Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

22/08/2024, 16:37

240822-t5an3sxclb 8

22/08/2024, 16:36

240822-t4ftpszbrp 3

Analysis

  • max time kernel
    150s
  • max time network
    141s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/08/2024, 16:37

General

  • Target

    winrar-x32-622es.exe

  • Size

    3.3MB

  • MD5

    84cd0e26bf4ad3e150e80bd10309dc5d

  • SHA1

    42c65db74fa0a13f1e068811201db15b5a312d6e

  • SHA256

    2985c4920ef1aa0bab69e6397b5ce943a53d82a49642dda20d470453275ec7d0

  • SHA512

    7148757c24f1ffc5afc364e6d7ee09b4c100168af2cf4c87057eec8b81e3ae5913f6080afd50404e10c51122f388eae602328c05257277f74a605f8d8e50c900

  • SSDEEP

    98304:qWhrDOBfKBwAf/sLdm5ZjA/nI+mod933b/kWlEXm8:/pULdm5K/I+nb/kWa/

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Impair Defenses: Safe Mode Boot 1 TTPs 2 IoCs
  • Downloads MZ/PE file
  • Drops file in System32 directory 35 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in Program Files directory 64 IoCs
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 4 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 9 IoCs
  • Modifies system certificate store 2 TTPs 18 IoCs
  • Suspicious behavior: EnumeratesProcesses 22 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 36 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\winrar-x32-622es.exe
    "C:\Users\Admin\AppData\Local\Temp\winrar-x32-622es.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:2320
  • C:\Windows\SysWOW64\werfault.exe
    werfault.exe /h /shared Global\da9912d95947426abb31489c8764ae47 /t 2772 /p 2320
    1⤵
      PID:5052
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      1⤵
      • Enumerates system info in registry
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:2984
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7fff27c9cc40,0x7fff27c9cc4c,0x7fff27c9cc58
        2⤵
          PID:1532
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1928,i,15703874675546287778,9344567693010425197,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=1924 /prefetch:2
          2⤵
            PID:2340
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2192,i,15703874675546287778,9344567693010425197,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2208 /prefetch:3
            2⤵
              PID:4600
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2292,i,15703874675546287778,9344567693010425197,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2520 /prefetch:8
              2⤵
                PID:4420
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3180,i,15703874675546287778,9344567693010425197,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3088 /prefetch:1
                2⤵
                  PID:4864
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3212,i,15703874675546287778,9344567693010425197,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3444 /prefetch:1
                  2⤵
                    PID:4196
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4520,i,15703874675546287778,9344567693010425197,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4588 /prefetch:1
                    2⤵
                      PID:4596
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4868,i,15703874675546287778,9344567693010425197,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4892 /prefetch:8
                      2⤵
                        PID:1124
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4912,i,15703874675546287778,9344567693010425197,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4892 /prefetch:8
                        2⤵
                          PID:4748
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=4436,i,15703874675546287778,9344567693010425197,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4752 /prefetch:1
                          2⤵
                            PID:1888
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=5356,i,15703874675546287778,9344567693010425197,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5336 /prefetch:1
                            2⤵
                              PID:4296
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=4408,i,15703874675546287778,9344567693010425197,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5376 /prefetch:1
                              2⤵
                                PID:4208
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=5036,i,15703874675546287778,9344567693010425197,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5200 /prefetch:1
                                2⤵
                                  PID:1132
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=4512,i,15703874675546287778,9344567693010425197,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5676 /prefetch:8
                                  2⤵
                                    PID:4584
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5664,i,15703874675546287778,9344567693010425197,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5704 /prefetch:8
                                    2⤵
                                      PID:4948
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5960,i,15703874675546287778,9344567693010425197,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5672 /prefetch:8
                                      2⤵
                                        PID:2528
                                      • C:\Users\Admin\Downloads\MBSetup.exe
                                        "C:\Users\Admin\Downloads\MBSetup.exe"
                                        2⤵
                                        • Drops file in Drivers directory
                                        • Checks BIOS information in registry
                                        • Executes dropped EXE
                                        • System Location Discovery: System Language Discovery
                                        • Suspicious behavior: EnumeratesProcesses
                                        • Suspicious use of FindShellTrayWindow
                                        PID:4760
                                    • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
                                      "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
                                      1⤵
                                        PID:2240
                                      • C:\Windows\system32\svchost.exe
                                        C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                        1⤵
                                          PID:5100
                                        • C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
                                          "C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe"
                                          1⤵
                                          • Drops file in Drivers directory
                                          • Impair Defenses: Safe Mode Boot
                                          • Drops file in Program Files directory
                                          • Executes dropped EXE
                                          • Loads dropped DLL
                                          • Modifies Internet Explorer settings
                                          • Modifies data under HKEY_USERS
                                          • Modifies registry class
                                          • Modifies system certificate store
                                          • Suspicious behavior: EnumeratesProcesses
                                          PID:512
                                          • C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe
                                            "C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe" /installmbtun
                                            2⤵
                                            • Drops file in System32 directory
                                            • Executes dropped EXE
                                            • Loads dropped DLL
                                            PID:4420

                                        Network

                                        MITRE ATT&CK Enterprise v15

                                        Replay Monitor

                                        Loading Replay Monitor...

                                        Downloads

                                        • C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe

                                          Filesize

                                          8.6MB

                                          MD5

                                          4dc92b52e48b9a7e209307def43f0fa4

                                          SHA1

                                          ba0640d5afd2d5b07fdfca4d2a37a1208bda1b94

                                          SHA256

                                          461727e42566cd84e4161d5332131956041e02e3d81cfec07c22862fa4b6d3d4

                                          SHA512

                                          cb1b2f63befed99c26a5f4912f5e9e7a315f75414097e66a2c2768573425129d18245e515d2bf38e352eefd78d0e61407d43a09993edf0aec6e2ff7c296d0d8d

                                        • C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe

                                          Filesize

                                          2.9MB

                                          MD5

                                          46f875f1fe3d6063b390e3a170c90e50

                                          SHA1

                                          62b901749a6e3964040f9af5ddb9a684936f6c30

                                          SHA256

                                          1cf9d3512efffaa2290c105ac8b7534026604067c9b533e7b7df2e017569a4ec

                                          SHA512

                                          fdfb348061158f8133380e9a94215f4bfc0f6ce643a129d623cb8034c49144f1489de56cd076da645478506d9fbddc7590fe3d643622210084b15fdf0d16b557

                                        • C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe

                                          Filesize

                                          291KB

                                          MD5

                                          6f96b5f5aefcb16a87b609e71ffe4102

                                          SHA1

                                          ff6393b0735c17b45af2e67f4a097caf3dd36764

                                          SHA256

                                          2a14ea7aa0a9032941be509b5e767562fe64e5d66fa04f5c9bd0553815ab18f3

                                          SHA512

                                          4a37f2f3cfff9d790bd0023774338ad3e370678bd87d5619c4f0938f6a92838c5bca91a0c6461a9fd137cf928b1903d4c5ca5b8b4ea1c59c7abeecd0ff387b93

                                        • C:\Program Files\Malwarebytes\Anti-Malware\ServiceConfig.json

                                          Filesize

                                          621B

                                          MD5

                                          f2bdfe7df3219d8d64313b151607d1ad

                                          SHA1

                                          cb1c444b9da64f03d8634284af9e42dde5fff971

                                          SHA256

                                          0fb1d61365a7cdae76a1e64b166f1e40e768f20a631151927e1de52147b2c23a

                                          SHA512

                                          7de260a8f762ee300ef13c483e1048a7c6d6476a46b093722e663bc8f4eb4322b11889d8080cceb7f43d7b404d32f8138982b02891808f06db3069041c9705dd

                                        • C:\Program Files\Malwarebytes\Anti-Malware\ctlrvers.dat

                                          Filesize

                                          8B

                                          MD5

                                          c9d055c8b473ed36b102277e246eab96

                                          SHA1

                                          9f21d44a5457fce59151391faa4830ed0d3b0631

                                          SHA256

                                          bd83ce37859006d7c8e9b72ba335363b4ccd98778463d076d3f1be55147c26e2

                                          SHA512

                                          31375edd020a38d018744b127764ae883a02acbdbedc663355dc22b402711f24b9dfc2b4faf09fbc0b7b5b89e7f851d9e0e16dd0dca000d395c7bc8e3fd1c620

                                        • C:\Program Files\Malwarebytes\Anti-Malware\mbtun.dll

                                          Filesize

                                          2.8MB

                                          MD5

                                          2bbf63f1dab335f5caf431dbd4f38494

                                          SHA1

                                          90f1d818ac8a4881bf770c1ff474f35cdaa4fcd0

                                          SHA256

                                          f21a980316bd4c57c70e00840ab76d9ad412092d7d2d6a2cff4f1311f7c05364

                                          SHA512

                                          ebb9834323329dc01ba2c87e5fad1083a4cb86f5ed761cb63299ac5336a9843a1aadd42fbed706797c2295117af1c00f96806422338352653c8e0255fecc2fd5

                                        • C:\Program Files\Malwarebytes\Anti-Malware\srvversion.dat

                                          Filesize

                                          9B

                                          MD5

                                          c5655eafbae3d85507c93a2a585c0dfb

                                          SHA1

                                          f6abe776d55940c74c20632d36839a09aa571008

                                          SHA256

                                          36310f22e6a5e06e5572f0dc42a97330a9807486ebfa04a3860f7e4d11f06877

                                          SHA512

                                          92f3471770f502a7f71d895a3664e929c8f1a08c39b100919b47677fa3f510ce43f1679e663d108b351a85948822dc24dbb7f7d4ea090f1081de6b37f7e9ed19

                                        • C:\Program Files\Malwarebytes\Anti-Malware\version.dat

                                          Filesize

                                          47B

                                          MD5

                                          21f4b2fe2b204991ab97f9bad9c1f1c5

                                          SHA1

                                          76ee089ba3797f9cba0dfd9da93efebc8c33d2df

                                          SHA256

                                          80e34d228b647451a3551ad1c7f166ecf2208bf227b54c23267295d9ae07b6f5

                                          SHA512

                                          ef0c0b8abc06173401655949f4de1dd817ea5801271f619f53d48db09a37df6ee4a9ad27a30385476ed9829ec30e5af01f3c4ab9c85f89df77ad6eeb20b4ec5d

                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

                                          Filesize

                                          649B

                                          MD5

                                          937888754ecf5cf9a5976aac57765f06

                                          SHA1

                                          736b225cff779617d6e606c471d73f70139d92fa

                                          SHA256

                                          0840954c49c7c9fe5d8cb184c68a39a27cc768bec23aa594da91ae0d50f20dc9

                                          SHA512

                                          92bf7836c426d82e6cc48c9f2bb61a86f5fe56f26fb964a74de7aced5d9fe58b9c5d7e7e8628dc19fb68ea6842bca60f3df39f45141b53f19161374508eca9be

                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000001

                                          Filesize

                                          212KB

                                          MD5

                                          2257803a7e34c3abd90ec6d41fd76a5a

                                          SHA1

                                          f7a32e6635d8513f74bd225f55d867ea56ae4803

                                          SHA256

                                          af23860fb3a448f2cc6107680078402555a345eb45bc5efb750f541fe5d7c174

                                          SHA512

                                          e9f4dc90d0829885f08879e868aa62041150b500f62682fc108da258eee26ad9509dcbf6e8a55f2d0bdba7aa9118dd149a70a7d851820d4ea683db7808c48540

                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                                          Filesize

                                          216B

                                          MD5

                                          6aa8049394d4b2339a1a05a3d7857b43

                                          SHA1

                                          4ca76c2204e81d501c37ccb4c48c9b38f9808497

                                          SHA256

                                          b29d2d12d20694272e6b20f4aede44c38ac2ec2e59862896efda2adb3d988b1e

                                          SHA512

                                          b7d5044c27c8bd68f53a2f8614bd2239aeae3744dea59facbb6ca5e4f330530d41229a9cc625af83f3bab8a9ba8317d73bbef728d24d1c9a186da8d24274ec76

                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                                          Filesize

                                          1KB

                                          MD5

                                          fbbfc75ec8518c0568b264df86a1795a

                                          SHA1

                                          ee10460430f5fafa1c184883c330a69228a4fdf2

                                          SHA256

                                          73aa231c3547d2b714269674a6fb6b0e9900cc16fb38f469c74bf220f04fc06e

                                          SHA512

                                          1b5c31505e1090496d51ee60d19d4f05015a1e77ed7318f9f9094606f652f5b639f7efd43b23f039970adc36f23ca3d578215c0bd3c76952ae4953b293bedb30

                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnCache\data_1

                                          Filesize

                                          264KB

                                          MD5

                                          7594af1143ee411974b431e40b8c7177

                                          SHA1

                                          c5a02ae747fc2942d7a5ba806ece454e3649410f

                                          SHA256

                                          9a40624f4b8fae1613adafcf826db77382697b3fc6788b0c0306fa8828580662

                                          SHA512

                                          563a34927831cca244bfb19f2c820549bc17b6fef8c5885a7f07ac0eef695c3161cb46b3fc3dd749c53fcad6270394d8ac622574a2bdffd74b871a65d04764c9

                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                          Filesize

                                          2KB

                                          MD5

                                          fc0404a264a3999e951dcd92d7e83297

                                          SHA1

                                          4d2f47d5ae682a67bb15b7eeeaa17d9c4f86f640

                                          SHA256

                                          bcb1e015081220fc2cd4917d2cee2fcaffdb176b4c6fba85f2278cbb694181f3

                                          SHA512

                                          6544654c63b8245053d096d72c22efc14557a92c184c5d2f071b8f26a06b5cc760b2c05a0a9c25e6f4f9be757ef930a7e6575f1ed76b72dd4cb6d5cd9cee8184

                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                          Filesize

                                          12KB

                                          MD5

                                          bd3660ba7c312d071be3b877f5689738

                                          SHA1

                                          ca122d0d24919f94640ba9a849067ece266ca871

                                          SHA256

                                          63940d16ea05c2f65d0909509667f08180242300074685c1ef63999759f0161a

                                          SHA512

                                          1375813a68cef470fd2dd7a88ba7be0ed76f50e34ffebfce5a7621cbc6b8e3f5b20eb4f6270db967ca012f282ab5933cd4bd60589c2ceca66479fae7b23ca84a

                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                                          Filesize

                                          2B

                                          MD5

                                          d751713988987e9331980363e24189ce

                                          SHA1

                                          97d170e1550eee4afc0af065b78cda302a97674c

                                          SHA256

                                          4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                                          SHA512

                                          b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                          Filesize

                                          356B

                                          MD5

                                          2338aa9c24afbbd41c21baa85c1e431e

                                          SHA1

                                          07b20a56992e0a6b995ef1bb631c724630eed8e6

                                          SHA256

                                          598e2684dd08994521f1e2f6c990c87c4e44228bdda0a7229715b68b6ba83ed0

                                          SHA512

                                          55fc4313a250f0819bd9127509e370b9ab08fc8f8d594c9118f18af55b62df73bb9c56fd4eddd64ce1c573d361bb802e888e211caa376b2d2954e941e38f354b

                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                          Filesize

                                          2KB

                                          MD5

                                          c0d748ec750f9c95f73edfbab376659b

                                          SHA1

                                          15f001ad0f3c2700c201551f83ce1bfc5714de82

                                          SHA256

                                          f0f519eee4654410274360979869b71b2dbd3d370bce9beaea1eebb08799d0c5

                                          SHA512

                                          b935e807f837f19a4d21c68321e072b01ca5425dfa6778c10ae824679f419a658022b1e95a5ae1665290f6d6c3c477ffb20804e9fff76c0b67edcca085e392c4

                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                          Filesize

                                          356B

                                          MD5

                                          9ea1c88df433e80b747cf86b5b0b5be7

                                          SHA1

                                          baf51a0344e0ae00b0aa6c5adcef1d05fa06c3a9

                                          SHA256

                                          16083655f969c1706f70ba5b82f24bb137b10bb7f2ad71daf5e73edfd7bee058

                                          SHA512

                                          9f9635ed1d3d1ead07e49635295401b1a74def5bce931cd71196c849e7571f6142d0fcb8737aa764cbee48840e54ab7417d97adf6a7a59469f7d339cece79509

                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                          Filesize

                                          356B

                                          MD5

                                          f9b54ee9bd984a22e90eace7dcdcc791

                                          SHA1

                                          82600296e0d75e5677777257e8cc49d97b096d8d

                                          SHA256

                                          e28673cfec6d1af24a0af369f846496f6823285178a2a01a12ec17d01b0271e7

                                          SHA512

                                          dead22442902f51af7c6a1a01e84faa13c6a5d14572c837af2f8ee005aaccc8b05f48edf4be19a0c83523d86496afc6c28c9e82929c2c3753d24c492bafb1986

                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                          Filesize

                                          9KB

                                          MD5

                                          a26a5a74d0435bbc8fd877b56e7f7df3

                                          SHA1

                                          065e806f7374ed8351dfcd2cd4edaa1a4a54ede3

                                          SHA256

                                          e3636165db173b24f7b52fefb25033d10a55c4c8cd63a6e5bbc83f337a406786

                                          SHA512

                                          b5ee5dd2471537d1e243b1783357e85038b384d1001a65bf8642f90658e9349cb4667720edc13d3ff1d8b6de7fb0404b72d4f5da9f71477e756380e591fbf118

                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                          Filesize

                                          9KB

                                          MD5

                                          7e0992eba2535129c8343d0cfa24d3df

                                          SHA1

                                          26f7d72f49984c283a76fb0826c3324cb0415585

                                          SHA256

                                          9d304d29426ef33bbbe3eaa2e32da03ef34fca689945e947b2bcf6d5ec525f11

                                          SHA512

                                          b2096e28e10390ae71d8c75c51a50cd3471d7128edb38feee56ed3fb902f8ab87a6fa16ca11f9a0cfd59099143b987383c0466d1a0690875847259dab054abb8

                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                          Filesize

                                          9KB

                                          MD5

                                          59d6acfbfc854a8b74e4f007af6b2b0d

                                          SHA1

                                          ec1c04112e5d307a7cf2fc659f03b0d31f4347c1

                                          SHA256

                                          c241ad88f428167f99b0989dd49a96bc429309aab12d85543bad079e86a5962a

                                          SHA512

                                          6767c3f6ac42b711ab4a1d2f653295ae188d9a986b2c4a301ca4fc8fedadd2e875a6e1a5fc07eebaf42bee567960d20b0d8dfc8c6d83dda871f9c2501029f5e3

                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                          Filesize

                                          10KB

                                          MD5

                                          fdc3c44e5a363b1c69ea37de84fe26ef

                                          SHA1

                                          c023d6ab44db62e6a448cc1357ace2188c0e6fda

                                          SHA256

                                          23d1ebefef6d4d6762f206c616dee2e2a5dc5938deb18616dcd4def8a2a1c207

                                          SHA512

                                          e25ffe5debe10d7716168540d6c10699fd4f934084e482256569024c3134db2acfecdf7e1b27df98438d0347f5c1e298e81b47ace630d0ea0028d96595d0b2f0

                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                          Filesize

                                          10KB

                                          MD5

                                          f73d2819b8e1ecc814aaa0f7460d651c

                                          SHA1

                                          4e33a8710a5fd89356c644f3ec3330924af291df

                                          SHA256

                                          440bd5e4cfff8b2b43f4befb33f714d6ca67ba01c7cfd7021efc746440c97aa5

                                          SHA512

                                          79df5b8184ff212b1422ff42e74457c1c589c11d9512b4c563d3a4db93cb071013df17bb9a92504f1f7c21bf4724da2c49a5af15db65c04eee309a9daba8df62

                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                          Filesize

                                          9KB

                                          MD5

                                          07cfb81046458a9a84fd3f5e1069f16c

                                          SHA1

                                          bbf59fe3a0622e0cdb416429d294eef37fa670f1

                                          SHA256

                                          8369c7ee2b446ce899d4a6881f9a88af69a7d76e47ae9234c48e74625fc7f5fc

                                          SHA512

                                          4afbf183ac8f03b4d495ac1b2cf8669d7058bfaf6d646df735625ee95e4ee887bfcce83effe4efc8c7dc65f09a2d558f2340324c509a454635e854f17baa947b

                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                          Filesize

                                          9KB

                                          MD5

                                          b24c3c46662fb729c43881ef9c86d0c9

                                          SHA1

                                          8ef14c737e0c64d8d0c102263795b4580b132e51

                                          SHA256

                                          5b6ea7a95c08ef05d9a47d2b2b54653c68e544d60a03b346abb2a8aeccb42547

                                          SHA512

                                          c14ebe305930dd543283ba52937d3961d04da6d44aac3f291ed8ec93c6425c09a2add5da5f9f07aef9cf5871ab85031c84d7eaedfbc77faf2f6fd96175c3b15d

                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

                                          Filesize

                                          15KB

                                          MD5

                                          0b33920b5e60d9e126757af9de44799f

                                          SHA1

                                          534c47fb4acffce70ed16ac84ca5049e852cdf48

                                          SHA256

                                          fe70f041f99a33fea16d805aca93f0e8cc0a65fc9da4cca1833f35bf83828fab

                                          SHA512

                                          a36f0866725eb9e719049fef753d5024f7ca8c6bf1562e15d6e4996528814f407155979f17eaae56d1d4d22390815fce31165691b0e002a66bb545967835f8b3

                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                          Filesize

                                          201KB

                                          MD5

                                          f600bda5429a3f46e614a4eab21d0322

                                          SHA1

                                          845ddca1910307cc89689e0c262d8f64204cde79

                                          SHA256

                                          2d93e321136fe0b1a015e2c3a71d30d555b9d7942165e56da337e424d466ea0e

                                          SHA512

                                          6fef7af8959d95f033154358c41d77968977c69ee8841e6dcabb2e25e9590887bc1d4f9df4dfe19405a90743374a9c9555b3561fe2a56128c5d83b15c5eed9a8

                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                          Filesize

                                          201KB

                                          MD5

                                          3967299801b30b1b4c2ffbebe4b10649

                                          SHA1

                                          716fe9e9949123ae846b6d5731f5f4e3b560d4cd

                                          SHA256

                                          d867bbcc40e62495a23592883181f3fda702baed184e4039d905c0ce23a8b1d0

                                          SHA512

                                          5edd5f9f0df6ec1b7dc5a7b2dc8fb2ee72b4541eaa3d8979f2886e182b7b4362fe7462774fea23f2e846bcdb1cad7f03b38b3c4652a7c7a5c214b2c2af0a5d31

                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                          Filesize

                                          201KB

                                          MD5

                                          bbfa5e44c52029a23013c77a22854b63

                                          SHA1

                                          c6da9162ea9f42b17a3a596de17f8531db83ab5e

                                          SHA256

                                          eed9281e6355f11217096aef3503128760e655d656130a0e55d77c133ab2c457

                                          SHA512

                                          ee5a3382cce0c5d3dd4f2ba37425fd63c865391644fd93ce97a9e666145894a9102945eac3f8639aee360a8b11edbe13e3e7e77915d47c5958edd548945fc763

                                        • C:\Users\Admin\Downloads\Unconfirmed 469096.crdownload

                                          Filesize

                                          2.5MB

                                          MD5

                                          d21bf3852bb27fb6f5459d2cf2bcd51c

                                          SHA1

                                          e59309bbe58c9584517e4bb50ff499dffb29d7b0

                                          SHA256

                                          de9c4e8b4b0c756eee4e39221c1e4e0e11c2e67effb828e27de3c4b4470ccff2

                                          SHA512

                                          17bc7740f131a1d4e84fd7e4ab5e1ce510660f5046340ef6d09ef99c56c88da2b6be3ae5c5ddb7213841c506eaec147c65abba1a7a2a8eb4fb8f6329bbaa03d1

                                        • C:\Windows\Temp\MBInstallTemp3350629960a511efa8fcc63d5579f9b2\7z.dll

                                          Filesize

                                          1.6MB

                                          MD5

                                          3430e2544637cebf8ba1f509ed5a27b1

                                          SHA1

                                          7e5bd7af223436081601413fb501b8bd20b67a1e

                                          SHA256

                                          bb01c6fbb29590d6d144a9038c2a7736d6925a6dbd31889538af033e03e4f5fa

                                          SHA512

                                          91c4eb3d341a8b30594ee4c08a638c3fb7f3a05248b459bcf07ca9f4c2a185959313a68741bdcec1d76014009875fa7cbfa47217fb45d57df3b9b1c580bc889d

                                        • C:\Windows\Temp\MBInstallTemp3350629960a511efa8fcc63d5579f9b2\ctlrpkg\Malwarebytes_Assistant.runtimeconfig.json

                                          Filesize

                                          372B

                                          MD5

                                          d94cf983fba9ab1bb8a6cb3ad4a48f50

                                          SHA1

                                          04855d8b7a76b7ec74633043ef9986d4500ca63c

                                          SHA256

                                          1eca0f0c70070aa83bb609e4b749b26dcb4409784326032726394722224a098a

                                          SHA512

                                          09a9667d4f4622817116c8bc27d3d481d5d160380a2e19b8944bdd1271a83f718415ce5e6d66e82e36819e575ec1b55f19c45213e0013b877b8d61e6feb9d998

                                        • C:\Windows\Temp\MBInstallTemp3350629960a511efa8fcc63d5579f9b2\ctlrpkg\mbae64.sys

                                          Filesize

                                          154KB

                                          MD5

                                          95515708f41a7e283d6725506f56f6f2

                                          SHA1

                                          9afc20a19db3d2a75b6915d8d9af602c5218735e

                                          SHA256

                                          321058a27d7462e55e39d253ad5d8b19a9acf754666400f82fe0542f33e733c6

                                          SHA512

                                          d9230901adeecb13b1f92287abe9317cdac458348885b96ef6500960793a7586c76ae374df053be948a35b44abe934aa853975a6ccd3788f93909903cc718c08

                                        • C:\Windows\Temp\MBInstallTemp3350629960a511efa8fcc63d5579f9b2\dbclspkg\MBAMCoreV5.dll

                                          Filesize

                                          6.3MB

                                          MD5

                                          65a49aa18cfaa688a43a62e2821fbd77

                                          SHA1

                                          2ff08fd8149e1202e580dad63f7ac1fe3130464e

                                          SHA256

                                          7dc3f946efc0cba5e4e6285bb0c77c20e04ae473f41ba58ac1a7ee539168e6ee

                                          SHA512

                                          4e0a6c1491f398ad9ed4a0004b0e6e0c6a29693f7c225d93d567ad356a9a6423b35cafe2ae5dbd8bdce9b034b35055ec1c3e5248a09a3a209116ed1f7e62aea1

                                        • C:\Windows\Temp\MBInstallTemp3350629960a511efa8fcc63d5579f9b2\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\mscordaccore.dll

                                          Filesize

                                          1.3MB

                                          MD5

                                          3143ffcfcc9818e0cd47cb9a980d2169

                                          SHA1

                                          72f1932fda377d3d71cb10f314fd946fab2ea77a

                                          SHA256

                                          b7fb9547e4359f6c116bd0dbe36a8ed05b7a490720f5a0d9013284be36b590b7

                                          SHA512

                                          904800d157eb010e7d17210f5797409fea005eed46fbf209bca454768b28f74ff3ff468eaad2cfd3642155d4978326274331a0a4e2c701dd7017e56ddfe5424b

                                        • C:\Windows\Temp\MBInstallTemp3350629960a511efa8fcc63d5579f9b2\servicepkg\MBAMService.exe

                                          Filesize

                                          8.6MB

                                          MD5

                                          2d49262ee00ca948aefc1047d65bca56

                                          SHA1

                                          ae60524cd5d0fc2e8f32b38835667871747db3fb

                                          SHA256

                                          6931bb215c086739a7b2ab089a8bd9cd4b2acbb9f44a32ec1b420f216f6ff782

                                          SHA512

                                          d069d4f20d69aa102438f1779f6222cfef7967733cce8d744bf6121e8e22bfc8dee4ee6887cf13e17ea173a0db4c52e3009fe85b861f5c7622294b63b366877a

                                        • C:\Windows\Temp\MBInstallTemp3350629960a511efa8fcc63d5579f9b2\servicepkg\mbamelam.cat

                                          Filesize

                                          10KB

                                          MD5

                                          60608328775d6acf03eaab38407e5b7c

                                          SHA1

                                          9f63644893517286753f63ad6d01bc8bfacf79b1

                                          SHA256

                                          3ed5a1668713ef80c2b5599b599f1434ad6648999f335cf69757ea3183c70c59

                                          SHA512

                                          9f65212121b8a5d1a0625c3baa14ef04a33b091d26f543324333e38dcdb903e02ccc4d009e22c2e85d2f61d954e0b994c2896e52f685003a6ef34758f8a650c7

                                        • C:\Windows\Temp\MBInstallTemp3350629960a511efa8fcc63d5579f9b2\servicepkg\mbamelam.inf

                                          Filesize

                                          2KB

                                          MD5

                                          c481ad4dd1d91860335787aa61177932

                                          SHA1

                                          81633414c5bf5832a8584fb0740bc09596b9b66d

                                          SHA256

                                          793626d240fd8eefc81b78a57c8dfe12ea247889b6f07918e9fd32a7411aa1c3

                                          SHA512

                                          d292e028936412f07264837d4a321ecfa2f5754d4048c8bcf774a0e076e535b361c411301558609d64c71c1ce9b19e6041efa44d201237a7010c553751e1e830

                                        • C:\Windows\Temp\MBInstallTemp3350629960a511efa8fcc63d5579f9b2\servicepkg\mbamelam.sys

                                          Filesize

                                          20KB

                                          MD5

                                          9e77c51e14fa9a323ee1635dc74ecc07

                                          SHA1

                                          a78bde0bd73260ce7af9cdc441af9db54d1637c2

                                          SHA256

                                          b5619d758ae6a65c1663f065e53e6b68a00511e7d7accb3e07ed94bfd0b1ede0

                                          SHA512

                                          a12ccf92bead694f5d3cba7ff7e731a2f862198efc338efc7f33a882fe0eb7499fb3fb533538d0a823e80631a7ca162962fbdfd78e401e3255672910b7140186