85aa5baea7651db7f4c8eaf3655bc6f27303e02da9f552bdf650e7253a4d1348

Resubmissions

10/07/2023, 10:25

230710-mf6a5ahg59 10

10/07/2023, 10:24

230710-mfp9xahg58 10

10/07/2023, 10:23

230710-me5yzahg56 10

10/07/2023, 10:15

230710-madc6aaf6x 10

Analysis

max time kernel
184s
max time network
265s
platform
windows10-1703_x64
resource
win10-20230703-en
resource tags

arch:x64arch:x86image:win10-20230703-enlocale:en-usos:windows10-1703-x64system
submitted
10/07/2023, 10:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

test.exe
Size

4.6MB
MD5

d2105743b649eb1d70e1bf69d8d3b758
SHA1

405545307fb273dee660055abac9e1213b3c95a4
SHA256

85aa5baea7651db7f4c8eaf3655bc6f27303e02da9f552bdf650e7253a4d1348
SHA512

ac5538c32bfd630dcf93aa10fda20c81434ececed186ebcc10d66b4ab01c367c08c2c64a8e4e98298ec31fc806cf02483dc4c8c566a6c3b233775120fe119bf3
SSDEEP

98304:HFdh9Q5zTSBRws9Bkc9ZBj3UD0E9NkYF0dPRO/7tdWKyjj:HctSrws9Bkc9ZdEwdPE/7tdWbj

Score

10^/10

Malware Config

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 12 IoCs

description	pid	Process	procid_target
PID 5028 created 3252	5028	test.exe	53
PID 5028 created 3252	5028	test.exe	53
PID 5028 created 3252	5028	test.exe	53
PID 5028 created 3252	5028	test.exe	53
PID 4896 created 3252	4896	updater.exe	53
PID 4896 created 3252	4896	updater.exe	53
PID 4896 created 3252	4896	updater.exe	53
PID 4896 created 3252	4896	updater.exe	53
PID 4528 created 2156	4528	svchost.exe	115
PID 4528 created 4568	4528	svchost.exe	116
PID 4528 created 5040	4528	svchost.exe	121
PID 4528 created 1160	4528	svchost.exe	124

Executes dropped EXE 1 IoCs

pid	Process
4896	updater.exe

Drops file in System32 directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.log	DllHost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.jfm	DllHost.exe
File opened for modification	C:\Windows\System32\Tasks\GoogleUpdateTaskMachineQC	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml	OfficeClickToRun.exe
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat	DllHost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\V01.chk	DllHost.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 5028 set thread context of 2520	5028	test.exe	73
PID 4896 set thread context of 4508	4896	updater.exe	85
PID 4896 set thread context of 3764	4896	updater.exe	88

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Google\Chrome\updater.exe	test.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	Explorer.EXE
File created	C:\Windows\rescache\_merged\4183903823\810424605.pri	taskmgr.exe
File created	C:\Windows\rescache\_merged\1601268389\3877292338.pri	taskmgr.exe
File created	C:\Windows\rescache\_merged\4129138312\2114356439.pri	RuntimeBroker.exe
File created	C:\Windows\rescache\_merged\3060194815\2825129510.pri	RuntimeBroker.exe

Program crash 6 IoCs

pid	pid_target	Process	procid_target
1876	3980	WerFault.exe	57
776	3936	WerFault.exe	66
3628	2156	WerFault.exe	115
4180	4568	WerFault.exe	116
424	5040	WerFault.exe	121
4340	1160	WerFault.exe	124

Checks SCSI registry key(s) 3 TTPs 11 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	RuntimeBroker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	RuntimeBroker.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	RuntimeBroker.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID	RuntimeBroker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	RuntimeBroker.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	RuntimeBroker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	RuntimeBroker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000	RuntimeBroker.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2767205360-3565838719-3800013281-1000\Software\Microsoft\Internet Explorer\Toolbar	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2767205360-3565838719-3800013281-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-2767205360-3565838719-3800013281-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2767205360-3565838719-3800013281-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	Explorer.EXE

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe_queried = "1688984823"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0	OfficeClickToRun.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe = "Mon, 10 Jul 2023 10:27:04 GMT"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSCategoriesSeverities = "1329 50,1329 10,1329 15,1329 100,1329 6"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSTagIds0 = "5804129,17110992,7202269,41484365,17110988,7153487,39965824,17962391,17962392,3462423,3702920,3700754,3965062,4297094,7153421,18716193,7153435,7202265,20502174,6308191,18407617"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Uninstall	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2767205360-3565838719-3800013281-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@%SystemRoot%\system32\RADCUI.dll,-15300#immutable1 = "RemoteApp and Desktop Connections"	RuntimeBroker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2767205360-3565838719-3800013281-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 50003100000000000000000010005573657273003c0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000055007300650072007300000014000000	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-2767205360-3565838719-3800013281-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0	RuntimeBroker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2767205360-3565838719-3800013281-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0 = 56003100000000000000000010004170704461746100400009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004100700070004400610074006100000016000000	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-2767205360-3565838719-3800013281-1000_Classes\Local Settings\ImmutableMuiCache	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2767205360-3565838719-3800013281-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@%SystemRoot%\system32\Vault.dll,-1#immutable1 = "Credential Manager"	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-2767205360-3565838719-3800013281-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-2767205360-3565838719-3800013281-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2767205360-3565838719-3800013281-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\KnownFolderDerivedFolderType = "{57807898-8C4F-4462-BB63-71042380B109}"	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2767205360-3565838719-3800013281-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic"	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2767205360-3565838719-3800013281-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@%SystemRoot%\System32\Speech\SpeechUX\speechuxcpl.dll,-1#immutable1 = "Speech Recognition"	RuntimeBroker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2767205360-3565838719-3800013281-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2767205360-3565838719-3800013281-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@%SystemRoot%\System32\accessibilitycpl.dll,-10#immutable1 = "Ease of Access Center"	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2767205360-3565838719-3800013281-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@%SystemRoot%\System32\mmsys.cpl,-300#immutable1 = "Sound"	RuntimeBroker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2767205360-3565838719-3800013281-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0 = d900310000000000ea564253100054656d7000003a0009000400efbee3562850ea5642532e000000b852010000000100000000000000000000000000000080988200540065006d007000000014008b0000002700efbe7d00000031535053b79daeff8d1cff43818c84403aa3732d6100000064000000001f000000280000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f007200740061006e0061005f006300770035006e003100680032007400780079006500770079000000000000000000000014000000	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-2767205360-3565838719-3800013281-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2767205360-3565838719-3800013281-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@%SystemRoot%\System32\telephon.cpl,-1#immutable1 = "Phone and Modem"	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2767205360-3565838719-3800013281-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@%SystemRoot%\System32\srchadmin.dll,-601#immutable1 = "Indexing Options"	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2767205360-3565838719-3800013281-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@%SystemRoot%\system32\colorcpl.exe,-6#immutable1 = "Color Management"	RuntimeBroker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2767205360-3565838719-3800013281-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-2767205360-3565838719-3800013281-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-2767205360-3565838719-3800013281-1000_Classes\Local Settings\ImmutableMuiCache\Strings	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2767205360-3565838719-3800013281-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@%SystemRoot%\System32\sud.dll,-1#immutable1 = "Default Programs"	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-2767205360-3565838719-3800013281-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-2767205360-3565838719-3800013281-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2767205360-3565838719-3800013281-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@%SystemRoot%\System32\main.cpl,-102#immutable1 = "Keyboard"	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-2767205360-3565838719-3800013281-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	RuntimeBroker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2767205360-3565838719-3800013281-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-2767205360-3565838719-3800013281-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2767205360-3565838719-3800013281-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@%SystemRoot%\System32\hgcpl.dll,-1#immutable1 = "HomeGroup"	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-2767205360-3565838719-3800013281-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	RuntimeBroker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2767205360-3565838719-3800013281-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	RuntimeBroker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2767205360-3565838719-3800013281-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = 00000000ffffffff	RuntimeBroker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2767205360-3565838719-3800013281-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\MRUListEx = 00000000ffffffff	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-2767205360-3565838719-3800013281-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-2767205360-3565838719-3800013281-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2767205360-3565838719-3800013281-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@%SystemRoot%\System32\systemcpl.dll,-1#immutable1 = "System"	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2767205360-3565838719-3800013281-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@%SystemRoot%\System32\fvecpl.dll,-47#immutable1 = "Device Encryption"	RuntimeBroker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2767205360-3565838719-3800013281-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	RuntimeBroker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2767205360-3565838719-3800013281-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\MRUListEx = ffffffff	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-2767205360-3565838719-3800013281-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2767205360-3565838719-3800013281-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2767205360-3565838719-3800013281-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@%SystemRoot%\System32\fhcpl.dll,-52#immutable1 = "File History"	RuntimeBroker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2767205360-3565838719-3800013281-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	RuntimeBroker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2767205360-3565838719-3800013281-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0 = 50003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014000000	RuntimeBroker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2767205360-3565838719-3800013281-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\MRUListEx = 00000000ffffffff	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-2767205360-3565838719-3800013281-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-2767205360-3565838719-3800013281-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2767205360-3565838719-3800013281-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@%SystemRoot%\System32\SyncCenter.dll,-3000#immutable1 = "Sync Center"	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-2767205360-3565838719-3800013281-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-2767205360-3565838719-3800013281-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-2767205360-3565838719-3800013281-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2767205360-3565838719-3800013281-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@%SystemRoot%\system32\inetcpl.cpl,-4312#immutable1 = "Internet Options"	RuntimeBroker.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2767205360-3565838719-3800013281-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@%SystemRoot%\system32\FirewallControlPanel.dll,-12122#immutable1 = "Windows Firewall"	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-2767205360-3565838719-3800013281-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2767205360-3565838719-3800013281-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 19002f433a5c000000000000000000000000000000000000000000	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2767205360-3565838719-3800013281-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@%SystemRoot%\System32\intl.cpl,-3#immutable1 = "Region"	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-2767205360-3565838719-3800013281-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	RuntimeBroker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2767205360-3565838719-3800013281-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e00000014000000	RuntimeBroker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2767205360-3565838719-3800013281-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-2767205360-3565838719-3800013281-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\WorkFolders	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-2767205360-3565838719-3800013281-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	RuntimeBroker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2767205360-3565838719-3800013281-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	RuntimeBroker.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3252	Explorer.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5028	test.exe
5028	test.exe
1984	powershell.exe
1984	powershell.exe
4460	taskmgr.exe
4460	taskmgr.exe
1984	powershell.exe
4460	taskmgr.exe
5028	test.exe
5028	test.exe
5028	test.exe
5028	test.exe
2520	dialer.exe
2520	dialer.exe
2520	dialer.exe
2520	dialer.exe
4460	taskmgr.exe
4460	taskmgr.exe
4460	taskmgr.exe
4460	taskmgr.exe
4460	taskmgr.exe
4460	taskmgr.exe
4460	taskmgr.exe
4460	taskmgr.exe
4460	taskmgr.exe
4460	taskmgr.exe
4460	taskmgr.exe
4460	taskmgr.exe
2028	powershell.exe
4460	taskmgr.exe
4460	taskmgr.exe
4460	taskmgr.exe
4460	taskmgr.exe
2028	powershell.exe
4460	taskmgr.exe
4460	taskmgr.exe
4460	taskmgr.exe
4460	taskmgr.exe
4460	taskmgr.exe
2520	dialer.exe
2520	dialer.exe
4528	svchost.exe
4528	svchost.exe
2028	powershell.exe
4528	svchost.exe
4528	svchost.exe
2520	dialer.exe
2520	dialer.exe
2028	powershell.exe
2520	dialer.exe
2520	dialer.exe
4460	taskmgr.exe
2520	dialer.exe
2520	dialer.exe
2520	dialer.exe
2520	dialer.exe
2520	dialer.exe
2520	dialer.exe
2520	dialer.exe
2520	dialer.exe
2028	powershell.exe
2520	dialer.exe
2520	dialer.exe
2520	dialer.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
3252	Explorer.EXE
4460	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3292	chrome.exe
3292	chrome.exe
3292	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe
3000	chrome.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3252	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1984	powershell.exe
Token: SeDebugPrivilege	4460	taskmgr.exe
Token: SeSystemProfilePrivilege	4460	taskmgr.exe
Token: SeCreateGlobalPrivilege	4460	taskmgr.exe
Token: SeIncreaseQuotaPrivilege	1984	powershell.exe
Token: SeSecurityPrivilege	1984	powershell.exe
Token: SeTakeOwnershipPrivilege	1984	powershell.exe
Token: SeLoadDriverPrivilege	1984	powershell.exe
Token: SeSystemProfilePrivilege	1984	powershell.exe
Token: SeSystemtimePrivilege	1984	powershell.exe
Token: SeProfSingleProcessPrivilege	1984	powershell.exe
Token: SeIncBasePriorityPrivilege	1984	powershell.exe
Token: SeCreatePagefilePrivilege	1984	powershell.exe
Token: SeBackupPrivilege	1984	powershell.exe
Token: SeRestorePrivilege	1984	powershell.exe
Token: SeShutdownPrivilege	1984	powershell.exe
Token: SeDebugPrivilege	1984	powershell.exe
Token: SeSystemEnvironmentPrivilege	1984	powershell.exe
Token: SeRemoteShutdownPrivilege	1984	powershell.exe
Token: SeUndockPrivilege	1984	powershell.exe
Token: SeManageVolumePrivilege	1984	powershell.exe
Token: 33	1984	powershell.exe
Token: 34	1984	powershell.exe
Token: 35	1984	powershell.exe
Token: 36	1984	powershell.exe
Token: SeDebugPrivilege	2520	dialer.exe
Token: SeDebugPrivilege	2028	powershell.exe
Token: SeIncreaseQuotaPrivilege	2028	powershell.exe
Token: SeSecurityPrivilege	2028	powershell.exe
Token: SeTakeOwnershipPrivilege	2028	powershell.exe
Token: SeLoadDriverPrivilege	2028	powershell.exe
Token: SeSystemProfilePrivilege	2028	powershell.exe
Token: SeSystemtimePrivilege	2028	powershell.exe
Token: SeProfSingleProcessPrivilege	2028	powershell.exe
Token: SeIncBasePriorityPrivilege	2028	powershell.exe
Token: SeCreatePagefilePrivilege	2028	powershell.exe
Token: SeBackupPrivilege	2028	powershell.exe
Token: SeRestorePrivilege	2028	powershell.exe
Token: SeShutdownPrivilege	2028	powershell.exe
Token: SeDebugPrivilege	2028	powershell.exe
Token: SeSystemEnvironmentPrivilege	2028	powershell.exe
Token: SeRemoteShutdownPrivilege	2028	powershell.exe
Token: SeUndockPrivilege	2028	powershell.exe
Token: SeManageVolumePrivilege	2028	powershell.exe
Token: 33	2028	powershell.exe
Token: 34	2028	powershell.exe
Token: 35	2028	powershell.exe
Token: 36	2028	powershell.exe
Token: SeAssignPrimaryTokenPrivilege	2484	svchost.exe
Token: SeIncreaseQuotaPrivilege	2484	svchost.exe
Token: SeSecurityPrivilege	2484	svchost.exe
Token: SeTakeOwnershipPrivilege	2484	svchost.exe
Token: SeLoadDriverPrivilege	2484	svchost.exe
Token: SeSystemtimePrivilege	2484	svchost.exe
Token: SeBackupPrivilege	2484	svchost.exe
Token: SeRestorePrivilege	2484	svchost.exe
Token: SeShutdownPrivilege	2484	svchost.exe
Token: SeSystemEnvironmentPrivilege	2484	svchost.exe
Token: SeUndockPrivilege	2484	svchost.exe
Token: SeManageVolumePrivilege	2484	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2484	svchost.exe
Token: SeIncreaseQuotaPrivilege	2484	svchost.exe
Token: SeSecurityPrivilege	2484	svchost.exe
Token: SeTakeOwnershipPrivilege	2484	svchost.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4460	taskmgr.exe
4460	taskmgr.exe
4460	taskmgr.exe
4460	taskmgr.exe
4460	taskmgr.exe
4460	taskmgr.exe
4460	taskmgr.exe
4460	taskmgr.exe
4460	taskmgr.exe
4460	taskmgr.exe
4460	taskmgr.exe
4460	taskmgr.exe
4460	taskmgr.exe
4460	taskmgr.exe
4460	taskmgr.exe
4460	taskmgr.exe
4460	taskmgr.exe
4460	taskmgr.exe
4460	taskmgr.exe
4460	taskmgr.exe
4460	taskmgr.exe
4460	taskmgr.exe
4460	taskmgr.exe
4460	taskmgr.exe
4460	taskmgr.exe
4460	taskmgr.exe
4460	taskmgr.exe
4460	taskmgr.exe
4460	taskmgr.exe
4460	taskmgr.exe
4460	taskmgr.exe
4460	taskmgr.exe
4460	taskmgr.exe
4460	taskmgr.exe
992	dwm.exe
992	dwm.exe
4460	taskmgr.exe
4460	taskmgr.exe
4460	taskmgr.exe
4460	taskmgr.exe
4460	taskmgr.exe
4460	taskmgr.exe
4460	taskmgr.exe
4460	taskmgr.exe
4460	taskmgr.exe
4460	taskmgr.exe
4460	taskmgr.exe
4460	taskmgr.exe
4460	taskmgr.exe
4460	taskmgr.exe
4460	taskmgr.exe
4460	taskmgr.exe
4460	taskmgr.exe
4460	taskmgr.exe
4460	taskmgr.exe
4460	taskmgr.exe
4460	taskmgr.exe
4460	taskmgr.exe
4460	taskmgr.exe
4460	taskmgr.exe
4460	taskmgr.exe
4460	taskmgr.exe
992	dwm.exe
992	dwm.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4460	taskmgr.exe
4460	taskmgr.exe
4460	taskmgr.exe
4460	taskmgr.exe
4460	taskmgr.exe
4460	taskmgr.exe
4460	taskmgr.exe
4460	taskmgr.exe
4460	taskmgr.exe
4460	taskmgr.exe
4460	taskmgr.exe
4460	taskmgr.exe
4460	taskmgr.exe
4460	taskmgr.exe
4460	taskmgr.exe
4460	taskmgr.exe
4460	taskmgr.exe
4460	taskmgr.exe
4460	taskmgr.exe
4460	taskmgr.exe
4460	taskmgr.exe
4460	taskmgr.exe
4460	taskmgr.exe
4460	taskmgr.exe
4460	taskmgr.exe
4460	taskmgr.exe
4460	taskmgr.exe
4460	taskmgr.exe
4460	taskmgr.exe
4460	taskmgr.exe
4460	taskmgr.exe
4460	taskmgr.exe
4460	taskmgr.exe
4460	taskmgr.exe
4460	taskmgr.exe
4460	taskmgr.exe
4460	taskmgr.exe
4460	taskmgr.exe
4460	taskmgr.exe
4460	taskmgr.exe
4460	taskmgr.exe
4460	taskmgr.exe
4460	taskmgr.exe
4460	taskmgr.exe
4460	taskmgr.exe
4460	taskmgr.exe
4460	taskmgr.exe
4460	taskmgr.exe
4460	taskmgr.exe
4460	taskmgr.exe
4460	taskmgr.exe
4460	taskmgr.exe
4460	taskmgr.exe
4460	taskmgr.exe
4460	taskmgr.exe
4460	taskmgr.exe
4460	taskmgr.exe
4460	taskmgr.exe
4460	taskmgr.exe
4460	taskmgr.exe
4460	taskmgr.exe
4460	taskmgr.exe
4460	taskmgr.exe
4460	taskmgr.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
3252	Explorer.EXE
3252	Explorer.EXE
3252	Explorer.EXE
3252	Explorer.EXE
3252	Explorer.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5028 wrote to memory of 2520	5028	test.exe	73
PID 2520 wrote to memory of 588	2520	dialer.exe	3
PID 2520 wrote to memory of 648	2520	dialer.exe	1
PID 2520 wrote to memory of 724	2520	dialer.exe	8
PID 2520 wrote to memory of 904	2520	dialer.exe	15
PID 2520 wrote to memory of 992	2520	dialer.exe	11
PID 2520 wrote to memory of 1016	2520	dialer.exe	12
PID 2520 wrote to memory of 392	2520	dialer.exe	13
PID 2520 wrote to memory of 928	2520	dialer.exe	14
PID 2520 wrote to memory of 1088	2520	dialer.exe	23
PID 2520 wrote to memory of 1128	2520	dialer.exe	22
PID 2520 wrote to memory of 1168	2520	dialer.exe	21
PID 2520 wrote to memory of 1284	2520	dialer.exe	20
PID 2520 wrote to memory of 1304	2520	dialer.exe	19
PID 2520 wrote to memory of 1340	2520	dialer.exe	18
PID 2520 wrote to memory of 1404	2520	dialer.exe	24
PID 2520 wrote to memory of 1460	2520	dialer.exe	26
PID 2520 wrote to memory of 1484	2520	dialer.exe	29
PID 2520 wrote to memory of 1528	2520	dialer.exe	28
PID 2520 wrote to memory of 1588	2520	dialer.exe	27
PID 2520 wrote to memory of 1620	2520	dialer.exe	30
PID 2520 wrote to memory of 1676	2520	dialer.exe	31
PID 2520 wrote to memory of 1728	2520	dialer.exe	32
PID 2520 wrote to memory of 1752	2520	dialer.exe	34
PID 2520 wrote to memory of 1776	2520	dialer.exe	33
PID 2520 wrote to memory of 1844	2520	dialer.exe	35
PID 2520 wrote to memory of 1912	2520	dialer.exe	37
PID 2520 wrote to memory of 2016	2520	dialer.exe	36
PID 2520 wrote to memory of 2076	2520	dialer.exe	38
PID 2520 wrote to memory of 2280	2520	dialer.exe	39
PID 2520 wrote to memory of 2344	2520	dialer.exe	40
PID 2520 wrote to memory of 2356	2520	dialer.exe	41
PID 2520 wrote to memory of 2384	2520	dialer.exe	44
PID 2520 wrote to memory of 2400	2520	dialer.exe	43
PID 2520 wrote to memory of 2468	2520	dialer.exe	42
PID 2520 wrote to memory of 2476	2520	dialer.exe	48
PID 2520 wrote to memory of 2484	2520	dialer.exe	45
PID 2520 wrote to memory of 2492	2520	dialer.exe	47
PID 2520 wrote to memory of 2820	2520	dialer.exe	46
PID 2520 wrote to memory of 2932	2520	dialer.exe	49
PID 2520 wrote to memory of 2940	2520	dialer.exe	51
PID 2520 wrote to memory of 3032	2520	dialer.exe	50
PID 2520 wrote to memory of 2588	2520	dialer.exe	52
PID 2520 wrote to memory of 3252	2520	dialer.exe	53
PID 2520 wrote to memory of 3756	2520	dialer.exe	67
PID 2520 wrote to memory of 3936	2520	dialer.exe	66
PID 2520 wrote to memory of 4648	2520	dialer.exe	64
PID 2520 wrote to memory of 4900	2520	dialer.exe	63
PID 648 wrote to memory of 2468	648	lsass.exe	42
PID 2520 wrote to memory of 1364	2520	dialer.exe	62
PID 2520 wrote to memory of 2948	2520	dialer.exe	61
PID 2520 wrote to memory of 3980	2520	dialer.exe	57
PID 2520 wrote to memory of 2780	2520	dialer.exe	60
PID 648 wrote to memory of 2468	648	lsass.exe	42
PID 2520 wrote to memory of 3244	2520	dialer.exe	59
PID 648 wrote to memory of 2468	648	lsass.exe	42
PID 2520 wrote to memory of 5028	2520	dialer.exe	68
PID 2520 wrote to memory of 4460	2520	dialer.exe	71
PID 2520 wrote to memory of 2028	2520	dialer.exe	74
PID 2520 wrote to memory of 4036	2520	dialer.exe	75
PID 2520 wrote to memory of 308	2520	dialer.exe
PID 2520 wrote to memory of 4528	2520	dialer.exe	76
PID 2520 wrote to memory of 776	2520	dialer.exe	78
PID 2520 wrote to memory of 2232	2520	dialer.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:648

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:588
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  - Suspicious use of FindShellTrayWindow
  PID:992

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k dcomlaunch -s PlugPlay
1⤵
PID:724

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
1⤵
PID:1016

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s lmhosts
1⤵
PID:392

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s NcbService
1⤵
PID:928

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k dcomlaunch -s LSM
1⤵
PID:904

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservice -s EventSystem
1⤵
PID:1340

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Themes
1⤵
PID:1304

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservice -s nsi
1⤵
PID:1284

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
1⤵
PID:1168

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s EventLog
1⤵
- Drops file in System32 directory
PID:1128

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Schedule
1⤵
- Drops file in System32 directory
PID:1088
- c:\windows\system32\taskhostw.exe
  taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
  2⤵
  PID:3032
- C:\Program Files\Google\Chrome\updater.exe
  "C:\Program Files\Google\Chrome\updater.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:4896

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s UserManager
1⤵
PID:1404
- c:\windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:2932

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s Dhcp
1⤵
PID:1460

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k networkservice -s NlaSvc
1⤵
PID:1588

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s AudioEndpointBuilder
1⤵
PID:1528

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s SENS
1⤵
PID:1484

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k networkservice -s Dnscache
1⤵
PID:1620

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
1⤵
PID:1676

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservice -s netprofm
1⤵
PID:1728

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted
1⤵
PID:1776

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
1⤵
PID:1752

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k appmodel -s StateRepository
1⤵
PID:1844

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2016

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
1⤵
PID:1912

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k networkservice -s LanmanWorkstation
1⤵
PID:2076

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k appmodel -s tiledatamodelsvc
1⤵
PID:2280

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
1⤵
PID:2344

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k networkservicenetworkrestricted -s PolicyAgent
1⤵
PID:2356

C:\Windows\sysmon.exe
C:\Windows\sysmon.exe
1⤵
PID:2468

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
1⤵
PID:2400

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k networkservice -s CryptSvc
1⤵
PID:2384

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2484

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Browser
1⤵
PID:2820

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s WpnService
1⤵
PID:2492

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s TrkWks
1⤵
PID:2476

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k unistacksvcgroup -s CDPUserSvc
1⤵
PID:2940

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:2588

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
PID:3252
- C:\Users\Admin\AppData\Local\Temp\test.exe
  "C:\Users\Admin\AppData\Local\Temp\test.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Suspicious use of SetThreadContext
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5028
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1984
- C:\Windows\system32\taskmgr.exe
  "C:\Windows\system32\taskmgr.exe" /4
  2⤵
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:4460
- C:\Windows\System32\dialer.exe
  C:\Windows\System32\dialer.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2520
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#isltohzp#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2028
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4036
- C:\Windows\System32\schtasks.exe
  C:\Windows\System32\schtasks.exe /run /tn "GoogleUpdateTaskMachineQC"
  2⤵
  PID:4776
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:512
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  PID:3776
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4584
- C:\Windows\System32\dialer.exe
  C:\Windows\System32\dialer.exe
  2⤵
  PID:4508
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#isltohzp#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  PID:440
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3972
- C:\Windows\System32\dialer.exe
  C:\Windows\System32\dialer.exe
  2⤵
  PID:3764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  PID:3292
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x134,0x138,0x13c,0x110,0x140,0x7ffc0aa29758,0x7ffc0aa29768,0x7ffc0aa29778
    3⤵
    PID:96
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1796 --field-trial-handle=1848,i,251387799524876763,8385696157490891514,131072 /prefetch:8
    3⤵
    PID:2752
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1520 --field-trial-handle=1848,i,251387799524876763,8385696157490891514,131072 /prefetch:2
    3⤵
    PID:704
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2100 --field-trial-handle=1848,i,251387799524876763,8385696157490891514,131072 /prefetch:8
    3⤵
    PID:1716
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2896 --field-trial-handle=1848,i,251387799524876763,8385696157490891514,131072 /prefetch:1
    3⤵
    PID:2180
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2864 --field-trial-handle=1848,i,251387799524876763,8385696157490891514,131072 /prefetch:1
    3⤵
    PID:3716
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4232 --field-trial-handle=1848,i,251387799524876763,8385696157490891514,131072 /prefetch:1
    3⤵
    PID:2904
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4372 --field-trial-handle=1848,i,251387799524876763,8385696157490891514,131072 /prefetch:8
    3⤵
    PID:4424
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4556 --field-trial-handle=1848,i,251387799524876763,8385696157490891514,131072 /prefetch:8
    3⤵
    PID:3680
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4724 --field-trial-handle=1848,i,251387799524876763,8385696157490891514,131072 /prefetch:8
    3⤵
    PID:2456
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4340 --field-trial-handle=1848,i,251387799524876763,8385696157490891514,131072 /prefetch:8
    3⤵
    PID:3008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  PID:3000
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x13c,0x140,0x144,0x118,0x148,0x7ffc0aa29758,0x7ffc0aa29768,0x7ffc0aa29778
    3⤵
    PID:832
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2024 --field-trial-handle=1728,i,76166177223572851,16495308881045783210,131072 /prefetch:8
    3⤵
    PID:3424
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2896 --field-trial-handle=1728,i,76166177223572851,16495308881045783210,131072 /prefetch:1
    3⤵
    PID:3940
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2888 --field-trial-handle=1728,i,76166177223572851,16495308881045783210,131072 /prefetch:1
    3⤵
    PID:1928
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2044 --field-trial-handle=1728,i,76166177223572851,16495308881045783210,131072 /prefetch:8
    3⤵
    PID:2092
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1652 --field-trial-handle=1728,i,76166177223572851,16495308881045783210,131072 /prefetch:2
    3⤵
    PID:864
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4224 --field-trial-handle=1728,i,76166177223572851,16495308881045783210,131072 /prefetch:1
    3⤵
    PID:4028
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4416 --field-trial-handle=1728,i,76166177223572851,16495308881045783210,131072 /prefetch:8
    3⤵
    PID:1604
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4664 --field-trial-handle=1728,i,76166177223572851,16495308881045783210,131072 /prefetch:8
    3⤵
    PID:5040
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4944 --field-trial-handle=1728,i,76166177223572851,16495308881045783210,131072 /prefetch:8
    3⤵
    PID:4348
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4700 --field-trial-handle=1728,i,76166177223572851,16495308881045783210,131072 /prefetch:8
    3⤵
    PID:1668
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=4696 --field-trial-handle=1728,i,76166177223572851,16495308881045783210,131072 /prefetch:1
    3⤵
    PID:4416
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=2136 --field-trial-handle=1728,i,76166177223572851,16495308881045783210,131072 /prefetch:1
    3⤵
    PID:1104
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5004 --field-trial-handle=1728,i,76166177223572851,16495308881045783210,131072 /prefetch:8
    3⤵
    PID:1868
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2980 --field-trial-handle=1728,i,76166177223572851,16495308881045783210,131072 /prefetch:8
    3⤵
    PID:4036
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=276 --field-trial-handle=1728,i,76166177223572851,16495308881045783210,131072 /prefetch:1
    3⤵
    PID:4932
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=2344 --field-trial-handle=1728,i,76166177223572851,16495308881045783210,131072 /prefetch:1
    3⤵
    PID:360
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5200 --field-trial-handle=1728,i,76166177223572851,16495308881045783210,131072 /prefetch:8
    3⤵
    PID:4592
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5352 --field-trial-handle=1728,i,76166177223572851,16495308881045783210,131072 /prefetch:8
    3⤵
    PID:4624
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=20 --mojo-platform-channel-handle=5360 --field-trial-handle=1728,i,76166177223572851,16495308881045783210,131072 /prefetch:1
    3⤵
    PID:4372
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4788 --field-trial-handle=1728,i,76166177223572851,16495308881045783210,131072 /prefetch:8
    3⤵
    PID:2896
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5412 --field-trial-handle=1728,i,76166177223572851,16495308881045783210,131072 /prefetch:2
    3⤵
    PID:4976

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3980
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3980 -s 708
  2⤵
  - Program crash
  PID:1876

C:\Windows\System32\InstallAgent.exe
C:\Windows\System32\InstallAgent.exe -Embedding
1⤵
PID:3244

C:\Windows\system32\ApplicationFrameHost.exe
C:\Windows\system32\ApplicationFrameHost.exe -Embedding
1⤵
PID:2780

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s wlidsvc
1⤵
PID:2948

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:1364

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -s WinHttpAutoProxySvc
1⤵
PID:4900

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservice -s CDPSvc
1⤵
PID:4648

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3936
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3936 -s 1008
  2⤵
  - Program crash
  PID:776

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies registry class
PID:3756

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious behavior: EnumeratesProcesses
PID:4528

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservice -s W32Time
1⤵
PID:1184

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s PcaSvc
1⤵
- Modifies data under HKEY_USERS
PID:4948

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:864

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:2032

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{7966B4D8-4FDC-4126-A10B-39A3209AD251}
1⤵
PID:2156
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2156 -s 456
  2⤵
  - Program crash
  PID:3628

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}
1⤵
PID:4568
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 4568 -s 360
  2⤵
  - Program crash
  PID:4180

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:5040
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 5040 -s 480
  2⤵
  - Program crash
  PID:424

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
PID:1948

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
- Drops file in System32 directory
PID:1160
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1160 -s 692
  2⤵
  - Program crash
  PID:4340

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5024

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
PID:3236

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Google\Chrome\updater.exe

Filesize
4.6MB

MD5
d2105743b649eb1d70e1bf69d8d3b758

SHA1
405545307fb273dee660055abac9e1213b3c95a4

SHA256
85aa5baea7651db7f4c8eaf3655bc6f27303e02da9f552bdf650e7253a4d1348

SHA512
ac5538c32bfd630dcf93aa10fda20c81434ececed186ebcc10d66b4ab01c367c08c2c64a8e4e98298ec31fc806cf02483dc4c8c566a6c3b233775120fe119bf3

Download Submit
C:\Program Files\Google\Chrome\updater.exe

Filesize
4.6MB

MD5
d2105743b649eb1d70e1bf69d8d3b758

SHA1
405545307fb273dee660055abac9e1213b3c95a4

SHA256
85aa5baea7651db7f4c8eaf3655bc6f27303e02da9f552bdf650e7253a4d1348

SHA512
ac5538c32bfd630dcf93aa10fda20c81434ececed186ebcc10d66b4ab01c367c08c2c64a8e4e98298ec31fc806cf02483dc4c8c566a6c3b233775120fe119bf3

Download Submit
C:\ProgramData\Microsoft\Windows\WER\Temp\WER726C.tmp.txt

Filesize
12KB

MD5
22e4a3ba57a233673c1f777c87a698c8

SHA1
4b9844e5ff9c39d50c18c720724f376d65a4e2e3

SHA256
012cbb1cb99fa34c5463092ba6307ac51b908f8833c001f420ad2bc089d21a24

SHA512
a891e6da29454022aa94b5e9c27b8c5cb9cdf20d302522cdc608a7d241d041d8f97c45f8c0931ba94d519130e00ca0a4b3caa20364138c0ea0af3fd315f0bb26

Download Submit
C:\ProgramData\Microsoft\Windows\WER\Temp\WER726D.tmp.csv

Filesize
35KB

MD5
493291a967fc5cd56514b7ba0805b541

SHA1
14e8353c5fc76e40cb046fd3872e2630df04d69e

SHA256
5f2351c00aff613cdf4b9cff7305b13c84bea958e00b44364405eacf4be25b4d

SHA512
d1998379deca8d6b1d39bee1ca0aa0173324d40238a094603ae9d8f5b70ed7903805a38c2ec7c04b8b64bae181d1d385fd18da6d0afcec7262f4f8d4d07a76f8

Download Submit
C:\ProgramData\Microsoft\Windows\WER\Temp\WER72AD.tmp.txt

Filesize
12KB

MD5
80dae86f45bfed7ee297da784865aa87

SHA1
4849a4e8d71f430d77799fc27fe3a958dfd6aeeb

SHA256
b4ff9a6f2c0313525d4b62213929e5adeca33d2bef139108a80088b6255be3a5

SHA512
78e5bcf5d0cc3bf5fc41ce6ebe83be5720ea5a02df96d8a83865ab5280a38d64e067125efe3b9f22aec34eeb4ade21129be510c4abdcb59d37826a6688336e8b

Download Submit
C:\ProgramData\Microsoft\Windows\WER\Temp\WERF889.tmp.csv

Filesize
32KB

MD5
e1159b5d916af3fc5f5e090d06fdb19a

SHA1
291f903f38f7b3b1bea6e8f6b993ab64534dc114

SHA256
067541a1d7289786df95801ddd5b629099dd4f8c4801bc99459c5e387f426d76

SHA512
ef1ef5363e6a3b91e51261028bfa43b203221d9a1f1eed5b3938b59ef937494dc95539acb2bbb882cb485dd919bd870d9399cfb7fdb6cd92f87564292e08bd11

Download Submit
C:\ProgramData\Microsoft\Windows\WER\Temp\WERF8C8.tmp.txt

Filesize
12KB

MD5
32dd3ea1b6035c8a98a70f0df1a84702

SHA1
e8de01ba6e2ccaadc975cc19f9b8eb5ce4d7a58a

SHA256
54ea1648a1ef3c31f40c5be883251f4902745fd991db52ca14ca58c58fe40ee4

SHA512
a9b549f14c19933cc33a3c78b74d854d46826ad5b35c0b5182f813e1da5f99ff9b9be23578ed3483d71662730f9ef19ab24590df7be20c498b485ae0521f7e66

Download Submit
C:\ProgramData\Microsoft\Windows\WER\Temp\WERF8C9.tmp.csv

Filesize
32KB

MD5
715887e139753a617b45d597562f106e

SHA1
68d24df7378196d2967cb046a68632df12df92f0

SHA256
8e3c24d8ac4d05d9e3f1ef3b304a7b774eb4eb7f07f819ceb33c5593428b35c6

SHA512
b6e98dc5229b48a20611c9b7240dcd321cb65c9eed3021b1fa82795ca11420555130dc35c1d97a48c4bdade62bdbc3b459d5f3f2a97b45477af75e9ee90433ca

Download Submit
C:\ProgramData\Microsoft\Windows\WER\Temp\WERF957.tmp.txt

Filesize
12KB

MD5
45210cf009e5a970270f93bf909f2205

SHA1
35f0ea6c1a77bd4351bd1d60421c4c989defd1d5

SHA256
8c34e1f9d378b91dc756eb09f0d4a2195f8f6e5446f42ff7e6ebe9a54b70e9e6

SHA512
ef064fc3636189b3c99464a55c7fa08496f291fa2ad96c950e888790d53fe9575c831dee3e5e287664f7e1792d07b4753af799a5b762d2dbb1f7d96f8bdbc8e3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\metadata

Filesize
114B

MD5
be73620210be053104dd4fbaa0d00c5e

SHA1
fc358c9dcb38ebbd4368a8160744a2fc88dd7803

SHA256
88e46e006b07de0b3d639fb3b92dfd0c1f2afe1e483550ee8dfd6b5337feb48e

SHA512
e478151e036fa14dd00fdcc88ae3c9a56880fd7a817bb265c533906c5ca1f1bea1fa580ddb34d9ff0562c3afde85e10b0a899ac7af9d2de3cc3676ee642bbaf2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\reports\f7c75323-c679-4444-a0c4-d029be5df494.dmp

Filesize
1.1MB

MD5
60fe3d79b4886565363c464ff6a74383

SHA1
7449659625bd069695f86ee5b069045c54624e52

SHA256
fbe7540ab68a8da0b537ee71cc628653b10967b2463091d13f0b53d5cedeab8d

SHA512
c84981833b14781181bfc6967a0d1f47e9fd076e9fe08a153443009b6df0cabaa54e0b680fd08852a58d061e9b4af5bad511e4ab63ab2c6b57ac37c0b1a8448d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

Filesize
40B

MD5
5f4717e49018602f429de4a1c764ac8d

SHA1
4ebf5362db47360524dc299152a86bd83d634cad

SHA256
26cf70fc8289b4140e123e66222ed46a181618aff2b47b281d74c91b52fda7fc

SHA512
014d4027d64cfc5a9ddda8f2d0d23040cfb7fbc4f74051cdafa8608b10483c79df5ecc5dfc092bd0b749f59fc3a01e62dafd838491ca1a99ce827b5dc22d1f82

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

Filesize
40B

MD5
5f4717e49018602f429de4a1c764ac8d

SHA1
4ebf5362db47360524dc299152a86bd83d634cad

SHA256
26cf70fc8289b4140e123e66222ed46a181618aff2b47b281d74c91b52fda7fc

SHA512
014d4027d64cfc5a9ddda8f2d0d23040cfb7fbc4f74051cdafa8608b10483c79df5ecc5dfc092bd0b749f59fc3a01e62dafd838491ca1a99ce827b5dc22d1f82

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_0

Filesize
44KB

MD5
56b4dafeab21526d5d48a443e546bd08

SHA1
1391309d0d7893f96ea6a370f2b45d20d27792a7

SHA256
19e9885ad31263cbebb77ca792afe51c89c99e94cee097f25135d04353e92c7f

SHA512
9e9b4ee610d2cb0ef8ad2fbd0d3fbd4a0bd5f02baafa995f5cb69269f21f93e10bb18320490ea9db136c3c5c3dcbfd9b6d186b10235f1913372f99f7acc05f80

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_1

Filesize
264KB

MD5
c3088c71914a053b3d80baf028a294dd

SHA1
0a45c87551ac540e33e1fe2140b9cef641dfe0ce

SHA256
3c6256d2671195eeeb28d089070c81eeb290de4175121f5e6c725a5cbe406aa9

SHA512
c47f5ad4d1c523a8beacb920c284d21b755c13ff11c1ae8fb2e4254032f0c79cddffec031836259b01a9b92b04ceadb659fa450234f8781e081134f27ce93b58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_3

Filesize
4.0MB

MD5
04ba607c49b1a8c47dfe9683a9d5fa5e

SHA1
01590aaf906dbaceac1ad0f9033a194ff4132208

SHA256
f438a1fb1e410d07ff5abfcf20c29a146ab7c9de6196317889699c6b66d7ff1b

SHA512
1c05d82f0a00225d6822db612003b7b4217f3ef1fa2d0c528e88c9d4106b5ae30bb7adb7c39c8d05a1c665a0fb537ba05bcfee1bd437c93938c5b7490b5c377b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000005

Filesize
37KB

MD5
bf8e177c972ff71fc0f4664092032052

SHA1
c17eb0d87b75b2a58a09633ac2fa7d5d64fbb92c

SHA256
f7373bae756c7bcd5d5813720213e93cd2d1187de43a7b8c4afa7a902bf47454

SHA512
1ec7db03e9065ed3494b2768c63fb0740ba979d1e8ccd53686f484aec03123b1a1f5d0de2619ea1388b0786e87339a58e64bf6aead36d1511795f03b2f37f889

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000006

Filesize
53KB

MD5
7466910f622cefd2d8f9dc3987067733

SHA1
3afd364e034749293cb1403ef754429e485ac331

SHA256
560483695ed326f8d73998faee2b42102da65732d4e19200883ed5a8d6fb996c

SHA512
5fae9059234b13d9819a0ac44490ce2c3e6bf64e31fb0254beb5f8a5102bd576fb64875ac4fb5865844d193d3668e17d84db927a93c73e0f0b51b128faaf7c63

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000013

Filesize
171KB

MD5
7a88e1edbba1ad7bd345eb14f1377a59

SHA1
b299cf2eacc2d17d1f2fbda9391079b6f05fb022

SHA256
3f6aa29738172f431b8e2af2e39cba0c2f91583d7bc23f988c7b7b35975bef2c

SHA512
48870540a5e7aedf4513610e23dad5d37ff48dde92909345771f7235d4526893e65d11915b46191e62dbe6e9bed4626215703fc90932bdebed356568c1557f95

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
0a76e63a10bab20c103ecc2b2d48ccdb

SHA1
cdb2ad5075d7ac68108520960db71a099c2944e6

SHA256
e42b7ea65383086231dffd5dbcbe598bf9084e4cb1dae049dd89c85149840cd9

SHA512
10d45a1f8bbbd4465e890640ce62359dd58fe97d69b73653fc00134c920930e94a86d37fab07de19d03a8d27015be2833a5d4786d154b2341899a68e2a340940

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
cf7234722e9e3e5cf699cf9db7ad0818

SHA1
1c04685d2eb6f5988d3ed3765a393a0b69455f86

SHA256
a1e189d48e70762885adfaf645ba025ef6159d650d58cdaad7fc0a7c9ca3447a

SHA512
eedb7c4b583357345018dc4d45feeb04aec82f87f06f58b64b9fd938811da21e8d29b16b11bcd763a819a35c73c24e18afca2644ba5f5d004789401844ee4f6c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State\LOG

Filesize
317B

MD5
5c5969cf9f0fa328652b541b58717380

SHA1
dfe7f289460436dab01a6deb06de1c98451a96fe

SHA256
89af8322010a7225bf006b560edd2568a5aa5f3d31fdf7876a640b294819fe51

SHA512
fe1941a099c6a47dbe94b3cd17cc5e376fc65038307fafb6319c54790feb4945dbf831570094b1792ae1f85551bff39d360b4ab46528e0f7ba8b479c984f02ad

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG

Filesize
329B

MD5
40b5c7ffebea7c542f851d6c9d13c179

SHA1
7c22f651694e0487c0e2cf7366fde43f81734436

SHA256
31782171a0d92c2aab01dcecbc7542062ab92bb609bb0257de890d8d2c0744b5

SHA512
4d715c03b460b351dd28f724fe420ea64a96d95b8b334f76d40cd7db024be1b9b85191dbdbe1af61595c1399ee70b234506feb6f4023c560a7de1f7c176df2cc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
4dc7e696104351782ad7620cf6fccec0

SHA1
a4e24629e732f1e412b1dc87b4e6cd6e4597c617

SHA256
71af4e59f874fa94b30b5d36a89ae161a34991d15fac6608d38540a59366e5b8

SHA512
136c258f9c727e0d564fea8aea5a3887387ffb99cd51b48122b23692f2a9657a84c81a911e01e6a3e8c9d74d76d8ca6da1dc239451615b4f023497a9024c1c92

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
4KB

MD5
a23136e9937ce5c0d15d2fb09f51c8c6

SHA1
d1f540866fa1a540cbe95a592c0565f8454dde96

SHA256
13cfd7d89d202dd2b882bfd6bf141f73b496674ad2b0db38ba61c743b9d10bd0

SHA512
6dd163ac2c2f563f054e5e00f7acf49a5d58980371a095995ca796be5f8fcfd856d2dfe987a5e0bd6ac13e2e8fd5bde94769610b3804e3867edc4fa37968de0c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
369B

MD5
b54cb0312e3f6539ca7abdb2c9cab49a

SHA1
6a519256b15e139fbb7db2b5ee0587316508a9cd

SHA256
33934f91cce4abfabe1777ccf8ae640c8db24f456a74e8fa8801f348b819bb87

SHA512
c751b9465ebc6fa60019f7dfa0cbf97fc2e56a01dd9e270166e54a816ec48bdbe7fc9a6cc578d23cccbf07cea687d206db2f5157ec23d1461d90ca08509346fa

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
0b3e585b7e8188cd1dee28f47abacf15

SHA1
4cd34a76f6d5ec999aa13478be5efcc97fa18467

SHA256
d1fac0f13261e1325a4f3fd2e4a07b19cafc17ba2e94db5bc6a6108a7afb4112

SHA512
37d5961b83d40add509f234183d8536ebb0ccd9e2e96d7a8d123e70744f41ae119c3117429d9dd22b4fe151c842a422b364f95837c883c619d2745c8ff8a2a55

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
371B

MD5
cc8cab120b0e68806e5ec212a6b504c6

SHA1
2f7ca5fed17bb28d71e0a457c81f85e13d0f22a6

SHA256
54d2477c1a5c26c76bd4cacda58a61c8808d2301af77e56e92a5fa98293a0af9

SHA512
b6c0bd309f1723c8e09ff113c79413806d944f2a32208bb7f3aac5a75eba3871ea7fc7d213df8f67d252402e5ae16b259bd7749419a34e36e953df44916bb5d5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
371B

MD5
cc8cab120b0e68806e5ec212a6b504c6

SHA1
2f7ca5fed17bb28d71e0a457c81f85e13d0f22a6

SHA256
54d2477c1a5c26c76bd4cacda58a61c8808d2301af77e56e92a5fa98293a0af9

SHA512
b6c0bd309f1723c8e09ff113c79413806d944f2a32208bb7f3aac5a75eba3871ea7fc7d213df8f67d252402e5ae16b259bd7749419a34e36e953df44916bb5d5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
2c1405adc8d1c944d487a5a7bbe96929

SHA1
50cdff34f759c7c5dc097db29a0d655472090457

SHA256
5c8f111390bded6ae2ebb674417869243105c236c9b9febba67fefe0bbf9cd17

SHA512
2ea34ff518bf63cc1cbe6630eb332d0431732e86d0c6b6e280018ce793306c7567c3b5c43bf4139e302289d9fb818befb71112c5903bcfa8b447eb2c8092d207

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
699B

MD5
52f3ffeb2c850add4dde71c0fc21ac9a

SHA1
d16a6906ffdb997a05df574c7f70d9ada368547c

SHA256
69c58abc184f5bfe15af340e89a292daab6b4351332f70f1346903e53ced6843

SHA512
46f679ce031234af265875b573c38f64fe12c1633d499bb2a3a3fef954f1b5a8d00f8680d1d6be6317f2d3356b107f68cc8a5becd63821ff9837b4db56842128

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
c696a2a038dee5771217e66c75e024ca

SHA1
e576782ad0cad528d03c1f64f467a0ee40c9abf4

SHA256
6bfb4ea260275c4fd44a0783619cf6544819d9c301c767e898ce0fc57e52de4b

SHA512
296c2838082cea93b26bc770335cc6260fcc38441b480f7a710ac16b22b1dec1cce92d64b176056533b5ca043c7ad657f57c4be6ac8e1d691859dc22124e5428

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
be642ebc05f9e6129651c5b723549b54

SHA1
0fde7ba2032a1ced247dd900a6b4df9ef011189c

SHA256
400896cb56b2aaed3c2a356119dfcd68b7dfca5a231c41654ab4c3e1ef49acb8

SHA512
db349e30d90399238b335f7184d71d2ee0829b5181bbef0fc025ece659e4d104a8258205a424e368e6f6a2d399aba0b547c7c7ba1b128e97cca32810eed56d23

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
be642ebc05f9e6129651c5b723549b54

SHA1
0fde7ba2032a1ced247dd900a6b4df9ef011189c

SHA256
400896cb56b2aaed3c2a356119dfcd68b7dfca5a231c41654ab4c3e1ef49acb8

SHA512
db349e30d90399238b335f7184d71d2ee0829b5181bbef0fc025ece659e4d104a8258205a424e368e6f6a2d399aba0b547c7c7ba1b128e97cca32810eed56d23

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
5d26b413fe3263435f43cdbe489a203f

SHA1
0e51f059d52b832f207458bc994b36612e82a3c8

SHA256
c71970b7bed79dd2ad84056aa73961da3975d8790bb248dfa0f95f59032278d3

SHA512
213a240bcdfe65710e473ef24bac689d0665618afe8fc1e4f18a0eeecc5fc36464a3b5211d5cc2c4ae787c55c5465d69fc6d70bdac299a5ef7d49f083df180c1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
551fc5e7332543c78413b8cebaf984b8

SHA1
0c06ebb4527634b8faa7fdb120b71367b2975dcb

SHA256
fac79df4d7c63b955a8084216715dc80d56d55bd9029f50d85e03e4b58d23560

SHA512
de480bd3f6ebff96496d162dc2243c45d97b9c5b8bab44de8a9c5de0747680cb5b935b1604cef62c1ab02b04cc3c411de784eaf1d359a8b15496506d7e06502b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
f87c8887bd233f4b54f48bd21d5ebfd9

SHA1
94f8456e1b623940bb257c09a9fc3767d37eb365

SHA256
bbc33478744132e3435d28983002d4b02cecfcafcd8913787c75056be5b62d6f

SHA512
fdf2f470d20c2ce83d7061069aaf8397ddd25ba464144c89fb03459f36f996d5cb7a60bb754ebc95087bf8b0fd16d194eb83b033ce495c2337d0c4e3b5b66cba

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
911b2c6ce1cbfc333a6d86e635d50e8e

SHA1
b922540ef13e4c68a86f4e04088795dcd7795772

SHA256
6f47e6430ad4134b1b4d191f35e56300eeb4cc03e109a353c75f59366c31b8cd

SHA512
b806f32b7d3b849b3c656e8fc2fb3cf3dbcc2b9cdcc09f46df9965a062663f278b188019f857b7fbaa8e752d62b60e8c9e719619f55364fa69f5b863e41b2483

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
f6103245fada5802d51242ccdc6b91ff

SHA1
8fdb2e6770392e25465a5755c52b64bd374b8ea1

SHA256
f5e11c7bbbdf9f7ad36f27acaa7fca180566eb4615ea8a9d73d7958e43aa72e7

SHA512
05dae2cc9fce55f556f82305954661699006b4c7ca5b891d455b19568aa0cca5dc3743043af56f31bea990244b396c5312b4c66ae4be50b88eb1c894037d8907

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
2674c2486d06f2286cf28ce249f5fd6b

SHA1
49893acf647ce8df2343ed17ec55db9ef104d29a

SHA256
42823951f584f92c5be96aecbd7b349abf02388c4295641a88b3ce7db31fff2e

SHA512
ae8ea4e4a5b35036c93509caeb24c2502b3b4029a79c0b00af54937265ee215cd3e2d1677ff1f523657cdb422533680ff9b5cc53b17d44a6cc1e6c290c64cdd7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5a3be1.TMP

Filesize
48B

MD5
e8c14f6137f463c54d15cd577dca8956

SHA1
c5992b25360336e40bc6bc4471548cffa6b6d945

SHA256
b21edb65043ec717f3dd422555da25e66993a1bdc8e19fa74653662962361b53

SHA512
e7d794e7ccda179c11189eb0d6dfca24ea5537962b52c731b3852c0a96c3a59ba0238c37f31be143ce905422592ad34544d2f2f050c9b9d4eda3c5cc0c83187d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sessions\Session_13332855601477304

Filesize
2KB

MD5
ef0eaba1119385e07e1552d36afd896c

SHA1
7a17c122af4c69f4feb4171163adbe31c5681b95

SHA256
0c03f15bd215d3e4d69b7cbce7cf3c2c6f632aedf0520e516f9cd43ee45af429

SHA512
d06352c9d7e79d06cf314fdaafa50356a7402e80cf5c517d1cef9f1b6b36e048748cc5f20f72125f4ab217e08b8b48a2ccb3503e8e1fda30c45add6bec4839ec

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG

Filesize
345B

MD5
e1fb19098b5e5758064e8917c3941309

SHA1
0f103419481dd59aed1e388c3bc59d2206a1c4fb

SHA256
059c326441e57615e1bbae839015f82f11a389e0e89b200ef8583e604f2d9540

SHA512
a2681eefa88891eb0f7c288cac7274cbd84d48732a61bfe89f4b0fc611254202eb0da00bb8ebc692a290f79a998bfd77614da031c09abff09bc9a54f4b349629

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000003.log

Filesize
8KB

MD5
9a73e862f5d454753f020820dd956c9a

SHA1
bcc63e9c568dc8f2ea859f07777ded30f3cc106b

SHA256
2172b03d176f1539860437da9ab392492665f1568aebfd4c31170eab9593b75b

SHA512
4870a8d42513c03635faed9f9a292537820ec7834b278630a82435fa6ed8261cfdac872aac90004706f0a43c2046f509b68966cd17b00056e517297189753211

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG

Filesize
321B

MD5
7eda1f8d7e7fea79d61c6197f684306f

SHA1
5864ed09c85116c3c4a0b37f2b066a388a61a20f

SHA256
54575934a4bdc98ca0ca72ce868c6d997623acee0bc992cfce5a623569a1cce3

SHA512
4120e5b906060301d70c7a32a7561f4a85fc8a28d2195d048e0ac8659d74218c10427b5f3b949131b0d3bca1501a8261f09fe87e89e21dd9d170f6c7b82ccf31

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\000003.log

Filesize
808B

MD5
e5bafa7dee336fe23ca4043e5decedc1

SHA1
963e647539b9c7b56c1e01bc38c3f672a3f18759

SHA256
fd40828da9c223d86a0f112bb236807edf7d49dc86989ab285ea947534d0ea0b

SHA512
29e956e4220133405404d11a4e34b06cfa65d09c8163da20199fe24174e53e1da6c6c42ba44163a63295a3ba4c17adfb730032d974c46a79b3ff0fb5ecb5f3ac

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\LOG

Filesize
317B

MD5
5982159bcbd649e0c7ea5439a787202b

SHA1
eae725cfa6162f305bdb3d9e4b8b795cc97d8c14

SHA256
2a58861234665ec89ec3d9a1b308a9506e337c99e1af42798210d86a8e6c67c3

SHA512
a64afeac7a5ff3ef1fc9b04d1b3aca0bda5ccf197d799283f7865012aa8ed9b4678b99b041026ce3710a7ab565232bd93c76fe47bd10d257ac0721c999a50f02

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\000003.log

Filesize
918B

MD5
68d7541361eaf2740c4be05f0e5af344

SHA1
af6d1dd974ba47949f0ef041b72d739f1cf557f3

SHA256
f0a709798a7de0ad698f73d25c97626b4b800786219fb461d53faf37daa152fa

SHA512
13028b9d0d696d9e4db7781919b9eb478cede267cfae2d7ce8cd8ccecabbc44c54fd7e5d1362294be708c208798cdd51742dddfd02600fb7d2926147a5503bc8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\LOG

Filesize
335B

MD5
839046cf2829a824f60318b457ea696c

SHA1
2ae9d470b7db3b2ffc494bb7a7ab75fa8abf18db

SHA256
0ae1947f31e802b2bc96d202e6f70da9ad7bd8deef72fcd03725f1fb9228f34b

SHA512
9c85bb647e0bae88a83dbe381cc655a8ba3d281b218befe830225dc01da327a5f7a7dc1ddb0dc932b079ec784ca1d09399e81268a03fad6b0be9f6b4d618c6ab

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version

Filesize
14B

MD5
9eae63c7a967fc314dd311d9f46a45b7

SHA1
caba9c2c93acfe0b9ceb9ab19b992b0fc19c71cf

SHA256
4288925b0cf871c7458c22c46936efb0e903802feb991a0e1803be94ca6c251d

SHA512
bed924bff236bf5b6ce1df1db82e86c935e5830a20d9d24697efd82ca331e30604db8d04b0d692ec8541ec6deb2225bcc7d805b79f2db5726642198ecf6348b8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
172KB

MD5
f12dab6be69fec0fb5c9e4687adb6238

SHA1
abce451621ca0e30746a046f429898e9170dd2fd

SHA256
37b9b1aefee096d90bb32e2a076733fc9618d07f2663a084998a877f31835b20

SHA512
aaae7256bdc25c4a08b9f846a8ce833793472ef8c407011ae2c7da11c48ab8af082994f4f2213ad1370fe49158e0303df751fe2aa25212e1b0be63c2f81a1de3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
172KB

MD5
f12dab6be69fec0fb5c9e4687adb6238

SHA1
abce451621ca0e30746a046f429898e9170dd2fd

SHA256
37b9b1aefee096d90bb32e2a076733fc9618d07f2663a084998a877f31835b20

SHA512
aaae7256bdc25c4a08b9f846a8ce833793472ef8c407011ae2c7da11c48ab8af082994f4f2213ad1370fe49158e0303df751fe2aa25212e1b0be63c2f81a1de3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
88KB

MD5
84f0ef972ab810418a359de5a5d78b6a

SHA1
93fe2836ca39b22fac3810690cff6d93611abf9c

SHA256
a6478a029717e5420fe4004b16423b9201478abb1f15a0192f63a5b372f8013b

SHA512
87103f78da2acc54fa548b69869e159ee7e825e0918392ebf80f76341f50a3933b541e28e00bd8b89cdd2a7a9faa877028ebc55caaa705caa63128cc8606c635

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
88KB

MD5
49a3733ae98be1298555bdc84520a3ef

SHA1
d0efe499e2bc15a23ed6fc66e85e93655a7e56d6

SHA256
5d3fa30dadb4b093b6654755b47aff2bd90968022f9e850dbc1ec264b82364bb

SHA512
c19d283eb1688a38d4a80e39d0faf36cd38a9ed36a1fd458fdaacd9d87d463dca73314ddaadeb781f4fb88db773d274610c29e34c437383400d30457de43c0f0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
99KB

MD5
2b6feed5fe1b6de31d2b6e889424f1bb

SHA1
7832a2e6e530105e47b862e6e399339427be9d6e

SHA256
ce4b18df01bd0f1aa831d4ee45ac4eed64dbf2276ef5e5139108a02ffb993379

SHA512
0ca8acfa58c301250b409f5ae2cc106b33bd76043155b61792f97c254551bdf5c1bef333dceaf744ecbd49e03e0d6215129b431197a33fc4d8c5dbc4f37b0fda

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
94KB

MD5
54c1b0e3fe30aba3d248bd6da4ab7d77

SHA1
a8ec332206da5b1fe8f95ce80ff3cd63aa298aa2

SHA256
52285ae64da54d56a4c3777ef685c222b77b762b74657df7905538199970f870

SHA512
f2b1ec3cb78fa5129eddd12577c2079fd0fdbd5f1342eeb09508a481f9a510ba809173785b9da2658c16082563ca3e9d9086df8637e94fb7cce5f5ddd3af5d3a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe5a2f20.TMP

Filesize
93KB

MD5
982c9321585cb95316a134cf928ff5a0

SHA1
ba22ca6db2ef9ecc4f51cca8a34ee33f7504c46f

SHA256
6d71381451c876c8a48bde7a6dc92d3ab563790b89b6faa026728ba123f8d299

SHA512
47dc51140ce3b6670b0699f78f0382e18ec8a1e5c942bc614eab10110f2d7d880e5f20422fa5fa7519924a737504d0b1db49f1f3007971d2ebd5109b19b54388

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Variations

Filesize
86B

MD5
961e3604f228b0d10541ebf921500c86

SHA1
6e00570d9f78d9cfebe67d4da5efe546543949a7

SHA256
f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed

SHA512
535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
3KB

MD5
8592ba100a78835a6b94d5949e13dfc1

SHA1
63e901200ab9a57c7dd4c078d7f75dcd3b357020

SHA256
fdd7d9def6f9f0c0f2e60dbc8a2d1999071cd7d3095e9e087bb1cda7a614ac3c

SHA512
87f98e6cb61b2a2a7d65710c4d33881d89715eb7a06e00d492259f35c3902498baabffc5886be0ec5a14312ad4c262e3fc40cd3a5cb91701af0fb229726b88c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
794bca7499c793c4f621ad8df8fd78de

SHA1
191a45fd0dd64e2e8225e80769943cfde11a4a77

SHA256
3ccbafd8c55bbb52938a7422c6720a28102e69cabfbf3a9e3be125f53c3f60e1

SHA512
fa82cc4a4e8acf6897b977dc59860dd04a939423a5787afabeb6ed797227fb22f229499f6e1fd46e9a1dc8cf9a5ac59d22713796c7b898fdd192da3b21e7ad1c

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_kaxdznxz.ffw.ps1

Filesize
1B

MD5
c4ca4238a0b923820dcc509a6f75849b

SHA1
356a192b7913b04c54574d18c28d46e6395428ab

SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

SHA512
4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
3KB

MD5
811d351aabd7b708fef7683cf5e29e15

SHA1
06fd89e5a575f45d411cf4b3a2d277e642e73dbb

SHA256
0915139ab02088c3932bcc062ce22d4e9c81aa6df0eacd62900d73d7ad2d3b18

SHA512
702d847c2aa3c9526ddf34249de06e58f5e3182d6ef66f77ddbdbbd2e9836026da6eacac2c892cf186d79bdc227a85c14f493b746c03233ef8820d981721c70a

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
302a7c179ef577c237c5418fb770fd27

SHA1
343ef00d1357a8d2ff6e1143541a8a29435ed30c

SHA256
9e6b50764916c21c41d6e7c4999bdf27120c069ec7a9268100e1ce5df845149f

SHA512
f2472371a322d0352772defb959ea0a9da0d5ca8f412f6abafac2e6547bcc8a53394a6fb81b488521fc256bfc9f3205d92c6b69d6d139bdb260fb46578946699

Download Submit
memory/392-215-0x00007FFBD6EC0000-0x00007FFBD6ED0000-memory.dmp

Filesize
64KB

Download
memory/392-223-0x00000283EB3C0000-0x00000283EB3E7000-memory.dmp

Filesize
156KB

Download
memory/392-211-0x00000283EB3C0000-0x00000283EB3E7000-memory.dmp

Filesize
156KB

Download
memory/588-177-0x000001C461980000-0x000001C4619A7000-memory.dmp

Filesize
156KB

Download
memory/588-194-0x000001C461980000-0x000001C4619A7000-memory.dmp

Filesize
156KB

Download
memory/588-178-0x00007FFBD6EC0000-0x00007FFBD6ED0000-memory.dmp

Filesize
64KB

Download
memory/588-174-0x000001C461950000-0x000001C461971000-memory.dmp

Filesize
132KB

Download
memory/648-182-0x00007FFBD6EC0000-0x00007FFBD6ED0000-memory.dmp

Filesize
64KB

Download
memory/648-176-0x000002ED55560000-0x000002ED55587000-memory.dmp

Filesize
156KB

Download
memory/648-190-0x000002ED55560000-0x000002ED55587000-memory.dmp

Filesize
156KB

Download
memory/724-197-0x00007FFBD6EC0000-0x00007FFBD6ED0000-memory.dmp

Filesize
64KB

Download
memory/724-192-0x0000024C2E7D0000-0x0000024C2E7F7000-memory.dmp

Filesize
156KB

Download
memory/724-305-0x0000024C2E7D0000-0x0000024C2E7F7000-memory.dmp

Filesize
156KB

Download
memory/776-469-0x000001D745970000-0x000001D745997000-memory.dmp

Filesize
156KB

Download
memory/904-198-0x00007FFBD6EC0000-0x00007FFBD6ED0000-memory.dmp

Filesize
64KB

Download
memory/904-193-0x000001D1C0030000-0x000001D1C0057000-memory.dmp

Filesize
156KB

Download
memory/904-201-0x000001D1C0030000-0x000001D1C0057000-memory.dmp

Filesize
156KB

Download
memory/928-221-0x00007FFBD6EC0000-0x00007FFBD6ED0000-memory.dmp

Filesize
64KB

Download
memory/928-216-0x000001E4A8AA0000-0x000001E4A8AC7000-memory.dmp

Filesize
156KB

Download
memory/928-228-0x000001E4A8AA0000-0x000001E4A8AC7000-memory.dmp

Filesize
156KB

Download
memory/992-196-0x00000182E1F00000-0x00000182E1F27000-memory.dmp

Filesize
156KB

Download
memory/992-200-0x00007FFBD6EC0000-0x00007FFBD6ED0000-memory.dmp

Filesize
64KB

Download
memory/992-205-0x00000182E1F00000-0x00000182E1F27000-memory.dmp

Filesize
156KB

Download
memory/1016-218-0x000001C5F8CD0000-0x000001C5F8CF7000-memory.dmp

Filesize
156KB

Download
memory/1016-207-0x000001C5F8CD0000-0x000001C5F8CF7000-memory.dmp

Filesize
156KB

Download
memory/1016-210-0x00007FFBD6EC0000-0x00007FFBD6ED0000-memory.dmp

Filesize
64KB

Download
memory/1088-224-0x00007FFBD6EC0000-0x00007FFBD6ED0000-memory.dmp

Filesize
64KB

Download
memory/1088-233-0x000001EFE7340000-0x000001EFE7367000-memory.dmp

Filesize
156KB

Download
memory/1088-220-0x000001EFE7340000-0x000001EFE7367000-memory.dmp

Filesize
156KB

Download
memory/1128-230-0x00007FFBD6EC0000-0x00007FFBD6ED0000-memory.dmp

Filesize
64KB

Download
memory/1128-225-0x000001CFEAF60000-0x000001CFEAF87000-memory.dmp

Filesize
156KB

Download
memory/1128-237-0x000001CFEAF60000-0x000001CFEAF87000-memory.dmp

Filesize
156KB

Download
memory/1168-231-0x000001405AC10000-0x000001405AC37000-memory.dmp

Filesize
156KB

Download
memory/1168-235-0x00007FFBD6EC0000-0x00007FFBD6ED0000-memory.dmp

Filesize
64KB

Download
memory/1168-241-0x000001405AC10000-0x000001405AC37000-memory.dmp

Filesize
156KB

Download
memory/1284-236-0x0000026C6C0F0000-0x0000026C6C117000-memory.dmp

Filesize
156KB

Download
memory/1284-240-0x00007FFBD6EC0000-0x00007FFBD6ED0000-memory.dmp

Filesize
64KB

Download
memory/1284-246-0x0000026C6C0F0000-0x0000026C6C117000-memory.dmp

Filesize
156KB

Download
memory/1304-248-0x00007FFBD6EC0000-0x00007FFBD6ED0000-memory.dmp

Filesize
64KB

Download
memory/1304-243-0x000001AF97220000-0x000001AF97247000-memory.dmp

Filesize
156KB

Download
memory/1304-310-0x000001AF97220000-0x000001AF97247000-memory.dmp

Filesize
156KB

Download
memory/1340-249-0x00007FFBD6EC0000-0x00007FFBD6ED0000-memory.dmp

Filesize
64KB

Download
memory/1340-250-0x0000022CB2560000-0x0000022CB2587000-memory.dmp

Filesize
156KB

Download
memory/1340-245-0x0000022CB2560000-0x0000022CB2587000-memory.dmp

Filesize
156KB

Download
memory/1364-424-0x000001DA81DB0000-0x000001DA81DD7000-memory.dmp

Filesize
156KB

Download
memory/1404-251-0x0000023BEF4C0000-0x0000023BEF4E7000-memory.dmp

Filesize
156KB

Download
memory/1460-314-0x0000026600130000-0x0000026600157000-memory.dmp

Filesize
156KB

Download
memory/1484-320-0x000001FAE1B00000-0x000001FAE1B27000-memory.dmp

Filesize
156KB

Download
memory/1528-324-0x000001C19A5D0000-0x000001C19A5F7000-memory.dmp

Filesize
156KB

Download
memory/1588-329-0x0000018933EA0000-0x0000018933EC7000-memory.dmp

Filesize
156KB

Download
memory/1620-335-0x000002339D0C0000-0x000002339D0E7000-memory.dmp

Filesize
156KB

Download
memory/1676-341-0x0000027F42100000-0x0000027F42127000-memory.dmp

Filesize
156KB

Download
memory/1728-346-0x000002448C1A0000-0x000002448C1C7000-memory.dmp

Filesize
156KB

Download
memory/1752-350-0x0000012867A00000-0x0000012867A27000-memory.dmp

Filesize
156KB

Download
memory/1776-355-0x0000021473BD0000-0x0000021473BF7000-memory.dmp

Filesize
156KB

Download
memory/1844-360-0x000001F7C4540000-0x000001F7C4567000-memory.dmp

Filesize
156KB

Download
memory/1912-365-0x0000021AF6C60000-0x0000021AF6C87000-memory.dmp

Filesize
156KB

Download
memory/1984-166-0x0000020B4E4E0000-0x0000020B4E4F0000-memory.dmp

Filesize
64KB

Download
memory/1984-121-0x0000020B682D0000-0x0000020B682F2000-memory.dmp

Filesize
136KB

Download
memory/1984-167-0x0000020B4E4E0000-0x0000020B4E4F0000-memory.dmp

Filesize
64KB

Download
memory/1984-134-0x0000020B4E4E0000-0x0000020B4E4F0000-memory.dmp

Filesize
64KB

Download
memory/1984-133-0x0000020B4E4E0000-0x0000020B4E4F0000-memory.dmp

Filesize
64KB

Download
memory/1984-124-0x0000020B68480000-0x0000020B684F6000-memory.dmp

Filesize
472KB

Download
memory/2016-370-0x00000000015B0000-0x00000000015D7000-memory.dmp

Filesize
156KB

Download
memory/2028-460-0x0000020471D80000-0x0000020471DA7000-memory.dmp

Filesize
156KB

Download
memory/2028-213-0x0000020471DD0000-0x0000020471DE0000-memory.dmp

Filesize
64KB

Download
memory/2028-209-0x0000020471DD0000-0x0000020471DE0000-memory.dmp

Filesize
64KB

Download
memory/2028-503-0x0000020471DD0000-0x0000020471DE0000-memory.dmp

Filesize
64KB

Download
memory/2076-493-0x00000242BFE60000-0x00000242BFE87000-memory.dmp

Filesize
156KB

Download
memory/2280-374-0x0000014985860000-0x0000014985887000-memory.dmp

Filesize
156KB

Download
memory/2344-494-0x000002149D9B0000-0x000002149D9D7000-memory.dmp

Filesize
156KB

Download
memory/2356-379-0x000001F9007E0000-0x000001F900807000-memory.dmp

Filesize
156KB

Download
memory/2384-495-0x000001ABFFB60000-0x000001ABFFB87000-memory.dmp

Filesize
156KB

Download
memory/2400-496-0x00000287147D0000-0x00000287147F7000-memory.dmp

Filesize
156KB

Download
memory/2468-384-0x000002031C150000-0x000002031C177000-memory.dmp

Filesize
156KB

Download
memory/2476-497-0x000001E1B5850000-0x000001E1B5877000-memory.dmp

Filesize
156KB

Download
memory/2484-389-0x000002341E000000-0x000002341E027000-memory.dmp

Filesize
156KB

Download
memory/2492-393-0x000002A4424B0000-0x000002A4424D7000-memory.dmp

Filesize
156KB

Download
memory/2520-172-0x00007FFC16E30000-0x00007FFC1700B000-memory.dmp

Filesize
1.9MB

Download
memory/2520-173-0x00007FFC14970000-0x00007FFC14A1E000-memory.dmp

Filesize
696KB

Download
memory/2520-187-0x00007FF754830000-0x00007FF754859000-memory.dmp

Filesize
164KB

Download
memory/2588-401-0x000002B032210000-0x000002B032237000-memory.dmp

Filesize
156KB

Download
memory/2780-435-0x000001BC817A0000-0x000001BC817C7000-memory.dmp

Filesize
156KB

Download
memory/2820-498-0x0000014C5DA60000-0x0000014C5DA87000-memory.dmp

Filesize
156KB

Download
memory/2932-396-0x000002925E250000-0x000002925E277000-memory.dmp

Filesize
156KB

Download
memory/2940-499-0x000001FBD0490000-0x000001FBD04B7000-memory.dmp

Filesize
156KB

Download
memory/2948-431-0x000001CA2B6B0000-0x000001CA2B6D7000-memory.dmp

Filesize
156KB

Download
memory/3032-502-0x000001FA99D30000-0x000001FA99D57000-memory.dmp

Filesize
156KB

Download
memory/3244-437-0x000002AE84870000-0x000002AE84897000-memory.dmp

Filesize
156KB

Download
memory/3252-406-0x00000000013E0000-0x0000000001407000-memory.dmp

Filesize
156KB

Download
memory/3756-412-0x000002279ECB0000-0x000002279ECD7000-memory.dmp

Filesize
156KB

Download
memory/4036-455-0x0000024A32230000-0x0000024A32257000-memory.dmp

Filesize
156KB

Download
memory/4460-444-0x00000190207F0000-0x0000019020817000-memory.dmp

Filesize
156KB

Download
memory/4528-463-0x0000025DF24C0000-0x0000025DF24E7000-memory.dmp

Filesize
156KB

Download
memory/4648-416-0x000001BCA8B80000-0x000001BCA8BA7000-memory.dmp

Filesize
156KB

Download
memory/4900-420-0x0000021E8F7C0000-0x0000021E8F7E7000-memory.dmp

Filesize
156KB

Download
memory/5028-183-0x00007FF730F90000-0x00007FF731432000-memory.dmp

Filesize
4.6MB

Download
memory/5028-440-0x000001EB50E50000-0x000001EB50E77000-memory.dmp

Filesize
156KB

Download