Analysis Overview
SHA256
392799ee175e6f0ee8ef42c410a01fb4085ccbf6c258f4e3d4b56fee0c4d2535
Threat Level: Likely malicious
The file download.png was found to be: Likely malicious.
Malicious Activity Summary
Possible privilege escalation attempt
Downloads MZ/PE file
Modifies file permissions
Executes dropped EXE
Legitimate hosting services abused for malware hosting/C2
File and Directory Permissions Modification: Windows File and Directory Permissions Modification
System Location Discovery: System Language Discovery
Enumerates physical storage devices
Browser Information Discovery
Suspicious use of SendNotifyMessage
Suspicious use of AdjustPrivilegeToken
Enumerates system info in registry
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Modifies data under HKEY_USERS
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Suspicious use of FindShellTrayWindow
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-10-03 17:42
Signatures
Analysis: behavioral1
Detonation Overview
Submitted
2024-10-03 17:42
Reported
2024-10-03 18:00
Platform
win10v2004-20240802-en
Max time kernel
1049s
Max time network
989s
Command Line
Signatures
Downloads MZ/PE file
Possible privilege escalation attempt
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\icacls.exe | N/A |
| N/A | N/A | C:\Windows\system32\takeown.exe | N/A |
| N/A | N/A | C:\Windows\system32\takeown.exe | N/A |
| N/A | N/A | C:\Windows\system32\takeown.exe | N/A |
| N/A | N/A | C:\Windows\system32\takeown.exe | N/A |
| N/A | N/A | C:\Windows\system32\icacls.exe | N/A |
| N/A | N/A | C:\Windows\system32\icacls.exe | N/A |
| N/A | N/A | C:\Windows\system32\takeown.exe | N/A |
| N/A | N/A | C:\Windows\system32\takeown.exe | N/A |
| N/A | N/A | C:\Windows\system32\icacls.exe | N/A |
| N/A | N/A | C:\Windows\system32\icacls.exe | N/A |
| N/A | N/A | C:\Windows\system32\icacls.exe | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\Downloads\HURR-DURR 4.0.exe | N/A |
Modifies file permissions
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\takeown.exe | N/A |
| N/A | N/A | C:\Windows\system32\icacls.exe | N/A |
| N/A | N/A | C:\Windows\system32\icacls.exe | N/A |
| N/A | N/A | C:\Windows\system32\icacls.exe | N/A |
| N/A | N/A | C:\Windows\system32\icacls.exe | N/A |
| N/A | N/A | C:\Windows\system32\takeown.exe | N/A |
| N/A | N/A | C:\Windows\system32\takeown.exe | N/A |
| N/A | N/A | C:\Windows\system32\takeown.exe | N/A |
| N/A | N/A | C:\Windows\system32\icacls.exe | N/A |
| N/A | N/A | C:\Windows\system32\takeown.exe | N/A |
| N/A | N/A | C:\Windows\system32\takeown.exe | N/A |
| N/A | N/A | C:\Windows\system32\icacls.exe | N/A |
File and Directory Permissions Modification: Windows File and Directory Permissions Modification
Legitimate hosting services abused for malware hosting/C2
| Description | Indicator | Process | Target |
| N/A | raw.githubusercontent.com | N/A | N/A |
| N/A | raw.githubusercontent.com | N/A | N/A |
| N/A | camo.githubusercontent.com | N/A | N/A |
| N/A | camo.githubusercontent.com | N/A | N/A |
Browser Information Discovery
Enumerates physical storage devices
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\Downloads\HURR-DURR 4.0.exe | N/A |
Enumerates system info in registry
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| Key opened | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Modifies data under HKEY_USERS
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133724509934207570" | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Processes
C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\download.png
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7fff5b5acc40,0x7fff5b5acc4c,0x7fff5b5acc58
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1984,i,17635624483441525028,10305577833027900175,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=1980 /prefetch:2
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2120,i,17635624483441525028,10305577833027900175,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2140 /prefetch:3
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2300,i,17635624483441525028,10305577833027900175,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2480 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3172,i,17635624483441525028,10305577833027900175,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3196 /prefetch:1
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3304,i,17635624483441525028,10305577833027900175,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3288 /prefetch:1
C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4596,i,17635624483441525028,10305577833027900175,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4588 /prefetch:1
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4696,i,17635624483441525028,10305577833027900175,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4740 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4732,i,17635624483441525028,10305577833027900175,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4840 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4708,i,17635624483441525028,10305577833027900175,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4996 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4728,i,17635624483441525028,10305577833027900175,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5148 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4844,i,17635624483441525028,10305577833027900175,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5216 /prefetch:8
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5216,i,17635624483441525028,10305577833027900175,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4760 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=4492,i,17635624483441525028,10305577833027900175,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5220 /prefetch:1
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=3372,i,17635624483441525028,10305577833027900175,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3396 /prefetch:1
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4480,i,17635624483441525028,10305577833027900175,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3340 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=5304,i,17635624483441525028,10305577833027900175,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4836 /prefetch:1
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5596,i,17635624483441525028,10305577833027900175,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5604 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5716,i,17635624483441525028,10305577833027900175,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5568 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4864,i,17635624483441525028,10305577833027900175,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5812 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --field-trial-handle=5652,i,17635624483441525028,10305577833027900175,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5688 /prefetch:1
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --field-trial-handle=4876,i,17635624483441525028,10305577833027900175,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3400 /prefetch:1
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --field-trial-handle=5676,i,17635624483441525028,10305577833027900175,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5724 /prefetch:1
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=4944,i,17635624483441525028,10305577833027900175,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=1168 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5420,i,17635624483441525028,10305577833027900175,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5408 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5424,i,17635624483441525028,10305577833027900175,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5136 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5364,i,17635624483441525028,10305577833027900175,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4896 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5848,i,17635624483441525028,10305577833027900175,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3368 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5660,i,17635624483441525028,10305577833027900175,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5320 /prefetch:8
C:\Users\Admin\Downloads\HURR-DURR 4.0.exe
"C:\Users\Admin\Downloads\HURR-DURR 4.0.exe"
C:\Windows\system32\cmd.exe
"C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\A8E4.tmp\A8E5.tmp\A8E6.bat "C:\Users\Admin\Downloads\HURR-DURR 4.0.exe""
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://hurr-durr.cc/
C:\Windows\system32\takeown.exe
takeown /f "C:\windows\system32\winload.exe"
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7fff6b0646f8,0x7fff6b064708,0x7fff6b064718
C:\Windows\system32\takeown.exe
takeown /f "C:\windows\system32\winresume.exe"
C:\Windows\system32\takeown.exe
takeown /f "C:\windows\system32\ntoskrnl.exe"
C:\Windows\system32\takeown.exe
takeown /f "C:\windows\system32\hal.dll"
C:\Windows\system32\takeown.exe
takeown /f "C:\windows\system32\ntdll.dll"
C:\Windows\system32\takeown.exe
takeown /f "C:\windows\system32\ci.dll"
C:\Windows\system32\icacls.exe
icacls "C:\windows\system32\winload.exe" /grant everyone:F /t /c
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2032,11545873968855907810,11890078050297466000,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2044 /prefetch:2
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2032,11545873968855907810,11890078050297466000,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 /prefetch:3
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2032,11545873968855907810,11890078050297466000,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2888 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,11545873968855907810,11890078050297466000,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,11545873968855907810,11890078050297466000,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:1
C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
C:\Windows\system32\icacls.exe
icacls "C:\windows\system32\winresume.exe" /grant everyone:F /t /c
C:\Windows\system32\icacls.exe
icacls "C:\windows\system32\ntoskrnl.exe" /grant everyone:F /t /c
C:\Windows\system32\icacls.exe
icacls "C:\windows\system32\hal.dll" /grant everyone:F /t /c
C:\Windows\system32\icacls.exe
icacls "C:\windows\system32\ntdll.dll" /grant everyone:F /t /c
C:\Windows\system32\icacls.exe
icacls "C:\windows\system32\ci.dll" /grant everyone:F /t /cç
C:\Windows\system32\mountvol.exe
mountvol C:\ /d
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 228.249.119.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 71.31.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 196.249.167.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | www.google.com | udp |
| GB | 216.58.204.68:443 | www.google.com | tcp |
| US | 8.8.8.8:53 | 202.187.250.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 67.204.58.216.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 68.204.58.216.in-addr.arpa | udp |
| US | 8.8.8.8:53 | ogads-pa.googleapis.com | udp |
| US | 8.8.8.8:53 | apis.google.com | udp |
| GB | 142.250.178.14:443 | apis.google.com | tcp |
| GB | 142.250.200.42:443 | ogads-pa.googleapis.com | tcp |
| GB | 142.250.200.42:443 | ogads-pa.googleapis.com | udp |
| US | 8.8.8.8:53 | 227.179.250.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 14.178.250.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 42.200.250.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | play.google.com | udp |
| GB | 142.250.179.238:443 | play.google.com | tcp |
| US | 8.8.8.8:53 | 238.179.250.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 133.211.185.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | clients2.google.com | udp |
| N/A | 224.0.0.251:5353 | udp | |
| GB | 172.217.16.238:443 | clients2.google.com | tcp |
| US | 8.8.8.8:53 | 238.16.217.172.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 197.87.175.4.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 18.31.95.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 100.209.201.84.in-addr.arpa | udp |
| GB | 216.58.204.68:443 | www.google.com | udp |
| US | 8.8.8.8:53 | content-autofill.googleapis.com | udp |
| GB | 216.58.201.106:443 | content-autofill.googleapis.com | tcp |
| US | 8.8.8.8:53 | 106.201.58.216.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 195.187.250.142.in-addr.arpa | udp |
| GB | 142.250.179.238:443 | play.google.com | udp |
| US | 8.8.8.8:53 | dns-tunnel-check.googlezip.net | udp |
| US | 8.8.8.8:53 | tunnel.googlezip.net | udp |
| US | 216.239.34.157:443 | tunnel.googlezip.net | tcp |
| US | 8.8.8.8:53 | 66.204.58.216.in-addr.arpa | udp |
| US | 216.239.34.157:443 | tunnel.googlezip.net | tcp |
| US | 8.8.8.8:53 | play.google.com | udp |
| GB | 142.250.179.238:443 | play.google.com | tcp |
| US | 8.8.8.8:53 | 157.34.239.216.in-addr.arpa | udp |
| GB | 142.250.200.42:443 | content-autofill.googleapis.com | udp |
| US | 8.8.8.8:53 | consent.google.com | udp |
| GB | 142.250.179.238:443 | consent.google.com | udp |
| US | 8.8.8.8:53 | 79.190.18.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | github.com | udp |
| US | 8.8.8.8:53 | github.githubassets.com | udp |
| US | 8.8.8.8:53 | avatars.githubusercontent.com | udp |
| US | 185.199.109.154:443 | github.githubassets.com | tcp |
| US | 185.199.109.154:443 | github.githubassets.com | tcp |
| US | 185.199.109.154:443 | github.githubassets.com | tcp |
| US | 185.199.109.154:443 | github.githubassets.com | tcp |
| US | 185.199.109.154:443 | github.githubassets.com | tcp |
| US | 185.199.109.154:443 | github.githubassets.com | tcp |
| US | 8.8.8.8:53 | user-images.githubusercontent.com | udp |
| US | 185.199.110.133:443 | user-images.githubusercontent.com | tcp |
| US | 8.8.8.8:53 | github-cloud.s3.amazonaws.com | udp |
| GB | 20.26.156.215:443 | github.com | tcp |
| GB | 216.58.201.106:443 | content-autofill.googleapis.com | tcp |
| US | 8.8.8.8:53 | collector.github.com | udp |
| US | 140.82.113.21:443 | collector.github.com | tcp |
| GB | 216.58.201.106:443 | content-autofill.googleapis.com | udp |
| US | 8.8.8.8:53 | camo.githubusercontent.com | udp |
| US | 185.199.108.133:443 | camo.githubusercontent.com | tcp |
| US | 8.8.8.8:53 | 154.109.199.185.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 133.110.199.185.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 215.156.26.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 21.113.82.140.in-addr.arpa | udp |
| US | 8.8.8.8:53 | api.github.com | udp |
| US | 185.199.109.154:443 | github.githubassets.com | tcp |
| GB | 20.26.156.210:443 | api.github.com | tcp |
| US | 8.8.8.8:53 | 133.108.199.185.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 210.156.26.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | encrypted-tbn0.gstatic.com | udp |
| GB | 142.250.187.206:443 | encrypted-tbn0.gstatic.com | tcp |
| GB | 142.250.187.206:443 | encrypted-tbn0.gstatic.com | tcp |
| GB | 142.250.187.206:443 | encrypted-tbn0.gstatic.com | tcp |
| US | 8.8.8.8:53 | 206.187.250.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 88.210.23.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | id.google.com | udp |
| GB | 142.250.200.35:443 | id.google.com | tcp |
| US | 8.8.8.8:53 | beacons.gcp.gvt2.com | udp |
| GB | 172.217.16.227:443 | beacons.gcp.gvt2.com | tcp |
| US | 216.239.34.157:443 | tunnel.googlezip.net | tcp |
| US | 216.239.34.157:443 | tunnel.googlezip.net | tcp |
| US | 8.8.8.8:53 | 35.200.250.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 227.16.217.172.in-addr.arpa | udp |
| GB | 142.250.179.238:443 | consent.google.com | udp |
| GB | 142.250.200.42:443 | content-autofill.googleapis.com | udp |
| GB | 20.26.156.215:443 | github.com | tcp |
| GB | 20.26.156.210:443 | api.github.com | tcp |
| US | 8.8.8.8:53 | github.com | udp |
| GB | 20.26.156.215:443 | github.com | tcp |
| US | 8.8.8.8:53 | api.github.com | udp |
| US | 8.8.8.8:53 | collector.github.com | udp |
| GB | 20.26.156.210:443 | api.github.com | tcp |
| GB | 172.217.16.227:443 | beacons.gcp.gvt2.com | udp |
| US | 8.8.8.8:53 | github-cloud.s3.amazonaws.com | udp |
| GB | 216.58.201.106:443 | content-autofill.googleapis.com | udp |
| US | 8.8.8.8:53 | e2c69.gcp.gvt2.com | udp |
| CA | 34.0.38.213:443 | e2c69.gcp.gvt2.com | tcp |
| US | 8.8.8.8:53 | beacons.gvt2.com | udp |
| GB | 172.217.169.67:443 | beacons.gvt2.com | tcp |
| US | 8.8.8.8:53 | 213.38.0.34.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 67.169.217.172.in-addr.arpa | udp |
| US | 8.8.8.8:53 | raw.githubusercontent.com | udp |
| US | 185.199.108.133:443 | raw.githubusercontent.com | tcp |
| US | 8.8.8.8:53 | hurr-durr.cc | udp |
| US | 172.67.191.55:443 | hurr-durr.cc | tcp |
| US | 8.8.8.8:53 | 55.191.67.172.in-addr.arpa | udp |
| US | 8.8.8.8:53 | api.github.com | udp |
| GB | 20.26.156.210:443 | api.github.com | tcp |
| US | 8.8.8.8:53 | collector.github.com | udp |
| US | 8.8.8.8:53 | github.com | udp |
| GB | 20.26.156.215:443 | github.com | tcp |
| GB | 172.217.16.227:443 | beacons.gcp.gvt2.com | udp |
Files
\??\pipe\crashpad_1728_DVLAXPKYORTTDCGU
| MD5 | d41d8cd98f00b204e9800998ecf8427e |
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
| SHA512 | cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
| MD5 | d751713988987e9331980363e24189ce |
| SHA1 | 97d170e1550eee4afc0af065b78cda302a97674c |
| SHA256 | 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945 |
| SHA512 | b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
| MD5 | 0812d8eb16657989bf1295398950527e |
| SHA1 | 2562331bc4ce535ddaeecb65ab6c35d12ea972a3 |
| SHA256 | fec43e2df94f432b23d4091956be93b9fe8dc1558af838caddbd32658dcbbdf9 |
| SHA512 | 359e48fe7c3219cab7ea1fc0b6762498e06141c3ffb8d98998b1158f41141ff85237eab95f69bb4fedd6bfadbaeeb9781add7ea043ee5d06d04b8ba5edf8ebda |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
| MD5 | 5ff92f04da8e4580802ba741116a65d8 |
| SHA1 | 4a2249a2cffaa04aaa9bf78ed4331f64df199712 |
| SHA256 | cfc7e6a7026ef60d8117de2f68b89c7f94888afcf15a332b74c488fc60ea235c |
| SHA512 | 55d350cf83174d2bccda77f3e0e72eaf714fa65a03503669e02fa5485b07478b7b84fca9f6463a16dd3af47c87424537f0a9928187a211d2681c528fabbe426d |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
| MD5 | 68ff19da0e9fd38692de8417984f5765 |
| SHA1 | 23b7016a7c57036ee5e77bc6eede2e3f4e28b94d |
| SHA256 | 4e55781d3cb0c148cec606db0e02651ced90042cfbb99e0f9f65e937547f3aa2 |
| SHA512 | 24ba6068e4be6241c41ce0cbe369fa2bf497e89a9962d1f092ae1a566f225a4c9bfcdae31213a32291ce2c2ac7612cc2b99df8c4c1793a9ff5f3ad20111177f8 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
| MD5 | 08fa1654777c8d9e9d826a9896fcf9d2 |
| SHA1 | 09a1afedfdfc35ab54a8b7addbdf510e27aea0a2 |
| SHA256 | fc6374025aebfded85498ecd1ff12b218b61cd795af824efa87d8f49c2e7286d |
| SHA512 | cb1cdabc03d516a46594ff2ab92107e617e3f09800b05da4a30ba9cf67281f73a161b42b661d56de392cffab1046f6ace96b877bfefde73a5e40db0085d26863 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000005
| MD5 | f942900ff0a10f251d338c612c456948 |
| SHA1 | 4a283d3c8f3dc491e43c430d97c3489ee7a3d320 |
| SHA256 | 38b76a54655aff71271a9ad376ac17f20187abd581bf5aced69ccde0fe6e2fd6 |
| SHA512 | 9b393ce73598ed1997d28ceeddb23491a4d986c337984878ebb0ae06019e30ea77448d375d3d6563c774856d6bc98ee3ca0e0ba88ea5769a451a5e814f6ddb41 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
| MD5 | 0fb84f5bcfdc720d79f8ea2c0f63c822 |
| SHA1 | ebec9e6a24d190e224a5353075cfb7b19a52bf26 |
| SHA256 | e4b3317913adc102e2b44518f61dcabf3fcf19105c31483735ff84f9372aa762 |
| SHA512 | 294ef2e314afe0d3802c98c1059c55a42ebdb9cb36d468cc78a11c9c815fa7397295b804529d30c4ea0e779b6ef28cfff302ecb4e81864168c052c6868d59294 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
| MD5 | 81be4109479d013bdc8494a255c8f4c5 |
| SHA1 | 53bd28a8b1e0cd9776fa5023dd499c545d45ae7c |
| SHA256 | be9078ee5daf072d9608dbbc1677e3d0b5f63b8244fafb93d2d4d476de5ab016 |
| SHA512 | 1a323b539f229017708bb91f01d0ef2c739781e9338a31574cab36244932c3ddcbc04464c3b0952273fd8fb96ce904f4ed4fe1233fc5ca874e9c7de53246ffbf |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
| MD5 | 0b59e55f1bdb7f08ae4112fcf9207431 |
| SHA1 | 0594ac0275280b59de40d32a5644b6bbb3e165a1 |
| SHA256 | c0c450f5fa1f0bfff4704337686b08ec836210d08e1f90f772f2866b4ca82f9f |
| SHA512 | b75c6e56f5f87433478dd5a4ab7ae8686dc8743200d459620fb1bc73d5ea0fd70e8f5b439adbef4484028a713c5a308944baa72c6b2b22d37fae89446aba6a96 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
| MD5 | 83e0d5644d5db0dbd47cc1d4ed5e6cd3 |
| SHA1 | 47b5301438f8eaf4aa6a9a18c0920764604b7012 |
| SHA256 | 72a2a43b64482434f888d7ad259b52b29704e71eccc361844f3e39d66a9a6c95 |
| SHA512 | 31c88c72a1a003165d14fb1ec41fbd1c40085a00e20fff4a84f88f494bbd4a4c03491f6d4eb64d17585922f7c0a6df1c84c21aa1c61460c0717d27dba6cfac1c |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
| MD5 | 2a2f85bca590d4ef1bccd9df7ff467f2 |
| SHA1 | 51bfbb5ce76f41c32a886efd5fb9eba2caf2a420 |
| SHA256 | fbd20dadacef612f4c58dcb3fe182d7a6a61721adf9955da26f9d117a1a0428e |
| SHA512 | 87de44714782073ea4f91f4880a66d07075ff78c77af27b3f16230f1a2bf97a061eef4f4c156f51c9a93162392e5668a907e1339c22376b321ed0882429f22ec |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
| MD5 | 0234bf868d0b5373dfcfe5a04e9ad66a |
| SHA1 | d99dff0057a1a161cb74c0f0be520ea18c58518f |
| SHA256 | b6c95de8dec4e9b92b4519b1ed682aef47c465f995cb41e1cc679af88ef8302e |
| SHA512 | b47d6393b5392677fc1cd0ec7032297f61baacafa33c0c671d60debdfd221d49d1363aa7da98a8d4a3df283ffede68c4647090f3311cd4fade2b8f08ad5ce72c |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
| MD5 | 7cc665a1d944bb2229fb7bf1a6dd7913 |
| SHA1 | 879b8ef221cfaf6f62053249ae63faa2fa5d88e3 |
| SHA256 | b6ba5f5b33882b85cc4372c3f37d8726482db03109bd19eac718d204c014bfd4 |
| SHA512 | 1fa2489c97a0cb9850e0545c0cd5c323120924693676279c07679014ea2d8ff11c1013e55078c3226f778b6c23561303071a98724701bb521d6a6c7270131fb4 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
| MD5 | 9ea46706c492278143651a09ab18a7dd |
| SHA1 | 59c0e8f4fd917347713acf79d049a2a57287b635 |
| SHA256 | d4fc37b009d8d16667c5f66194ae7a8feb167463ab4faa10410086d2147ad15d |
| SHA512 | 5851dad2afa9a18ad12a94749a0723b346f8da9eb841a41dfe6008bdc92d271903b71cb951b2dc6cf63bd773eae62130ae46129081cb8d117f74f2fb2af56267 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
| MD5 | 3fadca364ce4ee6153a10103ed7650ae |
| SHA1 | 8f41a663d92b2f0d49bb401fb2692a0ef03adeee |
| SHA256 | 0dbc86b6955be6a87751d6e9dc2f3097dccb6435caf72f600330b751072a8f8b |
| SHA512 | 4bec2622f5828fe129703e197234c4a0b29aad06482fcf9e904860c9a647300fa7fa9316dd7b16833fe2430e0389c0646fdec1795ed51cb75b89ea71fe6f8e79 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
| MD5 | 6fb91861bfaa0455246aa121bbf524ad |
| SHA1 | 7bd624effe0aa50df85ea1adcc6a1be0a3a89d59 |
| SHA256 | 9fe5eca3d0c8c55f6939d4a18cb7326ca938b11bd3c2b86f92af84af8b6cf7a0 |
| SHA512 | bbbe54fa6a8545999f812e36e26f23c7feb75b0561fb906c516290dd019af2d856f5e781445abc8b2e1cb58af2a2a40b6e9530db529735ede29529008f62f2e7 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
| MD5 | 97981dc5bbf52d352c3ab73204b762c0 |
| SHA1 | bbf8e6c915bee9d9a632e78b1ce99f411fa43eff |
| SHA256 | 2f996afff2c86cc06e040bd84f4c4243a2ad9248504aafb9c438007e623b6a1c |
| SHA512 | e98aeafe77db448f50ac9443f7bc1b1564c409e002c221c51e57b7429de5b41019bf8f8cdc7fd8d597799cc6b20a0dd6ba9db0a17d156e26f5c0f1fb3051947d |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
| MD5 | ebfa68beb2d7b35d3995babedd56af78 |
| SHA1 | 8ec5ee681ab3a76f54cbcaba7082bfcc7d734a56 |
| SHA256 | 0029e360c32a3df130d93622a53f5fc0f8a402a0d712e9f10d0e8eef856917a2 |
| SHA512 | 02a6949b125a27641ca4f478a0f3a9167ff28cc50e777743e22c6fe7a267c73aeeafb6ffc0cd68caed021853e0687ce3c072a44c8ed5a310fe03545e3c0f40b8 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
| MD5 | 1f71453e130e045feffdd981fdcf00a3 |
| SHA1 | 4995878e1211faa9221c1a68b6b518aa26870dac |
| SHA256 | 2eecca73cfb6ab1f937f351c67e545b4b99c02538436270966ff3191fd4fd3f2 |
| SHA512 | 5e3356f71bca72e9049c25d511ff9797d32301fd332d205eab69443950133d40c5ef1bf9f652ccf0650aa01d98270fb74578124cf461efb8e5e31cc087372030 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
| MD5 | 177ecf769a888a42436f3b7463d6a462 |
| SHA1 | 4d5ac9496e14445f844cc5953a0c12bb08d2ba66 |
| SHA256 | 98a174d4090b41bd76911e21037ef0f1f2c04e5a7c212624b8f505e745f89aaa |
| SHA512 | 0f6e6c54d05131e9427151dbacdc08170ca4e1acfdd34483a03659363d476cd3a32f22d655c5a315057d1c54dd81e00b486063c960076c990c447906aea1651c |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
| MD5 | 18cbbf8c6b0adb7987bf6c4049204fe3 |
| SHA1 | c00d38b1f3634eb427031cc29ddf462eef4df327 |
| SHA256 | 1a4d7ae8a9c335452cd79b98af20b92590cfbc8991be98af671cbb1eaa3e1bec |
| SHA512 | 60b4af9d30676fd4736319f5bb52300c39cd25a433daefa611b321f6dd3121dab44f53d319bf4a1073d0cbe46f68a27c7d3cd590f4328b3c9af806b7388fe397 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
| MD5 | 7a57fa35517b17f1eb2827a10eb01d8a |
| SHA1 | 33435e2371ccb01af98a42310d8e26359deb3c82 |
| SHA256 | 84fc54cf061342185793c4e9097cd760d9f070af4aa6315749383debb40a73ae |
| SHA512 | c1c2ad2d8f0b53add26cd5820bbe9c189060760997a36225d79ac48cf1612c453dd3db4d7877e349c9e63b5b29887e3c30cd82f3565bf6480fa732d80fcbd3c2 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
| MD5 | c11f07db6252a419c563e570cc44b527 |
| SHA1 | fcd060325bc928809eeff7d18685082fa4e05522 |
| SHA256 | 10bbeb9fdaa4af3babb945da9cd65bfe5027d2b371e4870f7eb8805f5303ff42 |
| SHA512 | 0281260d2dbd3d73b1fab825e92301116ae696d2f27b522bf7b9487ec8c691c10192c43b3380f66bec9d1c30f950b8942e948717144f82588b4c8f32bc1f5b68 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
| MD5 | ab7f17e63c7bbf5692502d82618de4af |
| SHA1 | ec821c89dbcfcee8b2e90a2b36df4739baf85bcd |
| SHA256 | fbeae303a3ac2d0bd904b0b9c2d5e4a545ae65c1db5486d84d3afaae43b0fd73 |
| SHA512 | 22d2de80f7e7a800d63c7ff7e6109fff88d5acbec533ba2b416af4584014730df249956083d8ea4b6d009f6b18d0ca0879a9e7e7ca5c42b12203d714506d75ff |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
| MD5 | 8d3657013c0b982368356c69c03d2f95 |
| SHA1 | fd8c2114fa559bf9deeb2b20cae473b43f521831 |
| SHA256 | e28d47bbda8579766c902563ea18db6abc87943d04716bcd18aa0879ddb09538 |
| SHA512 | 322c5ecc48280f312da14cd546ec72c4480079c47b19e068676d13c92885db399d259d69b05749c14da1169c6b5d45d1421fd2ab08adbef9223cb3784f3cf1cc |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
| MD5 | 8ef220ece916f5e23f57c5bcf0cd5e8f |
| SHA1 | 803dc29ec826dd0dbd79da8cc4696060d715738c |
| SHA256 | 11ad950064341a4c0782e5f2cbcb52fed5629bb54c6aeec9fd508cd93cc5a1aa |
| SHA512 | dfac109e67be1911fe16d2051d4da37f37f51a1c900be0045774bf8edef067464b408375fae60a312d27a0cd0728ea88999143076a261a168b26742e320db97f |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
| MD5 | ef623cdaf363583033b934b418ea5ddf |
| SHA1 | fbad1c41f39155da649c33eddd3fad91f46b9484 |
| SHA256 | 246050fc39d4576c65e845ed12ee0aa75fa84aa5be8b81047bd47f6d7fe61367 |
| SHA512 | 518e197c41a9aae62e28176ddc770273f38e17198e23a4a8c1d1f0a4cfbd0c080b9c7a3842963878c9f71df6fc09c4276d80f3e94b00b473dfcc384018ef9d6a |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
| MD5 | d18460ff0e81bb4b16495b7c5c3bc391 |
| SHA1 | 6c69b334525964131d983b9060ba97869332fd8c |
| SHA256 | a57907cb3e9b0228a1f5862da274ecdf1265d927b34131c3347368ae9c8a8270 |
| SHA512 | f99cd9b9fcc07b8557f96dbecc9c87536ffce9546679d3783572af67441ea356f3293fe6ae21a1a79cb8ccc138c50108011c6847408c7cda64d6ffb7e9e9f9fa |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
| MD5 | e853252d537c6533639944c26355316d |
| SHA1 | fd3a5a29153b905a1118a90e9e4ab63ec0a42af7 |
| SHA256 | bdc76f7f041d6b9e3cbafb1a9c44089f1ded3a68a64afe97c104d24b3c9a478f |
| SHA512 | 5b25ed1e00af1296c65e33b09779c4fc38b7cf1cfbc80f3a6ecfb83a3e6edc142876071b1a80885dbd6bd5dad19cb9ce1a369716a793cc166fc7df41bab8bdbe |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
| MD5 | d279a58bb786ef60520028820ff031fa |
| SHA1 | 8877f9fbc87f153371cdada70238b19e9d4e529d |
| SHA256 | c74f35635ef601edeafa264b54cec05eb7b22c794183c8c1fa67545739e18492 |
| SHA512 | d47f7a8ca0d377e40659b62698f845441193eb2a5cac21ac51229bdc703b966edc93e03d12e0b1187fbc039815f7b3a85fe9d8db0f553c03ecae6197848cfa50 |
C:\Users\Admin\Downloads\HURR-DURR 4.0.exe
| MD5 | 709002961b4a3d18185690cf820c4758 |
| SHA1 | 9e45ade994f2d711f12fd1bdd24c76c29190d919 |
| SHA256 | 39d024d9d590f29e0e522f1e41ac4e5c7bf67ebd261b3fa939b6e0ee883acc59 |
| SHA512 | a759d2c16eb3166714d0422e931458ea1bac942f440bd159f7a130e9edaef2fe13090adb4de0ef65d6f66446d929f2152e879d1949c4860654564e9e8f8be916 |
C:\Users\Admin\AppData\Local\Temp\A8E4.tmp\A8E5.tmp\A8E6.bat
| MD5 | fea29a2bbc979a1a83a9887b62240d6e |
| SHA1 | b6c1ab3b84f50a1aa567c311b77fade00379b006 |
| SHA256 | abb42b3699e20f9208261c9ef6105f29be0c1005b47e966b5dd9a78845b6dcb6 |
| SHA512 | c8ed4b01d15956e668cf4ce215efd0e3708405a3aa2dff30c4a5e4e5a86959308c832f14a4d19b1c0ef9b1491e24fcf8d3388dc155911784b3b8d5b25f790164 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
| MD5 | 38f59a47b777f2fc52088e96ffb2baaf |
| SHA1 | 267224482588b41a96d813f6d9e9d924867062db |
| SHA256 | 13569c5681c71dc42ab57d34879f5a567d7b94afe0e8f6d7c6f6c1314fb0087b |
| SHA512 | 4657d13e1bb7cdd7e83f5f2562f5598cca12edf839626ae96da43e943b5550fab46a14b9018f1bec90de88cc714f637605531ccda99deb9e537908ddb826113b |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | f93209793b6cd7498e28040d53e0daa8 |
| SHA1 | 968dce341bbe3acd91d2ae97802ddbf9c095c708 |
| SHA256 | 806d73386eafcc9cfe19041b5f28dee1276e81ed518c834460aac3d8e3dda22a |
| SHA512 | 7c0e82d8f16198dcbe88270b64d210c663094ec39c0489de296f3795fb9dbab94aeacdec4c8a2e71e51957bf0e5291b82bca2d1ba920ef901549ddf913b46e0e |