ca978112ca1bbdcafac231b39a23dc4da786eff8147c4e72b9807785afee48bb

Analysis

max time kernel
823s
max time network
2644s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
10-05-2023 17:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

run.ps1
Size

1B
MD5

0cc175b9c0f1b6a831c399e269772661
SHA1

86f7e437faa5a7fce15d1ddcb9eaeaea377667b8
SHA256

ca978112ca1bbdcafac231b39a23dc4da786eff8147c4e72b9807785afee48bb
SHA512

1f40fc92da241694750979ee6cf582f2d5d7d28e18335de05abc54d0560e0f5302860c652bf08d560252aa5e74210546f369fbbbce8c12cfc7957b2652fe9a75

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

7z2201-x64.exe

pid process

2420 7z2201-x64.exe
Loads dropped DLL 3 IoCs

Processes:

7z2201-x64.exechrome.exe

pid process

2420 7z2201-x64.exe
2832 chrome.exe
2832 chrome.exe

pid	process
2420	7z2201-x64.exe

pid	process
2420	7z2201-x64.exe
2832	chrome.exe
2832	chrome.exe

Registers COM server for autorun 1 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Processes:

7z2201-x64.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32	7z2201-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip.dll"	7z2201-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment"	7z2201-x64.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

Processes:

7z2201-x64.exe

description	ioc	process
File opened for modification	C:\Program Files\7-Zip\Lang\el.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\io.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ne.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pa-in.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ps.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\eu.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kab.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pt-br.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ast.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\co.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fy.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mng.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sr-spl.txt	7z2201-x64.exe
File created	C:\Program Files\7-Zip\Lang\tg.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tt.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sl.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sr-spc.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hu.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\7-zip32.dll	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\da.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ko.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sa.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tg.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fi.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hi.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\is.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nl.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tk.txt	7z2201-x64.exe
File created	C:\Program Files\7-Zip\Lang\uz-cyrl.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\be.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\bn.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uk.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uz.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\cs.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ext.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kaa.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kk.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\vi.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ar.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ku-ckb.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nn.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ro.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mn.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tr.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\zh-tw.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\License.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fa.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uz-cyrl.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\zh-cn.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\descript.ion	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\7-zip.chm	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ba.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\de.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\gu.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\he.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\si.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\History.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\gl.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nb.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sv.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\af.txt	7z2201-x64.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies Internet Explorer settings 1 TTPs 27 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A84B4FE1-EF66-11ED-901D-D2C9D0B8F522} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe

Modifies registry class 20 IoCs

Processes:

7z2201-x64.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2201-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32	7z2201-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip.dll"	7z2201-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip	7z2201-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\7-Zip	7z2201-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip	7z2201-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2201-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}	7z2201-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip32.dll"	7z2201-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\ = "7-Zip Shell Extension"	7z2201-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32	7z2201-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip	7z2201-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2201-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\ShellEx\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2201-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment"	7z2201-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}	7z2201-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2201-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\7-Zip	7z2201-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\ = "7-Zip Shell Extension"	7z2201-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment"	7z2201-x64.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

powershell.exechrome.exe

pid process

1888 powershell.exe
1932 chrome.exe
1932 chrome.exe
1932 chrome.exe
1932 chrome.exe

pid	process
1888	powershell.exe
1932	chrome.exe
1932	chrome.exe
1932	chrome.exe
1932	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

powershell.exechrome.exe

description	pid	process
Token: SeDebugPrivilege	1888	powershell.exe
Token: SeShutdownPrivilege	1932	chrome.exe
Token: SeShutdownPrivilege	1932	chrome.exe
Token: SeShutdownPrivilege	1932	chrome.exe
Token: SeShutdownPrivilege	1932	chrome.exe
Token: SeShutdownPrivilege	1932	chrome.exe
Token: SeShutdownPrivilege	1932	chrome.exe
Token: SeShutdownPrivilege	1932	chrome.exe
Token: SeShutdownPrivilege	1932	chrome.exe
Token: SeShutdownPrivilege	1932	chrome.exe
Token: SeShutdownPrivilege	1932	chrome.exe
Token: SeShutdownPrivilege	1932	chrome.exe
Token: SeShutdownPrivilege	1932	chrome.exe
Token: SeShutdownPrivilege	1932	chrome.exe
Token: SeShutdownPrivilege	1932	chrome.exe
Token: SeShutdownPrivilege	1932	chrome.exe
Token: SeShutdownPrivilege	1932	chrome.exe
Token: SeShutdownPrivilege	1932	chrome.exe
Token: SeShutdownPrivilege	1932	chrome.exe
Token: SeShutdownPrivilege	1932	chrome.exe
Token: SeShutdownPrivilege	1932	chrome.exe
Token: SeShutdownPrivilege	1932	chrome.exe
Token: SeShutdownPrivilege	1932	chrome.exe
Token: SeShutdownPrivilege	1932	chrome.exe
Token: SeShutdownPrivilege	1932	chrome.exe
Token: SeShutdownPrivilege	1932	chrome.exe
Token: SeShutdownPrivilege	1932	chrome.exe
Token: SeShutdownPrivilege	1932	chrome.exe
Token: SeShutdownPrivilege	1932	chrome.exe
Token: SeShutdownPrivilege	1932	chrome.exe
Token: SeShutdownPrivilege	1932	chrome.exe
Token: SeShutdownPrivilege	1932	chrome.exe
Token: SeShutdownPrivilege	1932	chrome.exe
Token: SeShutdownPrivilege	1932	chrome.exe
Token: SeShutdownPrivilege	1932	chrome.exe
Token: SeShutdownPrivilege	1932	chrome.exe
Token: SeShutdownPrivilege	1932	chrome.exe
Token: SeShutdownPrivilege	1932	chrome.exe
Token: SeShutdownPrivilege	1932	chrome.exe
Token: SeShutdownPrivilege	1932	chrome.exe
Token: SeShutdownPrivilege	1932	chrome.exe
Token: SeShutdownPrivilege	1932	chrome.exe
Token: SeShutdownPrivilege	1932	chrome.exe
Token: SeShutdownPrivilege	1932	chrome.exe
Token: SeShutdownPrivilege	1932	chrome.exe
Token: SeShutdownPrivilege	1932	chrome.exe
Token: SeShutdownPrivilege	1932	chrome.exe
Token: SeShutdownPrivilege	1932	chrome.exe
Token: SeShutdownPrivilege	1932	chrome.exe
Token: SeShutdownPrivilege	1932	chrome.exe
Token: SeShutdownPrivilege	1932	chrome.exe
Token: SeShutdownPrivilege	1932	chrome.exe
Token: SeShutdownPrivilege	1932	chrome.exe
Token: SeShutdownPrivilege	1932	chrome.exe
Token: SeShutdownPrivilege	1932	chrome.exe
Token: SeShutdownPrivilege	1932	chrome.exe
Token: SeShutdownPrivilege	1932	chrome.exe
Token: SeShutdownPrivilege	1932	chrome.exe
Token: SeShutdownPrivilege	1932	chrome.exe
Token: SeShutdownPrivilege	1932	chrome.exe
Token: SeShutdownPrivilege	1932	chrome.exe
Token: SeShutdownPrivilege	1932	chrome.exe
Token: SeShutdownPrivilege	1932	chrome.exe
Token: SeShutdownPrivilege	1932	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

iexplore.exechrome.exe

pid	process
1612	iexplore.exe
1932	chrome.exe
1932	chrome.exe
1932	chrome.exe
1932	chrome.exe
1932	chrome.exe
1932	chrome.exe
1932	chrome.exe
1932	chrome.exe
1932	chrome.exe
1932	chrome.exe
1932	chrome.exe
1932	chrome.exe
1932	chrome.exe
1932	chrome.exe
1932	chrome.exe
1932	chrome.exe
1932	chrome.exe
1932	chrome.exe
1932	chrome.exe
1932	chrome.exe
1932	chrome.exe
1932	chrome.exe
1932	chrome.exe
1932	chrome.exe
1932	chrome.exe
1932	chrome.exe
1932	chrome.exe
1932	chrome.exe
1932	chrome.exe
1932	chrome.exe
1932	chrome.exe
1932	chrome.exe
1932	chrome.exe
1932	chrome.exe
1932	chrome.exe
1932	chrome.exe
1932	chrome.exe
1932	chrome.exe
1932	chrome.exe
1932	chrome.exe
1932	chrome.exe
1932	chrome.exe
1932	chrome.exe
1932	chrome.exe
1932	chrome.exe
1932	chrome.exe
1932	chrome.exe
1932	chrome.exe
1932	chrome.exe
1932	chrome.exe
1932	chrome.exe
1932	chrome.exe
1932	chrome.exe
1932	chrome.exe
1932	chrome.exe
1932	chrome.exe
1932	chrome.exe
1932	chrome.exe
1932	chrome.exe
1932	chrome.exe
1932	chrome.exe
1932	chrome.exe
1932	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

chrome.exe

pid	process
1932	chrome.exe
1932	chrome.exe
1932	chrome.exe
1932	chrome.exe
1932	chrome.exe
1932	chrome.exe
1932	chrome.exe
1932	chrome.exe
1932	chrome.exe
1932	chrome.exe
1932	chrome.exe
1932	chrome.exe
1932	chrome.exe
1932	chrome.exe
1932	chrome.exe
1932	chrome.exe
1932	chrome.exe
1932	chrome.exe
1932	chrome.exe
1932	chrome.exe
1932	chrome.exe
1932	chrome.exe
1932	chrome.exe
1932	chrome.exe
1932	chrome.exe
1932	chrome.exe
1932	chrome.exe
1932	chrome.exe
1932	chrome.exe
1932	chrome.exe
1932	chrome.exe
1932	chrome.exe
1932	chrome.exe
1932	chrome.exe
1932	chrome.exe
1932	chrome.exe
1932	chrome.exe
1932	chrome.exe
1932	chrome.exe
1932	chrome.exe
1932	chrome.exe
1932	chrome.exe
1932	chrome.exe
1932	chrome.exe
1932	chrome.exe
1932	chrome.exe
1932	chrome.exe
1932	chrome.exe
1932	chrome.exe
1932	chrome.exe
1932	chrome.exe
1932	chrome.exe
1932	chrome.exe
1932	chrome.exe
1932	chrome.exe
1932	chrome.exe
1932	chrome.exe
1932	chrome.exe
1932	chrome.exe
1932	chrome.exe
1932	chrome.exe
1932	chrome.exe
1932	chrome.exe
1932	chrome.exe

Suspicious use of SetWindowsHookEx 7 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

1612 iexplore.exe
1612 iexplore.exe
912 IEXPLORE.EXE
912 IEXPLORE.EXE
1612 iexplore.exe
912 IEXPLORE.EXE
912 IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

iexplore.exechrome.exe

description	pid	process	target process
PID 1612 wrote to memory of 912	1612	iexplore.exe	IEXPLORE.EXE
PID 1612 wrote to memory of 912	1612	iexplore.exe	IEXPLORE.EXE
PID 1612 wrote to memory of 912	1612	iexplore.exe	IEXPLORE.EXE
PID 1612 wrote to memory of 912	1612	iexplore.exe	IEXPLORE.EXE
PID 1932 wrote to memory of 272	1932	chrome.exe	chrome.exe
PID 1932 wrote to memory of 272	1932	chrome.exe	chrome.exe
PID 1932 wrote to memory of 272	1932	chrome.exe	chrome.exe
PID 1932 wrote to memory of 1856	1932	chrome.exe	chrome.exe
PID 1932 wrote to memory of 1856	1932	chrome.exe	chrome.exe
PID 1932 wrote to memory of 1856	1932	chrome.exe	chrome.exe
PID 1932 wrote to memory of 1856	1932	chrome.exe	chrome.exe
PID 1932 wrote to memory of 1856	1932	chrome.exe	chrome.exe
PID 1932 wrote to memory of 1856	1932	chrome.exe	chrome.exe
PID 1932 wrote to memory of 1856	1932	chrome.exe	chrome.exe
PID 1932 wrote to memory of 1856	1932	chrome.exe	chrome.exe
PID 1932 wrote to memory of 1856	1932	chrome.exe	chrome.exe
PID 1932 wrote to memory of 1856	1932	chrome.exe	chrome.exe
PID 1932 wrote to memory of 1856	1932	chrome.exe	chrome.exe
PID 1932 wrote to memory of 1856	1932	chrome.exe	chrome.exe
PID 1932 wrote to memory of 1856	1932	chrome.exe	chrome.exe
PID 1932 wrote to memory of 1856	1932	chrome.exe	chrome.exe
PID 1932 wrote to memory of 1856	1932	chrome.exe	chrome.exe
PID 1932 wrote to memory of 1856	1932	chrome.exe	chrome.exe
PID 1932 wrote to memory of 1856	1932	chrome.exe	chrome.exe
PID 1932 wrote to memory of 1856	1932	chrome.exe	chrome.exe
PID 1932 wrote to memory of 1856	1932	chrome.exe	chrome.exe
PID 1932 wrote to memory of 1856	1932	chrome.exe	chrome.exe
PID 1932 wrote to memory of 1856	1932	chrome.exe	chrome.exe
PID 1932 wrote to memory of 1856	1932	chrome.exe	chrome.exe
PID 1932 wrote to memory of 1856	1932	chrome.exe	chrome.exe
PID 1932 wrote to memory of 1856	1932	chrome.exe	chrome.exe
PID 1932 wrote to memory of 1856	1932	chrome.exe	chrome.exe
PID 1932 wrote to memory of 1856	1932	chrome.exe	chrome.exe
PID 1932 wrote to memory of 1856	1932	chrome.exe	chrome.exe
PID 1932 wrote to memory of 1856	1932	chrome.exe	chrome.exe
PID 1932 wrote to memory of 1856	1932	chrome.exe	chrome.exe
PID 1932 wrote to memory of 1856	1932	chrome.exe	chrome.exe
PID 1932 wrote to memory of 1856	1932	chrome.exe	chrome.exe
PID 1932 wrote to memory of 1856	1932	chrome.exe	chrome.exe
PID 1932 wrote to memory of 1856	1932	chrome.exe	chrome.exe
PID 1932 wrote to memory of 1856	1932	chrome.exe	chrome.exe
PID 1932 wrote to memory of 1856	1932	chrome.exe	chrome.exe
PID 1932 wrote to memory of 1856	1932	chrome.exe	chrome.exe
PID 1932 wrote to memory of 1856	1932	chrome.exe	chrome.exe
PID 1932 wrote to memory of 1856	1932	chrome.exe	chrome.exe
PID 1932 wrote to memory of 1856	1932	chrome.exe	chrome.exe
PID 1932 wrote to memory of 1484	1932	chrome.exe	chrome.exe
PID 1932 wrote to memory of 1484	1932	chrome.exe	chrome.exe
PID 1932 wrote to memory of 1484	1932	chrome.exe	chrome.exe
PID 1932 wrote to memory of 2084	1932	chrome.exe	chrome.exe
PID 1932 wrote to memory of 2084	1932	chrome.exe	chrome.exe
PID 1932 wrote to memory of 2084	1932	chrome.exe	chrome.exe
PID 1932 wrote to memory of 2084	1932	chrome.exe	chrome.exe
PID 1932 wrote to memory of 2084	1932	chrome.exe	chrome.exe
PID 1932 wrote to memory of 2084	1932	chrome.exe	chrome.exe
PID 1932 wrote to memory of 2084	1932	chrome.exe	chrome.exe
PID 1932 wrote to memory of 2084	1932	chrome.exe	chrome.exe
PID 1932 wrote to memory of 2084	1932	chrome.exe	chrome.exe
PID 1932 wrote to memory of 2084	1932	chrome.exe	chrome.exe
PID 1932 wrote to memory of 2084	1932	chrome.exe	chrome.exe
PID 1932 wrote to memory of 2084	1932	chrome.exe	chrome.exe
PID 1932 wrote to memory of 2084	1932	chrome.exe	chrome.exe
PID 1932 wrote to memory of 2084	1932	chrome.exe	chrome.exe
PID 1932 wrote to memory of 2084	1932	chrome.exe	chrome.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\run.ps1
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1888

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1612

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1612 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:912

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1932

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef4fd9758,0x7fef4fd9768,0x7fef4fd9778
2⤵
PID:272

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1204 --field-trial-handle=1216,i,3532869165285161533,15557504802896450954,131072 /prefetch:2
2⤵
PID:1856

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1532 --field-trial-handle=1216,i,3532869165285161533,15557504802896450954,131072 /prefetch:8
2⤵
PID:1484

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1616 --field-trial-handle=1216,i,3532869165285161533,15557504802896450954,131072 /prefetch:8
2⤵
PID:2084

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2320 --field-trial-handle=1216,i,3532869165285161533,15557504802896450954,131072 /prefetch:1
2⤵
PID:2752

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2288 --field-trial-handle=1216,i,3532869165285161533,15557504802896450954,131072 /prefetch:1
2⤵
PID:2744

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1364 --field-trial-handle=1216,i,3532869165285161533,15557504802896450954,131072 /prefetch:2
2⤵
PID:2204

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=1420 --field-trial-handle=1216,i,3532869165285161533,15557504802896450954,131072 /prefetch:1
2⤵
PID:2400

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4056 --field-trial-handle=1216,i,3532869165285161533,15557504802896450954,131072 /prefetch:8
2⤵
PID:2416

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4076 --field-trial-handle=1216,i,3532869165285161533,15557504802896450954,131072 /prefetch:8
2⤵
PID:2456

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=4120 --field-trial-handle=1216,i,3532869165285161533,15557504802896450954,131072 /prefetch:1
2⤵
PID:2624

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=4632 --field-trial-handle=1216,i,3532869165285161533,15557504802896450954,131072 /prefetch:1
2⤵
PID:1152

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=4020 --field-trial-handle=1216,i,3532869165285161533,15557504802896450954,131072 /prefetch:1
2⤵
PID:2984

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=2340 --field-trial-handle=1216,i,3532869165285161533,15557504802896450954,131072 /prefetch:1
2⤵
PID:2440

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5036 --field-trial-handle=1216,i,3532869165285161533,15557504802896450954,131072 /prefetch:8
2⤵
PID:2632

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5052 --field-trial-handle=1216,i,3532869165285161533,15557504802896450954,131072 /prefetch:8
2⤵
PID:2724

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1640 --field-trial-handle=1216,i,3532869165285161533,15557504802896450954,131072 /prefetch:8
2⤵
PID:3008

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5128 --field-trial-handle=1216,i,3532869165285161533,15557504802896450954,131072 /prefetch:8
2⤵
PID:1708

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5124 --field-trial-handle=1216,i,3532869165285161533,15557504802896450954,131072 /prefetch:8
2⤵
PID:1872

C:\Users\Admin\Downloads\7z2201-x64.exe
"C:\Users\Admin\Downloads\7z2201-x64.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Registers COM server for autorun
- Drops file in Program Files directory
- Modifies registry class
PID:2420

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=20 --mojo-platform-channel-handle=2084 --field-trial-handle=1216,i,3532869165285161533,15557504802896450954,131072 /prefetch:1
2⤵
PID:2044

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=21 --mojo-platform-channel-handle=5152 --field-trial-handle=1216,i,3532869165285161533,15557504802896450954,131072 /prefetch:1
2⤵
PID:1188

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5388 --field-trial-handle=1216,i,3532869165285161533,15557504802896450954,131072 /prefetch:8
2⤵
PID:2008

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5500 --field-trial-handle=1216,i,3532869165285161533,15557504802896450954,131072 /prefetch:8
2⤵
PID:900

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=24 --mojo-platform-channel-handle=5408 --field-trial-handle=1216,i,3532869165285161533,15557504802896450954,131072 /prefetch:1
2⤵
PID:2896

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=25 --mojo-platform-channel-handle=4140 --field-trial-handle=1216,i,3532869165285161533,15557504802896450954,131072 /prefetch:1
2⤵
PID:2196

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=26 --mojo-platform-channel-handle=5436 --field-trial-handle=1216,i,3532869165285161533,15557504802896450954,131072 /prefetch:1
2⤵
PID:2392

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=27 --mojo-platform-channel-handle=5536 --field-trial-handle=1216,i,3532869165285161533,15557504802896450954,131072 /prefetch:1
2⤵
PID:3024

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1160 --field-trial-handle=1216,i,3532869165285161533,15557504802896450954,131072 /prefetch:8
2⤵
- Loads dropped DLL
PID:2832

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
PID:2516

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef4fd9758,0x7fef4fd9768,0x7fef4fd9778
2⤵
PID:2528

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:2992

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\7-zip.dll
Filesize
92KB

MD5
c3af132ea025d289ab4841fc00bb74af

SHA1
0a9973d5234cc55b8b97bbb82c722b910c71cbaf

SHA256
56b1148a7f96f730d7085f90cadda4980d31cad527d776545c5223466f9ffb52

SHA512
707097953d876fa8f25bfefb19bfb3af402b8a6a5d5c35a2d84282818df4466feba63b6401b9b9f11468a2189dcc7f504c51e4590a5e32e635eb4f5710fd80b2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Filesize
62KB

MD5
3ac860860707baaf32469fa7cc7c0192

SHA1
c33c2acdaba0e6fa41fd2f00f186804722477639

SHA256
d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

SHA512
d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Filesize
62KB

MD5
3ac860860707baaf32469fa7cc7c0192

SHA1
c33c2acdaba0e6fa41fd2f00f186804722477639

SHA256
d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

SHA512
d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
cc69f07c24cc3c173ef7be49d2fecfc9

SHA1
b5835966d4a9dea341992abe5acb995384f5c9b2

SHA256
aa23c6823f9724e9531b9a2ca7dd381c805df79c820be68c7a277367d4d8bc6b

SHA512
ad0ea61dcb8edb45b60884371d91c2a1b4267cb06d5050f5f6be5424e0a98c4662faad3dc6023352d6d79046c2218686e207099baadf0afdf9e78bf89af2a681

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
5688bc8e4ffb1371e45fb1f051aa0b9e

SHA1
ad02755b4a5ecad7611ffd978cbae07c6b823bf2

SHA256
c8601ebc57fd0f1e4f6d201a828b6374ccce085c8cf43c4b5710bbb43bdcdfeb

SHA512
356047b81662f97296d59cad3675cbf0928c89238eafba3d4d99fc4414c8ba9b9226136ba04ab9f60c7aebcf125a1b9ba6356e0eb55ed325d048a4fac870fd98

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
cd3bac910049d391fc8996133d2fad51

SHA1
f91e4abf0d99baeebdb95bf80d55d8e8f45d79a8

SHA256
ee665127accf31b182a537df9d28d4bf4a42d3e665d6b99ff6f741ba1f6295b7

SHA512
0cc27ccc6b93e163f0de0cfec10086ff9e59af52c1370738232b3674ae066724400178b437c28ad274a5a132b1094659a4851e0ce5901eab416ee6cbfe084a81

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
cb878935029f16e999f9e995bb6f4802

SHA1
221727279e54ef32ef5cc3c906a5794ef2eae03c

SHA256
f30f0dc4b05dbff13d1f91c7e8878374c1577bcb5b9eba2518f5d0eef917ef7c

SHA512
2452124f48ca229a60788d3db0e8b8ff0b09bdabaaf9b652c91c93a245a3a3fb89926e59b2009555cc28ab3c90e3a9adb70ea6c17389e4ea1b67b3602efd6a16

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
779842177c5483e6daa19febcfcf675e

SHA1
20c97eb272d9a5c46696a341d96ebb04b2f4a8e1

SHA256
90662bd2400b20010b0d6162181fca9c14d52ca8f219bb7854408c13027d4b7e

SHA512
3fe93df42f6cf39b82ba24a3e94daa3509a91d785c04705dc708aa047c3a8dfb9632747a7fcb617a060db6fd858b22c392fae44054ed14c87f7399c23c82ba84

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
778192b45f4f40d21020aef5b761e718

SHA1
edb798f56e29745ba63230e88157ccaa7799dd3a

SHA256
d6dde703fd8a3a812d8d27e2ec36703506736022ee779eecfcfbab32be068345

SHA512
1d4f473ebd6a7a426312336ce3179b217e22c946616b2a7ecd8c44dcd1dbfbff79a4920b588a29c618ea8ce3a239cda3fcd280485a78d2351515bdda214ae024

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
eb1958d2c42db1a61a3aa525b5ee6c90

SHA1
67f5fba829cda0cd2384c5b55d7ff66eb4cfea0d

SHA256
5f7e02a1aae79908a4aed189d94eb3be80c1b4d0f7f5523290237b1bc6a96a15

SHA512
b445d30401c7ff6bf08ffef425b051957e1d37255b9fbe8a2697b2a2ad473dbb35107f303f4a7ba2139ddf97ece5ff5b990254cf48258c15e3554e73fba7439f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Filesize
40B

MD5
d5593c1b3c86d1e008bc3b2e3f83eda3

SHA1
db6f31636ab577d9fba74bd045ff5a5a1b4fe565

SHA256
ab9e2dcfa54294798fdb11fabb47e183c401fadb4fc389fde26c33b9f1473dce

SHA512
a2cf3d9ea782703ca1c913505e99e873f4d8f3e31f46b445e59eb3537bd7a0318f3c09b6f93e401ce946709eb7a8a43ca98d574448d94dd983f65d0ea668fcdb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Filesize
40B

MD5
d5593c1b3c86d1e008bc3b2e3f83eda3

SHA1
db6f31636ab577d9fba74bd045ff5a5a1b4fe565

SHA256
ab9e2dcfa54294798fdb11fabb47e183c401fadb4fc389fde26c33b9f1473dce

SHA512
a2cf3d9ea782703ca1c913505e99e873f4d8f3e31f46b445e59eb3537bd7a0318f3c09b6f93e401ce946709eb7a8a43ca98d574448d94dd983f65d0ea668fcdb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Filesize
40B

MD5
d5593c1b3c86d1e008bc3b2e3f83eda3

SHA1
db6f31636ab577d9fba74bd045ff5a5a1b4fe565

SHA256
ab9e2dcfa54294798fdb11fabb47e183c401fadb4fc389fde26c33b9f1473dce

SHA512
a2cf3d9ea782703ca1c913505e99e873f4d8f3e31f46b445e59eb3537bd7a0318f3c09b6f93e401ce946709eb7a8a43ca98d574448d94dd983f65d0ea668fcdb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\9b5a343c-53d8-4d24-9735-6089ca39b205.tmp
Filesize
6KB

MD5
d26703aa05607755f129fcdbbd5133b3

SHA1
97b65996680972cfb4776eeeda74ca8443f8e615

SHA256
c1386f184fbbe4a62f3b92725a862a6a124c12425c3adc9f62f68908fd2e7dcf

SHA512
bfd3cd79939ef8a2320b70d847a38bd980e2b034c1ff38301a0f309164cc6d89e711cbec00f3580cab912b2a01afeee3070afa5f9e7ed5ad41fe67ea8ffc0649

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000006
Filesize
37KB

MD5
519005befdbc6eedc73862996b59a9f7

SHA1
e9bad4dc75c55f583747dbc4abd80a95d5796528

SHA256
603abe3532b1cc1eb1c3da44f3679804dd463d07d4430d55c630aba986b17c44

SHA512
b210b12a78c6134d66b14f46f924ebc95328c10f92bfed22a361b2554eca21ee7892f7d9718ae7415074d753026682903beba2bd40b35a4eeb60bf186dcdf589

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000026
Filesize
32KB

MD5
b582b2eca79a750948dbb3777aeaaadb

SHA1
bf0ea1c8a7b4a55779cbb3df1f1d75cc19910e9f

SHA256
04c7f19e1ae294cc641f6c497653b5c13c41b258559f5f05b790032ccca16c82

SHA512
35cfd88afe4e4e8091d3a5c53f0f3e2dcd92aa58b7544b94d4d9d7cdf508d429c5292aa97b813c9c8ad18e4d121d4e6595c49f5ddafbeab7b39f3a7c9d0b58dd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000027
Filesize
66KB

MD5
33411bb179575dfc40cc62c61899664f

SHA1
d03c06d5893d632e1a7f826a6ffd9768ba885e11

SHA256
274befc7b39609fed270e69335bc92b3d8251545594636eb408d5d93e0ae1a4f

SHA512
dc830766c928ac84df16d094fc92586b9c2c25f819123dc9b5ec259220b4b1c45e2af28c89a710f047c00c9dcf7df8dd859a9a7a2d2228703f616df13caef2c7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000028
Filesize
16KB

MD5
01d5892e6e243b52998310c2925b9f3a

SHA1
58180151b6a6ee4af73583a214b68efb9e8844d4

SHA256
7e90efb4620a78e8869796d256bcddbde90b853c8c15c5cc116cb11d3d17bc4d

SHA512
de6ca9d539326c1d63a79e90a87d6a69676fc77a2955050b4c5299fab12b87af63c3d7f0789d10f4be214e5c58d6271106a82944d276d5ca361b6d01f7a9f319

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\741c0cf17afc5cc7_0
Filesize
269B

MD5
4ea891cadf083daa3efed6ea149b979d

SHA1
351cb042d479708fd29dc0d923e3adef3ab6108c

SHA256
2df9fe68bf91b6bb1bb121d32f35bb965b18758b28725f8e753b6e808986037c

SHA512
09df0a8ea4f2e40b4d3806d82521c769e48a68978e2b9d5858d8b7a5fad2485904af851431bb6802649eb6b3d8cf36860d20ec8972358b751439e96479aa92cd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\783a4e5feec37732_0
Filesize
150KB

MD5
4939c03c6c97ed542596b3f7c6e9c343

SHA1
1f67f237cf543218f51e536859c8e93068d9c36d

SHA256
f2aa65f4ce3a36315bcd350d0ed6538851b64ef97eae69e13d4d555a9554d222

SHA512
d4b1073c7e23b038f803ef7e5368e95769ca79b16983bd6a0ca0cba50452112729e9715286a27840b38d4cb2b4271b88b1f223fabb41e6dc3dcc4209e2a0d349

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\d00786f0acc290a4_0
Filesize
275B

MD5
d15079a179585b50c31a36be705ce7c3

SHA1
c3ffdb8ebe26bf595eefe5bfc42efcb61ae1d9c9

SHA256
717e5a664580f9905dda6e52046cbeddc228ac94552c04707789953f7a103755

SHA512
bd058a0c97f49391d96e274da7e29fde1d283bd6d09b2013311f9175a400b1d854b8231af972c429953ac9615ef1d64160c6a658a52b05ce64f5ce2722e15b59

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\f98209f90684b09f_0
Filesize
135KB

MD5
ebfc7dd9eea3b125c70d944eb19f4f03

SHA1
2a8999ad46d1d161161ae2c2f43839906691df55

SHA256
1b621e8b474abaa0bd7a92f0861552fac33482c87e23c3ddc951249e6035ab9c

SHA512
10105847bbbdfd8f5ddbd585411e46077c7296e785b716bb2de5a325e2544c6e40bf15d183595187e5bbdf160ca76683401126c3be2ad236f976a2773b1277e2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
1KB

MD5
5c51b9b8dc03efa735d4d53fe7a051ff

SHA1
ffc11607d623202fdd3abc8b32b1783b9224449e

SHA256
626878adad5274007e8b3aaa6bda3e8555d6a2275e5da23202dfa08f33d0353f

SHA512
1ebdf5da074048ccf16f8c2d08b60e5a30ca1ae9509f223e0790186935af63a3cca34bd3af8dc43a66f05966d95d26d8be0587f10d6570c72683737fe76a22f4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
1KB

MD5
a1def1dcb0862700164ca671dbd334bf

SHA1
cfaed83579094b12b8143cd278b1f7d74d8015b4

SHA256
123274c083f9b4f28f209e7b49131b118f704477af0ef0067691356b240cceb2

SHA512
cd7f90401f8b39555b79919ecb39e73d4fd8c3dd02d0aa579e4c185a1e4e673ae407baf6178d5416d13e159a5f85cb7acffec6edb5d76979c0edb163c9c5680a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
1KB

MD5
b061fa2b1f7a800b01b47ec08f7ccf4d

SHA1
95d88e879cbc3696e878d31c5fa9b583941ad128

SHA256
6dce9000b75e34b87099be2cae6bc3b3d7f17405918b61fabff629dfdf567c26

SHA512
7f76904c56ecc2477f46140e81034500225e3256fd472406b76e869a65e5395092f0bbce2eae70abb93fd44b6b9b123c1af4ab901ccc52bf00c0d03336b49094

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
792B

MD5
06c43e1cb4ccc3944875688ff6a40063

SHA1
48421d4a0f7059e354fc1b0bc374d31e951dc700

SHA256
9a70a0a9a5b6697f26e492854cbff8a1a932dc9180c004851d87b67c1a794df2

SHA512
552fcbfb520ca12dd49835c93bc74d9d0c8a4010b54e8e76508ae58815d9ca19e0836ad54d3e48224534d5dad07d2f5a43b93177d2e4fc20185573c6e496db64

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\000002.dbtmp
Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1
Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\CURRENT~RF6dfc69.TMP
Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\27855d1e-d0ce-4ae8-8859-1c11331d7093.tmp
Filesize
6KB

MD5
40c4c8e21f8715da4d88ba176484817c

SHA1
d3921825cd0fca9e00be4605426ccf64d6dc7a59

SHA256
4ef82bcd9c34ec62ba4df2be34f0f2880aef4e4be7e52a851de6edb8192ae748

SHA512
0c2e5b1cd5d8d0b6d2f3e2849f4c2a299a9fd8c3a40ba1aa0c4c5948af190986371ad4934dedc3d22239928217c1cce82cbf68a1b4853c97cf2519fa70c7d443

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\588cbe08-ab40-4dd9-b013-e364b6702d9f.tmp
Filesize
6KB

MD5
2b59b56d511c894129661fdbec125027

SHA1
2962eafb992198046557062f2101cc4dcee6be06

SHA256
93b521682dad53f015f083184fdb678a484de7c515febe3e669a733d410a1879

SHA512
2741207e119cd3141ad8252e15024e6da131a9f9ee52bf28abb30914233710cd5cb297e54ffdd5d64b322f01e7b54c8fc3e49fd002eebcf015839a7a77fb96bd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
5KB

MD5
b72254af524fe44b58c024d610a91619

SHA1
c63019ed704371b2e07148d4a1290ef8c084a99c

SHA256
a624e2214340bef188d5c7d34811c10c20de97ce29de4554210f83f517daa38c

SHA512
c23f1f8316f33aa1489e0d34632902dbc7bc22865cfc688fd039bc830e6c979943185a02767782a5a7b486e31133aadab6e0ae8d725ef8d4ac4d699e8351e58e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
6KB

MD5
35a45de20d04242ec38ecc6996508ca1

SHA1
e7f86f935cccc5a4ee58d3cc58a7866a14cfab08

SHA256
c5f4ac3d99b9c0e5e2b3a17ee202836ae25d0a31d100041ecc318d17dee38395

SHA512
0ef67cb5802821017699bad58c667c79084173bc831d6cbbd1160a18c423d9bcf2384f3a3f36a43dd1ac438a169bde8686cec6a2ea44b4a35b2c06e27ced7927

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
1KB

MD5
4e2c6358f7292bd11a28fccaa266f6ca

SHA1
ca1e1b70d662c0945ace97920df24df201c77be0

SHA256
d809f088a6fe88a74948ade0a2b3c7ae84339c871ba771ddd89d5911341f59e0

SHA512
19869ec6f6d0a4137f9016481a609c14ac6cd4b4f7fbe665499904295cf6bfdf0a5aa4b7686ff8b75f08ba9c8d7670aa56837755a2d648f0b2e00c6b44d2c962

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
1KB

MD5
5a3d40b3051831ffebd74352a71af86e

SHA1
7974d92a696708433f2c146a41cbada391dd3f52

SHA256
0a37e41c4be88da39d55b48ed4e76991f5c179adda908ee1670bbe910bb42a36

SHA512
51c5f866f631f34be490773e02654edf52cea927335cfcbe18febe76d16a5097e081c14d3847153d8f97ca9fc04258ef89a0b9e17d7349e3796b10c60a6f60ac

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
691B

MD5
b10fcf3ec28cf255c4157c0f4e4ce45d

SHA1
fbba5695d96a92455f08c168e6805ef68bc5addf

SHA256
7e661e58166a3b9db0e9be67df99a9b27a0ceec51cb632ab1c2b2165c34f6293

SHA512
b763856b48ee23d9aec8293b45c07047c838fe97eba45890c634d97cfb0a59e5d8c7cbc89a025c14ac7dc9d7551a3eb7265fb3d151c7146c9fd4298ab77af541

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
527B

MD5
51a13032a1c7fc20dcc0b951d4e71fbd

SHA1
863409d913a41f79a1798fece4435e21beca2eab

SHA256
931bd452a01745c359026ed926cafee69b14b9c18b70547669c6149299543bb9

SHA512
230af7d510a98a49e22fd3183d047c71e169b7173fb5f97be13ab966993e5c4de34504305a0b50dc97d46feaf7a05ee5b3713b910cc3a96d91c4142ec94092dc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
1KB

MD5
a11f9e541c4e6a0afca2bd8e8902ef60

SHA1
de25b408a8eb6bbe81864e8562233001317eea43

SHA256
9d612563361fa47d015a3c782faa4a586664d73133836552955d6d59edaf5295

SHA512
dc783a49a053e93e874ed61e1878efec67f761c55688eafbcdfbaaca018825be5cfc757a008e955938e033f975ecc4a3787ce6f338836533e662d9a80ff1e2b3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
1KB

MD5
66ba6c32eb67857b078ec62ec447c425

SHA1
80d9417a7a7fb94f1b8ab193c82ff319b54da0d6

SHA256
7fdd6c62c98c5a0d9706864821fb79fc900d3872101589e61168518ce0403324

SHA512
fde5cfe2f4bdf032dcf06187a8824a755e9e4277397d7ff9bc8426c6c194084192ccb71368b1733e6667bef96aace9798e45efc8abfcaade8149f70f8af04267

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
1KB

MD5
a7eca2a3e646816527fd2234c5955362

SHA1
676366ea4091d306a2e08e3d91f05dc866ecbbe2

SHA256
d86ecba8b7f16077f5bf6524a22cb24b9b56f75f9b4bcbca2b60200cb8eb9783

SHA512
8bbb8757ff4aa6a54dd11fc5f6d872221c0dac3906c87619eca604b4938ed815e1f872d4c0bc93f6cf7cd6262b0a9b6845d37700fb7905fdbc524405461595df

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
691B

MD5
d321063cafaa120e4fed1d11e3c70498

SHA1
8c9fa0d4a7e2ffaef576be268dd23ecdb7af9d36

SHA256
7d6fadec5cdf7116380feb43746b98c8e930651339e2d21eb16b4d628b68da8c

SHA512
1d9f6f282a58139191bf2f5da52c5736a8b77691a00667430e95a9ff68de68f49b8e7049cb4008406b4e77cbcec97397060462bf0b1a861466c6fdcc39a9af01

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
4KB

MD5
01aee55e53e6decb583cf5e58c90bb0a

SHA1
30a5cfa0f75ea8b84a15a27c0ec51445bde5c9bb

SHA256
09b7c21458f3a6d5bf7a60d4c26a1ba896fdd2407a909e4a508899f5703e34de

SHA512
e491650bfecfd25fbd240284c3fad632219c03022ad9d6c931fc28d0f088861a235b34692ee0fa1d13778d9428542f3ed5c35994b1a11fe49a15fcef1b613dbc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
5KB

MD5
4fdbe6d065079e9919a1ea6ceb8e119a

SHA1
f58abb536c73f6a4d24e26de204042a99f2c8afd

SHA256
24457766c19a74ecd283d62a2778c3b363fa53bd2cbe562933eab6828b6939f9

SHA512
b69c32a1bc71a0fe827fd3948a3e4e6843ca256e6fdbb51d7061b410dcfdb05af42d5b8208256abe9b1b6717440ffcd79817fe45467c38d2b2909c87d0d9dd65

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
5KB

MD5
03ea5a1be0a3d32d7d95d58d2716da32

SHA1
0e9c8e78095b19dd10d7794bdcc6654edb9f8da5

SHA256
c1bb5c8dd1c0b45f7cfbf7db12a285165fbf7ea1e54c80e5adbb59fed79eddd6

SHA512
68e7d50010f38cf2887eae0bb6edb82e69edd9bbb612ad45178b72d5cc2cd1ea82adecd8a2ff26047b8d42873a5c1c9e0bcf1b134fffb2def1baace51e995c32

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
eaaaa29de7ebf2dda3b52f5210948e81

SHA1
6008fac34299d1ad2e051a2a745b83277b7c1477

SHA256
a7f55badd91bad3e72c372061d15542eb0b950f38f13ca39f8eeab1ddf80ce00

SHA512
1fe3599d4cc09832f5d163711f9c44dd2674886ff4d96ae27b78410f0f5e3aef0743c5dbd8fb0d8f224178b310bd40a7641870773fdc3d60f2d7b144633fd082

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
008de50b9b57419e19aa7aaf62479ea8

SHA1
18a3a07becd13fcd1370cd48cc545ffac5687994

SHA256
49dc76663cb42413c1bae0a4bfd7f9a3954349069dd2a0088b527a2affd17dae

SHA512
7a0ac45d1cbff889a04a72c63cdd8badf28525e522c65b21ea1f40707610fa561e429fd2ff48ed79036f0720774719e92ab96c5ffc67bf6e985d7f17ba619ee6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
4KB

MD5
f255285341bed4aae1f427d7332ea581

SHA1
35b2b6d222867bb89e14d44005d8f1889cd62cf7

SHA256
df7f59920de6956f91dcbf51cc8d951e23c70977fc208aa8d002efec9fd0c8ec

SHA512
cee607630cb17ef3012f6c7007adb6406d5e7efcb14dbdae8366103c5119db2717ef85293143b3bf5d569efc72e0424701b7d9907f29017cfaab061e767c4117

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
4KB

MD5
bcc8ebe45a25765c424846a2b1236b20

SHA1
c5beac6ea94d96868fb91908219cbdcd6a841499

SHA256
4cc7d4a0a069615300d817e7cda13408f6fd8d63df7f12d87e0f4990a41bcba4

SHA512
88d3a477fc50fa68997e0a7f867fe97acd2c5b5a07aa0a8b859cfabd8369c6ad2dca74e20af318ff0f8f3e394955ca2fbf095bb162caa9e5762c1f6a27caee58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
4KB

MD5
7b73268d8a322cbc5fa31cfe82622d1d

SHA1
415426942e2b250bc8745f1981684b6b7de6b3b9

SHA256
dbfbeabf159c00d59fa3efc04587001921fb679dc52eb3438da7a6041a49c2ce

SHA512
63d964bc45846a07feaa718c82db0d199ca1c3277d0f619191d0ffeaf4259bb4bfea02dd21e4e2a7e22065c75595e98227cc2ef244a311e203d6b8931ce0a10b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000004.dbtmp
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
149KB

MD5
19c6c5054f2f87b9eee69d894054ed33

SHA1
a83c26c6fdfbdc5c48cb157a828d5be0716b6be9

SHA256
61e3dab6b61b73c40b51bbbb273f4cd658e27bfcb7a8d2e1383fac7ec4b69c95

SHA512
9c42176b9f1d101ae798c47c961932d57002473bc4d14ae519f2f1a297043d959859e83c4454c00ad8877dda8da09c0cd412eb5e4f53bbf568728017880318b2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
149KB

MD5
8e9a0a49fa765e726eab8ca9407f6d04

SHA1
7dacf9548c7e5ee05b1ec8a89053816abf2d21e4

SHA256
771d76741fc4b668358aae71b15828f3c8a1b1054e44a5d280fe9e561d4f9fe8

SHA512
d7a68b517b0054b8bbd8ce423b61ac44b943c63893d5f9b504e25783f6ca83a45657b20d8066bc51751dd5d91ec64dfbe49addb46f2240c04cbbf3598ed41bf9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
149KB

MD5
99c57e35370abfde348236fad1229a6c

SHA1
7401d8818540392177416ef198b445c2756965df

SHA256
1597db3da8a09ea09d295048ac1b80a1fc3e3f01bf378c61f2d9cd7db54caabc

SHA512
ce2dcda6c86d5a47aec14130d540dacd97f79e93c1bd9049e20f9d1ce29245c008f83b765abf504dee09ec140f6a21ea9f690fa6173220675bdbc31a3a4fa5c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab652C.tmp
Filesize
61KB

MD5
fc4666cbca561e864e7fdf883a9e6661

SHA1
2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

SHA256
10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

SHA512
c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6737.tmp
Filesize
164KB

MD5
4ff65ad929cd9a367680e0e5b1c08166

SHA1
c0af0d4396bd1f15c45f39d3b849ba444233b3a2

SHA256
c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6

SHA512
f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27

Download Submit
C:\Users\Admin\Downloads\7z2201-x64.exe
Filesize
1.5MB

MD5
a6a0f7c173094f8dafef996157751ecf

SHA1
c0dcae7c4c80be25661d22400466b4ea074fc580

SHA256
b055fee85472921575071464a97a79540e489c1c3a14b9bdfbdbab60e17f36e4

SHA512
965d43f06d104bf6707513c459f18aaf8b049f4a043643d720b184ed9f1bb6c929309c51c3991d5aaff7b9d87031a7248ee3274896521abe955d0e49f901ac94

Download Submit
C:\Users\Admin\Downloads\7z2201-x64.exe
Filesize
1.5MB

MD5
a6a0f7c173094f8dafef996157751ecf

SHA1
c0dcae7c4c80be25661d22400466b4ea074fc580

SHA256
b055fee85472921575071464a97a79540e489c1c3a14b9bdfbdbab60e17f36e4

SHA512
965d43f06d104bf6707513c459f18aaf8b049f4a043643d720b184ed9f1bb6c929309c51c3991d5aaff7b9d87031a7248ee3274896521abe955d0e49f901ac94

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 857597.crdownload
Filesize
1.5MB

MD5
a6a0f7c173094f8dafef996157751ecf

SHA1
c0dcae7c4c80be25661d22400466b4ea074fc580

SHA256
b055fee85472921575071464a97a79540e489c1c3a14b9bdfbdbab60e17f36e4

SHA512
965d43f06d104bf6707513c459f18aaf8b049f4a043643d720b184ed9f1bb6c929309c51c3991d5aaff7b9d87031a7248ee3274896521abe955d0e49f901ac94

Download Submit
\??\pipe\crashpad_1932_LDVKTSBHHTWISPOC
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\Program Files\7-Zip\7-zip.dll
Filesize
92KB

MD5
c3af132ea025d289ab4841fc00bb74af

SHA1
0a9973d5234cc55b8b97bbb82c722b910c71cbaf

SHA256
56b1148a7f96f730d7085f90cadda4980d31cad527d776545c5223466f9ffb52

SHA512
707097953d876fa8f25bfefb19bfb3af402b8a6a5d5c35a2d84282818df4466feba63b6401b9b9f11468a2189dcc7f504c51e4590a5e32e635eb4f5710fd80b2

Download Submit
\Program Files\7-Zip\7-zip.dll
Filesize
92KB

MD5
c3af132ea025d289ab4841fc00bb74af

SHA1
0a9973d5234cc55b8b97bbb82c722b910c71cbaf

SHA256
56b1148a7f96f730d7085f90cadda4980d31cad527d776545c5223466f9ffb52

SHA512
707097953d876fa8f25bfefb19bfb3af402b8a6a5d5c35a2d84282818df4466feba63b6401b9b9f11468a2189dcc7f504c51e4590a5e32e635eb4f5710fd80b2

Download Submit
\Program Files\7-Zip\7zFM.exe
Filesize
935KB

MD5
d36deceeb4c9645aab2ded86608d090b

SHA1
912f4658c4b046fbadd084912f9126cb1ae3737b

SHA256
018d74ff917692124dee0a8a7e6302aecd219d79b049ad95f2f4eedea41b4a45

SHA512
9752a9e57dd2e6cd454ba6c2d041d884369734c2b62c53d3ec4854731c398cd6e25ac75f7a55cda9d4b4c2efb074cb2e6efcbf3080cd8cc7d9bc8c9a25f62ff2

Download Submit
memory/1888-60-0x0000000002580000-0x0000000002600000-memory.dmp

Filesize
512KB

Download
memory/1888-59-0x0000000002390000-0x0000000002398000-memory.dmp

Filesize
32KB

Download
memory/1888-61-0x0000000002580000-0x0000000002600000-memory.dmp

Filesize
512KB

Download
memory/1888-62-0x0000000002580000-0x0000000002600000-memory.dmp

Filesize
512KB

Download
memory/1888-63-0x0000000002580000-0x0000000002600000-memory.dmp

Filesize
512KB

Download
memory/1888-58-0x000000001B170000-0x000000001B452000-memory.dmp

Filesize
2.9MB

Download