Analysis
-
max time kernel
70s -
max time network
93s -
platform
windows11-21h2_x64 -
resource
win11-20240802-en -
resource tags
-
submitted
05-08-2024 23:48
General
-
Target
Purge_WB.bat
-
Size
5KB
-
MD5
895acbc5a11a2878f9f1be4d6fbde662
-
SHA1
41d41071a821dc4b1ada2941955e561bae8d27b4
-
SHA256
0da884ddad29cf36f90783a57b2587a8178b3a0f4ea2249f9b14b83e5ba62df9
-
SHA512
3ec78748bd628b55b82d57282f4261dba52b8dbb7ea15d2b281346bef967154c0d05c0854289acb0c900f47007b8f39f6934d59b4bf6b0b73f7a333505c63dd6
-
SSDEEP
96:GeI8huOXdzgWE9BrY7Tof33UHL7ZDgCOw/OW8z7J124JJYiAnrT8EMJ124J1:GeIuFi/iTof33UHBgWu7KekTLMKe1
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives 3 TTPs 4 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Drops file in Windows directory 4 IoCs
-
Browser Information Discovery 1 TTPs
Enumerate browser information.
-
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 7 IoCs
-
Kills process with taskkill 2 IoCs
-
Modifies Internet Explorer settings 1 TTPs 10 IoCs
-
Modifies data under HKEY_USERS 2 IoCs
-
Modifies registry class 64 IoCs
-
NTFS ADS 2 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 64 IoCs
-
Suspicious use of SendNotifyMessage 64 IoCs
-
Suspicious use of SetWindowsHookEx 9 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Purge_WB.bat"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cacls.exe"C:\Windows\system32\cacls.exe" "C:\Windows\system32\config\system"2⤵
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\reg.exereg query HKEY_CLASSES_ROOT\WbaFile2⤵
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\Software\Stardock\ObjectDesktop\WindowBlinds2⤵
-
C:\Windows\system32\reg.exereg query HKEY_CURRENT_USER\Software\Stardock\WindowBlinds2⤵
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\Software\Stardock\ObjectDesktop\WindowBlinds2⤵
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\Software\Stardock\WindowBlinds2⤵
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\Software\Wow6432Node\Stardock\WindowBlinds2⤵
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\WindowBlinds2⤵
-
C:\Windows\explorer.exeexplorer.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Modifies registry class
- NTFS ADS
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd39dccc40,0x7ffd39dccc4c,0x7ffd39dccc584⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1948,i,15629507842644884609,90418342852217471,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=1944 /prefetch:24⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1712,i,15629507842644884609,90418342852217471,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=2072 /prefetch:34⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2240,i,15629507842644884609,90418342852217471,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=2252 /prefetch:84⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3080,i,15629507842644884609,90418342852217471,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=3100 /prefetch:14⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3108,i,15629507842644884609,90418342852217471,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=3140 /prefetch:14⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4456,i,15629507842644884609,90418342852217471,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=4460 /prefetch:14⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4768,i,15629507842644884609,90418342852217471,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=4776 /prefetch:84⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4784,i,15629507842644884609,90418342852217471,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=4800 /prefetch:84⤵
-
C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe" --reenable-autoupdates --system-level4⤵
- Drops file in Windows directory
-
C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x244,0x248,0x24c,0x220,0x250,0x7ff744f04698,0x7ff744f046a4,0x7ff744f046b05⤵
- Drops file in Windows directory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=5100,i,15629507842644884609,90418342852217471,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=5108 /prefetch:14⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=3376,i,15629507842644884609,90418342852217471,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=3356 /prefetch:84⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=3372,i,15629507842644884609,90418342852217471,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=4796 /prefetch:14⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=3208,i,15629507842644884609,90418342852217471,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=212 /prefetch:84⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=3196,i,15629507842644884609,90418342852217471,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=3224 /prefetch:84⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=3176,i,15629507842644884609,90418342852217471,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=3188 /prefetch:14⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=3156,i,15629507842644884609,90418342852217471,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=5172 /prefetch:14⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=5180,i,15629507842644884609,90418342852217471,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=212 /prefetch:14⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=3288,i,15629507842644884609,90418342852217471,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=5128 /prefetch:14⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --field-trial-handle=3092,i,15629507842644884609,90418342852217471,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=5036 /prefetch:14⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --field-trial-handle=5820,i,15629507842644884609,90418342852217471,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=5776 /prefetch:14⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --field-trial-handle=5768,i,15629507842644884609,90418342852217471,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=5780 /prefetch:14⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5744,i,15629507842644884609,90418342852217471,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=5808 /prefetch:84⤵
- NTFS ADS
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Temp1_Purge_WB.zip\Purge_WB.bat" "3⤵
-
C:\Windows\system32\cacls.exe"C:\Windows\system32\cacls.exe" "C:\Windows\system32\config\system"4⤵
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe4⤵
- Kills process with taskkill
-
C:\Windows\system32\reg.exereg query HKEY_CLASSES_ROOT\WbaFile4⤵
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\Software\Stardock\ObjectDesktop\WindowBlinds4⤵
-
C:\Windows\system32\reg.exereg query HKEY_CURRENT_USER\Software\Stardock\WindowBlinds4⤵
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\Software\Stardock\ObjectDesktop\WindowBlinds4⤵
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\Software\Stardock\WindowBlinds4⤵
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\Software\Wow6432Node\Stardock\WindowBlinds4⤵
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\WindowBlinds4⤵
-
C:\Windows\explorer.exeexplorer.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Google\Chrome\Application\SetupMetrics\20240805234938.pmaFilesize
520B
MD5d7bdecbddac6262e516e22a4d6f24f0b
SHA11a633ee43641fa78fbe959d13fa18654fd4a90be
SHA256db3be7c6d81b2387c39b32d15c096173022cccee1015571dd3e09f2a69b508a9
SHA5121e72db18de776fe264db3052ce9a842c9766a720a9119fc6605f795c36d4c7bf8f77680c5564f36e591368ccd354104a7412f267c4157f04c4926bce51aeeaa1
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnCache\data_1Filesize
264KB
MD5ef3e8d9a40e77376e9b0d374609ee271
SHA1e65c15e26af50e35d3863be3ac9fbcc0a14eb1ca
SHA256c94ce647a66d7cf1afa94e0df31e5af1f8200f6cdd2a69ff983f42551764e616
SHA512de4612520714182fdc1132626fae1f738c971c7c0ac2e74a26dafe2eab02c47b98f74b2825b4f27cccc40a334c4d7b605152e8a2cc97d94103111ba2b5283968
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent StateFilesize
6KB
MD515e818d6fb6fa34107003ebefc666b4a
SHA1812b786731f4a81168208c68ed45a929a91e3a4c
SHA256a5b37b7d0b78f5c0df0be4da0bc6c1a5d90bc5699797081b3c6738097a5f6ca2
SHA51255bf2d8efed4849b2534c05de1ee962116a9ea0d0f789860fc23f95ab71822426a37d45dfc315146d448b087734b298470a9aa781365cc6df8afe58dba3b3206
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending ReportsFilesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurityFilesize
692B
MD5c6fd062c10309c1f33adf0008ec89b08
SHA1ac8e24a1780a73033b93c52702b05437888ec6ba
SHA256d998fda1ce0d1bb8bc3373f63d71261ea26531afdf1d8f5fa678b88c3d57bfa6
SHA51225a505f977a8470723103396b91eb4f61762c550f1b92cc19b762832799571d1a7b95b13a1302e95edf3049a1aefe5138801bae16e5f200e5157ebd36fd404b8
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurityFilesize
2KB
MD539567d6bef87030e8db0e24ed234d90c
SHA144863178ce4a45d726581b6bd2514c1655cc770b
SHA256167765fe10e5679e741eb624d1aa33a09bd5e639e348964848bb7ebe2f1b700a
SHA51216c0a27274ec888f3d96d8d4daaaa05bc12e77bb6a0fc5edc3363ae11ada9aacbb47f5f65eb566df0c08f272f1aacb4f7382edc14b4efb69b24a10170d366ff6
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurityFilesize
1KB
MD51b332ab8e49cf6dd01757c798f50f53b
SHA1ac5ba14140e4667b363e025ebf9f84de9a8ab488
SHA25695d5ac35acb61f09f00dcfc680ad8a0ca2581616d954d87b3f624472eba8b97b
SHA5125bfee669d1387f2d97c30d5f496f0293a60eead00d6e5866623cd0f4f11039a0d332ba8a290b7710b0b3aed17640bdde3dbf32d914a293ba382bbf3820e55f7c
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurityFilesize
2KB
MD5afc15546b52ddabcbdc461297bbf0ba2
SHA1300319fa0419b02ed310922b6d750684cb3d3e53
SHA256ce0fd00c34ac0245c37455433394875df128eb858cff5348da2aff99f1f1f5c8
SHA512f4c1e4329e0c22106b829d00325bf27eb19b4bb2721d0ceecc0d869c70f5df2867e2f0b63b622e91d7faa0ce9e15084e0af28a57e5eb61dbcf16e3b752543b47
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurityFilesize
2KB
MD593ff36d33834e8bb0cbb66fa2eb8aa63
SHA16381be01a0a487a249e08a9af8c4ba788e2541a5
SHA2560f28785fcef041cb089db16443b149edf5b0142d8f271d25aafd3eb2a18c4568
SHA51207dc6a867fda45e0eb5ca834a6d2a8d97f715157fd8468971b5dd950192f637875eabd31cbcee523a4a09596b63c3aff8befcb230f7b4e9a1147fc7bb4af2b36
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
8KB
MD51ea547467c2b8a1ee436eb75211c7879
SHA139672312cc90d5f5314b7b0f7e29b1d328cd7698
SHA256ebc5861754faefc6bf1938c60bef7262294e2df605c66603790af7a7128d7595
SHA512e800511c8282b64b460f6e1abf08b00d742e0f80dabaa5d15561c3f82ee7a5653fef68a4d4e960f34cdcf604ef2b3e4bc7667b9b5950701167746792d5e3ed61
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
9KB
MD5a57d1ce6417f359c96eaa589084404b5
SHA1aaa8291f403af7dc63bfb64232f71891f226e3e5
SHA25658f1a8d3da1ffc329526e84b25d1722c4f6f0815055b0ed0ef6ce4f5cb6ad809
SHA51249c50ad58be7b38c1640b5a074dc665ee33e911ceedadb89a96f020c4e0510f515d1bdebf492105a522aa9d64f5d9d417d2850910dcf26b1470eb4b0902fc605
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
9KB
MD525c4f571307f7f9b94b05a22624cc490
SHA1d596a06f5f44829aed27543148754e62ea0e6c8d
SHA25681ce115384ab3ebd2ee1620b6adb4e6b0839b661ae651d400886c7121f509f21
SHA512d6adda9e311ee01ad29441aa022a604a49ded69c621ebd0e4a1a1d84ca69ad679722a73a17410492c6eb7443c03f463c5026e6afa70a6e56a9e6d240bf16c33c
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
9KB
MD588727201b7ae6e00608146ae70736e35
SHA1d9a20df2bb8305aab019a9ede1184ab7985c4b69
SHA25611047ee02aad84a326ed63b474fbd7c00e745ea7eeb876af85bc55c7a2a6521d
SHA5129c1bba3829e9dbe55db4ccd62b87a897a23053b58cc63c715bf7fbe61d07a1001b28eb3c963b816295e96ac559137d99bd0c679f85f9fd42c4169811a42ba37b
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
9KB
MD5f5fa6c1e4997c0772706d36fbe892536
SHA1b6515e826a1689fa1b908cd4e58a18501fe353b5
SHA2568670d9bcd610315d628a921a1e2958985a73a137ed20e39f8c9d9cbd9c397b27
SHA512a1b711620bcdfd066c797aaa9a709ce861138fa8c21580387aa8d3f89059e564a6c1589a27f8f7043c8b9046c7b5aa210c6411ff73087d8d6942b6779c0cbd41
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
8KB
MD533cf6e0ce6c6e90c71d4326cdc290bed
SHA1770544e17fbff129b1a3892a494137cfd6f210cf
SHA2567381b6adddef798b9b2b00efa049ac18b7cb6b53b4f43e875adaa8b275f83be3
SHA512a268d750185c498c3cf9ae7bff52fe25a80c4fa3d90c3b043ccc1aa3ee3ee9d4bcff2cb915f113c116bfc67d90764f75cf5c3a17f432b82b232fcda9f129c439
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure PreferencesFilesize
15KB
MD5d4c6cc257528f7cbeb7127755a6feb22
SHA14c1af569f99467fe254561511799eb989568ffcc
SHA256eccf053bac044c17038b9e101841f63455e6d375d027fb773817179f0750e1b3
SHA512ea9c120aec5e0d5d7c06a43c216ae51fe4786394f9c78e1f7a1593802c1574d7cff30ede0602cead734b19fa52af3910f7384e45170dca9d6afff97df44ad905
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateFilesize
197KB
MD5a154caca2c6847aa3fad7fe9a50f9ca6
SHA1e541f4e835589e17d9163b56f553b0e4e7e0fcb8
SHA256c97908a43cbbe86d7be5e8665dfa5d9a9b06ff72876bebe46242e6d29f1cd00e
SHA512821fbc15ccc4dc4a570f43b94a5fd83f6479c598d0fbb1e187dfb1253d314f203abe20f4ceacc12b76f1f0ccd40136c8736cb77ba7801c0886eb7b3ac70ded0d
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateFilesize
197KB
MD5869c6b96622304e70905b3857e908e23
SHA11fe749319e9fe81ff41f2f0efd06131f2ee89718
SHA2567aee60056fda86bf0860e519011ff7d52b1d31ab7f76be776fa7d3a8da8b8430
SHA512b7827c882faa407203b9cb0c18c5045e95ccc34ef0de88ecf5fe65be57ba6daf1c78be22bb6c72fc433d4eded9ce922c33a1e90aaef925947727896df9c10756
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateFilesize
101KB
MD599066f5df84e651c7ee0498aa5e1097f
SHA1a9ba4b657fe66f12593f7b129768d87ddd2ac07c
SHA2562e350386cdc7c303d821927adbf3e5eb01432817901e90d7c1e508c1c860053f
SHA512e40ae881f776952a301d7ce32aa1012abae069210f393b716d1fd65ea5e1effd44581bd8fc1dc0e24980e7f2c947516ba8f80cffc50248939f4a854f9f20e94c
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateFilesize
287KB
MD5d983bed6c600e8e50fa06e591f228ddc
SHA14f906f05ae16612955721f05e07e333ed6f1c55d
SHA25637120993e663b0e27dd3e0ffc7a441a5443f5d24b61116b8840dd25ebf3ea373
SHA512aa1c0daf26de64c3d8309aaf3710b131071c4c4fc2d56c1995a845b0992d9bd2de37fa81c9e3882f9eb25b2c1c1796101842a249384a85eae3a692647db5fc9f
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\LocalState\start.binFilesize
4KB
MD5bafd74ed1605d515ba05b9ea9a1c6cd7
SHA1124014fcdfca21f1b942315ab179deadf06bc9da
SHA25671cefeeee4370273e730725e67347924c1a016c72cd47508838309aa2333fbfb
SHA512f89bc412a7a0393d5a23ade660e02a52da7a288ecbd0a01798bf90286dc8cfe3ac9f690111a26e8df9f0f1d876f6dbfd688261d9d4e056be659e315a70d27f55
-
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\FZDB0V8H\www.bing[1].xmlFilesize
2KB
MD577b29acd295aa611e03e49dd87e829d2
SHA1529dae893598ea58dccb591aeabd937dd9554d72
SHA2566ec599714a7303b5fde1eb55e6a1472b46475ad01ec0ea5ae65aedaa38b07206
SHA512cde26660015318ccb6e8d360c7650d5fb0daa5f3513b98efede3124c35013411c8ddbcbbe0d3bbfd0a204f4d60823b63d959ebf3470db17181fd088390387a2f
-
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\FZDB0V8H\www.bing[1].xmlFilesize
17KB
MD522d1833194d45d8cb0f0c4d5cf1645da
SHA14df02cdd467da98d0c714098e5df4c67ac6c55e4
SHA256f413fbcb82c421cb203aa5d63e1b4b5cbf6049699a36962567ede83f7e86c848
SHA5125619bd777cb947665afdb7bbe354f2578308565716eea1521153a0ea52b9acb442225347819bd601abd80de06719f564fadf75557b736a8d21db0a44e051cb0a
-
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\ServiceWorkerFiles\3FC3D503-2F49-473F-83BD-86303CA816B2\Zrtu2hQ08VU_1.bytecodeFilesize
66KB
MD5eed23559fd6dfe521c0d7642ce02b78e
SHA161aa4145d7136ce3321bcc4ef9260f68d75aee96
SHA25630793a6c30fcac6c7b2748526ec2d2b62a437c01e4bdf9c77f76ccf349f69efc
SHA5120029277e3148b5c00db914c88ed76bb5c4fb55c8c91a49f103f80275fac180037b47f40629706062f37f5c2003f3414caf88489ffa946126bce377dcf7f348da
-
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\ServiceWorkerFiles\3FC3D503-2F49-473F-83BD-86303CA816B2\Zrtu2hQ08VU_1.metadataFilesize
192B
MD5b02b06d99239c597c75c2bb097e24adf
SHA1141ab6a075a66f2f7fefe739c12f0c477e0bc59c
SHA256e0cc2f30c00d7a50c77bc51cfe4da8a7c1731aaf83b243ea966c7a8668d43571
SHA512c4cddbb087c002bdcbfc47d3ae0cf699f6799d84c05e3a52ab75a045ce117b7c5a81bb10ef022a9260b97b4fe89d42f2935160b45e7a044b83a36ed149668974
-
C:\Users\Admin\AppData\Local\Packages\microsoftwindows.client.cbs_cw5n1h2txyewy\AC\INetCache\FCK5ZBL7\tbcpdb4ILy50_OshQSeODT5Jq0w[1].cssFilesize
963KB
MD5140bd8a4e4ba2aeb930724ea8fac4d24
SHA13be1f83fed8e3f7cd1e76b6ba4bb4c66fa6e879e
SHA2563dad3aecbd010b477e7d19fbaf12785ccc1e50f0b03d786770aa0b227c6f358c
SHA5129a10fa00ad62d2da1acc7dbabae583e3c7c9f4e6d068974154f7f0c8ff94f74b609447086515028d7ecc031e1439fc17f24528f2f2833e365a572875c7e9a2c6
-
C:\Users\Admin\AppData\Local\Temp\Temp1_Purge_WB.zip\Purge_WB.batFilesize
5KB
MD5895acbc5a11a2878f9f1be4d6fbde662
SHA141d41071a821dc4b1ada2941955e561bae8d27b4
SHA2560da884ddad29cf36f90783a57b2587a8178b3a0f4ea2249f9b14b83e5ba62df9
SHA5123ec78748bd628b55b82d57282f4261dba52b8dbb7ea15d2b281346bef967154c0d05c0854289acb0c900f47007b8f39f6934d59b4bf6b0b73f7a333505c63dd6
-
C:\Users\Admin\AppData\Local\Temp\Temp1_Purge_WB.zip\Purge_WB.bat:Zone.IdentifierFilesize
77B
MD5d9b15d1bc83de68c844627d1e0c63abb
SHA1906160db1f883f95cf79a7cdfac9c4b5271636ea
SHA2569ef82d1ec454b2ca7975c287df12e72eaf49050d371315877a09694407c02835
SHA5125e0ce22dd855033ef55e6b1e5119ca3d327b82a9775ebcc8f8ed86ab4e5e768a7b44e71480cf5813e160c5b7be2db48261b15c0fce6737223af4e4300e9f7ae3
-
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dicFilesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
-
C:\Users\Admin\Downloads\Purge_WB.zipFilesize
1KB
MD5ba32afd7afaa81df73d9e926d4b0acd3
SHA1dae1e4d7c2428f3b315693a810e539fe917d96cd
SHA256533e2d4bbf6a7a42fa163142306ac9d702df7ac401db69ff5e6334f9710b1b55
SHA512566eeb9e26567cada1a1d79d192ece2b0891117b58e17b7fa0d84158ba85954b4609b1c73fd209574cefb78432ef5cf3b542b1f7686536c131d1a96a39def505
-
C:\Users\Admin\Downloads\Purge_WB.zip:Zone.IdentifierFilesize
130B
MD5e8278e46f837cefca4746751023d90d4
SHA1dfb1d1d83effe8be9350bd7b72714076f4cdd8cc
SHA256a15dd676d7cbb7b9762683f2a66bd800b6f563ee65bbe24eb35e550dfc8cfa07
SHA5120ffc828505dd21c21a47779d268687df7766876321d679dc9db5b1b3028d54c4ab71dc64e81b989fd4866be5852c1969866b05666d9befd5d350bed912733add
-
\??\pipe\crashpad_2292_VWNDVDESZEIVXPIGMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/2788-172-0x000001B83CC30000-0x000001B83CD30000-memory.dmpFilesize
1024KB
-
memory/2788-27-0x000001B828000000-0x000001B828100000-memory.dmpFilesize
1024KB
-
memory/2788-9-0x000001B806000000-0x000001B806100000-memory.dmpFilesize
1024KB
-
memory/2788-44-0x000001B839020000-0x000001B839040000-memory.dmpFilesize
128KB
-
memory/2788-70-0x000001B8393E0000-0x000001B8394E0000-memory.dmpFilesize
1024KB
-
memory/2788-87-0x000001B828720000-0x000001B828740000-memory.dmpFilesize
128KB
-
memory/2788-88-0x000001B8392C0000-0x000001B8392E0000-memory.dmpFilesize
128KB
-
memory/2788-108-0x000001B839730000-0x000001B839750000-memory.dmpFilesize
128KB
-
memory/5260-1092-0x00000216724D0000-0x00000216725D0000-memory.dmpFilesize
1024KB
-
memory/5260-1223-0x0000021676C90000-0x0000021676D90000-memory.dmpFilesize
1024KB
-
memory/5260-1159-0x00000216738A0000-0x00000216738C0000-memory.dmpFilesize
128KB
-
memory/5260-1139-0x0000021673110000-0x0000021673130000-memory.dmpFilesize
128KB
-
memory/5260-1138-0x0000021672880000-0x00000216728A0000-memory.dmpFilesize
128KB
-
memory/5260-1098-0x0000021673170000-0x0000021673270000-memory.dmpFilesize
1024KB
-
memory/5260-1095-0x0000021672EE0000-0x0000021672F00000-memory.dmpFilesize
128KB
-
memory/5260-1072-0x0000021670100000-0x0000021670200000-memory.dmpFilesize
1024KB