Analysis

  • max time kernel
    95s
  • max time network
    101s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02-10-2024 22:27

Errors

Reason
Machine shutdown

General

  • Target

    https://github.com/TheDarkMythos/windows-malware

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • UAC bypass 3 TTPs 1 IoCs
  • Disables RegEdit via registry modification 1 IoCs
  • Disables Task Manager via registry modification
  • Downloads MZ/PE file
  • Possible privilege escalation attempt 4 IoCs
  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 4 IoCs
  • Modifies file permissions 1 TTPs 4 IoCs
  • Modifies system executable filetype association 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Drops file in System32 directory 2 IoCs
  • Drops file in Program Files directory 37 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Modifies Control Panel 4 IoCs
  • Modifies data under HKEY_USERS 15 IoCs
  • Modifies registry class 11 IoCs
  • NTFS ADS 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 48 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 2 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/TheDarkMythos/windows-malware
    1⤵
    • Enumerates system info in registry
    • NTFS ADS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:5052
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff85f4c46f8,0x7ff85f4c4708,0x7ff85f4c4718
      2⤵
        PID:2432
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,13084122085071421827,15586956561862627607,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:2
        2⤵
          PID:4588
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,13084122085071421827,15586956561862627607,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2116 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:2480
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2060,13084122085071421827,15586956561862627607,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2900 /prefetch:8
          2⤵
            PID:4328
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,13084122085071421827,15586956561862627607,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
            2⤵
              PID:2064
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,13084122085071421827,15586956561862627607,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1
              2⤵
                PID:3168
              • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,13084122085071421827,15586956561862627607,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5380 /prefetch:8
                2⤵
                  PID:2668
                • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,13084122085071421827,15586956561862627607,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5380 /prefetch:8
                  2⤵
                  • Suspicious behavior: EnumeratesProcesses
                  PID:976
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2060,13084122085071421827,15586956561862627607,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5156 /prefetch:8
                  2⤵
                    PID:372
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,13084122085071421827,15586956561862627607,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1752 /prefetch:1
                    2⤵
                      PID:4284
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2060,13084122085071421827,15586956561862627607,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5960 /prefetch:8
                      2⤵
                        PID:4032
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2060,13084122085071421827,15586956561862627607,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6064 /prefetch:8
                        2⤵
                        • Suspicious behavior: EnumeratesProcesses
                        PID:4108
                    • C:\Windows\System32\CompPkgSrv.exe
                      C:\Windows\System32\CompPkgSrv.exe -Embedding
                      1⤵
                        PID:3504
                      • C:\Windows\System32\CompPkgSrv.exe
                        C:\Windows\System32\CompPkgSrv.exe -Embedding
                        1⤵
                          PID:788
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe"
                          1⤵
                          • Enumerates system info in registry
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious use of FindShellTrayWindow
                          • Suspicious use of SendNotifyMessage
                          PID:1052
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff85135cc40,0x7ff85135cc4c,0x7ff85135cc58
                            2⤵
                              PID:1808
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1840,i,8522080827948947066,2278159443096652519,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=1832 /prefetch:2
                              2⤵
                                PID:2604
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2176,i,8522080827948947066,2278159443096652519,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2232 /prefetch:3
                                2⤵
                                  PID:4104
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2280,i,8522080827948947066,2278159443096652519,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2296 /prefetch:8
                                  2⤵
                                    PID:4864
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3180,i,8522080827948947066,2278159443096652519,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3200 /prefetch:1
                                    2⤵
                                      PID:1212
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3336,i,8522080827948947066,2278159443096652519,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3444 /prefetch:1
                                      2⤵
                                        PID:4868
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4588,i,8522080827948947066,2278159443096652519,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4604 /prefetch:1
                                        2⤵
                                          PID:3612
                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4560,i,8522080827948947066,2278159443096652519,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4572 /prefetch:8
                                          2⤵
                                            PID:2492
                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4728,i,8522080827948947066,2278159443096652519,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4852 /prefetch:8
                                            2⤵
                                              PID:5040
                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=4420,i,8522080827948947066,2278159443096652519,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4452 /prefetch:1
                                              2⤵
                                                PID:3716
                                            • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
                                              "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
                                              1⤵
                                                PID:3400
                                              • C:\Windows\System32\rundll32.exe
                                                C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                1⤵
                                                  PID:4528
                                                • C:\Users\Admin\Downloads\MrsMajor2.0.exe
                                                  "C:\Users\Admin\Downloads\MrsMajor2.0.exe"
                                                  1⤵
                                                  • Checks computer location settings
                                                  • Executes dropped EXE
                                                  • System Location Discovery: System Language Discovery
                                                  PID:436
                                                  • C:\Windows\system32\wscript.exe
                                                    "C:\Windows\sysnative\wscript.exe" C:\Users\Admin\AppData\Local\Temp\65F8.tmp\65F9.vbs
                                                    2⤵
                                                    • Modifies WinLogon for persistence
                                                    • UAC bypass
                                                    • Disables RegEdit via registry modification
                                                    • Checks computer location settings
                                                    • Modifies system executable filetype association
                                                    • Adds Run key to start application
                                                    • Drops file in Program Files directory
                                                    • Modifies Control Panel
                                                    • Modifies registry class
                                                    • System policy modification
                                                    PID:3936
                                                    • C:\Windows\System32\cmd.exe
                                                      "C:\Windows\System32\cmd.exe" /c cd\&cd "C:\Users\Admin\AppData\Local\Temp" & eula32.exe
                                                      3⤵
                                                        PID:4228
                                                        • C:\Users\Admin\AppData\Local\Temp\eula32.exe
                                                          eula32.exe
                                                          4⤵
                                                          • Executes dropped EXE
                                                          • System Location Discovery: System Language Discovery
                                                          PID:4704
                                                      • C:\Program Files\MicrosoftWindowsServicesEtc\GetReady.exe
                                                        "C:\Program Files\MicrosoftWindowsServicesEtc\GetReady.exe"
                                                        3⤵
                                                        • Checks computer location settings
                                                        • Executes dropped EXE
                                                        • System Location Discovery: System Language Discovery
                                                        PID:3612
                                                        • C:\Windows\system32\cmd.exe
                                                          "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\1\B6F7.bat "C:\Program Files\MicrosoftWindowsServicesEtc\GetReady.exe""
                                                          4⤵
                                                          • Drops file in System32 directory
                                                          PID:1852
                                                          • C:\Windows\System32\takeown.exe
                                                            takeown /f taskmgr.exe
                                                            5⤵
                                                            • Possible privilege escalation attempt
                                                            • Modifies file permissions
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            PID:3172
                                                          • C:\Windows\System32\icacls.exe
                                                            icacls taskmgr.exe /granted "Admin":F
                                                            5⤵
                                                            • Possible privilege escalation attempt
                                                            • Modifies file permissions
                                                            PID:4328
                                                          • C:\Windows\System32\takeown.exe
                                                            takeown /f sethc.exe
                                                            5⤵
                                                            • Possible privilege escalation attempt
                                                            • Modifies file permissions
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            PID:4496
                                                          • C:\Windows\System32\icacls.exe
                                                            icacls sethc.exe /granted "Admin":F
                                                            5⤵
                                                            • Possible privilege escalation attempt
                                                            • Modifies file permissions
                                                            PID:920
                                                      • C:\Program Files\MicrosoftWindowsServicesEtc\notmuch.exe
                                                        "C:\Program Files\MicrosoftWindowsServicesEtc\notmuch.exe"
                                                        3⤵
                                                        • Executes dropped EXE
                                                        • System Location Discovery: System Language Discovery
                                                        PID:3700
                                                      • C:\Windows\System32\shutdown.exe
                                                        "C:\Windows\System32\shutdown.exe" -r -t 5
                                                        3⤵
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:2844
                                                  • C:\Windows\system32\LogonUI.exe
                                                    "LogonUI.exe" /flags:0x4 /state0:0xa3959855 /state1:0x41c64e6d
                                                    1⤵
                                                    • Modifies data under HKEY_USERS
                                                    • Suspicious use of SetWindowsHookEx
                                                    PID:1252
                                                  • C:\Windows\System32\rundll32.exe
                                                    C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding
                                                    1⤵
                                                      PID:3216

                                                    Network

                                                    MITRE ATT&CK Enterprise v15

                                                    Replay Monitor

                                                    Loading Replay Monitor...

                                                    Downloads

                                                    • C:\Program Files\MicrosoftWindowsServicesEtc\GetReady.exe

                                                      Filesize

                                                      52KB

                                                      MD5

                                                      57f3795953dafa8b5e2b24ba5bfad87f

                                                      SHA1

                                                      47719bd600e7527c355dbdb053e3936379d1b405

                                                      SHA256

                                                      5319958efc38ea81f61854eb9f6c8aee32394d4389e52fe5c1f7f7ef6b261725

                                                      SHA512

                                                      172006e8deed2766e7fa71e34182b5539309ec8c2ac5f63285724ef8f59864e1159c618c0914eb05692df721794eb4726757b2ccf576f0c78a6567d807cbfb98

                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                      Filesize

                                                      216B

                                                      MD5

                                                      710970d43efe3c2656ec119f99410e73

                                                      SHA1

                                                      0b1abd60eed01488736edbf5584dd993f97700ab

                                                      SHA256

                                                      68a6568e2df5453bd585771dd34e2f0bb7004ab0f53e5acf1fcdacc2865429d3

                                                      SHA512

                                                      2adfbaf51fdd6954777d95f609bfd04061e1ca6930bc3ed9c6cb3f971d173218971063caa7e891cb315e136d1bb716862a6f63dc6881a40010bdab2cb1b2f4c3

                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                                      Filesize

                                                      2KB

                                                      MD5

                                                      4ef65348bbae046f2d3a329cdf913fe2

                                                      SHA1

                                                      f6e5c5d6a027af382005e9cbf09979ffad941e32

                                                      SHA256

                                                      2e5db98783aba64cf39a4e21cabbaea1d49e4db0be88cb602c77c42db81fc0f0

                                                      SHA512

                                                      e76591ef30fc1ae3d956857612b0856772b67ab7da1b8aa5bc4805726f4741e6bc36e36b13a30fb9b043e6cf7a04ec4c492b4551f3ecf8ed39d8e3948ed37610

                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                                                      Filesize

                                                      2B

                                                      MD5

                                                      d751713988987e9331980363e24189ce

                                                      SHA1

                                                      97d170e1550eee4afc0af065b78cda302a97674c

                                                      SHA256

                                                      4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                                                      SHA512

                                                      b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                                      Filesize

                                                      524B

                                                      MD5

                                                      d113063f3f624beb7ac81d46b0fa76a5

                                                      SHA1

                                                      aead573dac883df4a8f8ca611a309630ce12988c

                                                      SHA256

                                                      d5615b557d94650b1d5f2dcf5572cad03d7e48df1169a080ec0d464bcc99f898

                                                      SHA512

                                                      4bc5f392524a128dfc0ebc700cd7662934c9a42351ddee4aa0937770409aa9356e6815cd0f3322c2558aaff4b28cfff7386f4d3b9494ac61ae63bdacdf8f1ed2

                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                      Filesize

                                                      8KB

                                                      MD5

                                                      de883e3a4fb91973e579cf86d29d9e6d

                                                      SHA1

                                                      966b25ba3c94202b1f9a9bb7e0aaa4bd8b2d491e

                                                      SHA256

                                                      d5fab198a278b0f296abf385296f66582bf4103e5c6eeb74238dd6dba57ed149

                                                      SHA512

                                                      16b628b61c0297be8ee8dc68527bfc70a66e92bb943cc0e088e2da5bd0690d884618eca50af301eabeb7aad4a46d7babd31c91d7ef890c59b47bb62d7c81bed7

                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GraphiteDawnCache\data_1

                                                      Filesize

                                                      264KB

                                                      MD5

                                                      f50f89a0a91564d0b8a211f8921aa7de

                                                      SHA1

                                                      112403a17dd69d5b9018b8cede023cb3b54eab7d

                                                      SHA256

                                                      b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

                                                      SHA512

                                                      bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                                      Filesize

                                                      99KB

                                                      MD5

                                                      19c08f4a1b456a0d1ea86b04b5595e8e

                                                      SHA1

                                                      aa0f190cb8bdb193a2c7ca2c759ec52fde070de4

                                                      SHA256

                                                      fc2ed0bb111b96fd6712816743f764e29949a73ec2ca6ba1168ec223be975bd8

                                                      SHA512

                                                      7290a8e388c839bffe3ea6453ec1697e50fe10489f2185fef912ca9a47d34301da8b6345cd05b3ad76455e9779bec21c9c2ec2ce9b0a767d2a202d3d20bdc519

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                      Filesize

                                                      152B

                                                      MD5

                                                      9b008261dda31857d68792b46af6dd6d

                                                      SHA1

                                                      e82dc88e2d1da2df7cb19d79a0346b9bb90d52b3

                                                      SHA256

                                                      9ac598d4f8170f7e475d84103aead9e3c23d5f2d292741a7f56a17bde8b6f7da

                                                      SHA512

                                                      78853091403a06beeec4998e2e3a4342111895ffd485f7f7cd367741a4883f7a25864cba00a6c86f27dc0c9ce9d04f08011ecc40c8ae9383d33274739ac39f10

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                      Filesize

                                                      152B

                                                      MD5

                                                      0446fcdd21b016db1f468971fb82a488

                                                      SHA1

                                                      726b91562bb75f80981f381e3c69d7d832c87c9d

                                                      SHA256

                                                      62c5dc18b25e758f3508582a7c58bb46b734a774d97fc0e8a20614235caa8222

                                                      SHA512

                                                      1df7c085042266959f1fe0aedc5f6d40ceba485b54159f51f0c38f17bb250b79ea941b735e1b6faf219f23fe8ab65ac4557f545519d52d5416b89ad0f9047a31

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                      Filesize

                                                      2KB

                                                      MD5

                                                      66dc299a01f0f3989f4bac9be58bde09

                                                      SHA1

                                                      1efef7a293638932033da0fcfd6454087505d6b2

                                                      SHA256

                                                      01eee756c1b1e8198e9c855d52ed94424bf7aabf057f9a639becc85d4ebfc26c

                                                      SHA512

                                                      0474c4daf7ad3d8d64cef74a9b6690b65fdc8c88da4f0f4334ba5e323898764327d4891a11558263425272ce690e69b24f6d283a19127a96a107a14b2ace5e6f

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                      Filesize

                                                      579B

                                                      MD5

                                                      106247267798fa1d7190823a5dd5c2a8

                                                      SHA1

                                                      62ff3bed0b462d3a59eb3d4aa1f0849e43612c61

                                                      SHA256

                                                      d59a10df53802434b539b56f779878466f70463da9508ef850f69c20fd590e9e

                                                      SHA512

                                                      7ce5fc8a4d2e13f265430e9ddc523bd5a4fd5c9bfd4dcb8e699429770888898b12b3d3c0313fd6c51c6638869e08286e6e16fa8894b6f606c88b42db973a83df

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                      Filesize

                                                      5KB

                                                      MD5

                                                      6cced760f835a2cc58b166e5481c6e45

                                                      SHA1

                                                      ccba3f94f608f26ca90744103d60e5c562e23363

                                                      SHA256

                                                      d972e091aca6038efa68f38c2805e832c3b78214c6da4e25cf0e53570d09bdbc

                                                      SHA512

                                                      f6caf4877278a0b8a0365a0703d8f00a927a92d917365a8f799b34c3b7b8b951104f68eab2e1efeaec85dc34de29d39d50395c9be108943acb7e46ee2393d437

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                      Filesize

                                                      6KB

                                                      MD5

                                                      ec9cc2bd7a32a801f0d3eaf3a8e2ba84

                                                      SHA1

                                                      9f2bf328f6d7f9b765e0348291c63481eacdd70d

                                                      SHA256

                                                      b081e99a927936419a3038ab668fbfbc98661e6034e88829e0732f7c1d01dfdd

                                                      SHA512

                                                      5780ad562177d6570b95b0a72fe1dc7853733b70121c32eb133107b038662b669fd3db30b2f42ade39ad2b83fc7a486d367f160e194ed05be630e8b237db04af

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                      Filesize

                                                      6KB

                                                      MD5

                                                      3632740429c23718fb1b281617da8643

                                                      SHA1

                                                      f63c213b7e7733489319f10797f2d9635db087fd

                                                      SHA256

                                                      dfdee7620a3d04784280f12755199c8681e5fb2781d51fe035e708c12cbb4ab4

                                                      SHA512

                                                      4dd8394105d81669b3b39e56afbbf897ba5534e45426ba5cf21bc875ca897646746ab9757f08e946be614c7cf59d60bfb99411bfdf3c624a8f3b47a322c76afb

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                      Filesize

                                                      6KB

                                                      MD5

                                                      41b60c9f18a495d9fe9d626dd2cfcb0f

                                                      SHA1

                                                      da7e3554e2e9e003320c121f9e0669a4f9f58d92

                                                      SHA256

                                                      66c8c39c40b2532ae3677aae43f3eeca144160b60a41600ad467656b66e89c8a

                                                      SHA512

                                                      034bd4111d5ba964d3ebdf55976c947dc2599ca357aea95911439abf2583cfa94083a3ebea91f1b05263465ed8d39cc7eb2084a1e736f0aa8832b2fa4b7f5f97

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                      Filesize

                                                      874B

                                                      MD5

                                                      3d6e142b475701e122b4070f6e12c26d

                                                      SHA1

                                                      ca06c79b914641b7d88e8684653cb9a3b74d3221

                                                      SHA256

                                                      f4a65183438b5870e3f078cc26426738f6ae1273205a98bc7b0091cc3d25c6fc

                                                      SHA512

                                                      2d2d4f1e4813f167d0961828cf3008fc6ec1f4cd762db407045d8463330e3893b8cf0a6e2d0907e2a7d05cae1cd599e172edccedc87e57db13b85511d7a55f19

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                      Filesize

                                                      1KB

                                                      MD5

                                                      3e448bd9a10b807ef3f24918fc48034c

                                                      SHA1

                                                      87a93d8c2980e3045dd6ab349d664729206e548f

                                                      SHA256

                                                      917c77066b32665d6fabbe457e806df401cc3b9cd75fd570c754169b476c8cbf

                                                      SHA512

                                                      e2849bd8fb157e3e9bbd1ed2f9e270cd615b4290fe1c9c53a175304239fc6cdcefe49bf421de41dc80c29288a240be58fd3ec117f66f886283de7e3336e2f6e8

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                      Filesize

                                                      1KB

                                                      MD5

                                                      c591f8742a0a061c84d4efbdf56b423f

                                                      SHA1

                                                      397738286a5102820fc681f08361d8aeb742be24

                                                      SHA256

                                                      edd35708f676231795f0665d8fa0fc1d0fdfd146cb34c60d32d281e51366a474

                                                      SHA512

                                                      51e6e660500d5dcb8f4f425fac403c7767c23806ec93a681f207fc2910dd9fb088f954dd8fb72d9c55e9554a7adb0389fc3c6009fcaa81c55bc7e4a85a3b4777

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57e33c.TMP

                                                      Filesize

                                                      874B

                                                      MD5

                                                      ae3360cbdacdee5149b6d8bb95ef8f3b

                                                      SHA1

                                                      d8b3f2fb8e754593457e9bfd6d780c5f34651018

                                                      SHA256

                                                      f998799c4bedbee76196c3db6a34f7ec036a8b92e89c4403ce2a2b7b40723d5c

                                                      SHA512

                                                      4eb6fa21b1a1aa551086eea5a33b1694e2a7f6ce29124fb4b9112a78e8b702d90c8efa71ed7aeca1b092a709e5e2dea0d9cf1cdffdc635560e4541b1b104456e

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                      Filesize

                                                      16B

                                                      MD5

                                                      6752a1d65b201c13b62ea44016eb221f

                                                      SHA1

                                                      58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                                      SHA256

                                                      0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                                      SHA512

                                                      9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                      Filesize

                                                      10KB

                                                      MD5

                                                      1a2b89b5177cee34062dc614031d1d46

                                                      SHA1

                                                      b79b5eb6e94128f4826b2c906f0082d34f5cd6bd

                                                      SHA256

                                                      6ac6724ac56cf5abc8a5996b98f8d5fa623262ed7d75731be99f4facad0720c0

                                                      SHA512

                                                      86532b248433278541e68b29e9b2a65d2c6ea5eff3c3c65944b846c9e7323803f3479ec16e010473a1fd80c0b0acbea6bbfad5a0de233716fa1d414fe4ed2a1c

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                      Filesize

                                                      10KB

                                                      MD5

                                                      e870bc252083773eddf5d0cec05c45cb

                                                      SHA1

                                                      962ab8669656f8cd346e7c162b8e497200b57192

                                                      SHA256

                                                      39617f696d80d04c0bc8611d363f9dbc292fadb556fcff213e1a6ea09724cd42

                                                      SHA512

                                                      b5cb5bb85d9cc5ea0399c4ad02edcd6bdca5d6a2c1562427528ca634ead28efbbd623be9253de5f8f88af15859809acc826124aaa336c233319e21c297007732

                                                    • C:\Users\Admin\AppData\Local\Temp\1\B6F7.bat

                                                      Filesize

                                                      356B

                                                      MD5

                                                      fe81c1282a808b7a1d0a27d7cccaa624

                                                      SHA1

                                                      f6afc7b26ead8cdb51b11d59c6e68e5aab265bfa

                                                      SHA256

                                                      3e18de7065154144b54a2f7c179c27b3f27c3cda5871f472f452a8cfc3dc6791

                                                      SHA512

                                                      873e226360edc463dd753aedfec7ec60e0d8efac08652245709862b8bd9e6ae85eb6ea6f05d8d2c0ec1c8e7fc1bddeebc5037efcac1ceb5b1f099b49c0a93045

                                                    • C:\Users\Admin\AppData\Local\Temp\65F8.tmp\65F9.vbs

                                                      Filesize

                                                      2KB

                                                      MD5

                                                      fd76266c8088a4dca45414c36c7e9523

                                                      SHA1

                                                      6b19bf2904a0e3b479032e101476b49ed3ae144a

                                                      SHA256

                                                      f853dddb0f9f1b74b72bccdb5191c28e18d466b5dbc205f7741a24391375cd6f

                                                      SHA512

                                                      3cd49395368e279ac9a63315583d3804aa89ec8bb6112754973451a7ea7b68140598699b30eef1b0e94c3286d1e6254e2063188282f7e6a18f1349877adeb072

                                                    • C:\Users\Admin\AppData\Local\Temp\65F8.tmp\MicrosoftWindowsServicesEtc\AppKill.bat

                                                      Filesize

                                                      671B

                                                      MD5

                                                      d4e987817d2e5d6ed2c12633d6f11101

                                                      SHA1

                                                      3f38430a028f9e3cb66c152e302b3586512dd9c4

                                                      SHA256

                                                      5549670ef8837c6e3c4e496c1ea2063670618249d4151dea4d07d48ab456690c

                                                      SHA512

                                                      b84fef88f0128b46f1e2f9c5dff2cb620ee885bed6c90dcf4a5dc51c77bea492c92b8084d8dc8b4277b47b2493a2d9d3f348c6e229bf3da9041ef90e0fd8b6c4

                                                    • C:\Users\Admin\AppData\Local\Temp\65F8.tmp\MicrosoftWindowsServicesEtc\CallFunc.vbs

                                                      Filesize

                                                      388B

                                                      MD5

                                                      5f9737f03289963a6d7a71efab0813c4

                                                      SHA1

                                                      ba22dfae8d365cbf8014a630f23f1d8574b5cf85

                                                      SHA256

                                                      a767894a68ebc490cb5ab2b7b04dd12b7465553ce7ba7e41e1ea45f1eaef5275

                                                      SHA512

                                                      5f4fb691e6da90e8e0872378a7b78cbd1acbf2bd75d19d65f17bf5b1cea95047d66b79fd1173703fcfef42cfc116ca629b9b37e355e44155e8f3b98f2d916a2a

                                                    • C:\Users\Admin\AppData\Local\Temp\65F8.tmp\MicrosoftWindowsServicesEtc\DgzRun.vbs

                                                      Filesize

                                                      341B

                                                      MD5

                                                      a91417f7c55510155771f1f644dd6c7e

                                                      SHA1

                                                      41bdb69c5baca73f49231d5b5f77975b79e55bdf

                                                      SHA256

                                                      729f7540887cf32a5d4e1968a284c46cf904752821c734bd970ecd30a848477a

                                                      SHA512

                                                      f786699c1ab9d7c74dd9eb9d76a76728980b29e84999a166a47b7ee102d8e545901ed0fcb30331712490a36de2d726115b661ad3900cdc2bfcfc601d00b76b07

                                                    • C:\Users\Admin\AppData\Local\Temp\65F8.tmp\MicrosoftWindowsServicesEtc\Major.exe

                                                      Filesize

                                                      60KB

                                                      MD5

                                                      d604c29940864c64b4752d31e2deb465

                                                      SHA1

                                                      c1698ea4e5d1ba1c9b78973556f97e8f6dbbdef3

                                                      SHA256

                                                      da0233f5e5e9a34e8dd4f6911444ca1f3e29bb9cbd958a9f4508ac7d72ccd55d

                                                      SHA512

                                                      89a4a14574ba19fe319c766add0111feeb4320c08bf75f55a898d9acc783d5a862a6433758a413cc719b9179dcf873f1c850d1084851b8fc37aa1e3deabfcf54

                                                    • C:\Users\Admin\AppData\Local\Temp\65F8.tmp\MicrosoftWindowsServicesEtc\NotMuch.exe

                                                      Filesize

                                                      122KB

                                                      MD5

                                                      87a43b15969dc083a0d7e2ef73ee4dd1

                                                      SHA1

                                                      657c7ff7e3f325bcbc88db9499b12c636d564a5f

                                                      SHA256

                                                      cf830a2d66d3ffe51341de9e62c939b2bb68583afbc926ddc7818c3a71e80ebb

                                                      SHA512

                                                      8a02d24f5dab33cdaf768bca0d7a1e3ea75ad515747ccca8ee9f7ffc6f93e8f392ab377f7c2efa5d79cc0b599750fd591358a557f074f3ce9170283ab5b786a1

                                                    • C:\Users\Admin\AppData\Local\Temp\65F8.tmp\MicrosoftWindowsServicesEtc\RuntimeChecker.exe

                                                      Filesize

                                                      58KB

                                                      MD5

                                                      cd58990b1b7f6c68f56244c41ab91665

                                                      SHA1

                                                      7ccca9958d6aebbe3883b55f115b041b827bd2e7

                                                      SHA256

                                                      51f59e877a1c2a1c2760c677def7395ef2868c2ee3e56ffdc3ace570afa50428

                                                      SHA512

                                                      011bdd417ec3bf72daa2b32d3816b696be8b87423740dc2a0182e23515651deeb870a94f3415a73480145f9f5e36c1a3a492410b77ca95d7fab8b9826e9198cc

                                                    • C:\Users\Admin\AppData\Local\Temp\65F8.tmp\MicrosoftWindowsServicesEtc\WinScrew.exe

                                                      Filesize

                                                      52KB

                                                      MD5

                                                      1aaafedd9f259acca75708f4af10b5be

                                                      SHA1

                                                      f6b4ea28d304e1f9205c1c0b970d60ee989402f2

                                                      SHA256

                                                      429e01b0e06b02a55bafb1527629f8d4c5f64d9b21ac9f81484a3928fdce6dc9

                                                      SHA512

                                                      a995ebf4d142452aabb419f0cacfa5412d03532840cb08c37dd7c00001dee521bf9d0da66ac4346b07dffd91fe01fa3115fa05811acbd43d380320dca1be4aa8

                                                    • C:\Users\Admin\AppData\Local\Temp\65F8.tmp\MicrosoftWindowsServicesEtc\breakrule.exe

                                                      Filesize

                                                      58KB

                                                      MD5

                                                      bcb0ac4822de8aeb86ea8a83cd74d7ca

                                                      SHA1

                                                      8e2b702450f91dde3c085d902c09dd265368112e

                                                      SHA256

                                                      5eafebd52fbf6d0e8abd0cc9bf42d36e5b6e4d85b8ebe59f61c9f2d6dccc65e4

                                                      SHA512

                                                      b73647a59eeb92f95c4d7519432ce40ce9014b292b9eb1ed6a809cca30864527c2c827fe49c285bb69984f33469704424edca526f9dff05a6244b33424df01d1

                                                    • C:\Users\Admin\AppData\Local\Temp\65F8.tmp\MicrosoftWindowsServicesEtc\bsod.exe

                                                      Filesize

                                                      1.2MB

                                                      MD5

                                                      8f6a3b2b1af3a4aacd8df1734d250cfe

                                                      SHA1

                                                      505b3bd8e936cb5d8999c1b319951ffebab335c9

                                                      SHA256

                                                      6581eeab9fd116662b4ca73f6ef00fb96e0505d01cfb446ee4b32bbdeefe1361

                                                      SHA512

                                                      c1b5f845c005a1a586080e9da9744e30c7f3eda1e3aaba9c351768f7dea802e9f39d0227772413756ab63914ae4a2514e6ce52c494a91e92c3a1f08badb40264

                                                    • C:\Users\Admin\AppData\Local\Temp\65F8.tmp\MicrosoftWindowsServicesEtc\checker.bat

                                                      Filesize

                                                      151B

                                                      MD5

                                                      f59801d5c49713770bdb2f14eff34e2f

                                                      SHA1

                                                      91090652460c3a197cfad74d2d3c16947d023d63

                                                      SHA256

                                                      3382484b5a6a04d05500e7622da37c1ffaef3a1343395942bc7802bf2a19b53f

                                                      SHA512

                                                      c1c3a78f86e7938afbe391f0e03065b04375207704e419fe77bf0810d1e740c3ef8926c878884ad81b429ec41e126813a68844f600e124f5fa8d28ef17b4b7bc

                                                    • C:\Users\Admin\AppData\Local\Temp\65F8.tmp\MicrosoftWindowsServicesEtc\clingclang.wav

                                                      Filesize

                                                      13.1MB

                                                      MD5

                                                      1c723b3b9420e04cb8845af8b62a37fa

                                                      SHA1

                                                      3331a0f04c851194405eb9a9ff49c76bfa3d4db0

                                                      SHA256

                                                      6831f471ee3363e981e6a1eb0d722f092b33c9b73c91f9f2a9aafa5cb4c56b29

                                                      SHA512

                                                      41f4005ec2a7e0ee8e0e5f52b9d97f25a64a25bb0f00c85c07c643e4e63ea361b4d86733a0cf719b30ea6af225c4fcaca494f22e8e2f73cda9db906c5a0f12ae

                                                    • C:\Users\Admin\AppData\Local\Temp\65F8.tmp\MicrosoftWindowsServicesEtc\data\eula32.exe

                                                      Filesize

                                                      1.2MB

                                                      MD5

                                                      cbc127fb8db087485068044b966c76e8

                                                      SHA1

                                                      d02451bd20b77664ce27d39313e218ab9a9fdbf9

                                                      SHA256

                                                      c5704419b3eec34fb133cf2509d12492febdcb8831efa1ab014edeac83f538d9

                                                      SHA512

                                                      200ee39287f056b504cc23beb1b301a88b183a3806b023d936a2d44a31bbfd08854f6776082d4f7e2232c3d2f606cd5d8229591ecdc86a2bbcfd970a1ee33d41

                                                    • C:\Users\Admin\AppData\Local\Temp\65F8.tmp\MicrosoftWindowsServicesEtc\data\excursor.ani

                                                      Filesize

                                                      17KB

                                                      MD5

                                                      289624a46bb7ec6d91d5b099343b7f24

                                                      SHA1

                                                      2b0aab828ddb252baf4ed99994f716d136cd7948

                                                      SHA256

                                                      b93b0cb2bb965f5758cb0c699fbc827a64712d6f248aaf810cde5fa5ef3227eb

                                                      SHA512

                                                      8c77696fe1c897f56ea3afdecf67ad1128274815942cd4c73d30bf0a44dd1a690d8c2f4b0be08e604853084e5515020c2e913d6e044f9801b6223c1912eec8f8

                                                    • C:\Users\Admin\AppData\Local\Temp\65F8.tmp\MicrosoftWindowsServicesEtc\data\fileico.ico

                                                      Filesize

                                                      38KB

                                                      MD5

                                                      a62eeca905717738a4355dc5009d0fc6

                                                      SHA1

                                                      dd4cc0d3f203d395dfdc26834fc890e181d33382

                                                      SHA256

                                                      d13f7fd44f38136dae1cdf147ba9b673e698f77c0a644ccd3c12e3a71818a0cd

                                                      SHA512

                                                      47ffac6dc37dac4276579cd668fd2524ab1591b594032adbeb609d442f3a28235a2d185c66d8b78b6827ac51d62d97bdc3dffc3ffbaa70cf13d4d5f1dc5f16c2

                                                    • C:\Users\Admin\AppData\Local\Temp\65F8.tmp\MicrosoftWindowsServicesEtc\data\runner32s.exe

                                                      Filesize

                                                      58KB

                                                      MD5

                                                      87815289b110cf33af8af1decf9ff2e9

                                                      SHA1

                                                      09024f9ec9464f56b7e6c61bdd31d7044bdf4795

                                                      SHA256

                                                      a97ea879e2b51972aa0ba46a19ad4363d876ac035502a2ed2df27db522bc6ac4

                                                      SHA512

                                                      8d9024507fa83f578b375c86f38970177313ec3dd9fae794b6e7f739e84fa047a9ef56bf190f6f131d0c7c5e280e729208848b152b3ca492a54af2b18e70f5dc

                                                    • C:\Users\Admin\AppData\Local\Temp\65F8.tmp\MicrosoftWindowsServicesEtc\data\thetruth.jpg

                                                      Filesize

                                                      483KB

                                                      MD5

                                                      7907845316bdbd32200b82944d752d9c

                                                      SHA1

                                                      1e5c37db25964c5dd05f4dce392533a838a722a9

                                                      SHA256

                                                      4e3baea3d98c479951f9ea02e588a3b98b1975055c1dfdf67af4de6e7b41e476

                                                      SHA512

                                                      72a64fab025928d60174d067990c35caa3bb6dadacf9c66e5629ee466016bc8495e71bed218e502f6bde61623e0819485459f25f3f82836e632a52727335c0a0

                                                    • C:\Users\Admin\AppData\Local\Temp\65F8.tmp\MicrosoftWindowsServicesEtc\healgen.vbs

                                                      Filesize

                                                      302B

                                                      MD5

                                                      8837818893ce61b6730dd8a83d625890

                                                      SHA1

                                                      a9d71d6d6d0c262d41a60b6733fb23cd7b8c7614

                                                      SHA256

                                                      cc6d0f847fde710096b01abf905c037594ff4afae6e68a8b6af0cc59543e29bb

                                                      SHA512

                                                      6f17d46098e3c56070ced4171d4c3a0785463d92db5f703b56b250ab8615bcb6e504d4c5a74d05308a62ea36ae31bc29850187943b54add2b50422fb03125516

                                                    • C:\Users\Admin\AppData\Local\Temp\65F8.tmp\MicrosoftWindowsServicesEtc\majordared.exe

                                                      Filesize

                                                      8.8MB

                                                      MD5

                                                      570d35aabee1887f7f6ab3f0a1e76984

                                                      SHA1

                                                      ae989563c3be21ee9043690dcaac3a426859d083

                                                      SHA256

                                                      fa24bc7bc366f2ad579d57a691fb0d10d868e501221df0c32a98e705d2d61e43

                                                      SHA512

                                                      9b68a8acacba451bbf028656c181fae29c5bcaed6a7ff4c1fc26ab708b62ca4be7bba9c777c598926d23331570617d20a0ce439f014461eccd8c3f595d21a54f

                                                    • C:\Users\Admin\AppData\Local\Temp\65F8.tmp\MicrosoftWindowsServicesEtc\majorlist.exe

                                                      Filesize

                                                      51KB

                                                      MD5

                                                      230970ec5286b34a6b2cda9afdd28368

                                                      SHA1

                                                      e3198d3d3b51d245a62a0dc955f2b1449608a295

                                                      SHA256

                                                      3cdafc944b48d45a0d5dc068652486a970124ebe1379a7a04e5cf1dcf05c37c8

                                                      SHA512

                                                      52912b6b2ba55c540316fcfc6f45d68771d1c22ddf4eb09c2cc15fb8ddd214812c18fd75cd61b561c29f660e2bf20290a101b85da1e0bbf8dfbf90b791892b57

                                                    • C:\Users\Admin\AppData\Local\Temp\65F8.tmp\MicrosoftWindowsServicesEtc\majorsod.exe

                                                      Filesize

                                                      58KB

                                                      MD5

                                                      b561c360c46744f55be79a25e1844e3c

                                                      SHA1

                                                      ed0f7eb00b4f1ae6cf92ad75e5701014f3d03d56

                                                      SHA256

                                                      d1094e91960ded15444c6f50756adc451a7c0b495b2ea28319b7184ba96236f7

                                                      SHA512

                                                      0a3a75d08f1d7afcd7a476fc71157983e04b0c26b00ace4d505aa644e5da3e242dd0f6afdb3c93f29ba0b08d2702d0e96b49acba4ed260330068b13f93973e9f

                                                    • C:\Users\Admin\AppData\Local\Temp\65F8.tmp\MicrosoftWindowsServicesEtc\rsod.exe

                                                      Filesize

                                                      74KB

                                                      MD5

                                                      91a0740cfb043e1f4d8461f8cbe2ff19

                                                      SHA1

                                                      92e1ad31c34c4102e5cb2cc69f3793b2a1d5304e

                                                      SHA256

                                                      dcaabfd6955d3fec26a86217d1b1ab7e979c301d498473e4d885145ce031fc3b

                                                      SHA512

                                                      c60067655e5f191708af9b25382869e3ce65cd3ea2d6cac70f8cae4132942cfd6a8aa9dde1e2b7f3f12997d6d7411e21dc73ab4cd83ec555d74b82b86778a613

                                                    • C:\Users\Admin\AppData\Local\Temp\65F8.tmp\MicrosoftWindowsServicesEtc\weird\GetReady.bat

                                                      Filesize

                                                      345B

                                                      MD5

                                                      3dbccaadafb7f0227c1839be5ca07015

                                                      SHA1

                                                      bd636f73235d52d172ad8932a8e4a6a8b17389a0

                                                      SHA256

                                                      33a0c62f3f66bce3fc1beb37aca8ad731bfa5590177d933d9d4eae016019242a

                                                      SHA512

                                                      d981670f9d492d97931ab260a7d7d27d4f97621a1ef3e20246d4be2a9b4cfc01e01174a1d46432b4a3d937ad135c97eec9ef7bbc7da46034388843887df4637e

                                                    • C:\Users\Admin\AppData\Local\Temp\65F8.tmp\MicrosoftWindowsServicesEtc\weird\Major.vbs

                                                      Filesize

                                                      2KB

                                                      MD5

                                                      9192fd494155eab424110765c751559e

                                                      SHA1

                                                      b54fcc1e29617b3eee1c7bb215c048498881b641

                                                      SHA256

                                                      cbd3b0f294e8f11592a3ad80d1070d81746f806a48183b93c345251422ccbf0d

                                                      SHA512

                                                      b8c48916535f3721e7f47be6af671765c3befefcd407c6ea5fabcf9ada119747408d662f61fb436f98a7c33050b6674da54dddf25e683429204a96555ec6e801

                                                    • C:\Users\Admin\AppData\Local\Temp\65F8.tmp\MicrosoftWindowsServicesEtc\weird\RuntimeChecker.vbs

                                                      Filesize

                                                      440B

                                                      MD5

                                                      fe44b78a465853c0ac0744c6ab05ea40

                                                      SHA1

                                                      f32dacd91b9547fce9a8a2846a4e17c33295aab3

                                                      SHA256

                                                      989d947c51c878bcefecb53d867a3c182c2d67129a87a5f6773eb6ef2bbf9b2e

                                                      SHA512

                                                      6b945e16786833c2e2e9867315b8859c413687fc72d4c8576b9c0a1aed2dc65249468317dd49f2ecf777e27c9969b7a7abc72b4d9b7c182dc7999051377515db

                                                    • C:\Users\Admin\AppData\Local\Temp\65F8.tmp\MicrosoftWindowsServicesEtc\weird\WinScrew.bat

                                                      Filesize

                                                      336B

                                                      MD5

                                                      04067ca733ee8b2ab2f068edc8b75a0f

                                                      SHA1

                                                      973cb577f6ab2463040918c3661333553a3132c8

                                                      SHA256

                                                      3aef33c03777abe62feef0a840ac6a087caafc05adfe801464fd1c52eac656a0

                                                      SHA512

                                                      5423a1e668211f269a3d787548e11d18de7365d6c2525c2de61014854f1ab5a51b5de9eda70fb21d6ebe356cb52e93b3f406c71ed7fbcaedd2b023b6fa9c13f8

                                                    • C:\Users\Admin\AppData\Local\Temp\65F8.tmp\MicrosoftWindowsServicesEtc\weird\breakrule.vbs

                                                      Filesize

                                                      108B

                                                      MD5

                                                      2609fde7a9604c73be5083e4bcfa0e20

                                                      SHA1

                                                      068c89f703fb11663143b9927f2a0c9f9f59c0e3

                                                      SHA256

                                                      17d014cb4abbaced3acce9b6d7a1b595cd6e2dd814e41f06ceddcdc08e93eebe

                                                      SHA512

                                                      439fee7cc198cb3fef4ef14693141e52c305579a4ff2da0842323f57dcffade03f3b01ac288080fed423511937a4c1e2080f5a79f967a963fe34253f541824cb

                                                    • C:\Users\Admin\AppData\Local\Temp\65F8.tmp\MicrosoftWindowsServicesEtc\weird\bsod.bat

                                                      Filesize

                                                      133B

                                                      MD5

                                                      c94bb8d71863b05b95891389bed6365e

                                                      SHA1

                                                      07bb402d67f8b1fc601687f1df2622369413db3b

                                                      SHA256

                                                      3900e3b60b4691311e050c4cf8fac82ff178a06e3d04d5d6b2d7ea12cf5d53d1

                                                      SHA512

                                                      00e7ab3a91862faaf5ac5ca3de6dbf2cbb8aac4aba277e1e14b2ecf4650eea2e68134e0df549dca35ab715ed46e36fa9cfee1ba7bb3520511723bf567566682d

                                                    • C:\Users\Admin\AppData\Local\Temp\65F8.tmp\MicrosoftWindowsServicesEtc\weird\cmd.vbs

                                                      Filesize

                                                      11B

                                                      MD5

                                                      b181d5a4055b4a620dd7c44c5065bbe7

                                                      SHA1

                                                      36320f257026b923b923ad2c0e7fa93a257806e0

                                                      SHA256

                                                      4d2639e890d6d5988eb9cb6f8cb50647048bbfeeb83fc604c52567e7381c876c

                                                      SHA512

                                                      0bec0cf2e5b93065701c5458c1d7e047312971d7bbed3ce5444db710654fa0d84eabb7d7c243130e3cb2dae38eb05874929b5b08547174a6065f8accd4e0433d

                                                    • C:\Users\Admin\AppData\Local\Temp\65F8.tmp\MicrosoftWindowsServicesEtc\weird\majorlist.bat

                                                      Filesize

                                                      105B

                                                      MD5

                                                      4cc606c63f423fda5324c962db709562

                                                      SHA1

                                                      091250ffc64db9bea451885350abed2b7748014c

                                                      SHA256

                                                      839301ef07178c100e7f4d47874faf995ae5d11dfd527dda096a284c8114671b

                                                      SHA512

                                                      f29ef2bc694f497499545d1fa4e14ca93c06049fff582af3a6caf3885153491a1cd9e96ab5a6746051aa972421f876c008e5d5b671bd34c3922b61c84151097f

                                                    • C:\Users\Admin\AppData\Local\Temp\65F8.tmp\MicrosoftWindowsServicesEtc\weird\majorsod.vbs

                                                      Filesize

                                                      126B

                                                      MD5

                                                      fecb9e50c1f01d9d6101f273cb860260

                                                      SHA1

                                                      18c413f577c289004db6156bd133e5db70258044

                                                      SHA256

                                                      8863b595563e92d73b29090ff83191b2fa1297507be588aa7e1cf910e77c7feb

                                                      SHA512

                                                      2c30641b099d5b6c3af40cb41e70160c1f4294bb30dc3162b018e9552b48fc899d1a63d3e366bfb71fcf6803bcc518cf8d504ce60684ce221028a9bf2bc07f9d

                                                    • C:\Users\Admin\AppData\Local\Temp\65F8.tmp\MicrosoftWindowsServicesEtc\weird\runner32s.vbs

                                                      Filesize

                                                      383B

                                                      MD5

                                                      5f427dc44f33906509423d24fa0590c0

                                                      SHA1

                                                      b896f7667381a594d3751e05f258925b81c231c0

                                                      SHA256

                                                      9aae0707b1d5d3b7ed3bf5cc8fbb530aebd195e3e2f18312f3f7f1aa43e031b4

                                                      SHA512

                                                      bd28c386772062ef945f24c8ad7a25f158856af36e31d2c9b14674cedfd34b4f48ed531cd40a7eb291384d83665ffe154f0786c1a7ee1616256cf30125120961

                                                    • C:\Users\Admin\AppData\Local\Temp\65F8.tmp\MicrosoftWindowsServicesEtc\xRun.vbs

                                                      Filesize

                                                      93B

                                                      MD5

                                                      26ec8d73e3f6c1e196cc6e3713b9a89f

                                                      SHA1

                                                      cb2266f3ecfef4d59bd12d7f117c2327eb9c55fa

                                                      SHA256

                                                      ed588fa361979f7f9c6dbb4e6a1ae6e075f2db8d79ea6ca2007ba8e3423671b0

                                                      SHA512

                                                      2b3ad279f1cdc2a5b05073116c71d79e190bfa407da09d8268d56ac2a0c4cc0c31161a251686ac67468d0ba329c302a301c542c22744d9e3a3f5e7ffd2b51195

                                                    • C:\Users\Admin\AppData\Local\Temp\65F8.tmp\MicrosoftWindowsServicesEtc\xRunReg.vbs

                                                      Filesize

                                                      134B

                                                      MD5

                                                      8267192f547f8914ff36eff80ca3f402

                                                      SHA1

                                                      23bdeb19fb37059e1293dd80d8be69480c957c73

                                                      SHA256

                                                      cdd4f356ca256c707960bc42b97649111a830e6f951ca6a3cf80853e3c342947

                                                      SHA512

                                                      cd684cb73496ca925fd8604fbbf286b842e2b02ce18b19d63618e8355dcec02bce700fb09b25da932545845b01a7f8d9986fa486db504b92a42d7c0ace21e9e2

                                                    • C:\Users\Admin\Downloads\Unconfirmed 228541.crdownload

                                                      Filesize

                                                      25.6MB

                                                      MD5

                                                      247a35851fdee53a1696715d67bd0905

                                                      SHA1

                                                      d2e86020e1d48e527e81e550f06c651328bd58a4

                                                      SHA256

                                                      5dd4ea169cabf9226f54bb53e63ea6a1b5880a0d1222242aee378efb6255b57d

                                                      SHA512

                                                      a173801aaef4fab608d99b52223b5b2400d69b91edcbf33c21fcb47bd832eef9d771dfd36da350a502a371ed1739c869a7c2b4dca456c93f2feed9ac9c647c7c

                                                    • \??\pipe\LOCAL\crashpad_5052_JUZFVIZCRWDQVHFB

                                                      MD5

                                                      d41d8cd98f00b204e9800998ecf8427e

                                                      SHA1

                                                      da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                      SHA256

                                                      e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                      SHA512

                                                      cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                    • memory/3700-712-0x0000000000560000-0x0000000000584000-memory.dmp

                                                      Filesize

                                                      144KB

                                                    • memory/4704-685-0x0000000000800000-0x000000000093C000-memory.dmp

                                                      Filesize

                                                      1.2MB

                                                    • memory/4704-686-0x0000000005830000-0x0000000005DD4000-memory.dmp

                                                      Filesize

                                                      5.6MB

                                                    • memory/4704-687-0x0000000005320000-0x00000000053B2000-memory.dmp

                                                      Filesize

                                                      584KB

                                                    • memory/4704-688-0x00000000053F0000-0x00000000053FA000-memory.dmp

                                                      Filesize

                                                      40KB