHA512693763954f90d9cf6755373a5f792de1a1e79b87f88dacaa03a61060f4e0b99ccfebde74bde6abe7de46ac2799660fa25f262e007d53950dcb3d0c10ae5214e4
-
C:\Users\Admin\Desktop\ConfirmCopy.m1vFilesize
109KB
MD50c895731aade9bd043d4a7c1c9bc29ca
SHA1a24522e797eee6072030c44f924ec1f11c6b9de6
SHA2569fff73a2964c7b5eef6ebbcb4c491ddd01c18a7edf48383e07f6d288487c31c7
SHA512d44018a697c2329a1fe4a400c989253f0d725f9332aafcf5b8076babe510b90a0e8e9144d1548b8b5a2474816236dba94a2f5036c7d911c62981910e90e40e3f
-
C:\Users\Admin\Desktop\ConvertEnable.pptmFilesize
180KB
MD5ad781833daa248045e26dd7899873240
SHA136793e7ecc2d2e1de5b06afc23ce5e3208a4abac
SHA2560cede6e1c50f3087b3e3f1ef50501879dc8f1e84cd1d860bd2f440f459c9341b
SHA512bd6f7fd80fe12dc7c00863f319b30a72199ad7633bae9ea48a14429df0b10f18ae0fb840727f9871e56687dfa36473e1d4a5319e35e44c78a54f5bf6321641d9
-
C:\Users\Admin\Desktop\DenyResolve.mpegFilesize
289KB
MD5d58d20a2e264dd8494734b8a3a9820df
SHA15f63b407a4f55960719d91d594825f7c25fcccfb
SHA256a35a119dd5aa7eba6d4f69b52ae8708190bdb8a6f31ec67ad0c793d848b78a8b
SHA512d4e7d21f66b88c9203c39fc92fe6c343886cb3df0fc538a1bbe4e4ece87d9a6f3c67f427930497dac7e9c9ed2700b8c0d7279eea14c808091e964abbd677848e
-
C:\Users\Admin\Desktop\EditOptimize.isoFilesize
219KB
MD5372ddea3d7ff2dc18254548474ff11ec
SHA177513cc257935eab31a9a8fbf69506bfdac25059
SHA256326c90f19957bdb367fbc1bc9ec8ce4d63ce9b504bf00865d362863cfe05ad16
SHA51201a5aa60482d45287cafbcba0d6c843c9f163580b330e62f134026c49e8560a80ffae2dda3f16f1597b54b4d600b63e439ed9d71d3e3bbecc5577540ed2aa032
-
C:\Users\Admin\Desktop\ExitRename.lockFilesize
282KB
MD51ee289acb67a4416c6ddf81a6720c8b5
SHA1e18cd94e84caadcc2214ff91b69295452556cded
SHA2562fb281d1827a1b5b2d2db8df45e9a01299e2e769b3fd29940b8d98f144658b22
SHA51274f63d6ce0d395c34b8f2949e020718c8bac08ee370798bf899d055b96a894379ef008476e56dbb1660b34c2eecd12658161372130041d8a584b03b2198c261b
-
C:\Users\Admin\Desktop\FindProtect.jtxFilesize
250KB
MD5b2cc099a67e1f2a78428c8efebfc9526
SHA1c4557c0a0679abd433488babf3f5758c52a9e68e
SHA256884f81f350ff9765175c598651fd6e02db70d2bb3afdbd3f4c1d61a866f88076
SHA512c3a3c50403ce67c1f7b26f5cc25b7490a000c7382d44b6a1a38123c357b2be52c1d0f66a03d592b234b8ad045a3b3870619a4a75d1baa57f011dd3195a416dbe
-
C:\Users\Admin\Desktop\GroupSuspend.odtFilesize
313KB
MD56afce5662d7a7c1a9b7e7efdbcb512da
SHA1333380f8c996a590a3b13e93d0db750f378c0468
SHA2563324c793572873aba3f4430864b857d522c0b888006e9ab2b92b142c78c3277a
SHA512246e16ab70886653863c5772014cf3efbdace2b91c54af772c4fbdca9577b99c888e4ab4c83181b8f9424a11984b466aeae9ed2485b13b2735aa5b19c750c1dc
-
C:\Users\Admin\Desktop\InitializeDisable.ADTSFilesize
305KB
MD52dc774c61641106fcc033be1bce3773b
SHA163ad80eaff79bc383351332fc23361c0a02fc9a7
SHA2562cf927099cd9d83754d0cc772a4c5459c83aeb0bf1e3c39d9369e47df6d406a6
SHA512ff76cacd3518dc09533b96f0723ba29e02bbebe186e1f81777315b7dd49002258fec58115cac432f8223961ec1304c84481466a63578e4a25c78ba6c7bdc408e
-
C:\Users\Admin\Desktop\MeasureCompress.midiFilesize
430KB
MD5427b57575fce72e3fa3d5ef6d98f7454
SHA10b66f24a6a8ca93ac9eed37cd18b163af7eec77b
SHA256d6e2aea9fe744b0c207b62cb44c02c48d628d32bbe13ff6c07bf5b8936e879b3
SHA5126ac4b5c83646f8237440d70973fb7338fdd42d5c1f0db50b0478f3e080c48adc2ab69ffb3e6e9a66a240d48a984b6a73434db214f0adb711bfadfe6b25e5ee56
-
C:\Users\Admin\Desktop\PopResolve.lockFilesize
258KB
MD5613e99614e20678b7b17ae2c2d0cb4f1
SHA172abdd769410f8e1a0dc863b0087a0182c3574e5
SHA256ab5025a3c3a2d31e9d592ded629d8b153a316321b2fbec48af5f164e3ecc91de
SHA512d026e1e2fd0f4b076115e0a3156add3a7baf2e62ecc55a96469439bb9851dba1b24878f9bc6219399e2493b6177923d2bd423c12b2c46f1a20fc5ea1beb9a47e
-
C:\Users\Admin\Desktop\ReadAdd.mhtmlFilesize
125KB
MD5bf1b1442292aea723fda91c5a917fe17
SHA1bea8f362f2c07e5c7cba668e258fee8b26432bc3
SHA2563ffa6299702fd66717211861301e559814d0c6e7dfd78c00a0d0d9773e43c8de
SHA5126ee255074a841bd096c54702b11b1f86548d8f08ab7ba5733b77ee87d2778ec1b4f7df72f7f33c16ae756f665b5f5b16435d5ac4a0c8b61ced6507ea0ac14c69
-
C:\Users\Admin\Desktop\ReceiveFind.phpFilesize
148KB
MD5f28203faca25301c9223d8711020965a
SHA14ee5d07bf69d3c97fe322a13ff81fd906b61f863
SHA25684fd86e0921d5c5bd72a65c3a4f60f460be56d592bf3470eabc00523d3c12cbb
SHA512cedebbbfb48a3e211ad87a8d8cd15a45cad1bd3a27c9a56c8043457e428f52979c337eb3d86b840910f06aa7a6cbeaf2625d4b5067e0146c4ec9871b65616f0d
-
C:\Users\Admin\Desktop\RegisterExpand.wmfFilesize
141KB
MD5f6cf7fd841bf6621c6e9bd00b100ffa7
SHA1f679a351ba6d30e8012f8ecbedeab240b5e5879b
SHA256c87af215f0424e57aba3e3f2359c9f3790815f11ac5951d942297cb10f8e3c73
SHA5122413114e48cb21619e8873248a8c25d15cbe3d0682db3484d600d0508ee38b28d6a16840f0bc00783c7260a6e1b8c36dd724cd8e07b88a2c21677d75441d1a8e
-
C:\Users\Admin\Desktop\RepairJoin.xltxFilesize
235KB
MD512cd234116a0da389167bde96d9355f9
SHA1c8c64f5ea3ebdce4a5b1f477c68c3c3b24ce42da
SHA25678f0673c01571e55dad1c203fbb5ef6b6a75daf63bf9235d01101c3fad25abf6
SHA512165e593d50230bc0d558ea8aad721782ed9a0d22c5ad142a2bc4d38639ab61ce05bfb5344b8e61b8ee79a06d197e31a9ec6dc7ca7aae691d94bf7a833604e9a5
-
C:\Users\Admin\Desktop\RequestUndo.pptFilesize
117KB
MD564a633378dc530c39198e904cec53028
SHA1e6c35aea1c9b762e64f1221600d22e4d5115424d
SHA256c5c979f26e3a53d11b7c7ea3a511bc7766eccf6059436fc63a4020ed8fd1c541
SHA512a288858e6b894d89aba7a15e4b801197f7a155f40c27c2b4a3e0d3387873094a4fe58b4ce1a65e1ebb112d30ff45504a7ce554c7cb805d2bbcba3de57f117804
-
C:\Users\Admin\Desktop\ResetCopy.dibFilesize
133KB
MD5c21f81105e8feaca2e366f36b7a1aa87
SHA16b2eb308a2750cad5f889134ce7d3be9987349c7
SHA256b1200618b2d72f9497121b1919dcafeabcafc5027aa2e33b657bfa46d1730034
SHA51202607dfc5cbc6310625b7dd5c89375ad64fc3a69b074247a728557f815bfb225bee853dd1189d7c604d940704092c79ac5b9bfa00865d33dc2dbf7e018fcb5de
-
C:\Users\Admin\Desktop\ResolveImport.potmFilesize
211KB
MD58bab65836889c6dddbe0521365dcee1a
SHA1dcf10004570017bbcfb56376e718f6e73eb13b4e
SHA2566f87cc5e76272800fae4f4666c004bf40e4cafaeece8f92111ee31667e527a23
SHA51239b8c31abaf8162e43e1bd9ff2b82901450ab253a0323ade2a5d745d471bf4beb0d2a83a8f729ff0bb417297703d5a58a9391bd4a12c3ca450ee86166066ba6b
-
C:\Users\Admin\Desktop\RevokeGrant.MODFilesize
164KB
MD53764a8366638b276b73ff7cdecc48730
SHA13cde34a0ab287b14ca3d6aa3472230d70415c095
SHA256aa6e1997dfb5d38cb3b3db2468a5fd0b0201f9ede55f50a83b996c4e8f7af3a5
SHA5128d205b0686bdf7617c1b2d657821706d06e0d69c8845be1784d5749ec624f75ccfa83a3486678d6075cd71ef2ace1632547d4a13d89234714798960994ccb99a
-
C:\Users\Admin\Desktop\RevokeInstall.txtFilesize
172KB
MD5af3d8da8fa4f944ba17bf7c75919930f
SHA10f3048a5698a3cb40e41855c0ea57f8d6c21d73d
SHA25643f6504dc8e1b8a23d83270c8f2ee45bc40dd1742708ae36643568faa716d2a7
SHA512edaebdd82c2f050158714f7d46d58309e254e262c2d13a2fc758c37b7cdc6105c12eb8bdeb6baff067f68dc529a18cb87ad2f70cadcd13be2149a167ef80f098
-
C:\Users\Admin\Desktop\SyncSend.aspFilesize
274KB
MD5da9c91fdec011a31aa83a6b8788f5af7
SHA13ae18751d50869412a3ea6c8d9a1d3abf153683c
SHA256502235f18da7508c3b60cabb66cbcf9ab9494d1ef1741c7ef8455ebfeb213f5f
SHA51259313ea582f9872fdd88a54bc471bcbdad35690718f4776bcd288cbc0a3f36f8981edda763eeafcc011571f5e881c1bf9b495926055dc240156539a37e29ce49
-
C:\Users\Admin\Desktop\UninstallWatch.jpgFilesize
266KB
MD5ff3fe166c489417b7a5ac4331753f2f9
SHA1e1ddc9c6fa84363acbbdc7a5f6e6a45ba6fad2a1
SHA2565794442ffd8f1d460b6d91a392d4fedc71b9e54df0b20b65bf85994b5ba6145f
SHA51218414fea1502ac74ef2d0b3a8c93cc3ee5e31671a73c54e7374315166b3893dc83c54178e731032702e947cd525f0d09d783df9025048e186534a19dcb10701d
-
C:\Users\Admin\Desktop\UnprotectClear.oggFilesize
227KB
MD501df5b47985e10e06039a6fa64f68669
SHA19e4959220948c69e3770f27f931f6c759a5060f8
SHA256d4203507ba656e7708d5b9ecb7cc35056fa51a3c839eacf427e6503c76d228d2
SHA5126605333e4115d7c116fcf16c7b19f12a34add01d22fe953d4528267caec24758f75b0f1107e78ffaaa50991090f320d38dfb0b841e49800d99fd84cc22fa9fec
-
C:\Users\Admin\Desktop\WatchHide.vdwFilesize
242KB
MD5e15318d0f5f355d74ac76aae7df43e6b
SHA15eb0618fddea0ee9226be245076cb09fa2290092
SHA256172e92a157a9b4dd2b328300ecc357585ec4a2e49c924506d97d8ae880bcfe52
SHA512dcb4ea623c22e9e8ad27064773cfcb0d85e686c7d384a9766159abdec851d0f1924babeb70e07d90c66e0cb3ba9b8e023ebbdc60bf99337dba0b20b02e580a20
-
C:\Users\Admin\Desktop\WriteDisconnect.wmaFilesize
156KB
MD5cbee7e27df5eb724567e2861c508db23
SHA12ad865b39302245fb7e2ad2955f86e308f66335b
SHA256feb726e0c89e28a6e9adf251b18436bfd9fe306c7f5b6825fa335f2fcb3b2421
SHA5126958206530bb658dc14df1fe9070786ecd5586a8274c1e4a30a4e2aa66d20832a62173fa3df0395ae1928c3850d8f07eeb9b7db4301666fc2eea4e82d8e5506e
-
\??\pipe\LOCAL\crashpad_4076_XQETNUOVHEOMFBXHMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/432-260-0x00000255A22A0000-0x00000255A22CA000-memory.dmpFilesize
168KB
-
memory/432-262-0x00007FFA5E9B0000-0x00007FFA5E9C0000-memory.dmpFilesize
64KB
-
memory/468-5-0x00007FFA7DA30000-0x00007FFA7E4F2000-memory.dmpFilesize
10.8MB
-
memory/468-244-0x00007FFA9CFB0000-0x00007FFA9D06D000-memory.dmpFilesize
756KB
-
memory/468-242-0x000001F433AA0000-0x000001F433ADE000-memory.dmpFilesize
248KB
-
memory/468-241-0x000001F432BE0000-0x000001F432BFE000-memory.dmpFilesize
120KB
-
memory/468-240-0x000001F41A1F0000-0x000001F41A202000-memory.dmpFilesize
72KB
-
memory/468-239-0x000001F433A20000-0x000001F433A96000-memory.dmpFilesize
472KB
-
memory/468-616-0x00007FFA7DA30000-0x00007FFA7E4F2000-memory.dmpFilesize
10.8MB
-
memory/468-1-0x00007FFA7DA33000-0x00007FFA7DA35000-memory.dmpFilesize
8KB
-
memory/468-2-0x000001F432C00000-0x000001F432DC2000-memory.dmpFilesize
1.8MB
-
memory/468-243-0x00007FFA9E920000-0x00007FFA9EB29000-memory.dmpFilesize
2.0MB
-
memory/468-3-0x00007FFA7DA30000-0x00007FFA7E4F2000-memory.dmpFilesize
10.8MB
-
memory/468-0-0x000001F418480000-0x000001F418498000-memory.dmpFilesize
96KB
-
memory/468-4-0x000001F433ED0000-0x000001F4343F8000-memory.dmpFilesize
5.2MB
-
memory/536-269-0x00007FFA5E9B0000-0x00007FFA5E9C0000-memory.dmpFilesize
64KB
-
memory/536-268-0x0000022A47330000-0x0000022A4735A000-memory.dmpFilesize
168KB
-
memory/612-272-0x000002384FB70000-0x000002384FB9A000-memory.dmpFilesize
168KB
-
memory/612-273-0x00007FFA5E9B0000-0x00007FFA5E9C0000-memory.dmpFilesize
64KB
-
memory/636-251-0x000001AE3B8B0000-0x000001AE3B8D3000-memory.dmpFilesize
140KB
-
memory/636-258-0x000001AE3B8E0000-0x000001AE3B90A000-memory.dmpFilesize
168KB
-
memory/636-259-0x00007FFA5E9B0000-0x00007FFA5E9C0000-memory.dmpFilesize
64KB
-
memory/688-253-0x000002C58E990000-0x000002C58E9BA000-memory.dmpFilesize
168KB
-
memory/688-255-0x00007FFA5E9B0000-0x00007FFA5E9C0000-memory.dmpFilesize
64KB
-
memory/1000-265-0x00007FFA5E9B0000-0x00007FFA5E9C0000-memory.dmpFilesize
64KB
-
memory/1000-264-0x0000023D334E0000-0x0000023D3350A000-memory.dmpFilesize
168KB
-
memory/1040-279-0x00000232335D0000-0x00000232335FA000-memory.dmpFilesize
168KB
-
memory/1040-280-0x00007FFA5E9B0000-0x00007FFA5E9C0000-memory.dmpFilesize
64KB
-
memory/1048-282-0x0000029C51E90000-0x0000029C51EBA000-memory.dmpFilesize
168KB
-
memory/1048-283-0x00007FFA5E9B0000-0x00007FFA5E9C0000-memory.dmpFilesize
64KB
-
memory/1140-286-0x00007FFA5E9B0000-0x00007FFA5E9C0000-memory.dmpFilesize
64KB
-
memory/1140-285-0x0000024AC39C0000-0x0000024AC39EA000-memory.dmpFilesize
168KB
-
memory/1204-288-0x0000026B26CE0000-0x0000026B26D0A000-memory.dmpFilesize
168KB
-
memory/1204-289-0x00007FFA5E9B0000-0x00007FFA5E9C0000-memory.dmpFilesize
64KB
-
memory/1248-293-0x00000243124A0000-0x00000243124CA000-memory.dmpFilesize
168KB
-
memory/1248-294-0x00007FFA5E9B0000-0x00007FFA5E9C0000-memory.dmpFilesize
64KB
-
memory/1284-296-0x000002171EFA0000-0x000002171EFCA000-memory.dmpFilesize
168KB
-
memory/1284-297-0x00007FFA5E9B0000-0x00007FFA5E9C0000-memory.dmpFilesize
64KB
-
memory/4860-247-0x00007FFA9E920000-0x00007FFA9EB29000-memory.dmpFilesize
2.0MB
-
memory/4860-248-0x00007FFA9CFB0000-0x00007FFA9D06D000-memory.dmpFilesize
756KB
-
memory/4860-245-0x0000000140000000-0x0000000140040000-memory.dmpFilesize
256KB
-
memory/4860-246-0x0000000140000000-0x0000000140040000-memory.dmpFilesize
256KB
-
memory/4860-249-0x0000000140000000-0x0000000140040000-memory.dmpFilesize
256KB
-
memory/4876-492-0x00000261EC370000-0x00000261EC392000-memory.dmpFilesize
136KB
