Overview

overview

8

Static

static

1

Purge_WB.bat

windows11-21h2-x64

8

Analysis

  • max time kernel
    70s
  • max time network
    93s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240802-en
  • resource tags

    arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    05-08-2024 23:48

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Purge_WB.bat

  • Size

    5KB

  • MD5

    895acbc5a11a2878f9f1be4d6fbde662

  • SHA1

    41d41071a821dc4b1ada2941955e561bae8d27b4

  • SHA256

    0da884ddad29cf36f90783a57b2587a8178b3a0f4ea2249f9b14b83e5ba62df9

  • SHA512

    3ec78748bd628b55b82d57282f4261dba52b8dbb7ea15d2b281346bef967154c0d05c0854289acb0c900f47007b8f39f6934d59b4bf6b0b73f7a333505c63dd6

  • SSDEEP

    96:GeI8huOXdzgWE9BrY7Tof33UHL7ZDgCOw/OW8z7J124JJYiAnrT8EMJ124J1:GeIuFi/iTof33UHBgWu7KekTLMKe1

Score
8/10
discoverypersistence

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Enumerates connected drives 3 TTPs 4 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Drops file in Windows directory 4 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 7 IoCs
  • Kills process with taskkill 2 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 10 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 64 IoCs
  • NTFS ADS 2 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 9 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Purge_WB.bat"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:880
    • C:\Windows\system32\cacls.exe
      "C:\Windows\system32\cacls.exe" "C:\Windows\system32\config\system"
      2⤵
        PID:4512
      • C:\Windows\system32\taskkill.exe
        taskkill /f /im explorer.exe
        2⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:4248
      • C:\Windows\system32\reg.exe
        reg query HKEY_CLASSES_ROOT\WbaFile
        2⤵
          PID:4832
        • C:\Windows\system32\reg.exe
          reg query HKEY_LOCAL_MACHINE\Software\Stardock\ObjectDesktop\WindowBlinds
          2⤵
            PID:2828
          • C:\Windows\system32\reg.exe
            reg query HKEY_CURRENT_USER\Software\Stardock\WindowBlinds
            2⤵
              PID:3108
            • C:\Windows\system32\reg.exe
              reg query HKEY_LOCAL_MACHINE\Software\Stardock\ObjectDesktop\WindowBlinds
              2⤵
                PID:2268
              • C:\Windows\system32\reg.exe
                reg query HKEY_LOCAL_MACHINE\Software\Stardock\WindowBlinds
                2⤵
                  PID:3076
                • C:\Windows\system32\reg.exe
                  reg query HKEY_LOCAL_MACHINE\Software\Wow6432Node\Stardock\WindowBlinds
                  2⤵
                    PID:960
                  • C:\Windows\system32\reg.exe
                    reg query HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\WindowBlinds
                    2⤵
                      PID:224
                    • C:\Windows\explorer.exe
                      explorer.exe
                      2⤵
                      • Boot or Logon Autostart Execution: Active Setup
                      • Enumerates connected drives
                      • Checks SCSI registry key(s)
                      • Modifies Internet Explorer settings
                      • Modifies registry class
                      • NTFS ADS
                      • Suspicious behavior: AddClipboardFormatListener
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious behavior: GetForegroundWindowSpam
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of FindShellTrayWindow
                      • Suspicious use of SendNotifyMessage
                      • Suspicious use of SetWindowsHookEx
                      • Suspicious use of WriteProcessMemory
                      PID:236
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe"
                        3⤵
                        • Drops file in Windows directory
                        • Enumerates system info in registry
                        • Modifies data under HKEY_USERS
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of FindShellTrayWindow
                        • Suspicious use of WriteProcessMemory
                        PID:2292
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd39dccc40,0x7ffd39dccc4c,0x7ffd39dccc58
                          4⤵
                            PID:1604
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1948,i,15629507842644884609,90418342852217471,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=1944 /prefetch:2
                            4⤵
                              PID:3848
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1712,i,15629507842644884609,90418342852217471,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=2072 /prefetch:3
                              4⤵
                                PID:4188
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2240,i,15629507842644884609,90418342852217471,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=2252 /prefetch:8
                                4⤵
                                  PID:4212
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3080,i,15629507842644884609,90418342852217471,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=3100 /prefetch:1
                                  4⤵
                                    PID:4184
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3108,i,15629507842644884609,90418342852217471,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=3140 /prefetch:1
                                    4⤵
                                      PID:5052
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4456,i,15629507842644884609,90418342852217471,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=4460 /prefetch:1
                                      4⤵
                                        PID:1772
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4768,i,15629507842644884609,90418342852217471,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=4776 /prefetch:8
                                        4⤵
                                          PID:3820
                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4784,i,15629507842644884609,90418342852217471,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=4800 /prefetch:8
                                          4⤵
                                            PID:4056
                                          • C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe
                                            "C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe" --reenable-autoupdates --system-level
                                            4⤵
                                            • Drops file in Windows directory
                                            PID:3416
                                            • C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe
                                              "C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x244,0x248,0x24c,0x220,0x250,0x7ff744f04698,0x7ff744f046a4,0x7ff744f046b0
                                              5⤵
                                              • Drops file in Windows directory
                                              PID:2996
                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=5100,i,15629507842644884609,90418342852217471,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=5108 /prefetch:1
                                            4⤵
                                              PID:1616
                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=3376,i,15629507842644884609,90418342852217471,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=3356 /prefetch:8
                                              4⤵
                                                PID:3260
                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=3372,i,15629507842644884609,90418342852217471,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=4796 /prefetch:1
                                                4⤵
                                                  PID:2284
                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=3208,i,15629507842644884609,90418342852217471,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=212 /prefetch:8
                                                  4⤵
                                                    PID:1592
                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=3196,i,15629507842644884609,90418342852217471,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=3224 /prefetch:8
                                                    4⤵
                                                      PID:3900
                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=3176,i,15629507842644884609,90418342852217471,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=3188 /prefetch:1
                                                      4⤵
                                                        PID:4904
                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=3156,i,15629507842644884609,90418342852217471,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=5172 /prefetch:1
                                                        4⤵
                                                          PID:1484
                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=5180,i,15629507842644884609,90418342852217471,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=212 /prefetch:1
                                                          4⤵
                                                            PID:3004
                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=3288,i,15629507842644884609,90418342852217471,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=5128 /prefetch:1
                                                            4⤵
                                                              PID:4948
                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --field-trial-handle=3092,i,15629507842644884609,90418342852217471,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=5036 /prefetch:1
                                                              4⤵
                                                                PID:1588
                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --field-trial-handle=5820,i,15629507842644884609,90418342852217471,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=5776 /prefetch:1
                                                                4⤵
                                                                  PID:5876
                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --field-trial-handle=5768,i,15629507842644884609,90418342852217471,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=5780 /prefetch:1
                                                                  4⤵
                                                                    PID:5204
                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5744,i,15629507842644884609,90418342852217471,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=5808 /prefetch:8
                                                                    4⤵
                                                                    • NTFS ADS
                                                                    PID:5280
                                                                • C:\Windows\system32\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Temp1_Purge_WB.zip\Purge_WB.bat" "
                                                                  3⤵
                                                                    PID:5660
                                                                    • C:\Windows\system32\cacls.exe
                                                                      "C:\Windows\system32\cacls.exe" "C:\Windows\system32\config\system"
                                                                      4⤵
                                                                        PID:5696
                                                                      • C:\Windows\system32\taskkill.exe
                                                                        taskkill /f /im explorer.exe
                                                                        4⤵
                                                                        • Kills process with taskkill
                                                                        PID:5720
                                                                      • C:\Windows\system32\reg.exe
                                                                        reg query HKEY_CLASSES_ROOT\WbaFile
                                                                        4⤵
                                                                          PID:5760
                                                                        • C:\Windows\system32\reg.exe
                                                                          reg query HKEY_LOCAL_MACHINE\Software\Stardock\ObjectDesktop\WindowBlinds
                                                                          4⤵
                                                                            PID:5824
                                                                          • C:\Windows\system32\reg.exe
                                                                            reg query HKEY_CURRENT_USER\Software\Stardock\WindowBlinds
                                                                            4⤵
                                                                              PID:5840
                                                                            • C:\Windows\system32\reg.exe
                                                                              reg query HKEY_LOCAL_MACHINE\Software\Stardock\ObjectDesktop\WindowBlinds
                                                                              4⤵
                                                                                PID:5864
                                                                              • C:\Windows\system32\reg.exe
                                                                                reg query HKEY_LOCAL_MACHINE\Software\Stardock\WindowBlinds
                                                                                4⤵
                                                                                  PID:5816
                                                                                • C:\Windows\system32\reg.exe
                                                                                  reg query HKEY_LOCAL_MACHINE\Software\Wow6432Node\Stardock\WindowBlinds
                                                                                  4⤵
                                                                                    PID:5896
                                                                                  • C:\Windows\system32\reg.exe
                                                                                    reg query HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\WindowBlinds
                                                                                    4⤵
                                                                                      PID:6084
                                                                                    • C:\Windows\explorer.exe
                                                                                      explorer.exe
                                                                                      4⤵
                                                                                      • Boot or Logon Autostart Execution: Active Setup
                                                                                      • Enumerates connected drives
                                                                                      • Checks SCSI registry key(s)
                                                                                      • Modifies registry class
                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                      PID:5912
                                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                1⤵
                                                                                • Modifies registry class
                                                                                • Suspicious use of SetWindowsHookEx
                                                                                PID:3992
                                                                              • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                                                                                "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                                                                                1⤵
                                                                                • Enumerates system info in registry
                                                                                • Modifies Internet Explorer settings
                                                                                • Modifies registry class
                                                                                • Suspicious use of SetWindowsHookEx
                                                                                PID:2788
                                                                              • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
                                                                                "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
                                                                                1⤵
                                                                                  PID:2204
                                                                                • C:\Windows\system32\svchost.exe
                                                                                  C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                                                                  1⤵
                                                                                    PID:1324
                                                                                  • C:\Windows\System32\rundll32.exe
                                                                                    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                                                    1⤵
                                                                                      PID:5340
                                                                                    • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                                                                                      "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                                                                                      1⤵
                                                                                      • Enumerates system info in registry
                                                                                      • Modifies Internet Explorer settings
                                                                                      • Modifies registry class
                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                      PID:5260
                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                      1⤵
                                                                                      • Modifies registry class
                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                      PID:6136

                                                                                    Network

                                                                                    MITRE ATT&CK Enterprise v15

                                                                                    Replay Monitor

                                                                                    Loading Replay Monitor...

                                                                                    Downloads

                                                                                    • C:\Program Files\Google\Chrome\Application\SetupMetrics\20240805234938.pma
                                                                                      Filesize

                                                                                      520B

                                                                                      MD5

                                                                                      d7bdecbddac6262e516e22a4d6f24f0b

                                                                                      SHA1

                                                                                      1a633ee43641fa78fbe959d13fa18654fd4a90be

                                                                                      SHA256

                                                                                      db3be7c6d81b2387c39b32d15c096173022cccee1015571dd3e09f2a69b508a9

                                                                                      SHA512

                                                                                      1e72db18de776fe264db3052ce9a842c9766a720a9119fc6605f795c36d4c7bf8f77680c5564f36e591368ccd354104a7412f267c4157f04c4926bce51aeeaa1

                                                                                      Download Submit

                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnCache\data_1
                                                                                      Filesize

                                                                                      264KB

                                                                                      MD5

                                                                                      ef3e8d9a40e77376e9b0d374609ee271

                                                                                      SHA1

                                                                                      e65c15e26af50e35d3863be3ac9fbcc0a14eb1ca

                                                                                      SHA256

                                                                                      c94ce647a66d7cf1afa94e0df31e5af1f8200f6cdd2a69ff983f42551764e616

                                                                                      SHA512

                                                                                      de4612520714182fdc1132626fae1f738c971c7c0ac2e74a26dafe2eab02c47b98f74b2825b4f27cccc40a334c4d7b605152e8a2cc97d94103111ba2b5283968

                                                                                      Download Submit

                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                                      Filesize

                                                                                      6KB

                                                                                      MD5

                                                                                      15e818d6fb6fa34107003ebefc666b4a

                                                                                      SHA1

                                                                                      812b786731f4a81168208c68ed45a929a91e3a4c

                                                                                      SHA256

                                                                                      a5b37b7d0b78f5c0df0be4da0bc6c1a5d90bc5699797081b3c6738097a5f6ca2

                                                                                      SHA512

                                                                                      55bf2d8efed4849b2534c05de1ee962116a9ea0d0f789860fc23f95ab71822426a37d45dfc315146d448b087734b298470a9aa781365cc6df8afe58dba3b3206

                                                                                      Download Submit

                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
                                                                                      Filesize

                                                                                      2B

                                                                                      MD5

                                                                                      d751713988987e9331980363e24189ce

                                                                                      SHA1

                                                                                      97d170e1550eee4afc0af065b78cda302a97674c

                                                                                      SHA256

                                                                                      4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                                                                                      SHA512

                                                                                      b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                                                                                      Download Submit

                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                                                                      Filesize

                                                                                      692B

                                                                                      MD5

                                                                                      c6fd062c10309c1f33adf0008ec89b08

                                                                                      SHA1

                                                                                      ac8e24a1780a73033b93c52702b05437888ec6ba

                                                                                      SHA256

                                                                                      d998fda1ce0d1bb8bc3373f63d71261ea26531afdf1d8f5fa678b88c3d57bfa6

                                                                                      SHA512

                                                                                      25a505f977a8470723103396b91eb4f61762c550f1b92cc19b762832799571d1a7b95b13a1302e95edf3049a1aefe5138801bae16e5f200e5157ebd36fd404b8

                                                                                      Download Submit

                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                                                                      Filesize

                                                                                      2KB

                                                                                      MD5

                                                                                      39567d6bef87030e8db0e24ed234d90c

                                                                                      SHA1

                                                                                      44863178ce4a45d726581b6bd2514c1655cc770b

                                                                                      SHA256

                                                                                      167765fe10e5679e741eb624d1aa33a09bd5e639e348964848bb7ebe2f1b700a

                                                                                      SHA512

                                                                                      16c0a27274ec888f3d96d8d4daaaa05bc12e77bb6a0fc5edc3363ae11ada9aacbb47f5f65eb566df0c08f272f1aacb4f7382edc14b4efb69b24a10170d366ff6

                                                                                      Download Submit

                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                                                                      Filesize

                                                                                      1KB

                                                                                      MD5

                                                                                      1b332ab8e49cf6dd01757c798f50f53b

                                                                                      SHA1

                                                                                      ac5ba14140e4667b363e025ebf9f84de9a8ab488

                                                                                      SHA256

                                                                                      95d5ac35acb61f09f00dcfc680ad8a0ca2581616d954d87b3f624472eba8b97b

                                                                                      SHA512

                                                                                      5bfee669d1387f2d97c30d5f496f0293a60eead00d6e5866623cd0f4f11039a0d332ba8a290b7710b0b3aed17640bdde3dbf32d914a293ba382bbf3820e55f7c

                                                                                      Download Submit

                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                                                                      Filesize

                                                                                      2KB

                                                                                      MD5

                                                                                      afc15546b52ddabcbdc461297bbf0ba2

                                                                                      SHA1

                                                                                      300319fa0419b02ed310922b6d750684cb3d3e53

                                                                                      SHA256

                                                                                      ce0fd00c34ac0245c37455433394875df128eb858cff5348da2aff99f1f1f5c8

                                                                                      SHA512

                                                                                      f4c1e4329e0c22106b829d00325bf27eb19b4bb2721d0ceecc0d869c70f5df2867e2f0b63b622e91d7faa0ce9e15084e0af28a57e5eb61dbcf16e3b752543b47

                                                                                      Download Submit

                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                                                                      Filesize

                                                                                      2KB

                                                                                      MD5

                                                                                      93ff36d33834e8bb0cbb66fa2eb8aa63

                                                                                      SHA1

                                                                                      6381be01a0a487a249e08a9af8c4ba788e2541a5

                                                                                      SHA256

                                                                                      0f28785fcef041cb089db16443b149edf5b0142d8f271d25aafd3eb2a18c4568

                                                                                      SHA512

                                                                                      07dc6a867fda45e0eb5ca834a6d2a8d97f715157fd8468971b5dd950192f637875eabd31cbcee523a4a09596b63c3aff8befcb230f7b4e9a1147fc7bb4af2b36

                                                                                      Download Submit

                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                      Filesize

                                                                                      8KB

                                                                                      MD5

                                                                                      1ea547467c2b8a1ee436eb75211c7879

                                                                                      SHA1

                                                                                      39672312cc90d5f5314b7b0f7e29b1d328cd7698

                                                                                      SHA256

                                                                                      ebc5861754faefc6bf1938c60bef7262294e2df605c66603790af7a7128d7595

                                                                                      SHA512

                                                                                      e800511c8282b64b460f6e1abf08b00d742e0f80dabaa5d15561c3f82ee7a5653fef68a4d4e960f34cdcf604ef2b3e4bc7667b9b5950701167746792d5e3ed61

                                                                                      Download Submit

                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                      Filesize

                                                                                      9KB

                                                                                      MD5

                                                                                      a57d1ce6417f359c96eaa589084404b5

                                                                                      SHA1

                                                                                      aaa8291f403af7dc63bfb64232f71891f226e3e5

                                                                                      SHA256

                                                                                      58f1a8d3da1ffc329526e84b25d1722c4f6f0815055b0ed0ef6ce4f5cb6ad809

                                                                                      SHA512

                                                                                      49c50ad58be7b38c1640b5a074dc665ee33e911ceedadb89a96f020c4e0510f515d1bdebf492105a522aa9d64f5d9d417d2850910dcf26b1470eb4b0902fc605

                                                                                      Download Submit

                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                      Filesize

                                                                                      9KB

                                                                                      MD5

                                                                                      25c4f571307f7f9b94b05a22624cc490

                                                                                      SHA1

                                                                                      d596a06f5f44829aed27543148754e62ea0e6c8d

                                                                                      SHA256

                                                                                      81ce115384ab3ebd2ee1620b6adb4e6b0839b661ae651d400886c7121f509f21

                                                                                      SHA512

                                                                                      d6adda9e311ee01ad29441aa022a604a49ded69c621ebd0e4a1a1d84ca69ad679722a73a17410492c6eb7443c03f463c5026e6afa70a6e56a9e6d240bf16c33c

                                                                                      Download Submit

                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                      Filesize

                                                                                      9KB

                                                                                      MD5

                                                                                      88727201b7ae6e00608146ae70736e35

                                                                                      SHA1

                                                                                      d9a20df2bb8305aab019a9ede1184ab7985c4b69

                                                                                      SHA256

                                                                                      11047ee02aad84a326ed63b474fbd7c00e745ea7eeb876af85bc55c7a2a6521d

                                                                                      SHA512

                                                                                      9c1bba3829e9dbe55db4ccd62b87a897a23053b58cc63c715bf7fbe61d07a1001b28eb3c963b816295e96ac559137d99bd0c679f85f9fd42c4169811a42ba37b

                                                                                      Download Submit

                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                      Filesize

                                                                                      9KB

                                                                                      MD5

                                                                                      f5fa6c1e4997c0772706d36fbe892536

                                                                                      SHA1

                                                                                      b6515e826a1689fa1b908cd4e58a18501fe353b5

                                                                                      SHA256

                                                                                      8670d9bcd610315d628a921a1e2958985a73a137ed20e39f8c9d9cbd9c397b27

                                                                                      SHA512

                                                                                      a1b711620bcdfd066c797aaa9a709ce861138fa8c21580387aa8d3f89059e564a6c1589a27f8f7043c8b9046c7b5aa210c6411ff73087d8d6942b6779c0cbd41

                                                                                      Download Submit

                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                      Filesize

                                                                                      8KB

                                                                                      MD5

                                                                                      33cf6e0ce6c6e90c71d4326cdc290bed

                                                                                      SHA1

                                                                                      770544e17fbff129b1a3892a494137cfd6f210cf

                                                                                      SHA256

                                                                                      7381b6adddef798b9b2b00efa049ac18b7cb6b53b4f43e875adaa8b275f83be3

                                                                                      SHA512

                                                                                      a268d750185c498c3cf9ae7bff52fe25a80c4fa3d90c3b043ccc1aa3ee3ee9d4bcff2cb915f113c116bfc67d90764f75cf5c3a17f432b82b232fcda9f129c439

                                                                                      Download Submit

                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
                                                                                      Filesize

                                                                                      15KB

                                                                                      MD5

                                                                                      d4c6cc257528f7cbeb7127755a6feb22

                                                                                      SHA1

                                                                                      4c1af569f99467fe254561511799eb989568ffcc

                                                                                      SHA256

                                                                                      eccf053bac044c17038b9e101841f63455e6d375d027fb773817179f0750e1b3

                                                                                      SHA512

                                                                                      ea9c120aec5e0d5d7c06a43c216ae51fe4786394f9c78e1f7a1593802c1574d7cff30ede0602cead734b19fa52af3910f7384e45170dca9d6afff97df44ad905

                                                                                      Download Submit

                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                      Filesize

                                                                                      197KB

                                                                                      MD5

                                                                                      a154caca2c6847aa3fad7fe9a50f9ca6

                                                                                      SHA1

                                                                                      e541f4e835589e17d9163b56f553b0e4e7e0fcb8

                                                                                      SHA256

                                                                                      c97908a43cbbe86d7be5e8665dfa5d9a9b06ff72876bebe46242e6d29f1cd00e

                                                                                      SHA512

                                                                                      821fbc15ccc4dc4a570f43b94a5fd83f6479c598d0fbb1e187dfb1253d314f203abe20f4ceacc12b76f1f0ccd40136c8736cb77ba7801c0886eb7b3ac70ded0d

                                                                                      Download Submit

                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                      Filesize

                                                                                      197KB

                                                                                      MD5

                                                                                      869c6b96622304e70905b3857e908e23

                                                                                      SHA1

                                                                                      1fe749319e9fe81ff41f2f0efd06131f2ee89718

                                                                                      SHA256

                                                                                      7aee60056fda86bf0860e519011ff7d52b1d31ab7f76be776fa7d3a8da8b8430

                                                                                      SHA512

                                                                                      b7827c882faa407203b9cb0c18c5045e95ccc34ef0de88ecf5fe65be57ba6daf1c78be22bb6c72fc433d4eded9ce922c33a1e90aaef925947727896df9c10756

                                                                                      Download Submit

                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                      Filesize

                                                                                      101KB

                                                                                      MD5

                                                                                      99066f5df84e651c7ee0498aa5e1097f

                                                                                      SHA1

                                                                                      a9ba4b657fe66f12593f7b129768d87ddd2ac07c

                                                                                      SHA256

                                                                                      2e350386cdc7c303d821927adbf3e5eb01432817901e90d7c1e508c1c860053f

                                                                                      SHA512

                                                                                      e40ae881f776952a301d7ce32aa1012abae069210f393b716d1fd65ea5e1effd44581bd8fc1dc0e24980e7f2c947516ba8f80cffc50248939f4a854f9f20e94c

                                                                                      Download Submit

                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                      Filesize

                                                                                      287KB

                                                                                      MD5

                                                                                      d983bed6c600e8e50fa06e591f228ddc

                                                                                      SHA1

                                                                                      4f906f05ae16612955721f05e07e333ed6f1c55d

                                                                                      SHA256

                                                                                      37120993e663b0e27dd3e0ffc7a441a5443f5d24b61116b8840dd25ebf3ea373

                                                                                      SHA512

                                                                                      aa1c0daf26de64c3d8309aaf3710b131071c4c4fc2d56c1995a845b0992d9bd2de37fa81c9e3882f9eb25b2c1c1796101842a249384a85eae3a692647db5fc9f

                                                                                      Download Submit

                                                                                    • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\LocalState\start.bin
                                                                                      Filesize

                                                                                      4KB

                                                                                      MD5

                                                                                      bafd74ed1605d515ba05b9ea9a1c6cd7

                                                                                      SHA1

                                                                                      124014fcdfca21f1b942315ab179deadf06bc9da

                                                                                      SHA256

                                                                                      71cefeeee4370273e730725e67347924c1a016c72cd47508838309aa2333fbfb

                                                                                      SHA512

                                                                                      f89bc412a7a0393d5a23ade660e02a52da7a288ecbd0a01798bf90286dc8cfe3ac9f690111a26e8df9f0f1d876f6dbfd688261d9d4e056be659e315a70d27f55

                                                                                      Download Submit

                                                                                    • C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\FZDB0V8H\www.bing[1].xml
                                                                                      Filesize

                                                                                      2KB

                                                                                      MD5

                                                                                      77b29acd295aa611e03e49dd87e829d2

                                                                                      SHA1

                                                                                      529dae893598ea58dccb591aeabd937dd9554d72

                                                                                      SHA256

                                                                                      6ec599714a7303b5fde1eb55e6a1472b46475ad01ec0ea5ae65aedaa38b07206

                                                                                      SHA512

                                                                                      cde26660015318ccb6e8d360c7650d5fb0daa5f3513b98efede3124c35013411c8ddbcbbe0d3bbfd0a204f4d60823b63d959ebf3470db17181fd088390387a2f

                                                                                      Download Submit

                                                                                    • C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\FZDB0V8H\www.bing[1].xml
                                                                                      Filesize

                                                                                      17KB

                                                                                      MD5

                                                                                      22d1833194d45d8cb0f0c4d5cf1645da

                                                                                      SHA1

                                                                                      4df02cdd467da98d0c714098e5df4c67ac6c55e4

                                                                                      SHA256

                                                                                      f413fbcb82c421cb203aa5d63e1b4b5cbf6049699a36962567ede83f7e86c848

                                                                                      SHA512

                                                                                      5619bd777cb947665afdb7bbe354f2578308565716eea1521153a0ea52b9acb442225347819bd601abd80de06719f564fadf75557b736a8d21db0a44e051cb0a

                                                                                      Download Submit

                                                                                    • C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\ServiceWorkerFiles\3FC3D503-2F49-473F-83BD-86303CA816B2\Zrtu2hQ08VU_1.bytecode
                                                                                      Filesize

                                                                                      66KB

                                                                                      MD5

                                                                                      eed23559fd6dfe521c0d7642ce02b78e

                                                                                      SHA1

                                                                                      61aa4145d7136ce3321bcc4ef9260f68d75aee96

                                                                                      SHA256

                                                                                      30793a6c30fcac6c7b2748526ec2d2b62a437c01e4bdf9c77f76ccf349f69efc

                                                                                      SHA512

                                                                                      0029277e3148b5c00db914c88ed76bb5c4fb55c8c91a49f103f80275fac180037b47f40629706062f37f5c2003f3414caf88489ffa946126bce377dcf7f348da

                                                                                      Download Submit

                                                                                    • C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\ServiceWorkerFiles\3FC3D503-2F49-473F-83BD-86303CA816B2\Zrtu2hQ08VU_1.metadata
                                                                                      Filesize

                                                                                      192B

                                                                                      MD5

                                                                                      b02b06d99239c597c75c2bb097e24adf

                                                                                      SHA1

                                                                                      141ab6a075a66f2f7fefe739c12f0c477e0bc59c

                                                                                      SHA256

                                                                                      e0cc2f30c00d7a50c77bc51cfe4da8a7c1731aaf83b243ea966c7a8668d43571

                                                                                      SHA512

                                                                                      c4cddbb087c002bdcbfc47d3ae0cf699f6799d84c05e3a52ab75a045ce117b7c5a81bb10ef022a9260b97b4fe89d42f2935160b45e7a044b83a36ed149668974

                                                                                      Download Submit

                                                                                    • C:\Users\Admin\AppData\Local\Packages\microsoftwindows.client.cbs_cw5n1h2txyewy\AC\INetCache\FCK5ZBL7\tbcpdb4ILy50_OshQSeODT5Jq0w[1].css
                                                                                      Filesize

                                                                                      963KB

                                                                                      MD5

                                                                                      140bd8a4e4ba2aeb930724ea8fac4d24

                                                                                      SHA1

                                                                                      3be1f83fed8e3f7cd1e76b6ba4bb4c66fa6e879e

                                                                                      SHA256

                                                                                      3dad3aecbd010b477e7d19fbaf12785ccc1e50f0b03d786770aa0b227c6f358c

                                                                                      SHA512

                                                                                      9a10fa00ad62d2da1acc7dbabae583e3c7c9f4e6d068974154f7f0c8ff94f74b609447086515028d7ecc031e1439fc17f24528f2f2833e365a572875c7e9a2c6

                                                                                      Download Submit

                                                                                    • C:\Users\Admin\AppData\Local\Temp\Temp1_Purge_WB.zip\Purge_WB.bat
                                                                                      Filesize

                                                                                      5KB

                                                                                      MD5

                                                                                      895acbc5a11a2878f9f1be4d6fbde662

                                                                                      SHA1

                                                                                      41d41071a821dc4b1ada2941955e561bae8d27b4

                                                                                      SHA256

                                                                                      0da884ddad29cf36f90783a57b2587a8178b3a0f4ea2249f9b14b83e5ba62df9

                                                                                      SHA512

                                                                                      3ec78748bd628b55b82d57282f4261dba52b8dbb7ea15d2b281346bef967154c0d05c0854289acb0c900f47007b8f39f6934d59b4bf6b0b73f7a333505c63dd6

                                                                                      Download Submit

                                                                                    • C:\Users\Admin\AppData\Local\Temp\Temp1_Purge_WB.zip\Purge_WB.bat:Zone.Identifier
                                                                                      Filesize

                                                                                      77B

                                                                                      MD5

                                                                                      d9b15d1bc83de68c844627d1e0c63abb

                                                                                      SHA1

                                                                                      906160db1f883f95cf79a7cdfac9c4b5271636ea

                                                                                      SHA256

                                                                                      9ef82d1ec454b2ca7975c287df12e72eaf49050d371315877a09694407c02835

                                                                                      SHA512

                                                                                      5e0ce22dd855033ef55e6b1e5119ca3d327b82a9775ebcc8f8ed86ab4e5e768a7b44e71480cf5813e160c5b7be2db48261b15c0fce6737223af4e4300e9f7ae3

                                                                                      Download Submit

                                                                                    • C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
                                                                                      Filesize

                                                                                      2B

                                                                                      MD5

                                                                                      f3b25701fe362ec84616a93a45ce9998

                                                                                      SHA1

                                                                                      d62636d8caec13f04e28442a0a6fa1afeb024bbb

                                                                                      SHA256

                                                                                      b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

                                                                                      SHA512

                                                                                      98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

                                                                                      Download Submit

                                                                                    • C:\Users\Admin\Downloads\Purge_WB.zip
                                                                                      Filesize

                                                                                      1KB

                                                                                      MD5

                                                                                      ba32afd7afaa81df73d9e926d4b0acd3

                                                                                      SHA1

                                                                                      dae1e4d7c2428f3b315693a810e539fe917d96cd

                                                                                      SHA256

                                                                                      533e2d4bbf6a7a42fa163142306ac9d702df7ac401db69ff5e6334f9710b1b55

                                                                                      SHA512

                                                                                      566eeb9e26567cada1a1d79d192ece2b0891117b58e17b7fa0d84158ba85954b4609b1c73fd209574cefb78432ef5cf3b542b1f7686536c131d1a96a39def505

                                                                                      Download Submit

                                                                                    • C:\Users\Admin\Downloads\Purge_WB.zip:Zone.Identifier
                                                                                      Filesize

                                                                                      130B

                                                                                      MD5

                                                                                      e8278e46f837cefca4746751023d90d4

                                                                                      SHA1

                                                                                      dfb1d1d83effe8be9350bd7b72714076f4cdd8cc

                                                                                      SHA256

                                                                                      a15dd676d7cbb7b9762683f2a66bd800b6f563ee65bbe24eb35e550dfc8cfa07

                                                                                      SHA512

                                                                                      0ffc828505dd21c21a47779d268687df7766876321d679dc9db5b1b3028d54c4ab71dc64e81b989fd4866be5852c1969866b05666d9befd5d350bed912733add

                                                                                      Download Submit

                                                                                    • memory/2788-172-0x000001B83CC30000-0x000001B83CD30000-memory.dmp

                                                                                      Filesize

                                                                                      1024KB

                                                                                      Download

                                                                                    • memory/2788-27-0x000001B828000000-0x000001B828100000-memory.dmp

                                                                                      Filesize

                                                                                      1024KB

                                                                                      Download

                                                                                    • memory/2788-9-0x000001B806000000-0x000001B806100000-memory.dmp

                                                                                      Filesize

                                                                                      1024KB

                                                                                      Download

                                                                                    • memory/2788-44-0x000001B839020000-0x000001B839040000-memory.dmp

                                                                                      Filesize

                                                                                      128KB

                                                                                      Download

                                                                                    • memory/2788-70-0x000001B8393E0000-0x000001B8394E0000-memory.dmp

                                                                                      Filesize

                                                                                      1024KB

                                                                                      Download

                                                                                    • memory/2788-87-0x000001B828720000-0x000001B828740000-memory.dmp

                                                                                      Filesize

                                                                                      128KB

                                                                                      Download

                                                                                    • memory/2788-88-0x000001B8392C0000-0x000001B8392E0000-memory.dmp

                                                                                      Filesize

                                                                                      128KB

                                                                                      Download

                                                                                    • memory/2788-108-0x000001B839730000-0x000001B839750000-memory.dmp

                                                                                      Filesize

                                                                                      128KB

                                                                                      Download

                                                                                    • memory/5260-1092-0x00000216724D0000-0x00000216725D0000-memory.dmp

                                                                                      Filesize

                                                                                      1024KB

                                                                                      Download

                                                                                    • memory/5260-1223-0x0000021676C90000-0x0000021676D90000-memory.dmp

                                                                                      Filesize

                                                                                      1024KB

                                                                                      Download

                                                                                    • memory/5260-1159-0x00000216738A0000-0x00000216738C0000-memory.dmp

                                                                                      Filesize

                                                                                      128KB

                                                                                      Download

                                                                                    • memory/5260-1139-0x0000021673110000-0x0000021673130000-memory.dmp

                                                                                      Filesize

                                                                                      128KB

                                                                                      Download

                                                                                    • memory/5260-1138-0x0000021672880000-0x00000216728A0000-memory.dmp

                                                                                      Filesize

                                                                                      128KB

                                                                                      Download

                                                                                    • memory/5260-1098-0x0000021673170000-0x0000021673270000-memory.dmp

                                                                                      Filesize

                                                                                      1024KB

                                                                                      Download

                                                                                    • memory/5260-1095-0x0000021672EE0000-0x0000021672F00000-memory.dmp

                                                                                      Filesize

                                                                                      128KB

                                                                                      Download

                                                                                    • memory/5260-1072-0x0000021670100000-0x0000021670200000-memory.dmp

                                                                                      Filesize

                                                                                      1024KB

                                                                                      Download