Malware Analysis Report

2024-11-16 12:57

Sample ID 240809-rewgravglg
Target https://github.com/pankoza2-pl/malwaredatabase-old
Tags
bootkit discovery evasion exploit persistence upx
score
8/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
8/10

Threat Level: Likely malicious

The file https://github.com/pankoza2-pl/malwaredatabase-old was found to be: Likely malicious.

Malicious Activity Summary

bootkit discovery evasion exploit persistence upx

Possible privilege escalation attempt

Disables Task Manager via registry modification

Modifies file permissions

UPX packed file

Executes dropped EXE

Writes to the Master Boot Record (MBR)

Legitimate hosting services abused for malware hosting/C2

Modifies boot configuration data using bcdedit

System Location Discovery: System Language Discovery

Enumerates physical storage devices

Browser Information Discovery

Suspicious use of SetWindowsHookEx

Suspicious behavior: EnumeratesProcesses

Kills process with taskkill

Modifies data under HKEY_USERS

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious use of AdjustPrivilegeToken

Enumerates system info in registry

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Modifies registry key

Delays execution with timeout.exe

Suspicious use of SendNotifyMessage

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-08-09 14:06

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-08-09 14:06

Reported

2024-08-09 14:16

Platform

win10-20240404-en

Max time kernel

470s

Max time network

468s

Command Line

"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/pankoza2-pl/malwaredatabase-old

Signatures

Disables Task Manager via registry modification

evasion

Possible privilege escalation attempt

exploit
Description Indicator Process Target
N/A N/A C:\Windows\system32\icacls.exe N/A
N/A N/A C:\Windows\system32\takeown.exe N/A
N/A N/A C:\Windows\system32\icacls.exe N/A
N/A N/A C:\Windows\system32\icacls.exe N/A
N/A N/A C:\Windows\system32\takeown.exe N/A
N/A N/A C:\Windows\system32\icacls.exe N/A

Modifies file permissions

discovery
Description Indicator Process Target
N/A N/A C:\Windows\system32\icacls.exe N/A
N/A N/A C:\Windows\system32\takeown.exe N/A
N/A N/A C:\Windows\system32\icacls.exe N/A
N/A N/A C:\Windows\system32\icacls.exe N/A
N/A N/A C:\Windows\system32\takeown.exe N/A
N/A N/A C:\Windows\system32\icacls.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A

Modifies boot configuration data using bcdedit

Description Indicator Process Target
N/A N/A C:\Windows\system32\bcdedit.exe N/A

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PhysicalDrive0 C:\Users\Admin\AppData\Local\Temp\DC24.tmp\TrashMBR.exe N/A

Browser Information Discovery

discovery

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\DC24.tmp\MouseError.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\DC24.tmp\PlgBlt.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\DC24.tmp\BitBlt.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\DC24.tmp\glitch.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\DC24.tmp\MouseAppIcon.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\Downloads\ExtremeDeath\ExtremeDeath.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\DC24.tmp\TrashMBR.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\DC24.tmp\MouseWarning.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\DC24.tmp\MouseAppIcon.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\DC24.tmp\MouseWarning.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\DC24.tmp\MouseError.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133676861367163972" C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\system32\reg.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\DC24.tmp\PlgBlt.exe N/A

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\7-Zip\7zG.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4604 wrote to memory of 1328 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4604 wrote to memory of 1328 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4604 wrote to memory of 3732 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4604 wrote to memory of 3732 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4604 wrote to memory of 3732 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4604 wrote to memory of 3732 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4604 wrote to memory of 3732 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4604 wrote to memory of 3732 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4604 wrote to memory of 3732 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4604 wrote to memory of 3732 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4604 wrote to memory of 3732 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4604 wrote to memory of 3732 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4604 wrote to memory of 3732 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4604 wrote to memory of 3732 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4604 wrote to memory of 3732 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4604 wrote to memory of 3732 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4604 wrote to memory of 3732 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4604 wrote to memory of 3732 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4604 wrote to memory of 3732 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4604 wrote to memory of 3732 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4604 wrote to memory of 3732 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4604 wrote to memory of 3732 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4604 wrote to memory of 3732 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4604 wrote to memory of 3732 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4604 wrote to memory of 3732 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4604 wrote to memory of 3732 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4604 wrote to memory of 3732 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4604 wrote to memory of 3732 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4604 wrote to memory of 3732 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4604 wrote to memory of 3732 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4604 wrote to memory of 3732 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4604 wrote to memory of 3732 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4604 wrote to memory of 3732 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4604 wrote to memory of 3732 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4604 wrote to memory of 3732 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4604 wrote to memory of 3732 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4604 wrote to memory of 3732 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4604 wrote to memory of 3732 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4604 wrote to memory of 3732 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4604 wrote to memory of 3732 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4604 wrote to memory of 196 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4604 wrote to memory of 196 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4604 wrote to memory of 4632 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4604 wrote to memory of 4632 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4604 wrote to memory of 4632 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4604 wrote to memory of 4632 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4604 wrote to memory of 4632 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4604 wrote to memory of 4632 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4604 wrote to memory of 4632 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4604 wrote to memory of 4632 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4604 wrote to memory of 4632 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4604 wrote to memory of 4632 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4604 wrote to memory of 4632 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4604 wrote to memory of 4632 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4604 wrote to memory of 4632 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4604 wrote to memory of 4632 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4604 wrote to memory of 4632 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4604 wrote to memory of 4632 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4604 wrote to memory of 4632 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4604 wrote to memory of 4632 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4604 wrote to memory of 4632 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4604 wrote to memory of 4632 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4604 wrote to memory of 4632 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4604 wrote to memory of 4632 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe

Processes

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/pankoza2-pl/malwaredatabase-old

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffe04d29758,0x7ffe04d29768,0x7ffe04d29778

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1520 --field-trial-handle=2000,i,12821782817384880288,6676510596054767740,131072 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1784 --field-trial-handle=2000,i,12821782817384880288,6676510596054767740,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1812 --field-trial-handle=2000,i,12821782817384880288,6676510596054767740,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3060 --field-trial-handle=2000,i,12821782817384880288,6676510596054767740,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3068 --field-trial-handle=2000,i,12821782817384880288,6676510596054767740,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3848 --field-trial-handle=2000,i,12821782817384880288,6676510596054767740,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3848 --field-trial-handle=2000,i,12821782817384880288,6676510596054767740,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2644 --field-trial-handle=2000,i,12821782817384880288,6676510596054767740,131072 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4548 --field-trial-handle=2000,i,12821782817384880288,6676510596054767740,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5160 --field-trial-handle=2000,i,12821782817384880288,6676510596054767740,131072 /prefetch:8

C:\Windows\System32\rundll32.exe

C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

C:\Program Files\7-Zip\7zG.exe

"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\ExtremeDeath\" -spe -an -ai#7zMap21513:86:7zEvent16766

C:\Users\Admin\Downloads\ExtremeDeath\ExtremeDeath.exe

"C:\Users\Admin\Downloads\ExtremeDeath\ExtremeDeath.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\DC24.tmp\DC25.tmp\DC26.bat C:\Users\Admin\Downloads\ExtremeDeath\ExtremeDeath.exe"

C:\Windows\system32\cscript.exe

cscript prompt.vbs

C:\Windows\system32\bcdedit.exe

bcdedit /delete {current}

C:\Users\Admin\AppData\Local\Temp\DC24.tmp\TrashMBR.exe

TrashMBR.exe

C:\Windows\system32\taskkill.exe

taskkill /f /im logonui.exe

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='logonui.exe' delete /nointeractive

C:\Windows\system32\takeown.exe

takeown /f C:\Windows\system32\logonui.exe

C:\Windows\system32\icacls.exe

icacls C:\Windows\system32\logonui.exe /grant Admin:F

C:\Windows\system32\icacls.exe

icacls C:\Windows\system32\logonui.exe /grant "everyone":F

C:\Windows\system32\taskkill.exe

taskkill /f /im taskmgr.exe

C:\Windows\System32\Wbem\WMIC.exe

wmic process where name='taskmgr.exe' delete /nointeractive

C:\Windows\system32\takeown.exe

takeown /f C:\Windows\system32\taskmgr.exe

C:\Windows\system32\icacls.exe

icacls C:\Windows\system32\taskmgr.exe /grant Admin:F

C:\Windows\system32\icacls.exe

icacls C:\Windows\system32\taskmgr.exe /grant "everyone":F

C:\Windows\system32\reg.exe

reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f

C:\Users\Admin\AppData\Local\Temp\DC24.tmp\beeper.exe

beeper.exe

C:\Windows\system32\timeout.exe

timeout 1 /nobreak

C:\Users\Admin\AppData\Local\Temp\DC24.tmp\MouseError.exe

MouseError.exe

C:\Windows\system32\timeout.exe

timeout 5 /nobreak

C:\Users\Admin\AppData\Local\Temp\DC24.tmp\MouseWarning.exe

MouseWarning.exe

C:\Windows\system32\timeout.exe

timeout 5 /nobreak

C:\Users\Admin\AppData\Local\Temp\DC24.tmp\MouseAppIcon.exe

MouseAppIcon.exe

C:\Windows\system32\timeout.exe

timeout 10 /nobreak

C:\Users\Admin\AppData\Local\Temp\DC24.tmp\PlgBlt.exe

PlgBlt.exe

C:\Windows\system32\taskkill.exe

taskkill /f /im MouseError.exe

C:\Windows\system32\taskkill.exe

taskkill /f /im MouseWarning.exe

C:\Windows\system32\taskkill.exe

taskkill /f /im MouseAppIcon.exe

C:\Windows\system32\timeout.exe

timeout 1 /nobreak

C:\Users\Admin\AppData\Local\Temp\DC24.tmp\MouseError.exe

MouseError.exe

C:\Users\Admin\AppData\Local\Temp\DC24.tmp\MouseWarning.exe

MouseWarning.exe

C:\Users\Admin\AppData\Local\Temp\DC24.tmp\MouseAppIcon.exe

MouseAppIcon.exe

C:\Windows\system32\timeout.exe

timeout 15 /nobreak

C:\Users\Admin\AppData\Local\Temp\DC24.tmp\BitBlt.exe

BitBlt.exe

C:\Windows\system32\timeout.exe

timeout 5 /nobreak

C:\Users\Admin\AppData\Local\Temp\DC24.tmp\glitch.exe

glitch.exe

C:\Windows\system32\timeout.exe

timeout 30 /nobreak

C:\Windows\system32\mountvol.exe

mountvol c: /d

Network

Country Destination Domain Proto
US 8.8.8.8:53 github.com udp
GB 20.26.156.215:443 github.com tcp
GB 20.26.156.215:443 github.com tcp
US 8.8.8.8:53 github.githubassets.com udp
US 8.8.8.8:53 avatars.githubusercontent.com udp
US 185.199.111.133:443 avatars.githubusercontent.com tcp
US 8.8.8.8:53 github-cloud.s3.amazonaws.com udp
US 185.199.111.154:443 github.githubassets.com tcp
US 185.199.111.154:443 github.githubassets.com tcp
US 185.199.111.154:443 github.githubassets.com tcp
US 185.199.111.154:443 github.githubassets.com tcp
US 185.199.111.154:443 github.githubassets.com tcp
US 185.199.111.154:443 github.githubassets.com tcp
US 8.8.8.8:53 user-images.githubusercontent.com udp
US 8.8.8.8:53 215.156.26.20.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 133.111.199.185.in-addr.arpa udp
US 8.8.8.8:53 154.111.199.185.in-addr.arpa udp
US 8.8.8.8:53 content-autofill.googleapis.com udp
NL 142.251.36.10:443 content-autofill.googleapis.com tcp
US 8.8.8.8:53 collector.github.com udp
US 140.82.113.21:443 collector.github.com tcp
US 185.199.111.154:443 github.githubassets.com tcp
NL 142.251.36.10:443 content-autofill.googleapis.com udp
US 8.8.8.8:53 api.github.com udp
GB 20.26.156.210:443 api.github.com tcp
US 8.8.8.8:53 21.113.82.140.in-addr.arpa udp
US 8.8.8.8:53 10.36.251.142.in-addr.arpa udp
US 8.8.8.8:53 210.156.26.20.in-addr.arpa udp
N/A 224.0.0.251:5353 udp
US 20.231.121.79:80 tcp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 89.16.208.104.in-addr.arpa udp
US 8.8.8.8:53 github.com udp
US 8.8.8.8:53 api.github.com udp
US 8.8.8.8:53 collector.github.com udp
GB 20.26.156.215:443 github.com tcp
GB 20.26.156.210:443 api.github.com tcp
US 140.82.113.22:443 collector.github.com tcp
US 8.8.8.8:53 github-cloud.s3.amazonaws.com udp
NL 142.251.36.10:443 content-autofill.googleapis.com udp
US 8.8.8.8:53 22.113.82.140.in-addr.arpa udp
US 8.8.8.8:53 raw.githubusercontent.com udp
US 185.199.110.133:443 raw.githubusercontent.com tcp
US 8.8.8.8:53 133.110.199.185.in-addr.arpa udp
US 8.8.8.8:53 api.github.com udp
GB 20.26.156.210:443 api.github.com tcp

Files

\??\pipe\crashpad_4604_DYKDYTKEFFGGZNKY

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 2a31d487e6a237a2a9a7b23b665a235c
SHA1 05e5cab94c2e3d40ed0f7ee4914d6c0fa529eaff
SHA256 30def830d52ed4739891d95d8c5ea8b726637b93bf9130f973ae5446710e04ca
SHA512 369d12d0e51ed2141f93b6f63073156491c469076b7dd871c979735ecaf55fc315dd83c89ceb263865ad96c303bc9053ddc2c8990baec2697d18cb6cf34efbef

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 bd949e773bf72276e302615349f63f8e
SHA1 cacb8ee5c1d15b7afcc60c38231d79d8bd924a28
SHA256 27336efab7de6a7123bdcab1d470a0ce447444c1181cf39e98a6d431ef75cca0
SHA512 5cd7a74592af22b0e7932de49cc3e0d2d37318a0818f6966f16eb8144182ff6571920558fe220ff2f3bc9b4bb758d076cae4cd07d8b0645455164196936867d7

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 797679e2024f25caa07031de14427167
SHA1 7105546b76e8182211c7818b3a9e4dc5ad049c89
SHA256 780c5574b0cd21c65971a5fb23289e8ea8ab0b6b87229374c5097fb1c2fdd4f8
SHA512 14b9111e1e6052ada5e49a8b892bfafda2eabc88d7aed445fc4cbf8e3bc182281f3c528680172aab2e83416649e6a098165d98bdc5ce7747cc939ff1806c88cc

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

MD5 8f54c928e50c89fe7bb958241fc61968
SHA1 9b27f0b2fb6c4b80fc20c5117c5dd4866ef69bb1
SHA256 b47909554a0b949ea79a2dba2f7dc6649f305a7aea3c36c5e69a7531b5cc4945
SHA512 ea2e324ad1a65f1246d8547ee8662bf153eff45b56dd52acefc1dc4f89baf9fb9a1c210d698ec09e446adbc627e3cff40bf883edf5e5f0cbf33be7447d4373e1

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 2819f85e5e78ac274e2006246bf8ec7b
SHA1 a25dbdd9c83537fc8308560710e427d14d2f4094
SHA256 69312f9ebb05fca53c20cd3dd41365d444c9dacc2391f2d5af94975e9feb62f7
SHA512 cf8cf57368723e8ba76fbadf7cc1cde79d41661df31e76ba3ec8c70013016b0784d9ab3a7bf9465df787f97f9fc591bc44b02713eb797778b9dc8d771dad4496

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\e5b48df7-f52e-4844-8a3d-f79a0fc44295.tmp

MD5 fb4872c5a8ba041115cd93e231af05ac
SHA1 d7c8f64ce3acb68f07930387d13ac5421c6e9a18
SHA256 6131e02237334fdcbcf9ca1c17be633ff13b807514c123caccbf6feefdf941bd
SHA512 5c16aa0a61aa95643d53218802a0df2ddd68c20cd496f147b59e97e52870acfe689fd29de06aadbdc15df19d6d10d2bbe10ff9d4e491932a911b19075764393d

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 58f55db21a56095c73cb9faeb14e7734
SHA1 ad9360c766d0d7ac4e1aa85cad33a09b7f7e6179
SHA256 66f6d9c11b6a87bbead47313496c7c6bd3fa611dea55d9ed4831ca917d2bb7e9
SHA512 be87bc4cf2e74a1cb9b4bbba96e79bc20cbd69db49bc194df2e5e86f217a9af54d69f060d680433b3c9a85f982314be5963f5857f9763de208be6baaca9b652e

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

MD5 2581fe77098d28fd09c6ca8359db272f
SHA1 849435e81b0e36887bf5266d91116ab0dc1ddc5e
SHA256 6115d05184f1fb5caee8f105b772b168c66b9d740295c53beed73d17268f0b98
SHA512 b00a8169c242cb6d35fdbb33d04b6a114581e838880294e0a1006d07b1abea5894f8d54cd7149406191549e22bebdea1fa4bfbded99887b7a795b1d1e260e39c

C:\Users\Admin\Downloads\ExtremeDeath.zip

MD5 80bf076cf31615750f7416d3bc7bb87f
SHA1 8b63084e104752100b0bdc9eb4d2ff9864557e90
SHA256 8509174c6b51296ac8a43d08dc773c48fa10b86c9ff7095c4f80bba31966ea1d
SHA512 733374e03c4fe4345c2a6f8de500f62de5c9e5541561dd257d8ef004c3d12ab43797079c043be5896b8e5530735154deba3934dfd36ca9515feaeb4bb651ae34

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 0befa01ac01ec2e51227a8519a7a2bae
SHA1 16e98048974559118f86d8b361ec63d323aed9a9
SHA256 ec64f87b803e4a019286b3de6242676924e869d9cda096bf49d79be6c0a10683
SHA512 0cd79ea82585a5bea4426cd933873705b4440f189df9ec6aa97c452b10ecd8e95c6d659f1efdc52342f1c4c66ec8e71ff71cc3eb6e08744a1476a7cbd917ad0d

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe5b5475.TMP

MD5 f7ef068c62bdacfec8d85fab67399530
SHA1 ff8a95b364f2b01953fb159b9383b44a93f55053
SHA256 81f655e319b2a77107c152715ec8724a642fbfa4772990ba7c0b481322d17883
SHA512 d75a464b26b478806051adab581746cdb79cda01e312d599846a7547062944c2956d73ddd831abf63780501fc982b967ab17e143524315541e91f323f8ae8daf

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

MD5 bbf4d7f7d0d3bc6db6305546bf924c40
SHA1 2d62d760b6b624bda93cff806368078ea208a0da
SHA256 b149fe8bf9c5183ea23fe5cf5425856433f8a3868d4ec27880b92372204aeb4f
SHA512 de9247484cc65166d144d976828a4d7994f95cb9c0030bd51813d4d5c3ad1e840d4b7a865fdfb2d02321164db901e2aeeb6e66929a3fdb4511f01d672ac79025

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 93be1839ac6c9306b7a2b2e9f63271ca
SHA1 730868c3cad4cdc31e13a92d4db394607f50ca4b
SHA256 931a871db6275e76c774f1cc3d1fc8d7593457579f0ade68ec17716242355762
SHA512 bb8283b7373e31e5f5f28addc5ae9f545f6ab0d204d89bb261f395704077614ac4e2b8f9d230dffc79da26f5cbbe4c38bb494bfb294d2a5073eb7f8005eba1fb

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 3ba1d08edfbb88de52773d1799520612
SHA1 73cd0cdcc67c6191ec7c23198883e9becfc71b3b
SHA256 e326cd9de5ceb62047a34e3112b62832e16a57c27eb4d808bd2166bf973939f2
SHA512 3fa2ac2bd72998b80b9224c0347f1b3892ebff0cc00887ef6ed6dac3f051bd90d15b4aeb941cd5a56a904bea7d8b1a5e7998b3681cf89358665608971ba38cd7

C:\Users\Admin\Downloads\ExtremeDeath\ExtremeDeath.exe

MD5 c5beb8a1b7dd11483cfc2f032d2bb861
SHA1 f4c530d8d8ea1f1d7bbba72218660f6585d3cb41
SHA256 6587cb50a483b55754761252903bfa1156f278ebc78a06d7e1fd34d2b09a26f8
SHA512 736e866c08e9451473b6ac1566f7173569d015ad232a204d6fc8f216b5edbae0f3adc8e31b91b1caa8f3b43ee9891414c992336f7bfdb32aea2e3c6989527b95

memory/400-320-0x0000000000400000-0x000000000051D000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\DC24.tmp\DC25.tmp\DC26.bat

MD5 8c5dafc8fbd26dd529c25a01ecd5a51d
SHA1 839e962516258049a9e5e358dec7fe352e09d840
SHA256 355785cc786eed7dffecfa7d33872f6de6baa833dce34598adf0d5c8688c00f6
SHA512 fda772a900c542eb59f4a94dc1eadec9677bb117e84a07c4e5c1afbf853704e6be4031383330f0dd88d2b48bbca973484c1e60ab3aa9424158f2c787e63de295

C:\Users\Admin\AppData\Local\Temp\DC24.tmp\prompt.vbs

MD5 709874d32bd68e69010acdf70cebf063
SHA1 feb94076246fe2fc902ef04d745fa0e60fe1497f
SHA256 1187be0f09aa0f917718064406e4595ac6137dd3a801e91ab2d7a03d98872da1
SHA512 bdb10baa9d02f9fff1b59e718a59c6c5a163d4a9d503fb2fe1767163fd3d746c01a7ca1546ad4febc25685d5a854635bc6170009db851a66853ce66d71d25526

C:\Users\Admin\AppData\Local\Temp\DC24.tmp\TrashMBR.exe

MD5 42d06436fdc392a4e90d03623119fa87
SHA1 df9f007d438fc17fd47324b74a82d100a0763204
SHA256 82f2e6b2cdad0ef859fe839c97bd7c0a34452638d49094979d7c0c4488b5c2ab
SHA512 52655cd83ab881c93c9076ad0d8a9b8ebeba37d6d2b00ebcf5a45f1e835463898aa22611445ff7505977cb8d8942e2f8b6a60706ec7eee494f7131ecc65e76c4

memory/3440-345-0x0000000000400000-0x00000000004D8000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\DC24.tmp\beeper.exe

MD5 8d1a9c2e8d53425499f3a1853d2e0910
SHA1 83962bce20d3f84b796486489e2c734afd1d0846
SHA256 1d89bd45a36dd300a250292cacf22a7beff3cfe0dfddab0d7b77c3c260032131
SHA512 81ba0b91f2fd0ba9b198c59ae7cc6115bf9b05c119ea46f37043a1981ef246c617fe6ba5590048b2e1383fb27c686b6eb75fdd6e642ea4433b404d0eaabf3950

memory/508-349-0x0000000000800000-0x000000000086A000-memory.dmp

memory/508-350-0x000000001B4F0000-0x000000001B550000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\DC24.tmp\MouseError.exe

MD5 cc72818ce44b3506b64b7f9a73d701bf
SHA1 041497924684e41aa671fe64acf6f980e0d9da7c
SHA256 48da69b9dfd600973ffcdba14abd88972ae51a5cae31b41d85ed56977f2b94dc
SHA512 4e3ad05ad99bd8c150ad99c8becca122613e446c678617f0a5a28e780706afe03580ec643956245e5e02d169e4f28bdf4f95b7d095d8e055517508c7dbeb0149

memory/400-355-0x0000000000400000-0x000000000051D000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\DC24.tmp\MouseWarning.exe

MD5 ad241a26c7f536fdb0658d602a86fcdd
SHA1 f862eecbac2d4afe4a437b77c6020b6de38b0671
SHA256 c3c6fe174f474e47b93e7aea1d0d77539d6880c3d84acac6412eff3393366dae
SHA512 5d8f9bd5d17a98b03adb4f0e173f011071708847748395889e7b582a25fc9f4606223415d9b61b3f82274a3addd73d86752bfba0bcb452990347f6b1439d672f

C:\Users\Admin\AppData\Local\Temp\DC24.tmp\MouseAppIcon.exe

MD5 92af619c1bdabf79c26bddda2556d9d0
SHA1 ac153eb6edd873abf6dcb6a0edbc9922d15e5dd1
SHA256 72a5692d137571317f84287c4f2abb341b95173f9ee43901f6b3272bb1631e95
SHA512 439855a8487f5cdd5ec195c303c85078af69c05ae28a837ff4d74d8e9f922a9556299b02b7bfdbe47f4287772604b21fe017ee49e0668022877a063771a37adb

memory/996-363-0x0000000000400000-0x000000000041D000-memory.dmp

memory/1840-365-0x0000000000400000-0x000000000041D000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

MD5 f884f3a7141b753742773d728055b87e
SHA1 be35ef6dbee1fa4792ad34a5eaf417e8c9d4bbb9
SHA256 7e9f926be0d61c4cfc598f97c0d11745446e93a18ab924824db9527ef86cd136
SHA512 d5e8107bb0df999a32275d5cc43b5c48a385a8751b0b282233c2f5bcee9c253ba6f4a63f65ed76056429c6864b78e7a9972f36ebcb7ba8ed6292e96fd407f394

C:\Users\Admin\AppData\Local\Temp\DC24.tmp\PlgBlt.exe

MD5 5d8ff1dd3662ac09e5bfa682ffdb233e
SHA1 c0ed5cfd5fa76db7087b4f25a806e124e29520af
SHA256 7cd320070e23e6582589d83f01f4da86ce0d1c0fe83d8df2007886c6ea10cc83
SHA512 d2258dda192a6a938989617aa46c33c0eabfae2a2d3284d3ac999b8d482ff2f08ffde836156ff341e51029d946f71ce77892b13a5924996b92a7773f2e123bb9

memory/996-378-0x0000000000400000-0x000000000041D000-memory.dmp

memory/384-379-0x0000000000400000-0x000000000041D000-memory.dmp

memory/1840-380-0x0000000000400000-0x000000000041D000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 3bcf004da3b803d0765bb52bed3ea91a
SHA1 4f39b092a73ded72926b467417362526d76ba38f
SHA256 553e3ca30db84a278da3ebb755cf209a2481f304a1191316da4cb55c1e367e88
SHA512 8e8a029c4ccc471d1bb1adce73d7fe5bae08aca9f88983e478aa13962da1988bdc86c378469ca77b6999b76ef4ebc7979f56fcb8082b7fd919f81648847fb25b

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 0de861330bedba743c0ada3b0cdca489
SHA1 a153d748f95bc38a5c51f3c96d20cc42b6bf6bf3
SHA256 1d2b810e009e89ce6d2f9a4d0ba1b43bbfcc609f6f9c047937d4876e749c7638
SHA512 ddd2e0a66f8c425a049b230aee13724950072f130626a424c8a48600c6f116f6bd076c1f99f15e667295e8dd2ec765f9b361720883709784a9c78c4ca6a827a7

memory/1500-404-0x0000000000400000-0x000000000041D000-memory.dmp

memory/2944-405-0x0000000000400000-0x000000000041D000-memory.dmp

memory/1940-406-0x0000000000400000-0x000000000041D000-memory.dmp

memory/628-407-0x0000000000400000-0x000000000041D000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\DC24.tmp\BitBlt.exe

MD5 d96dcc6c97ee4740f0a3a41b3bccf5cc
SHA1 25530ffaf174063c119e2d0c06afdc1d2bdd416f
SHA256 e0c40f127ceef9de46569154ef16f59e7e15d19477beb167f67a72d35193114e
SHA512 0f9ca7eb852edb469fd2f73e8b2a9425771d359aff4fde220193996befaa07fb57ac5e77d11b4cf29f3d64b358169d6a95cab02af57e5eea390063d5bd9e8372

C:\Users\Admin\AppData\Local\Temp\DC24.tmp\glitch.exe

MD5 5ce49a6bbff759faf8204a65991d6bd7
SHA1 b8fe526d5cc346c506e543c7eecef995d1f96021
SHA256 48af943061196a4f47d5de6d2335bef7bcfdb89990e8ddb2339e64024f0d50d9
SHA512 e77785d8366de1062eb0d044b3b096f3d3c7687986ec332a607333a40acf8341f917a62f910ca5b419b4122f294e11d81e6fbaf707c240baa8556ede87d01356

memory/2944-416-0x0000000000400000-0x000000000041D000-memory.dmp

memory/628-418-0x0000000000400000-0x000000000041D000-memory.dmp

memory/1940-417-0x0000000000400000-0x000000000041D000-memory.dmp

memory/3468-420-0x0000000000400000-0x000000000041D000-memory.dmp

memory/2944-422-0x0000000000400000-0x000000000041D000-memory.dmp

memory/688-425-0x0000000000400000-0x000000000041D000-memory.dmp

memory/628-424-0x0000000000400000-0x000000000041D000-memory.dmp

memory/1940-423-0x0000000000400000-0x000000000041D000-memory.dmp

memory/2944-429-0x0000000000400000-0x000000000041D000-memory.dmp

memory/628-431-0x0000000000400000-0x000000000041D000-memory.dmp

memory/1940-430-0x0000000000400000-0x000000000041D000-memory.dmp

memory/628-439-0x0000000000400000-0x000000000041D000-memory.dmp

memory/1940-438-0x0000000000400000-0x000000000041D000-memory.dmp

memory/2944-437-0x0000000000400000-0x000000000041D000-memory.dmp