Analysis

  • max time kernel
    141s
  • max time network
    143s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240802-en
  • resource tags

    arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    28-09-2024 12:44

General

  • Target

    https://www.youtube.com/redirect?event=channel_description&redir_token=QUFFLUhqbWZIYUJ4TWx6cS0tVG9DTmhDaFZDbFlJTXVJQXxBQ3Jtc0ttaVhpOW5XUkh6NnN5ek1PdWxpT3g3emZwVDA0TThMTlJyQXpHUUd5OHY0UTVKdThVel8xRnFwRXlWQUZob19jOU5FNFVVb0pJQmJjZjEwcWpDclZLVmM3Z1plbW1Td3F2M1lqeVUxaFJKYkpabDlDbw&q=https%3A%2F%2Ftinyurl.com%2F2h4sppnc

Malware Config

Signatures

  • Rhadamanthys

    Rhadamanthys is an info stealer written in C++ first seen in August 2022.

  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Downloads MZ/PE file
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 3 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

    When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 20 IoCs
  • NTFS ADS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 19 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 12 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
      PID:2116
      • C:\Windows\SysWOW64\openwith.exe
        "C:\Windows\system32\openwith.exe"
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:4236
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.youtube.com/redirect?event=channel_description&redir_token=QUFFLUhqbWZIYUJ4TWx6cS0tVG9DTmhDaFZDbFlJTXVJQXxBQ3Jtc0ttaVhpOW5XUkh6NnN5ek1PdWxpT3g3emZwVDA0TThMTlJyQXpHUUd5OHY0UTVKdThVel8xRnFwRXlWQUZob19jOU5FNFVVb0pJQmJjZjEwcWpDclZLVmM3Z1plbW1Td3F2M1lqeVUxaFJKYkpabDlDbw&q=https%3A%2F%2Ftinyurl.com%2F2h4sppnc
      1⤵
      • Drops file in Windows directory
      • Enumerates system info in registry
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:3716
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd493bcc40,0x7ffd493bcc4c,0x7ffd493bcc58
        2⤵
          PID:2932
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1816,i,12861692940010316850,16914978182771827851,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=1812 /prefetch:2
          2⤵
            PID:4284
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1388,i,12861692940010316850,16914978182771827851,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=2092 /prefetch:3
            2⤵
              PID:1928
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2176,i,12861692940010316850,16914978182771827851,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=1784 /prefetch:8
              2⤵
                PID:3844
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3080,i,12861692940010316850,16914978182771827851,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=3096 /prefetch:1
                2⤵
                  PID:2280
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3248,i,12861692940010316850,16914978182771827851,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=3244 /prefetch:1
                  2⤵
                    PID:944
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4580,i,12861692940010316850,16914978182771827851,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=4588 /prefetch:8
                    2⤵
                      PID:4756
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4648,i,12861692940010316850,16914978182771827851,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=4936 /prefetch:8
                      2⤵
                        PID:968
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4860,i,12861692940010316850,16914978182771827851,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=4832 /prefetch:8
                        2⤵
                          PID:3188
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=4964,i,12861692940010316850,16914978182771827851,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=4940 /prefetch:1
                          2⤵
                            PID:3620
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=3140,i,12861692940010316850,16914978182771827851,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=5068 /prefetch:1
                            2⤵
                              PID:2716
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=5192,i,12861692940010316850,16914978182771827851,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=5164 /prefetch:1
                              2⤵
                                PID:1696
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5420,i,12861692940010316850,16914978182771827851,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=5404 /prefetch:8
                                2⤵
                                  PID:4236
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5424,i,12861692940010316850,16914978182771827851,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=5568 /prefetch:8
                                  2⤵
                                    PID:2084
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=5364,i,12861692940010316850,16914978182771827851,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=5436 /prefetch:1
                                    2⤵
                                      PID:3768
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5052,i,12861692940010316850,16914978182771827851,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=5468 /prefetch:8
                                      2⤵
                                      • NTFS ADS
                                      PID:3144
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=4896,i,12861692940010316850,16914978182771827851,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=4748 /prefetch:8
                                      2⤵
                                        PID:1704
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5668,i,12861692940010316850,16914978182771827851,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=4892 /prefetch:8
                                        2⤵
                                        • Subvert Trust Controls: Mark-of-the-Web Bypass
                                        • NTFS ADS
                                        PID:2908
                                      • C:\Users\Admin\Downloads\7z2408-x64.exe
                                        "C:\Users\Admin\Downloads\7z2408-x64.exe"
                                        2⤵
                                        • Executes dropped EXE
                                        • Drops file in Program Files directory
                                        • System Location Discovery: System Language Discovery
                                        • Modifies registry class
                                        • Suspicious use of SetWindowsHookEx
                                        PID:2276
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=5344,i,12861692940010316850,16914978182771827851,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=4908 /prefetch:8
                                        2⤵
                                        • Suspicious behavior: EnumeratesProcesses
                                        PID:2016
                                    • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
                                      "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
                                      1⤵
                                        PID:4444
                                      • C:\Windows\system32\svchost.exe
                                        C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                        1⤵
                                          PID:5012
                                        • C:\Windows\System32\rundll32.exe
                                          C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                          1⤵
                                            PID:3696
                                          • C:\Program Files\7-Zip\7zG.exe
                                            "C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\grewgrwegrwgerg\" -spe -an -ai#7zMap5520:92:7zEvent19812
                                            1⤵
                                            • Executes dropped EXE
                                            • Loads dropped DLL
                                            PID:3368
                                          • C:\Users\Admin\Downloads\grewgrwegrwgerg\launcher.exe
                                            "C:\Users\Admin\Downloads\grewgrwegrwgerg\launcher.exe"
                                            1⤵
                                            • Executes dropped EXE
                                            • Suspicious use of SetWindowsHookEx
                                            PID:996
                                            • C:\Windows\system32\cmd.exe
                                              C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData'; Add-MpPreference -ExclusionPath 'C:\ProgramData'""
                                              2⤵
                                                PID:1436
                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                  powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData'; Add-MpPreference -ExclusionPath 'C:\ProgramData'"
                                                  3⤵
                                                  • Command and Scripting Interpreter: PowerShell
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  PID:1744
                                              • C:\Windows\system32\cmd.exe
                                                C:\Windows\system32\cmd.exe /d /s /c "C:\Users\Admin\AppData\Local\Temp\t1vup51feb.exe"
                                                2⤵
                                                  PID:1812
                                                  • C:\Users\Admin\AppData\Local\Temp\t1vup51feb.exe
                                                    C:\Users\Admin\AppData\Local\Temp\t1vup51feb.exe
                                                    3⤵
                                                    • Suspicious use of NtCreateUserProcessOtherParentProcess
                                                    • Executes dropped EXE
                                                    • System Location Discovery: System Language Discovery
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    • Suspicious use of SetWindowsHookEx
                                                    PID:3720
                                              • C:\Users\Admin\Downloads\grewgrwegrwgerg\launcher.exe
                                                "C:\Users\Admin\Downloads\grewgrwegrwgerg\launcher.exe"
                                                1⤵
                                                • Executes dropped EXE
                                                • Suspicious use of SetWindowsHookEx
                                                PID:4896
                                                • C:\Windows\system32\cmd.exe
                                                  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData'; Add-MpPreference -ExclusionPath 'C:\ProgramData'""
                                                  2⤵
                                                    PID:3024
                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData'; Add-MpPreference -ExclusionPath 'C:\ProgramData'"
                                                      3⤵
                                                      • Command and Scripting Interpreter: PowerShell
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      PID:3144

                                                Network

                                                MITRE ATT&CK Enterprise v15

                                                Replay Monitor

                                                Loading Replay Monitor...

                                                Downloads

                                                • C:\Program Files\7-Zip\7-zip.dll

                                                  Filesize

                                                  99KB

                                                  MD5

                                                  d346530e648e15887ae88ea34c82efc9

                                                  SHA1

                                                  5644d95910852e50a4b42375bddfef05f6b3490f

                                                  SHA256

                                                  f972b164d9a90821be0ea2f46da84dd65f85cd0f29cd1abba0c8e9a7d0140902

                                                  SHA512

                                                  62db21717f79702cbdd805109f30f51a7f7ff5f751dc115f4c95d052c5405eb34d5e8c5a83f426d73875591b7d463f00f686c182ef3850db2e25989ae2d83673

                                                • C:\Program Files\7-Zip\7z.dll

                                                  Filesize

                                                  1.8MB

                                                  MD5

                                                  1143c4905bba16d8cc02c6ba8f37f365

                                                  SHA1

                                                  db38ac221275acd087cf87ebad393ef7f6e04656

                                                  SHA256

                                                  e79ddfb6319dbf9bac6382035d23597dad979db5e71a605d81a61ee817c1e812

                                                  SHA512

                                                  b918ae107c179d0b96c8fb14c2d5f019cad381ba4dcdc760c918dfcd5429d1c9fb6ce23f4648823a0449cb8a842af47f25ede425a4e37a7b67eb291ce8cce894

                                                • C:\Program Files\7-Zip\7zG.exe

                                                  Filesize

                                                  692KB

                                                  MD5

                                                  4159ff3f09b72e504e25a5f3c7ed3a5b

                                                  SHA1

                                                  b79ab2c83803e1d6da1dcd902f41e45d6cd26346

                                                  SHA256

                                                  0163ec83208b4902a2846de998a915de1b9e72aba33d98d5c8a14a8fbf0f6101

                                                  SHA512

                                                  48f54f0ab96be620db392b4c459a49a0fa8fbe95b1c1b7df932de565cf5f77adfaae98ef1e5998f326172b5ae4ffa9896aeac0f7b98568fcde6f7b1480df4e2d

                                                • C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx

                                                  Filesize

                                                  64KB

                                                  MD5

                                                  b5ad5caaaee00cb8cf445427975ae66c

                                                  SHA1

                                                  dcde6527290a326e048f9c3a85280d3fa71e1e22

                                                  SHA256

                                                  b6409b9d55ce242ff022f7a2d86ae8eff873daabf3a0506031712b8baa6197b8

                                                  SHA512

                                                  92f7fbbcbbea769b1af6dd7e75577be3eb8bb4a4a6f8a9288d6da4014e1ea309ee649a7b089be09ba27866e175ab6f6a912413256d7e13eaf60f6f30e492ce7f

                                                • C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock

                                                  Filesize

                                                  4B

                                                  MD5

                                                  f49655f856acb8884cc0ace29216f511

                                                  SHA1

                                                  cb0f1f87ec0455ec349aaa950c600475ac7b7b6b

                                                  SHA256

                                                  7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba

                                                  SHA512

                                                  599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8

                                                • C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val

                                                  Filesize

                                                  1008B

                                                  MD5

                                                  d222b77a61527f2c177b0869e7babc24

                                                  SHA1

                                                  3f23acb984307a4aeba41ebbb70439c97ad1f268

                                                  SHA256

                                                  80dc3ffa698e4ff2e916f97983b5eae79470203e91cb684c5ccd4ff1a465d747

                                                  SHA512

                                                  d17d836ea77aeaff4cd01f9c7523345167a4a6bc62528aac74acde12679f48079d75d159e9cea2e614da50e83c2dcd92c374c899ea6c4fe8e5513d9bf06c01ff

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

                                                  Filesize

                                                  649B

                                                  MD5

                                                  ea9e1a5337070451e344b850d61de334

                                                  SHA1

                                                  3bb0882cb3b3bfcb9694222f6e2e5b9894a8f449

                                                  SHA256

                                                  fbd8f6b34adf47dc7ade4dd2261fb8dc21c8327c62c32819059735fb7752a8b1

                                                  SHA512

                                                  0d1b5c1571acd3d4dabbff8d163a7838d6886c09bfd4aa1891e5afa5ab8597585f971cedda372c18653591215776b42f64462ac3b10fc927c935736ed5a759b2

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                                  Filesize

                                                  1KB

                                                  MD5

                                                  c3729638e650e3b3db86b62708e13272

                                                  SHA1

                                                  b80cfebb11445db5f83ccab2ea5796fffe2536eb

                                                  SHA256

                                                  931295408118c78e6a3f79e1da5eaaf71466796ecf6d2df0d58c7fcd0b9af2b9

                                                  SHA512

                                                  6477460b67344f86aea5c1d9a87140d5c57d0264d99a183ab2249f2062c3c4944d6f72669c16976732815488769f8b77c8dbc2046854b8e4a82ff7a5a89c1960

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                                                  Filesize

                                                  2B

                                                  MD5

                                                  d751713988987e9331980363e24189ce

                                                  SHA1

                                                  97d170e1550eee4afc0af065b78cda302a97674c

                                                  SHA256

                                                  4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                                                  SHA512

                                                  b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                                  Filesize

                                                  858B

                                                  MD5

                                                  fb118106944b2b8e3342a5489027bee0

                                                  SHA1

                                                  e118d0b042a933f79418736aaeb781e28b89befa

                                                  SHA256

                                                  92fe94c13238b064b8dc12a530757ddc562f7c5a51ee5623960dbcd89061db85

                                                  SHA512

                                                  69fed4543b7ada17c5f33da18e48e87d1c71c49345574ecd842d6b3c91da22541da5591dda8a49095422a555d467d60f4081956a93128c66faad555d57f566d6

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                                  Filesize

                                                  524B

                                                  MD5

                                                  693834fbac359043554abb806b5d2d76

                                                  SHA1

                                                  fed734880808fa93a8043345872f60fd69278687

                                                  SHA256

                                                  e6754f424df375223501aaa7aceb79331c2972a0c0e34a7ba8f4841db6c08bce

                                                  SHA512

                                                  975b3b1d2140df1678f3ecc3c7975a90b13c8d959073c4708e09a72db3cfa0d8db738ef49072f44ef38a8b2059fdbb0dba536e090fc21c209b6a628081e264cf

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                                  Filesize

                                                  858B

                                                  MD5

                                                  7a4ef36375a482d4e028e1d91372b6f9

                                                  SHA1

                                                  dc6b7cc6f96bdf57a6439e21e04d287a5a6b3c1e

                                                  SHA256

                                                  5a024a9110bc1fccfeb56835785f5fff06663a0fd9bfc0c0edca5be45d4d4b0c

                                                  SHA512

                                                  5908dba392bd72f3f7625c4134ba86655a76f91b5eb247f79c5b4aef87b582aae04e6858ba5b39abe8d4e1bdc9def6c4ac54fb430eb19e5d8a9b2ed338638de1

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                  Filesize

                                                  10KB

                                                  MD5

                                                  7c9b496cc31021b79a225942e68216d8

                                                  SHA1

                                                  77336a945a89860ef545eb4cdcefc358ad1c8ba8

                                                  SHA256

                                                  09c2485095fa2526e3bbbb41280e2d87f2b607ae84de64805bdccc3b17069a81

                                                  SHA512

                                                  696f99839e05cdd1d0a2761d8a05d85c025a1f95f0cccb9f04a433edef09b501c033754f8a8c0926392bdd16dedc8d2cc0311984482585b781b157e3e6ba18ad

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                  Filesize

                                                  10KB

                                                  MD5

                                                  15f1d4f8b1ff32d66e3b8df37d3410ad

                                                  SHA1

                                                  9d784f9fcc8ce18a46749a8bbf54ef5d17f0da0b

                                                  SHA256

                                                  01fcf2157875ce51e3b1998e7af43c3a5783e5764d8333962d482877d9d9db6c

                                                  SHA512

                                                  b9e4c3e66e62aea0847848675e7a0994b32da47dea01d3876db79cfc6c6850c935a53c159f1a5d419584af7f0bba37e84cd16e9f5e2b844afc7585ff9c24057c

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                  Filesize

                                                  10KB

                                                  MD5

                                                  9054fd810e05c65571ffc74594bf7be0

                                                  SHA1

                                                  33b6aa8193c03c84b2eea950ffef156f60415363

                                                  SHA256

                                                  3205ff9300451df59e1ec2ffeb164e7f103357bd5b5276ee2ca4a19f23c1651a

                                                  SHA512

                                                  c85a75b1264410fc72ec1179a4582cc6ed594aefe25afbfe8dff4298ba051599cce64b764a48ac4c24367f1c461c1262503fabffd4d8aff56b77a499168f256b

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                  Filesize

                                                  9KB

                                                  MD5

                                                  a13049b46daf4ff6ad76f00cd7788712

                                                  SHA1

                                                  841586e84071ad42c65e3bfb2eb39fd1bc1fb0f3

                                                  SHA256

                                                  8ec0aea97484123478889dfe9bf14371aa8d316b2b11caa5a548cc9084510d37

                                                  SHA512

                                                  a8bd5231ced1dc83f08aa4004d54e4352058e8762c32bc0900fbb219385b30aa9f3028dec8beeadba0517a54d8f02f981af403e8b626b2a9e99592f6c4a1d981

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                  Filesize

                                                  10KB

                                                  MD5

                                                  ffd714c56c4e259af284a39ca0b7dbf6

                                                  SHA1

                                                  1262b6ab8fa294e733a8bf51991ee85073bba680

                                                  SHA256

                                                  49b46de0f1379cba4d6ebc98a85fc5ff63523b9269a90e1872b82d8101d66a01

                                                  SHA512

                                                  737d691ce2d795f959d35eabf9895ff64f7022cbc46dbac93e3cc35d542c8433c4072bc04e0a73048f53ee797997c276b619d2425ed034b813a06c3b296464af

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                  Filesize

                                                  9KB

                                                  MD5

                                                  30d17d0ebab2887137bee6a8b0ede545

                                                  SHA1

                                                  dccd6ef0a0be6fb676ddeb792fdc2973fbed1a2c

                                                  SHA256

                                                  528a4c0095e24cea9fafa6a1a61b7c58b292634e2d39f0b228d137595369baef

                                                  SHA512

                                                  f4a0a115b2c689e145d374640183162182c75dddc35c43104446bc4b0590e5b3422f75a7c3863e4582fd0151a3a3894f308eab159b99b7749c28d972a7c034f8

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                  Filesize

                                                  9KB

                                                  MD5

                                                  1fc4e7180204b94a6eb8427c82dd7003

                                                  SHA1

                                                  60108d139ad2adfce44c24038ec95319dbfcc50b

                                                  SHA256

                                                  d8cf1b459d2742b4986cbd973f8ebd5936b81ab56b4c8caf671439409c2e014a

                                                  SHA512

                                                  57782a524b86516e906a04cebadd13da810894028d391ca0b2780fbc28e6028b8aa947ef60d8742727c9ce0267d9c00b89a55673e5c4ec47f11dd28af1cc5cec

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                  Filesize

                                                  9KB

                                                  MD5

                                                  dede1e08e7af5d17389387d2a289eda0

                                                  SHA1

                                                  22b3f81d42eab489687c60d1767e2b7e625edf52

                                                  SHA256

                                                  1e424fe676205b6c3504f72ea578dcf8269c5ed7ab3858471b6b18dbf972717a

                                                  SHA512

                                                  fb9e7749a57d9223fe1b073b08d29936e1b2b75513b131b4757cc9792bd659d55915ea26676116805929d8749e17a26b3900a0b41b7c5c5a786f1331eea66d5c

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                                  Filesize

                                                  101KB

                                                  MD5

                                                  4aed91a3b4d735b388315205565aed9a

                                                  SHA1

                                                  c4c7aee2c2382959dc83748b62a9aed45ba1a263

                                                  SHA256

                                                  9bf2f6c48e532537890f74a6d3cb2531240e178d86f3e9b6a4bfc27e69f8009a

                                                  SHA512

                                                  c6e529920fcada5c1459d3773dbaaa507657400707b55e4547bdebc69d27b561001cd90962d41c5739c191e4e0410cebb5e8a69a3d0caadb84d1184e732223f9

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                                  Filesize

                                                  101KB

                                                  MD5

                                                  93befad67d536e19ed977403f6df732d

                                                  SHA1

                                                  243a2661bfbf3237fa268a2328ae378b5257b9f5

                                                  SHA256

                                                  f90786db0272361c699eed7a8510fd0ae17e50cf8fb30ade0244f763fe87adc4

                                                  SHA512

                                                  5d491924b7d23e4a9d321614672a13caa338f31579f80eddbd6e56b9764fd80b16fbb7b49d489526edc24c8829d62916f0c766fd9588a6fd2334befd18688d00

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                                  Filesize

                                                  101KB

                                                  MD5

                                                  dc318d410d614995afcf0580244cb1bf

                                                  SHA1

                                                  4bf14c042e07b1c6b1731b70ad3ff5e44d05db02

                                                  SHA256

                                                  2f9ca85a62116221e97a7bab380426f18bd67b6184a3b418b1c62a6e3e6d1ed6

                                                  SHA512

                                                  4ede56cb710dae572cfc5612e532aa23b77078dfa9a069a2e1c5012b37f62c8b6f084b8cbad70806c4cd2edd606c07073c460c92b4200bac661501308fad18de

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                                  Filesize

                                                  101KB

                                                  MD5

                                                  4903ef8bbcc12266810d40219161f895

                                                  SHA1

                                                  0c72549fff47a4e8933f79cadfe6568e41dc81d0

                                                  SHA256

                                                  b3d69ea370d49e2e0597ac075a7e232f6ecf4177a7fad09e9fed7e569889230d

                                                  SHA512

                                                  5b4291b2305057a55808bf661e23516a99d9543bb40aeb951af228bee2d1553461aa14b029a4c7a8fefb3b97e0d3d2708bf328814630630d2fddd06d145469a5

                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ce5c1edd-072f-48d1-ab11-72a5fe3d00aa.tmp

                                                  Filesize

                                                  130KB

                                                  MD5

                                                  277cc025393c03e397e852954df2dab7

                                                  SHA1

                                                  ac21490dc2dfaa19353aaaac5a2f3b658b1abc9c

                                                  SHA256

                                                  2253600dbc3da419368be6adfd8555b0c4075e871075e1e76c1ef7ffcbf72156

                                                  SHA512

                                                  e25a16b0663c8ea9c78573a1c8e0e6f33126c0d78653808dc4959ecd3ffba634da3713e2e9a059aa05985b6f6de2f772d67230796281f6c8a69f59db84fe2784

                                                • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                                                  Filesize

                                                  2KB

                                                  MD5

                                                  627073ee3ca9676911bee35548eff2b8

                                                  SHA1

                                                  4c4b68c65e2cab9864b51167d710aa29ebdcff2e

                                                  SHA256

                                                  85b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c

                                                  SHA512

                                                  3c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb

                                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                  Filesize

                                                  944B

                                                  MD5

                                                  1a9fa92a4f2e2ec9e244d43a6a4f8fb9

                                                  SHA1

                                                  9910190edfaccece1dfcc1d92e357772f5dae8f7

                                                  SHA256

                                                  0ee052d5333fd5fd86bc84856fec98e045f077a7ac8051651bf7c521b9706888

                                                  SHA512

                                                  5d2361476fa22200e6f83883efe7dcb8c3fe7dae8d56e04e28a36e9ae1270c327b6aa161d92b239593da7661289d002c574446ecfd6bd19928209aae25e3ef64

                                                • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_l1tl2w25.rrb.ps1

                                                  Filesize

                                                  60B

                                                  MD5

                                                  d17fe0a3f47be24a6453e9ef58c94641

                                                  SHA1

                                                  6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                  SHA256

                                                  96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                  SHA512

                                                  5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                • C:\Users\Admin\AppData\Local\Temp\t1vup51feb.exe

                                                  Filesize

                                                  2.4MB

                                                  MD5

                                                  ec96e65299b7639d4aa60dd315acad80

                                                  SHA1

                                                  7196b8eb744f769810b390c02371872d11c33bbd

                                                  SHA256

                                                  c1df546782a82cb03e27ccfea0002f304c56bb26b3fc3d9d8e76ff7c7f61e529

                                                  SHA512

                                                  db187aedfc8046e2c3e8c49ad7e3741b56c4280e6ea0017835dc2f0121234f69ae9a24fd5a4eab19f8f3682f0d47279b3441aedb331cdb54a38951ac5626c883

                                                • C:\Users\Admin\Downloads\7z2408-x64.exe

                                                  Filesize

                                                  1.5MB

                                                  MD5

                                                  0330d0bd7341a9afe5b6d161b1ff4aa1

                                                  SHA1

                                                  86918e72f2e43c9c664c246e62b41452d662fbf3

                                                  SHA256

                                                  67cb9d3452c9dd974b04f4a5fd842dbcba8184f2344ff72e3662d7cdb68b099b

                                                  SHA512

                                                  850382414d9d33eab134f8bd89dc99759f8d0459b7ad48bd9588405a3705aeb2cd727898529e3f71d9776a42e141c717e844e0b5c358818bbeac01d096907ad1

                                                • C:\Users\Admin\Downloads\grewgrwegrwgerg.zip:Zone.Identifier

                                                  Filesize

                                                  26B

                                                  MD5

                                                  fbccf14d504b7b2dbcb5a5bda75bd93b

                                                  SHA1

                                                  d59fc84cdd5217c6cf74785703655f78da6b582b

                                                  SHA256

                                                  eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

                                                  SHA512

                                                  aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

                                                • C:\Users\Admin\Downloads\grewgrwegrwgerg\launcher.exe

                                                  Filesize

                                                  35.9MB

                                                  MD5

                                                  d4eca6136281d617dcfac5bae3349e70

                                                  SHA1

                                                  c6941cd9df4f7db4bdf6bd163869016a2520d644

                                                  SHA256

                                                  0777bba437bc66725d3e00f17810a1dee973fef63808d3d14aa046503a5589a6

                                                  SHA512

                                                  a17b7bc6985304008649b8b6a009f675b3570e14a39e0073ea6cd00dca5ffecc0acedcc67f9c250e35b09d3c941540e74b338795f1cff12172c137d525afeb8a

                                                • \??\pipe\crashpad_3716_MFYBWOJCGURXALIY

                                                  MD5

                                                  d41d8cd98f00b204e9800998ecf8427e

                                                  SHA1

                                                  da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                  SHA256

                                                  e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                  SHA512

                                                  cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                • memory/1744-474-0x000001E34C040000-0x000001E34C062000-memory.dmp

                                                  Filesize

                                                  136KB

                                                • memory/3720-496-0x0000000000400000-0x00000000007D8000-memory.dmp

                                                  Filesize

                                                  3.8MB

                                                • memory/3720-501-0x00007FFD585A0000-0x00007FFD587A9000-memory.dmp

                                                  Filesize

                                                  2.0MB

                                                • memory/3720-503-0x00000000754F0000-0x0000000075742000-memory.dmp

                                                  Filesize

                                                  2.3MB

                                                • memory/3720-506-0x0000000000400000-0x00000000007D8000-memory.dmp

                                                  Filesize

                                                  3.8MB

                                                • memory/3720-500-0x0000000003750000-0x0000000003B50000-memory.dmp

                                                  Filesize

                                                  4.0MB

                                                • memory/3720-499-0x0000000003750000-0x0000000003B50000-memory.dmp

                                                  Filesize

                                                  4.0MB

                                                • memory/3720-495-0x0000000000400000-0x00000000007D8000-memory.dmp

                                                  Filesize

                                                  3.8MB

                                                • memory/4236-504-0x0000000000330000-0x0000000000339000-memory.dmp

                                                  Filesize

                                                  36KB

                                                • memory/4236-507-0x0000000002230000-0x0000000002630000-memory.dmp

                                                  Filesize

                                                  4.0MB

                                                • memory/4236-508-0x00007FFD585A0000-0x00007FFD587A9000-memory.dmp

                                                  Filesize

                                                  2.0MB

                                                • memory/4236-510-0x00000000754F0000-0x0000000075742000-memory.dmp

                                                  Filesize

                                                  2.3MB