107bb526c374d6fd9f45317c0c16e83ab50076f2bcd630caf3d6794596fae69b

Resubmissions

29/12/2022, 00:57

221229-bbcx8sca96 8

29/12/2022, 00:51

221229-a7zw7sfb5z 8

29/12/2022, 00:46

221229-a4x87sfb5x 8

Analysis

max time kernel
287s
max time network
302s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29/12/2022, 00:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SKlauncher 3.0.exe
Size

1.2MB
MD5

32c7e3347f8e532e675d154eb07f4ccf
SHA1

5ca004745e2cdab497a7d6ef29c7efb25dc4046d
SHA256

107bb526c374d6fd9f45317c0c16e83ab50076f2bcd630caf3d6794596fae69b
SHA512

c82f3a01719f30cbb876a1395fda713ddba07b570bc188515b1b705e54e15a7cca5f71f741d51763f63aa5f40e00df06f63b341ed4db6b1be87b3ee59460dbe2
SSDEEP

24576:Dh199z42ojP6a7HJlF9eu5XFQZSIZeNGdmEE8H17UBcegl:R9zbgH3euNFQZr/oEE892cfl

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 3 IoCs

flow	pid	Process
95	2408	msiexec.exe
97	2408	msiexec.exe
101	2512	msiexec.exe

Downloads MZ/PE file

Loads dropped DLL 1 IoCs

pid	Process
1028	MsiExec.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Eclipse Adoptium\jdk-17.0.5.8-hotspot\jmods\jdk.jpackage.jmod	msiexec.exe
File created	C:\Program Files\Eclipse Adoptium\jdk-17.0.5.8-hotspot\legal\jdk.internal.opt\LICENSE	msiexec.exe
File created	C:\Program Files\Eclipse Adoptium\jdk-17.0.5.8-hotspot\legal\jdk.jconsole\ADDITIONAL_LICENSE_INFO	msiexec.exe
File created	C:\Program Files\Eclipse Adoptium\jdk-17.0.5.8-hotspot\legal\jdk.internal.ed\ADDITIONAL_LICENSE_INFO	msiexec.exe
File created	C:\Program Files\Eclipse Adoptium\jdk-17.0.5.8-hotspot\legal\jdk.crypto.cryptoki\ADDITIONAL_LICENSE_INFO	msiexec.exe
File created	C:\Program Files\Eclipse Adoptium\jdk-17.0.5.8-hotspot\legal\jdk.accessibility\LICENSE	msiexec.exe
File created	C:\Program Files\Eclipse Adoptium\jdk-17.0.5.8-hotspot\jmods\jdk.hotspot.agent.jmod	msiexec.exe
File created	C:\Program Files\Eclipse Adoptium\jdk-17.0.5.8-hotspot\jmods\jdk.internal.vm.compiler.management.jmod	msiexec.exe
File created	C:\Program Files\Eclipse Adoptium\jdk-17.0.5.8-hotspot\bin\api-ms-win-core-processenvironment-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\Eclipse Adoptium\jdk-17.0.5.8-hotspot\legal\java.transaction.xa\LICENSE	msiexec.exe
File created	C:\Program Files\Eclipse Adoptium\jdk-17.0.5.8-hotspot\legal\jdk.localedata\ASSEMBLY_EXCEPTION	msiexec.exe
File created	C:\Program Files\Eclipse Adoptium\jdk-17.0.5.8-hotspot\legal\jdk.net\ASSEMBLY_EXCEPTION	msiexec.exe
File created	C:\Program Files\Eclipse Adoptium\jdk-17.0.5.8-hotspot\legal\jdk.management.agent\LICENSE	msiexec.exe
File created	C:\Program Files\Eclipse Adoptium\jdk-17.0.5.8-hotspot\lib\jfr\default.jfc	msiexec.exe
File created	C:\Program Files\Eclipse Adoptium\jdk-17.0.5.8-hotspot\legal\java.rmi\ASSEMBLY_EXCEPTION	msiexec.exe
File created	C:\Program Files\Eclipse Adoptium\jdk-17.0.5.8-hotspot\bin\javadoc.exe	msiexec.exe
File created	C:\Program Files\Eclipse Adoptium\jdk-17.0.5.8-hotspot\include\jvmti.h	msiexec.exe
File created	C:\Program Files\Eclipse Adoptium\jdk-17.0.5.8-hotspot\bin\jimage.dll	msiexec.exe
File created	C:\Program Files\Eclipse Adoptium\jdk-17.0.5.8-hotspot\legal\jdk.jcmd\ADDITIONAL_LICENSE_INFO	msiexec.exe
File created	C:\Program Files\Eclipse Adoptium\jdk-17.0.5.8-hotspot\legal\jdk.security.jgss\LICENSE	msiexec.exe
File created	C:\Program Files\Eclipse Adoptium\jdk-17.0.5.8-hotspot\bin\serialver.exe	msiexec.exe
File created	C:\Program Files\Eclipse Adoptium\jdk-17.0.5.8-hotspot\lib\security\cacerts	msiexec.exe
File created	C:\Program Files\Eclipse Adoptium\jdk-17.0.5.8-hotspot\legal\java.management.rmi\ASSEMBLY_EXCEPTION	msiexec.exe
File created	C:\Program Files\Eclipse Adoptium\jdk-17.0.5.8-hotspot\bin\jaccesswalker.exe	msiexec.exe
File created	C:\Program Files\Eclipse Adoptium\jdk-17.0.5.8-hotspot\bin\verify.dll	msiexec.exe
File created	C:\Program Files\Eclipse Adoptium\jdk-17.0.5.8-hotspot\legal\jdk.zipfs\ADDITIONAL_LICENSE_INFO	msiexec.exe
File created	C:\Program Files\Eclipse Adoptium\jdk-17.0.5.8-hotspot\legal\java.base\icu.md	msiexec.exe
File created	C:\Program Files\Eclipse Adoptium\jdk-17.0.5.8-hotspot\legal\jdk.accessibility\ADDITIONAL_LICENSE_INFO	msiexec.exe
File created	C:\Program Files\Eclipse Adoptium\jdk-17.0.5.8-hotspot\legal\java.xml\ASSEMBLY_EXCEPTION	msiexec.exe
File created	C:\Program Files\Eclipse Adoptium\jdk-17.0.5.8-hotspot\legal\jdk.editpad\ADDITIONAL_LICENSE_INFO	msiexec.exe
File created	C:\Program Files\Eclipse Adoptium\jdk-17.0.5.8-hotspot\bin\nio.dll	msiexec.exe
File created	C:\Program Files\Eclipse Adoptium\jdk-17.0.5.8-hotspot\bin\api-ms-win-crt-conio-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\Eclipse Adoptium\jdk-17.0.5.8-hotspot\legal\java.xml.crypto\LICENSE	msiexec.exe
File created	C:\Program Files\Eclipse Adoptium\jdk-17.0.5.8-hotspot\bin\le.dll	msiexec.exe
File created	C:\Program Files\Eclipse Adoptium\jdk-17.0.5.8-hotspot\bin\api-ms-win-core-file-l1-2-0.dll	msiexec.exe
File created	C:\Program Files\Eclipse Adoptium\jdk-17.0.5.8-hotspot\jmods\jdk.internal.vm.compiler.jmod	msiexec.exe
File created	C:\Program Files\Eclipse Adoptium\jdk-17.0.5.8-hotspot\jmods\jdk.jstatd.jmod	msiexec.exe
File created	C:\Program Files\Eclipse Adoptium\jdk-17.0.5.8-hotspot\bin\jrunscript.exe	msiexec.exe
File created	C:\Program Files\Eclipse Adoptium\jdk-17.0.5.8-hotspot\jmods\jdk.charsets.jmod	msiexec.exe
File created	C:\Program Files\Eclipse Adoptium\jdk-17.0.5.8-hotspot\legal\jdk.editpad\ASSEMBLY_EXCEPTION	msiexec.exe
File created	C:\Program Files\Eclipse Adoptium\jdk-17.0.5.8-hotspot\jmods\jdk.management.jmod	msiexec.exe
File created	C:\Program Files\Eclipse Adoptium\jdk-17.0.5.8-hotspot\jmods\jdk.jshell.jmod	msiexec.exe
File created	C:\Program Files\Eclipse Adoptium\jdk-17.0.5.8-hotspot\legal\jdk.net\ADDITIONAL_LICENSE_INFO	msiexec.exe
File created	C:\Program Files\Eclipse Adoptium\jdk-17.0.5.8-hotspot\jmods\jdk.incubator.vector.jmod	msiexec.exe
File created	C:\Program Files\Eclipse Adoptium\jdk-17.0.5.8-hotspot\jmods\jdk.net.jmod	msiexec.exe
File created	C:\Program Files\Eclipse Adoptium\jdk-17.0.5.8-hotspot\bin\jawt.dll	msiexec.exe
File created	C:\Program Files\Eclipse Adoptium\jdk-17.0.5.8-hotspot\legal\jdk.localedata\LICENSE	msiexec.exe
File created	C:\Program Files\Eclipse Adoptium\jdk-17.0.5.8-hotspot\bin\fontmanager.dll	msiexec.exe
File created	C:\Program Files\Eclipse Adoptium\jdk-17.0.5.8-hotspot\lib\jvm.cfg	msiexec.exe
File created	C:\Program Files\Eclipse Adoptium\jdk-17.0.5.8-hotspot\legal\java.xml\ADDITIONAL_LICENSE_INFO	msiexec.exe
File created	C:\Program Files\Eclipse Adoptium\jdk-17.0.5.8-hotspot\legal\java.security.jgss\ADDITIONAL_LICENSE_INFO	msiexec.exe
File created	C:\Program Files\Eclipse Adoptium\jdk-17.0.5.8-hotspot\jmods\java.base.jmod	msiexec.exe
File created	C:\Program Files\Eclipse Adoptium\jdk-17.0.5.8-hotspot\legal\jdk.jsobject\ADDITIONAL_LICENSE_INFO	msiexec.exe
File created	C:\Program Files\Eclipse Adoptium\jdk-17.0.5.8-hotspot\legal\jdk.nio.mapmode\ADDITIONAL_LICENSE_INFO	msiexec.exe
File created	C:\Program Files\Eclipse Adoptium\jdk-17.0.5.8-hotspot\legal\java.smartcardio\ASSEMBLY_EXCEPTION	msiexec.exe
File created	C:\Program Files\Eclipse Adoptium\jdk-17.0.5.8-hotspot\bin\api-ms-win-crt-private-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\Eclipse Adoptium\jdk-17.0.5.8-hotspot\jmods\jdk.internal.opt.jmod	msiexec.exe
File created	C:\Program Files\Eclipse Adoptium\jdk-17.0.5.8-hotspot\legal\jdk.management\ADDITIONAL_LICENSE_INFO	msiexec.exe
File created	C:\Program Files\Eclipse Adoptium\jdk-17.0.5.8-hotspot\include\win32\jawt_md.h	msiexec.exe
File created	C:\Program Files\Eclipse Adoptium\jdk-17.0.5.8-hotspot\legal\java.scripting\ADDITIONAL_LICENSE_INFO	msiexec.exe
File created	C:\Program Files\Eclipse Adoptium\jdk-17.0.5.8-hotspot\legal\jdk.charsets\LICENSE	msiexec.exe
File created	C:\Program Files\Eclipse Adoptium\jdk-17.0.5.8-hotspot\legal\java.naming\ASSEMBLY_EXCEPTION	msiexec.exe
File created	C:\Program Files\Eclipse Adoptium\jdk-17.0.5.8-hotspot\legal\java.desktop\mesa3d.md	msiexec.exe
File created	C:\Program Files\Eclipse Adoptium\jdk-17.0.5.8-hotspot\legal\java.xml\jcup.md	msiexec.exe

Drops file in Windows directory 13 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\6ebbb3.ipi	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File opened for modification	C:\Windows\Installer\6ebbb2.msi	msiexec.exe
File created	C:\Windows\Installer\6ebbb3.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\{F1C2D1E1-4A3D-43C8-B546-8D348202FA4D}\logo.ico	msiexec.exe
File created	C:\Windows\Installer\6ebbb5.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\{F1C2D1E1-4A3D-43C8-B546-8D348202FA4D}\logo.ico	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File created	C:\Windows\Installer\6ebbb2.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC57E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICD3C.tmp	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies Internet Explorer settings 1 TTPs 50 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{18403301-871C-11ED-B390-DA7E66F9F45D} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingDelete	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingDelete\C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{E2DA3763-871B-11ED-B390-DA7E66F9F45D}.dat = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E2DA3761-871B-11ED-B390-DA7E66F9F45D} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Modifies data under HKEY_USERS 46 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe

Modifies registry class 35 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1E1D2C1FD3A48C345B64D8432820AFD4\FeatureJavaHome = "FeatureMain"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1E1D2C1FD3A48C345B64D8432820AFD4\SourceList\PackageName = "OpenJDK17U-jdk_x64_windows_hotspot_17.0.5_8.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1E1D2C1FD3A48C345B64D8432820AFD4\SourceList\Net\1 = "C:\\Users\\Admin\\Downloads\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1E1D2C1FD3A48C345B64D8432820AFD4\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.jar\Content Type = "application/java-archive"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1E1D2C1FD3A48C345B64D8432820AFD4\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1E1D2C1FD3A48C345B64D8432820AFD4	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1E1D2C1FD3A48C345B64D8432820AFD4\ProductName = "Eclipse Temurin JDK with Hotspot 17.0.5+8 (x64)"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1E1D2C1FD3A48C345B64D8432820AFD4\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Eclipse Adoptium.jarfile\shell\open	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1E1D2C1FD3A48C345B64D8432820AFD4\PackageCode = "B69306DBDEE1E3941B9E80CA60EED185"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1E1D2C1FD3A48C345B64D8432820AFD4\Language = "1033"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\897E583341745E32540FC917742104AF\1E1D2C1FD3A48C345B64D8432820AFD4	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1E1D2C1FD3A48C345B64D8432820AFD4\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1E1D2C1FD3A48C345B64D8432820AFD4\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\Downloads\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1E1D2C1FD3A48C345B64D8432820AFD4\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.jar	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Eclipse Adoptium.jarfile	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Eclipse Adoptium.jarfile\shell	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1E1D2C1FD3A48C345B64D8432820AFD4\FeatureMain	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1E1D2C1FD3A48C345B64D8432820AFD4\AuthorizedLUAApp = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1E1D2C1FD3A48C345B64D8432820AFD4\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Eclipse Adoptium.jarfile\shell\open\command	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Eclipse Adoptium.jarfile\shell\open\command\ = "\"C:\\Program Files\\Eclipse Adoptium\\jdk-17.0.5.8-hotspot\\bin\\javaw.exe\" -jar \"%1\" %*"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1E1D2C1FD3A48C345B64D8432820AFD4\FeatureEnvironment = "FeatureMain"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1E1D2C1FD3A48C345B64D8432820AFD4\Version = "285212677"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1E1D2C1FD3A48C345B64D8432820AFD4\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1E1D2C1FD3A48C345B64D8432820AFD4\ProductIcon = "C:\\Windows\\Installer\\{F1C2D1E1-4A3D-43C8-B546-8D348202FA4D}\\logo.ico"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1E1D2C1FD3A48C345B64D8432820AFD4\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.jar\ = "Eclipse Adoptium.jarfile"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1E1D2C1FD3A48C345B64D8432820AFD4\FeatureJarFileRunWith = "FeatureMain"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1E1D2C1FD3A48C345B64D8432820AFD4\FeatureOracleJavaSoft = "FeatureMain"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1E1D2C1FD3A48C345B64D8432820AFD4	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1E1D2C1FD3A48C345B64D8432820AFD4\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\897E583341745E32540FC917742104AF	msiexec.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
2040	chrome.exe
636	chrome.exe
636	chrome.exe
2212	chrome.exe
636	chrome.exe
636	chrome.exe
916	chrome.exe
2512	msiexec.exe
2512	msiexec.exe
1840	chrome.exe
2912	chrome.exe
2912	chrome.exe
3040	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2408	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: 33	1976	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1976	AUDIODG.EXE
Token: 33	1976	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1976	AUDIODG.EXE
Token: SeShutdownPrivilege	2408	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2408	msiexec.exe
Token: SeRestorePrivilege	2512	msiexec.exe
Token: SeTakeOwnershipPrivilege	2512	msiexec.exe
Token: SeSecurityPrivilege	2512	msiexec.exe
Token: SeCreateTokenPrivilege	2408	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2408	msiexec.exe
Token: SeLockMemoryPrivilege	2408	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2408	msiexec.exe
Token: SeMachineAccountPrivilege	2408	msiexec.exe
Token: SeTcbPrivilege	2408	msiexec.exe
Token: SeSecurityPrivilege	2408	msiexec.exe
Token: SeTakeOwnershipPrivilege	2408	msiexec.exe
Token: SeLoadDriverPrivilege	2408	msiexec.exe
Token: SeSystemProfilePrivilege	2408	msiexec.exe
Token: SeSystemtimePrivilege	2408	msiexec.exe
Token: SeProfSingleProcessPrivilege	2408	msiexec.exe
Token: SeIncBasePriorityPrivilege	2408	msiexec.exe
Token: SeCreatePagefilePrivilege	2408	msiexec.exe
Token: SeCreatePermanentPrivilege	2408	msiexec.exe
Token: SeBackupPrivilege	2408	msiexec.exe
Token: SeRestorePrivilege	2408	msiexec.exe
Token: SeShutdownPrivilege	2408	msiexec.exe
Token: SeDebugPrivilege	2408	msiexec.exe
Token: SeAuditPrivilege	2408	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2408	msiexec.exe
Token: SeChangeNotifyPrivilege	2408	msiexec.exe
Token: SeRemoteShutdownPrivilege	2408	msiexec.exe
Token: SeUndockPrivilege	2408	msiexec.exe
Token: SeSyncAgentPrivilege	2408	msiexec.exe
Token: SeEnableDelegationPrivilege	2408	msiexec.exe
Token: SeManageVolumePrivilege	2408	msiexec.exe
Token: SeImpersonatePrivilege	2408	msiexec.exe
Token: SeCreateGlobalPrivilege	2408	msiexec.exe
Token: SeBackupPrivilege	2572	vssvc.exe
Token: SeRestorePrivilege	2572	vssvc.exe
Token: SeAuditPrivilege	2572	vssvc.exe
Token: SeBackupPrivilege	2512	msiexec.exe
Token: SeRestorePrivilege	2512	msiexec.exe
Token: SeRestorePrivilege	2680	DrvInst.exe
Token: SeRestorePrivilege	2680	DrvInst.exe
Token: SeRestorePrivilege	2680	DrvInst.exe
Token: SeRestorePrivilege	2680	DrvInst.exe
Token: SeRestorePrivilege	2680	DrvInst.exe
Token: SeRestorePrivilege	2680	DrvInst.exe
Token: SeRestorePrivilege	2680	DrvInst.exe
Token: SeLoadDriverPrivilege	2680	DrvInst.exe
Token: SeLoadDriverPrivilege	2680	DrvInst.exe
Token: SeLoadDriverPrivilege	2680	DrvInst.exe
Token: SeRestorePrivilege	2512	msiexec.exe
Token: SeTakeOwnershipPrivilege	2512	msiexec.exe
Token: SeRestorePrivilege	2512	msiexec.exe
Token: SeTakeOwnershipPrivilege	2512	msiexec.exe
Token: SeRestorePrivilege	2512	msiexec.exe
Token: SeTakeOwnershipPrivilege	2512	msiexec.exe
Token: SeRestorePrivilege	2512	msiexec.exe
Token: SeTakeOwnershipPrivilege	2512	msiexec.exe
Token: SeRestorePrivilege	2512	msiexec.exe
Token: SeTakeOwnershipPrivilege	2512	msiexec.exe
Token: SeRestorePrivilege	2512	msiexec.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
636	chrome.exe
636	chrome.exe
636	chrome.exe
636	chrome.exe
636	chrome.exe
636	chrome.exe
636	chrome.exe
636	chrome.exe
636	chrome.exe
636	chrome.exe
636	chrome.exe
636	chrome.exe
636	chrome.exe
636	chrome.exe
636	chrome.exe
636	chrome.exe
636	chrome.exe
636	chrome.exe
636	chrome.exe
636	chrome.exe
636	chrome.exe
636	chrome.exe
636	chrome.exe
636	chrome.exe
636	chrome.exe
636	chrome.exe
636	chrome.exe
636	chrome.exe
636	chrome.exe
636	chrome.exe
636	chrome.exe
636	chrome.exe
636	chrome.exe
636	chrome.exe
636	chrome.exe
636	chrome.exe
636	chrome.exe
636	chrome.exe
636	chrome.exe
636	chrome.exe
636	chrome.exe
636	chrome.exe
636	chrome.exe
636	chrome.exe
636	chrome.exe
636	chrome.exe
636	chrome.exe
636	chrome.exe
636	chrome.exe
636	chrome.exe
636	chrome.exe
636	chrome.exe
636	chrome.exe
636	chrome.exe
636	chrome.exe
636	chrome.exe
636	chrome.exe
636	chrome.exe
636	chrome.exe
636	chrome.exe
636	chrome.exe
636	chrome.exe
636	chrome.exe
636	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
636	chrome.exe
636	chrome.exe
636	chrome.exe
636	chrome.exe
636	chrome.exe
636	chrome.exe
636	chrome.exe
636	chrome.exe
636	chrome.exe
636	chrome.exe
636	chrome.exe
636	chrome.exe
636	chrome.exe
636	chrome.exe
636	chrome.exe
636	chrome.exe
636	chrome.exe
636	chrome.exe
636	chrome.exe
636	chrome.exe
636	chrome.exe
636	chrome.exe
636	chrome.exe
636	chrome.exe
636	chrome.exe
636	chrome.exe
636	chrome.exe
636	chrome.exe
636	chrome.exe
636	chrome.exe
636	chrome.exe
636	chrome.exe
636	chrome.exe
636	chrome.exe
636	chrome.exe
636	chrome.exe
636	chrome.exe
636	chrome.exe
636	chrome.exe
636	chrome.exe
636	chrome.exe
636	chrome.exe
636	chrome.exe
636	chrome.exe
636	chrome.exe
636	chrome.exe
636	chrome.exe
636	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe
2912	chrome.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
2032	iexplore.exe
2032	iexplore.exe
2192	IEXPLORE.EXE
2192	IEXPLORE.EXE
2456	iexplore.exe
2456	iexplore.exe
2760	IEXPLORE.EXE
2760	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 636 wrote to memory of 1648	636	chrome.exe	31
PID 636 wrote to memory of 1648	636	chrome.exe	31
PID 636 wrote to memory of 1648	636	chrome.exe	31
PID 636 wrote to memory of 2004	636	chrome.exe	32
PID 636 wrote to memory of 2004	636	chrome.exe	32
PID 636 wrote to memory of 2004	636	chrome.exe	32
PID 636 wrote to memory of 2004	636	chrome.exe	32
PID 636 wrote to memory of 2004	636	chrome.exe	32
PID 636 wrote to memory of 2004	636	chrome.exe	32
PID 636 wrote to memory of 2004	636	chrome.exe	32
PID 636 wrote to memory of 2004	636	chrome.exe	32
PID 636 wrote to memory of 2004	636	chrome.exe	32
PID 636 wrote to memory of 2004	636	chrome.exe	32
PID 636 wrote to memory of 2004	636	chrome.exe	32
PID 636 wrote to memory of 2004	636	chrome.exe	32
PID 636 wrote to memory of 2004	636	chrome.exe	32
PID 636 wrote to memory of 2004	636	chrome.exe	32
PID 636 wrote to memory of 2004	636	chrome.exe	32
PID 636 wrote to memory of 2004	636	chrome.exe	32
PID 636 wrote to memory of 2004	636	chrome.exe	32
PID 636 wrote to memory of 2004	636	chrome.exe	32
PID 636 wrote to memory of 2004	636	chrome.exe	32
PID 636 wrote to memory of 2004	636	chrome.exe	32
PID 636 wrote to memory of 2004	636	chrome.exe	32
PID 636 wrote to memory of 2004	636	chrome.exe	32
PID 636 wrote to memory of 2004	636	chrome.exe	32
PID 636 wrote to memory of 2004	636	chrome.exe	32
PID 636 wrote to memory of 2004	636	chrome.exe	32
PID 636 wrote to memory of 2004	636	chrome.exe	32
PID 636 wrote to memory of 2004	636	chrome.exe	32
PID 636 wrote to memory of 2004	636	chrome.exe	32
PID 636 wrote to memory of 2004	636	chrome.exe	32
PID 636 wrote to memory of 2004	636	chrome.exe	32
PID 636 wrote to memory of 2004	636	chrome.exe	32
PID 636 wrote to memory of 2004	636	chrome.exe	32
PID 636 wrote to memory of 2004	636	chrome.exe	32
PID 636 wrote to memory of 2004	636	chrome.exe	32
PID 636 wrote to memory of 2004	636	chrome.exe	32
PID 636 wrote to memory of 2004	636	chrome.exe	32
PID 636 wrote to memory of 2004	636	chrome.exe	32
PID 636 wrote to memory of 2004	636	chrome.exe	32
PID 636 wrote to memory of 2004	636	chrome.exe	32
PID 636 wrote to memory of 2004	636	chrome.exe	32
PID 636 wrote to memory of 2004	636	chrome.exe	32
PID 636 wrote to memory of 2040	636	chrome.exe	33
PID 636 wrote to memory of 2040	636	chrome.exe	33
PID 636 wrote to memory of 2040	636	chrome.exe	33
PID 636 wrote to memory of 1000	636	chrome.exe	34
PID 636 wrote to memory of 1000	636	chrome.exe	34
PID 636 wrote to memory of 1000	636	chrome.exe	34
PID 636 wrote to memory of 1000	636	chrome.exe	34
PID 636 wrote to memory of 1000	636	chrome.exe	34
PID 636 wrote to memory of 1000	636	chrome.exe	34
PID 636 wrote to memory of 1000	636	chrome.exe	34
PID 636 wrote to memory of 1000	636	chrome.exe	34
PID 636 wrote to memory of 1000	636	chrome.exe	34
PID 636 wrote to memory of 1000	636	chrome.exe	34
PID 636 wrote to memory of 1000	636	chrome.exe	34
PID 636 wrote to memory of 1000	636	chrome.exe	34
PID 636 wrote to memory of 1000	636	chrome.exe	34
PID 636 wrote to memory of 1000	636	chrome.exe	34
PID 636 wrote to memory of 1000	636	chrome.exe	34
PID 636 wrote to memory of 1000	636	chrome.exe	34
PID 636 wrote to memory of 1000	636	chrome.exe	34

C:\Users\Admin\AppData\Local\Temp\SKlauncher 3.0.exe
"C:\Users\Admin\AppData\Local\Temp\SKlauncher 3.0.exe"
1⤵
PID:896
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" https://adoptium.net/
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2032
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2032 CREDAT:275457 /prefetch:2
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:2192

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:1632

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x408
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1976

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:636
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6644f50,0x7fef6644f60,0x7fef6644f70
  2⤵
  PID:1648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1064,3295851295043608632,2213574136535494753,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1084 /prefetch:2
  2⤵
  PID:2004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1064,3295851295043608632,2213574136535494753,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1356 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1064,3295851295043608632,2213574136535494753,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1860 /prefetch:8
  2⤵
  PID:1000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1064,3295851295043608632,2213574136535494753,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2044 /prefetch:1
  2⤵
  PID:940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1064,3295851295043608632,2213574136535494753,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2084 /prefetch:1
  2⤵
  PID:684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1064,3295851295043608632,2213574136535494753,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2848 /prefetch:8
  2⤵
  PID:1712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1064,3295851295043608632,2213574136535494753,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=swiftshader-webgl --mojo-platform-channel-handle=3260 /prefetch:2
  2⤵
  PID:1576
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1064,3295851295043608632,2213574136535494753,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1348 /prefetch:1
  2⤵
  PID:2072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1064,3295851295043608632,2213574136535494753,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3596 /prefetch:8
  2⤵
  PID:2132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1064,3295851295043608632,2213574136535494753,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3692 /prefetch:8
  2⤵
  PID:2140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1064,3295851295043608632,2213574136535494753,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3868 /prefetch:8
  2⤵
  PID:2148
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1064,3295851295043608632,2213574136535494753,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3976 /prefetch:8
  2⤵
  PID:2184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1064,3295851295043608632,2213574136535494753,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3912 /prefetch:8
  2⤵
  PID:2284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1064,3295851295043608632,2213574136535494753,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3888 /prefetch:8
  2⤵
  PID:2292
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1064,3295851295043608632,2213574136535494753,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4036 /prefetch:8
  2⤵
  PID:2316
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1064,3295851295043608632,2213574136535494753,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4052 /prefetch:8
  2⤵
  PID:2308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1064,3295851295043608632,2213574136535494753,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3868 /prefetch:8
  2⤵
  PID:2300
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1064,3295851295043608632,2213574136535494753,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4012 /prefetch:8
  2⤵
  PID:2324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1064,3295851295043608632,2213574136535494753,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3712 /prefetch:8
  2⤵
  PID:2344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1064,3295851295043608632,2213574136535494753,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3736 /prefetch:8
  2⤵
  PID:2336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1064,3295851295043608632,2213574136535494753,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3696 /prefetch:8
  2⤵
  PID:2556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1064,3295851295043608632,2213574136535494753,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3852 /prefetch:8
  2⤵
  PID:2564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1064,3295851295043608632,2213574136535494753,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3864 /prefetch:1
  2⤵
  PID:2656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1064,3295851295043608632,2213574136535494753,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2180 /prefetch:1
  2⤵
  PID:2716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1064,3295851295043608632,2213574136535494753,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3780 /prefetch:1
  2⤵
  PID:2804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1064,3295851295043608632,2213574136535494753,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4248 /prefetch:1
  2⤵
  PID:2812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1064,3295851295043608632,2213574136535494753,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2716 /prefetch:1
  2⤵
  PID:2948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1064,3295851295043608632,2213574136535494753,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=536 /prefetch:8
  2⤵
  PID:3016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1064,3295851295043608632,2213574136535494753,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4600 /prefetch:8
  2⤵
  PID:2208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1064,3295851295043608632,2213574136535494753,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4676 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2212
- C:\Windows\System32\msiexec.exe
  "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\Downloads\OpenJDK17U-jdk_x64_windows_hotspot_17.0.5_8.msi"
  2⤵
  - Blocklisted process makes network request
  - Enumerates connected drives
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  PID:2408
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1064,3295851295043608632,2213574136535494753,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4188 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:916

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2512
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding CE1763C12924A7DF818A5EDC8115AAF4
  2⤵
  - Loads dropped DLL
  PID:1028

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2572

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000003BC" "000000000000049C"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2680

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:2396

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SendNotifyMessage
PID:2912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6644f50,0x7fef6644f60,0x7fef6644f70
  2⤵
  PID:1496
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1128,18343528727622503315,16211751328658881736,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1136 /prefetch:2
  2⤵
  PID:2068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1128,18343528727622503315,16211751328658881736,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1292 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1128,18343528727622503315,16211751328658881736,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1812 /prefetch:8
  2⤵
  PID:1908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1128,18343528727622503315,16211751328658881736,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2108 /prefetch:1
  2⤵
  PID:3028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1128,18343528727622503315,16211751328658881736,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2096 /prefetch:1
  2⤵
  PID:1912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1128,18343528727622503315,16211751328658881736,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2756 /prefetch:8
  2⤵
  PID:340
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1128,18343528727622503315,16211751328658881736,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=swiftshader-webgl --mojo-platform-channel-handle=3348 /prefetch:2
  2⤵
  PID:3008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1128,18343528727622503315,16211751328658881736,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3416 /prefetch:1
  2⤵
  PID:1952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1128,18343528727622503315,16211751328658881736,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3564 /prefetch:8
  2⤵
  PID:1468
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1128,18343528727622503315,16211751328658881736,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3668 /prefetch:8
  2⤵
  PID:1000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1128,18343528727622503315,16211751328658881736,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3676 /prefetch:8
  2⤵
  PID:916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1128,18343528727622503315,16211751328658881736,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3868 /prefetch:8
  2⤵
  PID:2768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1128,18343528727622503315,16211751328658881736,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3932 /prefetch:8
  2⤵
  PID:2368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1128,18343528727622503315,16211751328658881736,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3836 /prefetch:1
  2⤵
  PID:872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1128,18343528727622503315,16211751328658881736,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2204 /prefetch:1
  2⤵
  PID:2340
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1128,18343528727622503315,16211751328658881736,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3808 /prefetch:1
  2⤵
  PID:2976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1128,18343528727622503315,16211751328658881736,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3592 /prefetch:1
  2⤵
  PID:2868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1128,18343528727622503315,16211751328658881736,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4040 /prefetch:1
  2⤵
  PID:2872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1128,18343528727622503315,16211751328658881736,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3428 /prefetch:1
  2⤵
  PID:2668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1128,18343528727622503315,16211751328658881736,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3436 /prefetch:1
  2⤵
  PID:2504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1128,18343528727622503315,16211751328658881736,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2224 /prefetch:1
  2⤵
  PID:628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1128,18343528727622503315,16211751328658881736,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4052 /prefetch:1
  2⤵
  PID:1680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1128,18343528727622503315,16211751328658881736,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3788 /prefetch:1
  2⤵
  PID:2764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1128,18343528727622503315,16211751328658881736,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3328 /prefetch:8
  2⤵
  PID:2140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1128,18343528727622503315,16211751328658881736,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3536 /prefetch:1
  2⤵
  PID:1516
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1128,18343528727622503315,16211751328658881736,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3404 /prefetch:1
  2⤵
  PID:1828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1128,18343528727622503315,16211751328658881736,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2284 /prefetch:1
  2⤵
  PID:2392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1128,18343528727622503315,16211751328658881736,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5524 /prefetch:8
  2⤵
  PID:2980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1128,18343528727622503315,16211751328658881736,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5620 /prefetch:8
  2⤵
  PID:2960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1128,18343528727622503315,16211751328658881736,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5544 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1128,18343528727622503315,16211751328658881736,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5688 /prefetch:8
  2⤵
  PID:1488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1128,18343528727622503315,16211751328658881736,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5632 /prefetch:8
  2⤵
  PID:2560

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2456
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2456 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2760

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
61KB

MD5
fc4666cbca561e864e7fdf883a9e6661

SHA1
2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

SHA256
10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

SHA512
c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
a641f5c48784f9e4c7705445fdd84ff0

SHA1
c2b961b65e9b47d81f4fa8ce34a83c83ec37d3a2

SHA256
52d8437c018e3b51a20f14a2d4793113af2bb5b21d7e7a4ffd15c7a06c726887

SHA512
8fec9debf589b75b33ed35bd16ff400049b7ff705004ab4e4dc94104b14325a961f19f1f52ff0a63645972b17df3197620788151c33aa4b1f2b7f7431a049ad7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
d870c3b929f26478a684253554f82f34

SHA1
99d32b1b302c12603a59c1b26bf8321e4a28260e

SHA256
d3ecd3a16a8110d8746f1347827120719b098cfa401a6c261cff7d8bceb30899

SHA512
5da77e44ff786601dc43e7c44513675489d82cd10eff81e6d32737884a5cfe46422ed7c0a650d8bc058b88ac2989a7a0cd204e16b766ecae8f013c191e86ab84

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

Filesize
40B

MD5
ca0c469b8152e7e371cf08d73b026433

SHA1
07a87b72da129c4af371a735398bd1aefdb0e74a

SHA256
49bf5be3f0eae3a1851a7ac6e98c2aacfd41d04b0bee3f34ea75d3fe76ac4996

SHA512
2a051c82401a439602f6400b7af49353c869f464815dbefe068c3ad6249f7875e42d4c486dfdc22e60d54f711afc339491bb74922bba551df98e9ec0780dbafa

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\data_0

Filesize
44KB

MD5
80c3e82a458325c1b128c1258ef42f2b

SHA1
2424daddaf09530e8bc0085491c25dd8fafa2daa

SHA256
43f5fcf8741f4585711e867cf75aebf34572abce026c7c6662d1ebe07ce99a7c

SHA512
f2db4502fd8b24e897132aeb61a9ca43888a9a1a9a5277fc15f01e8db5a040aa5c7880843c4f5f738fe4d6a9830f27cd5c91b74697348574b08fbe7c9dd8bc83

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Favicons

Filesize
28KB

MD5
ac8eb93bac930e7ef188c1395ad74496

SHA1
98902d450b64922243161ab63b6d5f43eaa82a6a

SHA256
dc09c5d9b5d1c4b319dc15bfe3f5f3348fb0f34fe3a29507bd3727feff19ff62

SHA512
50f53c07b5dd4223736f9dc9eae8f895b877c05e6df32b1d67afe3a0c37a3b112b45abce25c0642091b1e7f7c7ca69e0b18c6c85803c7343503acaaea0edf5e2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\History

Filesize
116KB

MD5
2517cb705a00d4291cb5e72af8cddbd8

SHA1
f8bffcacb6519372c5c964b608a7da486f8bc093

SHA256
76fd2abe32add96a7a28b8f4507805c5df1c848fb8f7feb4de62bc6c2f281a09

SHA512
f9943a324bfd885b739a6ce447080f74d81fd03123b73b5b38ca1551d1552a308ecff1e266dc1c594bb09b4feb8138b44f82556b0b85f9382fc81e04ebe88892

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.log

Filesize
25KB

MD5
fb483dd5c0f0265e3be05bc3ade1cfd9

SHA1
4bd74192caf530b7f2dda37ae87ef3e3cd05ed97

SHA256
2f97f33d6dbb6415b080f3e846b465a558538e4df3caca7b20281daeb7f6cc27

SHA512
0f1c2eed99d18a5926d5a8f79c1ecb1c4ca78bb63d281dd75a7c65404e3cfe3ddef7eb7c41c2e8a2bc956198437371dc158b7704a0e45411d3a81c2c27955af4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG

Filesize
329B

MD5
5810264e795f7e59905902f5c214d4a6

SHA1
a1ed1052fd7967a3059813df78d2c0adad16f2e8

SHA256
3d8bcacb56aaa65fcd6e0ca851a9189ae947f8e6bed0dc6a8e32bd530d963003

SHA512
6bb2c792bfc1d1464cea5526cbd14fe67d7dfab7d726eaf6ad583b04241ff82f54d948da3873c3df3c742331a8e9c0f877e60fa8f1731992359251661611833b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network Persistent State

Filesize
3KB

MD5
7511be086181bac130a4e036e9288639

SHA1
88097eae8e96aa39abb497c8dc2fa22373dabf33

SHA256
c4a115004601134613a1d905d04b6f19af7898962466234853ef4dddfaaeea63

SHA512
a3e422bfd67487aba6b448fb9f8b2128cb6c289b80543cf1ad5192c29d4eadf0272cf3e5ba3b2b9bbd78c545149a9d5fa2f05ca6a0a5e4deb96f3cc2fc09bf6c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
617e44261be46bfc27ff46f56dfa102a

SHA1
e449c925665f082ffe5d502565240adcb5648293

SHA256
49efeaff0ae97f235a73c21112dd50c3e86788a7656a2e92c2bf206aa71c4f96

SHA512
6810d7c51650111156dfcfe5c7d93599be6ac03198d371eeff0e0d3d86ac2904bc1dab6016f457953ef7520c1e6fc0beea95ae1a06e4c272c0932a9e9f3ecdb1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
3d319287c240398d0e582b6c1d3b6c62

SHA1
3f11ac874c3e02480471971e76a5f8666c60c967

SHA256
12010c0b64bf97941ade8118860084943adbb9e4a97059ca70cfaae3b57bdcd4

SHA512
b85c7df826de44a27b33b42ef1ab411fd34dcfd30bcd89ebdd4f573c2c163ac101dd1d467c54e69515d7dadad12afe1830e6e38411f3950e5d0283b0b08a4ef3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sessions\Tabs_13316752359161800

Filesize
8KB

MD5
8b0a8f66e1780a9c326fc5dbf544391a

SHA1
62e800c49b903fd37f4365c296e8700a3554e364

SHA256
4edeed7a32326fc987723f3932ac85d1da3f478944a622289bc7f6d2bdd9dca4

SHA512
2d13255139b17bae086cf333f220fcf3c2a675cf2e19c8c342b8520a023b41cd6c14626ae755edbdf4e2fdd947a934059ae34141df7b45ad7061322b41f94eaf

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000003.log

Filesize
112B

MD5
8779105e4eebf8a427db0d533e43870a

SHA1
bcae95651745fe435543a4dc5137c0e8a635d5ac

SHA256
7065d458824f6e763723e091c22a1fe15c26936f8f4849396d5bb5bea9aa4ddf

SHA512
37081620a7abe4c8e2d8bd62165635bcc452dee34f94d670cc505d9d8172453eb4b7cf3f7f7e1a64a2d629b8ae19ccf4452bafffc77e9ccf6263a546ccd03143

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG

Filesize
345B

MD5
9534c313116023cddd32e709c8243299

SHA1
f5f038f1a6206da38a680aab38108c15a6781185

SHA256
c4f89cbe5c0fb3fbf81c1eb728a6205065aae9651ef430bb102299651eec4f15

SHA512
827a50c741936894e2b48c0272eeaefeed9da7658997cf62bc91463c8033069678bdaec46518e80d45f795937f1040e3b83cf34c5dc7611660b530d2986b47c1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000003.log

Filesize
160B

MD5
de92ad90be6d3364745b2f73f4c3cf73

SHA1
9158681463bd30e5af4dda4baac81f93cedbda77

SHA256
0025a3e0d3b834401b3b5f820e1991ef7e810d9a4b8b6b579e6301c94e7031a0

SHA512
9e81cefc195439439f4b23ee7696309d7bc3c08e5b444d2abde26d2f12b2d3bcfd124fb9a2d40c6389e9f787741676fad366a2e9982674e7b931028c014d8a79

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG

Filesize
321B

MD5
3d7969d36ba1a279565dee1fc9077d67

SHA1
6672bd58eae4d8d971ebbb4443f1540afa9690ad

SHA256
fce82549f5036f05d8d0e7201d8a3293431afc7a106e5ef082896c6bdd65776e

SHA512
19c87f01d0e4338b5bd763396659bfc2a7da7d1af0e117f23b62402ccb7719c81dc32f82598a4f2bf875e20aa238d484d9d4a6c940615fed7d7436bd5486834b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\TransportSecurity

Filesize
1KB

MD5
74d169c8c90c1b48f81d151aea9f036b

SHA1
8badba0cf12b80b31712707dbc4576fc531bc749

SHA256
82e2169d0aafadad90f17e3802a89ca066d545eee63ffa76fbae4d5db69191c8

SHA512
a1afef02ee6311d49ef958e24266b86825a6165199c80dca1e97d69342269444bfdecdf7d5e37089949ae62c06a6e458fff7ad17ba5f0ad8a695a530ded7bb8e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Visited Links

Filesize
128KB

MD5
6fbb1d77e6707ee9635e016cc23d0abf

SHA1
6bcfa4e8a4d0943f9e244a723b75a301eda85d36

SHA256
f6ae0a3ad9d4677fc8341177de6414067e1342d08d21e4dbf3cc01cdcf883f13

SHA512
8db9e26ab63c84a2f1c148af16c996b7f60d0a3ae58e02c95d645cf3a8b72c22b68eb621080454d7bc0df2a2eea72e061d70491f5606161a15744d212ac6256e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data

Filesize
88KB

MD5
bc4132e7a60a2b7e833a6c34877be1dd

SHA1
b2227b8e109513b4951dce03252a18c4e008a190

SHA256
3000393f7edcf8b987bac95620cd31c2ed7f28216099a96ac8195fb9a50e330f

SHA512
c44ba3d64bfca2e68aa4da96ad7f6d0911fd5feb768f188fc7331fd14871b5b272f4ea6f85652a5bd80b839be2ebd9f0e44529c5ef956ec647dbd44bea59847a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version

Filesize
13B

MD5
b63048c4e7e52c52053d25da30d9c5ab

SHA1
679a44d402f5ec24605719e06459f5a707989187

SHA256
389caa40ea458e84bc624a9af1e0dec60fa652b2db2b81c09b1dfe22822cc3d1

SHA512
e86c58c5a25e24f21ad79ed526a90c120a09c115f4820663bd2ebbc59e7bb1c4c418267eb77645522aa20b2c1b53fba8e31690db7bae9b21e4eff3db06316359

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
106KB

MD5
05cc0897632e7eba017115e65674c143

SHA1
b19759ebf889ed7e115cbb9248259418a0a25b6b

SHA256
47c0a4c3eb47e62f1f2aec8366b01eb0b787b9c55922ac4270857c214eeddddc

SHA512
f8343a99a4ed94f2fe22bf8af182196a6d1c5100c363e602a2a7a95d3393979ad5967496aff337801433051f7dba0defc1e6c46b1e0d85031553bc6feff85e3c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\GPUCache\data_1

Filesize
264KB

MD5
13f877a0b0993ff018308dab9ccf5d68

SHA1
7f9c7cd16d14b0ebafa7a135f80651e24e741bbc

SHA256
44a6e9e2067166da2d06f9a565e26d1ac0964fa5b8604a58a2055d28d82a649d

SHA512
6d3e4646343d64d822337f8b4e16c2fc2e5061ae1675169f1cece569255ead2b88fc0c1568d72c7ed0012e0af2b0d8ac9d7f26da10dbdc70aeebe2ae1a4107f2

Download Submit
C:\Users\Admin\Downloads\OpenJDK17U-jdk_x64_windows_hotspot_17.0.5_8.msi

Filesize
160.2MB

MD5
134f7ff76b5573eea19d38dbd24f1710

SHA1
fc761b265e064cf54af2447ead40f619213d717e

SHA256
33a2d3d25d83cc6c7e5e7267bfa4c262319555f402d771ce1e05abbf52183391

SHA512
cd5a28f18bec9176b22b89ad6384f16af7b7b48bb41f3684be27250edf9811df7d6b06e8d49aa0eef33c9393d1dc216eac68c2b334a1e9af2393d06b7ba31e4e

Download Submit
C:\Windows\Installer\MSIC57E.tmp

Filesize
215KB

MD5
5a36af31695af76ce3aa1507611fe5bd

SHA1
255787a75d37258a02e6f0d19a83d96b46654d80

SHA256
17a7553b6fdef993bb221fd870f2b30e3783ae9d6e9b9b01af718b61e680a118

SHA512
b3611dba29d3f32d3fdbc5ec0a6fdacdee7e41406f0089f65c64e68219114d364e7f44616f06ce9c5f0ba3280edd35115d9e93924a46ae91e1dce5ab6efd567d

Download Submit
\Windows\Installer\MSIC57E.tmp

Filesize
215KB

MD5
5a36af31695af76ce3aa1507611fe5bd

SHA1
255787a75d37258a02e6f0d19a83d96b46654d80

SHA256
17a7553b6fdef993bb221fd870f2b30e3783ae9d6e9b9b01af718b61e680a118

SHA512
b3611dba29d3f32d3fdbc5ec0a6fdacdee7e41406f0089f65c64e68219114d364e7f44616f06ce9c5f0ba3280edd35115d9e93924a46ae91e1dce5ab6efd567d

Download Submit
memory/896-54-0x0000000075B41000-0x0000000075B43000-memory.dmp

Filesize
8KB

Download
memory/1632-55-0x000007FEFBF71000-0x000007FEFBF73000-memory.dmp

Filesize
8KB

Download