392799ee175e6f0ee8ef42c410a01fb4085ccbf6c258f4e3d4b56fee0c4d2535

Analysis

max time kernel
1049s
max time network
989s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
03/10/2024, 17:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

download.png
Size

7KB
MD5

ae5aeb13244a67adc092d617c10da8dc
SHA1

90d27a22523ceca32449f74f509f62fb1a18d393
SHA256

392799ee175e6f0ee8ef42c410a01fb4085ccbf6c258f4e3d4b56fee0c4d2535
SHA512

53734c9b3f77aba63e81ec11d0fb31ab957c7324ce17e85e945ff37631077b1c9afe3c0dee0639ff7afb6ba634c85b0609ca2fb36282330bef88e0fd6e7f9034
SSDEEP

192:WYbyHJ/13xis4VfGH3uRqm3GPwiFBy0NqAIv89mU3Xn:Wm+Biv+H3uiPwmBy0cAIv89z3Xn

Score

8^/10

defense_evasion discovery exploit

Malware Config

Signatures

Downloads MZ/PE file

Possible privilege escalation attempt 12 IoCs

exploit

pid	Process
4136	icacls.exe
716	takeown.exe
5032	takeown.exe
3320	takeown.exe
2532	takeown.exe
1796	icacls.exe
220	icacls.exe
756	takeown.exe
4620	takeown.exe
4000	icacls.exe
720	icacls.exe
5040	icacls.exe

Executes dropped EXE 1 IoCs

pid	Process
4736	HURR-DURR 4.0.exe

Modifies file permissions 1 TTPs 12 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4620	takeown.exe
1796	icacls.exe
720	icacls.exe
5040	icacls.exe
220	icacls.exe
2532	takeown.exe
756	takeown.exe
716	takeown.exe
4136	icacls.exe
3320	takeown.exe
5032	takeown.exe
4000	icacls.exe

File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
defense_evasion

Windows File and Directory Permissions Modification
T1222.001

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
171	raw.githubusercontent.com
172	raw.githubusercontent.com
120	camo.githubusercontent.com
121	camo.githubusercontent.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HURR-DURR 4.0.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133724509934207570"	chrome.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1728	chrome.exe
1728	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
2760	chrome.exe
1236	msedge.exe
1236	msedge.exe
3932	msedge.exe
3932	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe
3932	msedge.exe
3932	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1728	chrome.exe
Token: SeCreatePagefilePrivilege	1728	chrome.exe
Token: SeShutdownPrivilege	1728	chrome.exe
Token: SeCreatePagefilePrivilege	1728	chrome.exe
Token: SeShutdownPrivilege	1728	chrome.exe
Token: SeCreatePagefilePrivilege	1728	chrome.exe
Token: SeShutdownPrivilege	1728	chrome.exe
Token: SeCreatePagefilePrivilege	1728	chrome.exe
Token: SeShutdownPrivilege	1728	chrome.exe
Token: SeCreatePagefilePrivilege	1728	chrome.exe
Token: SeShutdownPrivilege	1728	chrome.exe
Token: SeCreatePagefilePrivilege	1728	chrome.exe
Token: SeShutdownPrivilege	1728	chrome.exe
Token: SeCreatePagefilePrivilege	1728	chrome.exe
Token: SeShutdownPrivilege	1728	chrome.exe
Token: SeCreatePagefilePrivilege	1728	chrome.exe
Token: SeShutdownPrivilege	1728	chrome.exe
Token: SeCreatePagefilePrivilege	1728	chrome.exe
Token: SeShutdownPrivilege	1728	chrome.exe
Token: SeCreatePagefilePrivilege	1728	chrome.exe
Token: SeShutdownPrivilege	1728	chrome.exe
Token: SeCreatePagefilePrivilege	1728	chrome.exe
Token: SeShutdownPrivilege	1728	chrome.exe
Token: SeCreatePagefilePrivilege	1728	chrome.exe
Token: SeShutdownPrivilege	1728	chrome.exe
Token: SeCreatePagefilePrivilege	1728	chrome.exe
Token: SeShutdownPrivilege	1728	chrome.exe
Token: SeCreatePagefilePrivilege	1728	chrome.exe
Token: SeShutdownPrivilege	1728	chrome.exe
Token: SeCreatePagefilePrivilege	1728	chrome.exe
Token: SeShutdownPrivilege	1728	chrome.exe
Token: SeCreatePagefilePrivilege	1728	chrome.exe
Token: SeShutdownPrivilege	1728	chrome.exe
Token: SeCreatePagefilePrivilege	1728	chrome.exe
Token: SeShutdownPrivilege	1728	chrome.exe
Token: SeCreatePagefilePrivilege	1728	chrome.exe
Token: SeShutdownPrivilege	1728	chrome.exe
Token: SeCreatePagefilePrivilege	1728	chrome.exe
Token: SeShutdownPrivilege	1728	chrome.exe
Token: SeCreatePagefilePrivilege	1728	chrome.exe
Token: SeShutdownPrivilege	1728	chrome.exe
Token: SeCreatePagefilePrivilege	1728	chrome.exe
Token: SeShutdownPrivilege	1728	chrome.exe
Token: SeCreatePagefilePrivilege	1728	chrome.exe
Token: SeShutdownPrivilege	1728	chrome.exe
Token: SeCreatePagefilePrivilege	1728	chrome.exe
Token: SeShutdownPrivilege	1728	chrome.exe
Token: SeCreatePagefilePrivilege	1728	chrome.exe
Token: SeShutdownPrivilege	1728	chrome.exe
Token: SeCreatePagefilePrivilege	1728	chrome.exe
Token: SeShutdownPrivilege	1728	chrome.exe
Token: SeCreatePagefilePrivilege	1728	chrome.exe
Token: SeShutdownPrivilege	1728	chrome.exe
Token: SeCreatePagefilePrivilege	1728	chrome.exe
Token: SeShutdownPrivilege	1728	chrome.exe
Token: SeCreatePagefilePrivilege	1728	chrome.exe
Token: SeShutdownPrivilege	1728	chrome.exe
Token: SeCreatePagefilePrivilege	1728	chrome.exe
Token: SeShutdownPrivilege	1728	chrome.exe
Token: SeCreatePagefilePrivilege	1728	chrome.exe
Token: SeShutdownPrivilege	1728	chrome.exe
Token: SeCreatePagefilePrivilege	1728	chrome.exe
Token: SeShutdownPrivilege	1728	chrome.exe
Token: SeCreatePagefilePrivilege	1728	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe

Suspicious use of SendNotifyMessage 48 IoCs

pid	Process
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe
1728	chrome.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1728 wrote to memory of 5048	1728	chrome.exe	91
PID 1728 wrote to memory of 5048	1728	chrome.exe	91
PID 1728 wrote to memory of 3940	1728	chrome.exe	92
PID 1728 wrote to memory of 3940	1728	chrome.exe	92
PID 1728 wrote to memory of 3940	1728	chrome.exe	92
PID 1728 wrote to memory of 3940	1728	chrome.exe	92
PID 1728 wrote to memory of 3940	1728	chrome.exe	92
PID 1728 wrote to memory of 3940	1728	chrome.exe	92
PID 1728 wrote to memory of 3940	1728	chrome.exe	92
PID 1728 wrote to memory of 3940	1728	chrome.exe	92
PID 1728 wrote to memory of 3940	1728	chrome.exe	92
PID 1728 wrote to memory of 3940	1728	chrome.exe	92
PID 1728 wrote to memory of 3940	1728	chrome.exe	92
PID 1728 wrote to memory of 3940	1728	chrome.exe	92
PID 1728 wrote to memory of 3940	1728	chrome.exe	92
PID 1728 wrote to memory of 3940	1728	chrome.exe	92
PID 1728 wrote to memory of 3940	1728	chrome.exe	92
PID 1728 wrote to memory of 3940	1728	chrome.exe	92
PID 1728 wrote to memory of 3940	1728	chrome.exe	92
PID 1728 wrote to memory of 3940	1728	chrome.exe	92
PID 1728 wrote to memory of 3940	1728	chrome.exe	92
PID 1728 wrote to memory of 3940	1728	chrome.exe	92
PID 1728 wrote to memory of 3940	1728	chrome.exe	92
PID 1728 wrote to memory of 3940	1728	chrome.exe	92
PID 1728 wrote to memory of 3940	1728	chrome.exe	92
PID 1728 wrote to memory of 3940	1728	chrome.exe	92
PID 1728 wrote to memory of 3940	1728	chrome.exe	92
PID 1728 wrote to memory of 3940	1728	chrome.exe	92
PID 1728 wrote to memory of 3940	1728	chrome.exe	92
PID 1728 wrote to memory of 3940	1728	chrome.exe	92
PID 1728 wrote to memory of 3940	1728	chrome.exe	92
PID 1728 wrote to memory of 3940	1728	chrome.exe	92
PID 1728 wrote to memory of 3120	1728	chrome.exe	93
PID 1728 wrote to memory of 3120	1728	chrome.exe	93
PID 1728 wrote to memory of 4556	1728	chrome.exe	94
PID 1728 wrote to memory of 4556	1728	chrome.exe	94
PID 1728 wrote to memory of 4556	1728	chrome.exe	94
PID 1728 wrote to memory of 4556	1728	chrome.exe	94
PID 1728 wrote to memory of 4556	1728	chrome.exe	94
PID 1728 wrote to memory of 4556	1728	chrome.exe	94
PID 1728 wrote to memory of 4556	1728	chrome.exe	94
PID 1728 wrote to memory of 4556	1728	chrome.exe	94
PID 1728 wrote to memory of 4556	1728	chrome.exe	94
PID 1728 wrote to memory of 4556	1728	chrome.exe	94
PID 1728 wrote to memory of 4556	1728	chrome.exe	94
PID 1728 wrote to memory of 4556	1728	chrome.exe	94
PID 1728 wrote to memory of 4556	1728	chrome.exe	94
PID 1728 wrote to memory of 4556	1728	chrome.exe	94
PID 1728 wrote to memory of 4556	1728	chrome.exe	94
PID 1728 wrote to memory of 4556	1728	chrome.exe	94
PID 1728 wrote to memory of 4556	1728	chrome.exe	94
PID 1728 wrote to memory of 4556	1728	chrome.exe	94
PID 1728 wrote to memory of 4556	1728	chrome.exe	94
PID 1728 wrote to memory of 4556	1728	chrome.exe	94
PID 1728 wrote to memory of 4556	1728	chrome.exe	94
PID 1728 wrote to memory of 4556	1728	chrome.exe	94
PID 1728 wrote to memory of 4556	1728	chrome.exe	94
PID 1728 wrote to memory of 4556	1728	chrome.exe	94
PID 1728 wrote to memory of 4556	1728	chrome.exe	94
PID 1728 wrote to memory of 4556	1728	chrome.exe	94
PID 1728 wrote to memory of 4556	1728	chrome.exe	94
PID 1728 wrote to memory of 4556	1728	chrome.exe	94
PID 1728 wrote to memory of 4556	1728	chrome.exe	94
PID 1728 wrote to memory of 4556	1728	chrome.exe	94

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\download.png
1⤵
PID:2352

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7fff5b5acc40,0x7fff5b5acc4c,0x7fff5b5acc58
  2⤵
  PID:5048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1984,i,17635624483441525028,10305577833027900175,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=1980 /prefetch:2
  2⤵
  PID:3940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2120,i,17635624483441525028,10305577833027900175,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2140 /prefetch:3
  2⤵
  PID:3120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2300,i,17635624483441525028,10305577833027900175,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2480 /prefetch:8
  2⤵
  PID:4556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3172,i,17635624483441525028,10305577833027900175,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3196 /prefetch:1
  2⤵
  PID:2436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3304,i,17635624483441525028,10305577833027900175,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:4576
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4596,i,17635624483441525028,10305577833027900175,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4588 /prefetch:1
  2⤵
  PID:4120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4696,i,17635624483441525028,10305577833027900175,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4740 /prefetch:8
  2⤵
  PID:3132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4732,i,17635624483441525028,10305577833027900175,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4840 /prefetch:8
  2⤵
  PID:2328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4708,i,17635624483441525028,10305577833027900175,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4996 /prefetch:8
  2⤵
  PID:4092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4728,i,17635624483441525028,10305577833027900175,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5148 /prefetch:8
  2⤵
  PID:4460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4844,i,17635624483441525028,10305577833027900175,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5216 /prefetch:8
  2⤵
  PID:4072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5216,i,17635624483441525028,10305577833027900175,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4760 /prefetch:8
  2⤵
  PID:4480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=4492,i,17635624483441525028,10305577833027900175,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5220 /prefetch:1
  2⤵
  PID:4736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=3372,i,17635624483441525028,10305577833027900175,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3396 /prefetch:1
  2⤵
  PID:3288
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4480,i,17635624483441525028,10305577833027900175,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3340 /prefetch:8
  2⤵
  PID:4604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=5304,i,17635624483441525028,10305577833027900175,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4836 /prefetch:1
  2⤵
  PID:3104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5596,i,17635624483441525028,10305577833027900175,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5604 /prefetch:8
  2⤵
  PID:4684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5716,i,17635624483441525028,10305577833027900175,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5568 /prefetch:8
  2⤵
  PID:736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4864,i,17635624483441525028,10305577833027900175,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5812 /prefetch:8
  2⤵
  PID:2828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --field-trial-handle=5652,i,17635624483441525028,10305577833027900175,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5688 /prefetch:1
  2⤵
  PID:1608
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --field-trial-handle=4876,i,17635624483441525028,10305577833027900175,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3400 /prefetch:1
  2⤵
  PID:3904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --field-trial-handle=5676,i,17635624483441525028,10305577833027900175,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5724 /prefetch:1
  2⤵
  PID:3504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=4944,i,17635624483441525028,10305577833027900175,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=1168 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5420,i,17635624483441525028,10305577833027900175,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5408 /prefetch:8
  2⤵
  PID:3080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5424,i,17635624483441525028,10305577833027900175,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5136 /prefetch:8
  2⤵
  PID:4376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5364,i,17635624483441525028,10305577833027900175,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4896 /prefetch:8
  2⤵
  PID:3572
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5848,i,17635624483441525028,10305577833027900175,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3368 /prefetch:8
  2⤵
  PID:5016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5660,i,17635624483441525028,10305577833027900175,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5320 /prefetch:8
  2⤵
  PID:1868
- C:\Users\Admin\Downloads\HURR-DURR 4.0.exe
  "C:\Users\Admin\Downloads\HURR-DURR 4.0.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4736
- - C:\Windows\system32\cmd.exe
    "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\A8E4.tmp\A8E5.tmp\A8E6.bat "C:\Users\Admin\Downloads\HURR-DURR 4.0.exe""
    3⤵
    PID:848
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://hurr-durr.cc/
      4⤵
      Enumerates system info in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      PID:3932
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7fff6b0646f8,0x7fff6b064708,0x7fff6b064718
        5⤵
        
        PID:3756
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2032,11545873968855907810,11890078050297466000,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2044 /prefetch:2
        5⤵
        
        PID:1924
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2032,11545873968855907810,11890078050297466000,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 /prefetch:3
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1236
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2032,11545873968855907810,11890078050297466000,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2888 /prefetch:8
        5⤵
        
        PID:4936
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,11545873968855907810,11890078050297466000,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
        5⤵
        
        PID:1436
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,11545873968855907810,11890078050297466000,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:1
        5⤵
        
        PID:5060
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\windows\system32\winload.exe"
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:3320
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\windows\system32\winresume.exe"
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:2532
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\windows\system32\ntoskrnl.exe"
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:756
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\windows\system32\hal.dll"
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:716
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\windows\system32\ntdll.dll"
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:5032
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\windows\system32\ci.dll"
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4620
  - - C:\Windows\system32\icacls.exe
      icacls "C:\windows\system32\winload.exe" /grant everyone:F /t /c
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:1796
  - - C:\Windows\system32\icacls.exe
      icacls "C:\windows\system32\winresume.exe" /grant everyone:F /t /c
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4000
  - - C:\Windows\system32\icacls.exe
      icacls "C:\windows\system32\ntoskrnl.exe" /grant everyone:F /t /c
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:720
  - - C:\Windows\system32\icacls.exe
      icacls "C:\windows\system32\hal.dll" /grant everyone:F /t /c
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4136
  - - C:\Windows\system32\icacls.exe
      icacls "C:\windows\system32\ntdll.dll" /grant everyone:F /t /c
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:5040
  - - C:\Windows\system32\icacls.exe
      icacls "C:\windows\system32\ci.dll" /grant everyone:F /t /c├º
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:220
  - - C:\Windows\system32\mountvol.exe
      mountvol C:\ /d
      4⤵
      PID:344

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:4704

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:448

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2408

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3372

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Windows File and Directory Permissions Modification

T1222.001

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
0812d8eb16657989bf1295398950527e

SHA1
2562331bc4ce535ddaeecb65ab6c35d12ea972a3

SHA256
fec43e2df94f432b23d4091956be93b9fe8dc1558af838caddbd32658dcbbdf9

SHA512
359e48fe7c3219cab7ea1fc0b6762498e06141c3ffb8d98998b1158f41141ff85237eab95f69bb4fedd6bfadbaeeb9781add7ea043ee5d06d04b8ba5edf8ebda

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000005

Filesize
213KB

MD5
f942900ff0a10f251d338c612c456948

SHA1
4a283d3c8f3dc491e43c430d97c3489ee7a3d320

SHA256
38b76a54655aff71271a9ad376ac17f20187abd581bf5aced69ccde0fe6e2fd6

SHA512
9b393ce73598ed1997d28ceeddb23491a4d986c337984878ebb0ae06019e30ea77448d375d3d6563c774856d6bc98ee3ca0e0ba88ea5769a451a5e814f6ddb41

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
c11f07db6252a419c563e570cc44b527

SHA1
fcd060325bc928809eeff7d18685082fa4e05522

SHA256
10bbeb9fdaa4af3babb945da9cd65bfe5027d2b371e4870f7eb8805f5303ff42

SHA512
0281260d2dbd3d73b1fab825e92301116ae696d2f27b522bf7b9487ec8c691c10192c43b3380f66bec9d1c30f950b8942e948717144f82588b4c8f32bc1f5b68

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
e853252d537c6533639944c26355316d

SHA1
fd3a5a29153b905a1118a90e9e4ab63ec0a42af7

SHA256
bdc76f7f041d6b9e3cbafb1a9c44089f1ded3a68a64afe97c104d24b3c9a478f

SHA512
5b25ed1e00af1296c65e33b09779c4fc38b7cf1cfbc80f3a6ecfb83a3e6edc142876071b1a80885dbd6bd5dad19cb9ce1a369716a793cc166fc7df41bab8bdbe

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
6fb91861bfaa0455246aa121bbf524ad

SHA1
7bd624effe0aa50df85ea1adcc6a1be0a3a89d59

SHA256
9fe5eca3d0c8c55f6939d4a18cb7326ca938b11bd3c2b86f92af84af8b6cf7a0

SHA512
bbbe54fa6a8545999f812e36e26f23c7feb75b0561fb906c516290dd019af2d856f5e781445abc8b2e1cb58af2a2a40b6e9530db529735ede29529008f62f2e7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
4KB

MD5
ebfa68beb2d7b35d3995babedd56af78

SHA1
8ec5ee681ab3a76f54cbcaba7082bfcc7d734a56

SHA256
0029e360c32a3df130d93622a53f5fc0f8a402a0d712e9f10d0e8eef856917a2

SHA512
02a6949b125a27641ca4f478a0f3a9167ff28cc50e777743e22c6fe7a267c73aeeafb6ffc0cd68caed021853e0687ce3c072a44c8ed5a310fe03545e3c0f40b8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
5KB

MD5
8d3657013c0b982368356c69c03d2f95

SHA1
fd8c2114fa559bf9deeb2b20cae473b43f521831

SHA256
e28d47bbda8579766c902563ea18db6abc87943d04716bcd18aa0879ddb09538

SHA512
322c5ecc48280f312da14cd546ec72c4480079c47b19e068676d13c92885db399d259d69b05749c14da1169c6b5d45d1421fd2ab08adbef9223cb3784f3cf1cc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
356B

MD5
08fa1654777c8d9e9d826a9896fcf9d2

SHA1
09a1afedfdfc35ab54a8b7addbdf510e27aea0a2

SHA256
fc6374025aebfded85498ecd1ff12b218b61cd795af824efa87d8f49c2e7286d

SHA512
cb1cdabc03d516a46594ff2ab92107e617e3f09800b05da4a30ba9cf67281f73a161b42b661d56de392cffab1046f6ace96b877bfefde73a5e40db0085d26863

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
d279a58bb786ef60520028820ff031fa

SHA1
8877f9fbc87f153371cdada70238b19e9d4e529d

SHA256
c74f35635ef601edeafa264b54cec05eb7b22c794183c8c1fa67545739e18492

SHA512
d47f7a8ca0d377e40659b62698f845441193eb2a5cac21ac51229bdc703b966edc93e03d12e0b1187fbc039815f7b3a85fe9d8db0f553c03ecae6197848cfa50

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
3fadca364ce4ee6153a10103ed7650ae

SHA1
8f41a663d92b2f0d49bb401fb2692a0ef03adeee

SHA256
0dbc86b6955be6a87751d6e9dc2f3097dccb6435caf72f600330b751072a8f8b

SHA512
4bec2622f5828fe129703e197234c4a0b29aad06482fcf9e904860c9a647300fa7fa9316dd7b16833fe2430e0389c0646fdec1795ed51cb75b89ea71fe6f8e79

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
ef623cdaf363583033b934b418ea5ddf

SHA1
fbad1c41f39155da649c33eddd3fad91f46b9484

SHA256
246050fc39d4576c65e845ed12ee0aa75fa84aa5be8b81047bd47f6d7fe61367

SHA512
518e197c41a9aae62e28176ddc770273f38e17198e23a4a8c1d1f0a4cfbd0c080b9c7a3842963878c9f71df6fc09c4276d80f3e94b00b473dfcc384018ef9d6a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
7a57fa35517b17f1eb2827a10eb01d8a

SHA1
33435e2371ccb01af98a42310d8e26359deb3c82

SHA256
84fc54cf061342185793c4e9097cd760d9f070af4aa6315749383debb40a73ae

SHA512
c1c2ad2d8f0b53add26cd5820bbe9c189060760997a36225d79ac48cf1612c453dd3db4d7877e349c9e63b5b29887e3c30cd82f3565bf6480fa732d80fcbd3c2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
356B

MD5
0234bf868d0b5373dfcfe5a04e9ad66a

SHA1
d99dff0057a1a161cb74c0f0be520ea18c58518f

SHA256
b6c95de8dec4e9b92b4519b1ed682aef47c465f995cb41e1cc679af88ef8302e

SHA512
b47d6393b5392677fc1cd0ec7032297f61baacafa33c0c671d60debdfd221d49d1363aa7da98a8d4a3df283ffede68c4647090f3311cd4fade2b8f08ad5ce72c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
356B

MD5
81be4109479d013bdc8494a255c8f4c5

SHA1
53bd28a8b1e0cd9776fa5023dd499c545d45ae7c

SHA256
be9078ee5daf072d9608dbbc1677e3d0b5f63b8244fafb93d2d4d476de5ab016

SHA512
1a323b539f229017708bb91f01d0ef2c739781e9338a31574cab36244932c3ddcbc04464c3b0952273fd8fb96ce904f4ed4fe1233fc5ca874e9c7de53246ffbf

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
1f71453e130e045feffdd981fdcf00a3

SHA1
4995878e1211faa9221c1a68b6b518aa26870dac

SHA256
2eecca73cfb6ab1f937f351c67e545b4b99c02538436270966ff3191fd4fd3f2

SHA512
5e3356f71bca72e9049c25d511ff9797d32301fd332d205eab69443950133d40c5ef1bf9f652ccf0650aa01d98270fb74578124cf461efb8e5e31cc087372030

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
d18460ff0e81bb4b16495b7c5c3bc391

SHA1
6c69b334525964131d983b9060ba97869332fd8c

SHA256
a57907cb3e9b0228a1f5862da274ecdf1265d927b34131c3347368ae9c8a8270

SHA512
f99cd9b9fcc07b8557f96dbecc9c87536ffce9546679d3783572af67441ea356f3293fe6ae21a1a79cb8ccc138c50108011c6847408c7cda64d6ffb7e9e9f9fa

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
97981dc5bbf52d352c3ab73204b762c0

SHA1
bbf8e6c915bee9d9a632e78b1ce99f411fa43eff

SHA256
2f996afff2c86cc06e040bd84f4c4243a2ad9248504aafb9c438007e623b6a1c

SHA512
e98aeafe77db448f50ac9443f7bc1b1564c409e002c221c51e57b7429de5b41019bf8f8cdc7fd8d597799cc6b20a0dd6ba9db0a17d156e26f5c0f1fb3051947d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
8ef220ece916f5e23f57c5bcf0cd5e8f

SHA1
803dc29ec826dd0dbd79da8cc4696060d715738c

SHA256
11ad950064341a4c0782e5f2cbcb52fed5629bb54c6aeec9fd508cd93cc5a1aa

SHA512
dfac109e67be1911fe16d2051d4da37f37f51a1c900be0045774bf8edef067464b408375fae60a312d27a0cd0728ea88999143076a261a168b26742e320db97f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
2a2f85bca590d4ef1bccd9df7ff467f2

SHA1
51bfbb5ce76f41c32a886efd5fb9eba2caf2a420

SHA256
fbd20dadacef612f4c58dcb3fe182d7a6a61721adf9955da26f9d117a1a0428e

SHA512
87de44714782073ea4f91f4880a66d07075ff78c77af27b3f16230f1a2bf97a061eef4f4c156f51c9a93162392e5668a907e1339c22376b321ed0882429f22ec

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
ab7f17e63c7bbf5692502d82618de4af

SHA1
ec821c89dbcfcee8b2e90a2b36df4739baf85bcd

SHA256
fbeae303a3ac2d0bd904b0b9c2d5e4a545ae65c1db5486d84d3afaae43b0fd73

SHA512
22d2de80f7e7a800d63c7ff7e6109fff88d5acbec533ba2b416af4584014730df249956083d8ea4b6d009f6b18d0ca0879a9e7e7ca5c42b12203d714506d75ff

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
177ecf769a888a42436f3b7463d6a462

SHA1
4d5ac9496e14445f844cc5953a0c12bb08d2ba66

SHA256
98a174d4090b41bd76911e21037ef0f1f2c04e5a7c212624b8f505e745f89aaa

SHA512
0f6e6c54d05131e9427151dbacdc08170ca4e1acfdd34483a03659363d476cd3a32f22d655c5a315057d1c54dd81e00b486063c960076c990c447906aea1651c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
0b59e55f1bdb7f08ae4112fcf9207431

SHA1
0594ac0275280b59de40d32a5644b6bbb3e165a1

SHA256
c0c450f5fa1f0bfff4704337686b08ec836210d08e1f90f772f2866b4ca82f9f

SHA512
b75c6e56f5f87433478dd5a4ab7ae8686dc8743200d459620fb1bc73d5ea0fd70e8f5b439adbef4484028a713c5a308944baa72c6b2b22d37fae89446aba6a96

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
68ff19da0e9fd38692de8417984f5765

SHA1
23b7016a7c57036ee5e77bc6eede2e3f4e28b94d

SHA256
4e55781d3cb0c148cec606db0e02651ced90042cfbb99e0f9f65e937547f3aa2

SHA512
24ba6068e4be6241c41ce0cbe369fa2bf497e89a9962d1f092ae1a566f225a4c9bfcdae31213a32291ce2c2ac7612cc2b99df8c4c1793a9ff5f3ad20111177f8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
9ea46706c492278143651a09ab18a7dd

SHA1
59c0e8f4fd917347713acf79d049a2a57287b635

SHA256
d4fc37b009d8d16667c5f66194ae7a8feb167463ab4faa10410086d2147ad15d

SHA512
5851dad2afa9a18ad12a94749a0723b346f8da9eb841a41dfe6008bdc92d271903b71cb951b2dc6cf63bd773eae62130ae46129081cb8d117f74f2fb2af56267

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
18cbbf8c6b0adb7987bf6c4049204fe3

SHA1
c00d38b1f3634eb427031cc29ddf462eef4df327

SHA256
1a4d7ae8a9c335452cd79b98af20b92590cfbc8991be98af671cbb1eaa3e1bec

SHA512
60b4af9d30676fd4736319f5bb52300c39cd25a433daefa611b321f6dd3121dab44f53d319bf4a1073d0cbe46f68a27c7d3cd590f4328b3c9af806b7388fe397

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
0fb84f5bcfdc720d79f8ea2c0f63c822

SHA1
ebec9e6a24d190e224a5353075cfb7b19a52bf26

SHA256
e4b3317913adc102e2b44518f61dcabf3fcf19105c31483735ff84f9372aa762

SHA512
294ef2e314afe0d3802c98c1059c55a42ebdb9cb36d468cc78a11c9c815fa7397295b804529d30c4ea0e779b6ef28cfff302ecb4e81864168c052c6868d59294

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
210KB

MD5
5ff92f04da8e4580802ba741116a65d8

SHA1
4a2249a2cffaa04aaa9bf78ed4331f64df199712

SHA256
cfc7e6a7026ef60d8117de2f68b89c7f94888afcf15a332b74c488fc60ea235c

SHA512
55d350cf83174d2bccda77f3e0e72eaf714fa65a03503669e02fa5485b07478b7b84fca9f6463a16dd3af47c87424537f0a9928187a211d2681c528fabbe426d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
210KB

MD5
83e0d5644d5db0dbd47cc1d4ed5e6cd3

SHA1
47b5301438f8eaf4aa6a9a18c0920764604b7012

SHA256
72a2a43b64482434f888d7ad259b52b29704e71eccc361844f3e39d66a9a6c95

SHA512
31c88c72a1a003165d14fb1ec41fbd1c40085a00e20fff4a84f88f494bbd4a4c03491f6d4eb64d17585922f7c0a6df1c84c21aa1c61460c0717d27dba6cfac1c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
210KB

MD5
7cc665a1d944bb2229fb7bf1a6dd7913

SHA1
879b8ef221cfaf6f62053249ae63faa2fa5d88e3

SHA256
b6ba5f5b33882b85cc4372c3f37d8726482db03109bd19eac718d204c014bfd4

SHA512
1fa2489c97a0cb9850e0545c0cd5c323120924693676279c07679014ea2d8ff11c1013e55078c3226f778b6c23561303071a98724701bb521d6a6c7270131fb4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
38f59a47b777f2fc52088e96ffb2baaf

SHA1
267224482588b41a96d813f6d9e9d924867062db

SHA256
13569c5681c71dc42ab57d34879f5a567d7b94afe0e8f6d7c6f6c1314fb0087b

SHA512
4657d13e1bb7cdd7e83f5f2562f5598cca12edf839626ae96da43e943b5550fab46a14b9018f1bec90de88cc714f637605531ccda99deb9e537908ddb826113b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
f93209793b6cd7498e28040d53e0daa8

SHA1
968dce341bbe3acd91d2ae97802ddbf9c095c708

SHA256
806d73386eafcc9cfe19041b5f28dee1276e81ed518c834460aac3d8e3dda22a

SHA512
7c0e82d8f16198dcbe88270b64d210c663094ec39c0489de296f3795fb9dbab94aeacdec4c8a2e71e51957bf0e5291b82bca2d1ba920ef901549ddf913b46e0e

Download Submit
C:\Users\Admin\AppData\Local\Temp\A8E4.tmp\A8E5.tmp\A8E6.bat

Filesize
1003B

MD5
fea29a2bbc979a1a83a9887b62240d6e

SHA1
b6c1ab3b84f50a1aa567c311b77fade00379b006

SHA256
abb42b3699e20f9208261c9ef6105f29be0c1005b47e966b5dd9a78845b6dcb6

SHA512
c8ed4b01d15956e668cf4ce215efd0e3708405a3aa2dff30c4a5e4e5a86959308c832f14a4d19b1c0ef9b1491e24fcf8d3388dc155911784b3b8d5b25f790164

Download Submit
C:\Users\Admin\Downloads\HURR-DURR 4.0.exe

Filesize
1.7MB

MD5
709002961b4a3d18185690cf820c4758

SHA1
9e45ade994f2d711f12fd1bdd24c76c29190d919

SHA256
39d024d9d590f29e0e522f1e41ac4e5c7bf67ebd261b3fa939b6e0ee883acc59

SHA512
a759d2c16eb3166714d0422e931458ea1bac942f440bd159f7a130e9edaef2fe13090adb4de0ef65d6f66446d929f2152e879d1949c4860654564e9e8f8be916

Download Submit