124a96831880a7f4ec1c70705466b9a48723ca387f7abc12f0d28d28a18edf20

Analysis

max time kernel
51s
max time network
105s
platform
windows10-2004_x64
resource
win10v2004-20230703-es
resource tags

arch:x64arch:x86image:win10v2004-20230703-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
16/07/2023, 15:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

StartAllBack_3.x_Patch.exe
Size

63KB
MD5

07ca9ef8ca62bdfdcb8bd9b966d60bf2
SHA1

54bbb2bfd527ec503e66fe0db1c99a568c0240e8
SHA256

124a96831880a7f4ec1c70705466b9a48723ca387f7abc12f0d28d28a18edf20
SHA512

d0f0b0d5c01c0dcbc8458e509348f7e7969b87bd6261242e3488d9fef61f7e335f1fdcc9eb4bc777045202b6ebb5fa231fc39575f3da81163f82290e20b47e85
SSDEEP

1536:Vg6JzfNCUod2REhHMHwvG9wF2DxzYjVxT:DfIUocEqH9NzYhx

Score

8^/10

persistence

Malware Config

Signatures

Modifies Installed Components in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Loads dropped DLL 1 IoCs

pid	Process
4936	StartAllBack_3.x_Patch.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\Software\Microsoft\Windows\CurrentVersion\Run	chrome.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\StartAllBack\StartAllBackX64.dll	StartAllBack_3.x_Patch.exe

Drops file in Windows directory 21 IoCs

description	ioc	Process
File opened for modification	C:\Windows\INF\vdrvroot.PNF	explorer.exe
File opened for modification	C:\Windows\INF\umbus.PNF	explorer.exe
File opened for modification	C:\Windows\INF\hdaudio.PNF	explorer.exe
File opened for modification	C:\Windows\INF\swenum.PNF	explorer.exe
File opened for modification	C:\Windows\INF\compositebus.PNF	explorer.exe
File opened for modification	C:\Windows\INF\spaceport.PNF	explorer.exe
File opened for modification	C:\Windows\INF\pci.PNF	explorer.exe
File opened for modification	C:\Windows\INF\msmouse.PNF	explorer.exe
File opened for modification	C:\Windows\INF\volume.PNF	explorer.exe
File opened for modification	C:\Windows\INF\mssmbios.PNF	explorer.exe
File opened for modification	C:\Windows\INF\rdpbus.PNF	explorer.exe
File opened for modification	C:\Windows\INF\volmgr.PNF	explorer.exe
File opened for modification	C:\Windows\INF\monitor.PNF	explorer.exe
File opened for modification	C:\Windows\INF\cdrom.PNF	explorer.exe
File opened for modification	C:\Windows\INF\usbport.PNF	explorer.exe
File opened for modification	C:\Windows\INF\vhdmp.PNF	explorer.exe
File opened for modification	C:\Windows\INF\input.PNF	explorer.exe
File opened for modification	C:\Windows\INF\keyboard.PNF	explorer.exe
File opened for modification	C:\Windows\INF\hdaudbus.PNF	explorer.exe
File opened for modification	C:\Windows\INF\mshdc.PNF	explorer.exe
File opened for modification	C:\Windows\INF\acpi.PNF	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 10 IoCs

pid	pid_target	Process	procid_target
4100	3728	WerFault.exe	119
2040	1792	WerFault.exe	126
1580	3596	WerFault.exe	133
1964	3808	WerFault.exe	131
4760	328	WerFault.exe	141
3452	5056	WerFault.exe	139
1704	4084	WerFault.exe	147
1076	3348	WerFault.exe	154
3928	1540	WerFault.exe	152
4288	4844	WerFault.exe	160

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
4088	taskkill.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133339958754048533"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0"	StartAllBack_3.x_Patch.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\MRUListEx = ffffffff	StartAllBack_3.x_Patch.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	StartAllBack_3.x_Patch.exe
Key created	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e80922b16d365937a46956b92703aca08af0000	StartAllBack_3.x_Patch.exe
Key created	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	StartAllBack_3.x_Patch.exe
Key created	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	StartAllBack_3.x_Patch.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16"	StartAllBack_3.x_Patch.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	StartAllBack_3.x_Patch.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1"	StartAllBack_3.x_Patch.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1 = 3a002e803accbfb42cdb4c42b0297fe99a87c641260001002600efbe11000000c8b30e07acadd9019e0bdc0cacadd901ecf88d0eacadd90114000000	StartAllBack_3.x_Patch.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	StartAllBack_3.x_Patch.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	StartAllBack_3.x_Patch.exe
Key created	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	StartAllBack_3.x_Patch.exe
Key created	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	StartAllBack_3.x_Patch.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\NodeSlot = "2"	StartAllBack_3.x_Patch.exe
Key created	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	StartAllBack_3.x_Patch.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	StartAllBack_3.x_Patch.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	StartAllBack_3.x_Patch.exe
Key created	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Local Settings	StartAllBack_3.x_Patch.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents"	StartAllBack_3.x_Patch.exe
Key created	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	StartAllBack_3.x_Patch.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\ApplicationFrame\Microsoft.Windows.PeopleExperienceHos = 6801000088020000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	StartAllBack_3.x_Patch.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4"	StartAllBack_3.x_Patch.exe
Key created	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	StartAllBack_3.x_Patch.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	StartAllBack_3.x_Patch.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	StartAllBack_3.x_Patch.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0"	StartAllBack_3.x_Patch.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Generic"	StartAllBack_3.x_Patch.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	StartAllBack_3.x_Patch.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	StartAllBack_3.x_Patch.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	StartAllBack_3.x_Patch.exe
Key created	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}	StartAllBack_3.x_Patch.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257"	StartAllBack_3.x_Patch.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0100000000000000ffffffff	StartAllBack_3.x_Patch.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	StartAllBack_3.x_Patch.exe
Key created	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	StartAllBack_3.x_Patch.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	StartAllBack_3.x_Patch.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1498570331-2313266200-788959944-1000\{DE7F4BF3-4BC2-48BF-85AF-784A98AC4CFB}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Local Settings	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	StartAllBack_3.x_Patch.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	StartAllBack_3.x_Patch.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	StartAllBack_3.x_Patch.exe
Key created	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	StartAllBack_3.x_Patch.exe
Key created	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	StartAllBack_3.x_Patch.exe
Key created	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	StartAllBack_3.x_Patch.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	StartAllBack_3.x_Patch.exe
Key created	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	StartAllBack_3.x_Patch.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	StartAllBack_3.x_Patch.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	StartAllBack_3.x_Patch.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	StartAllBack_3.x_Patch.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	StartAllBack_3.x_Patch.exe
Key created	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	StartAllBack_3.x_Patch.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1"	StartAllBack_3.x_Patch.exe
Key created	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	StartAllBack_3.x_Patch.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1"	StartAllBack_3.x_Patch.exe
Key created	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1	StartAllBack_3.x_Patch.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2796	chrome.exe
2796	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
2796	chrome.exe
2796	chrome.exe
2796	chrome.exe
2796	chrome.exe

Suspicious use of AdjustPrivilegeToken 57 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2796	chrome.exe
Token: SeCreatePagefilePrivilege	2796	chrome.exe
Token: SeShutdownPrivilege	2796	chrome.exe
Token: SeCreatePagefilePrivilege	2796	chrome.exe
Token: SeShutdownPrivilege	2796	chrome.exe
Token: SeCreatePagefilePrivilege	2796	chrome.exe
Token: SeShutdownPrivilege	2796	chrome.exe
Token: SeCreatePagefilePrivilege	2796	chrome.exe
Token: SeShutdownPrivilege	2796	chrome.exe
Token: SeCreatePagefilePrivilege	2796	chrome.exe
Token: SeShutdownPrivilege	2796	chrome.exe
Token: SeCreatePagefilePrivilege	2796	chrome.exe
Token: SeShutdownPrivilege	2796	chrome.exe
Token: SeCreatePagefilePrivilege	2796	chrome.exe
Token: SeShutdownPrivilege	2796	chrome.exe
Token: SeCreatePagefilePrivilege	2796	chrome.exe
Token: SeShutdownPrivilege	2796	chrome.exe
Token: SeCreatePagefilePrivilege	2796	chrome.exe
Token: SeShutdownPrivilege	2796	chrome.exe
Token: SeCreatePagefilePrivilege	2796	chrome.exe
Token: SeShutdownPrivilege	2796	chrome.exe
Token: SeCreatePagefilePrivilege	2796	chrome.exe
Token: SeShutdownPrivilege	2796	chrome.exe
Token: SeCreatePagefilePrivilege	2796	chrome.exe
Token: SeShutdownPrivilege	2796	chrome.exe
Token: SeCreatePagefilePrivilege	2796	chrome.exe
Token: SeShutdownPrivilege	2796	chrome.exe
Token: SeCreatePagefilePrivilege	2796	chrome.exe
Token: SeShutdownPrivilege	2796	chrome.exe
Token: SeCreatePagefilePrivilege	2796	chrome.exe
Token: SeShutdownPrivilege	2796	chrome.exe
Token: SeCreatePagefilePrivilege	2796	chrome.exe
Token: SeShutdownPrivilege	2796	chrome.exe
Token: SeCreatePagefilePrivilege	2796	chrome.exe
Token: SeShutdownPrivilege	2796	chrome.exe
Token: SeCreatePagefilePrivilege	2796	chrome.exe
Token: SeShutdownPrivilege	2796	chrome.exe
Token: SeCreatePagefilePrivilege	2796	chrome.exe
Token: SeShutdownPrivilege	2796	chrome.exe
Token: SeCreatePagefilePrivilege	2796	chrome.exe
Token: SeShutdownPrivilege	2796	chrome.exe
Token: SeCreatePagefilePrivilege	2796	chrome.exe
Token: SeShutdownPrivilege	2796	chrome.exe
Token: SeCreatePagefilePrivilege	2796	chrome.exe
Token: SeShutdownPrivilege	2796	chrome.exe
Token: SeCreatePagefilePrivilege	2796	chrome.exe
Token: SeDebugPrivilege	4088	taskkill.exe
Token: SeShutdownPrivilege	3728	explorer.exe
Token: SeCreatePagefilePrivilege	3728	explorer.exe
Token: SeShutdownPrivilege	3728	explorer.exe
Token: SeCreatePagefilePrivilege	3728	explorer.exe
Token: SeShutdownPrivilege	3728	explorer.exe
Token: SeCreatePagefilePrivilege	3728	explorer.exe
Token: SeShutdownPrivilege	3728	explorer.exe
Token: SeCreatePagefilePrivilege	3728	explorer.exe
Token: SeShutdownPrivilege	3728	explorer.exe
Token: SeCreatePagefilePrivilege	3728	explorer.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
2796	chrome.exe
2796	chrome.exe
2796	chrome.exe
2796	chrome.exe
2796	chrome.exe
2796	chrome.exe
2796	chrome.exe
2796	chrome.exe
2796	chrome.exe
2796	chrome.exe
2796	chrome.exe
2796	chrome.exe
2796	chrome.exe
2796	chrome.exe
2796	chrome.exe
2796	chrome.exe
2796	chrome.exe
2796	chrome.exe
2796	chrome.exe
2796	chrome.exe
2796	chrome.exe
2796	chrome.exe
2796	chrome.exe
2796	chrome.exe
2796	chrome.exe
2796	chrome.exe
2796	chrome.exe
3728	explorer.exe
3728	explorer.exe
3728	explorer.exe
3728	explorer.exe
3728	explorer.exe
3728	explorer.exe
3728	explorer.exe
3728	explorer.exe

Suspicious use of SendNotifyMessage 34 IoCs

pid	Process
2796	chrome.exe
2796	chrome.exe
2796	chrome.exe
2796	chrome.exe
2796	chrome.exe
2796	chrome.exe
2796	chrome.exe
2796	chrome.exe
2796	chrome.exe
2796	chrome.exe
2796	chrome.exe
2796	chrome.exe
2796	chrome.exe
2796	chrome.exe
2796	chrome.exe
2796	chrome.exe
2796	chrome.exe
2796	chrome.exe
2796	chrome.exe
2796	chrome.exe
2796	chrome.exe
2796	chrome.exe
2796	chrome.exe
2796	chrome.exe
3728	explorer.exe
3728	explorer.exe
3728	explorer.exe
3728	explorer.exe
3728	explorer.exe
3728	explorer.exe
3728	explorer.exe
3728	explorer.exe
3728	explorer.exe
3728	explorer.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4936	StartAllBack_3.x_Patch.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2796 wrote to memory of 3800	2796	chrome.exe	88
PID 2796 wrote to memory of 3800	2796	chrome.exe	88
PID 2796 wrote to memory of 1704	2796	chrome.exe	90
PID 2796 wrote to memory of 1704	2796	chrome.exe	90
PID 2796 wrote to memory of 1704	2796	chrome.exe	90
PID 2796 wrote to memory of 1704	2796	chrome.exe	90
PID 2796 wrote to memory of 1704	2796	chrome.exe	90
PID 2796 wrote to memory of 1704	2796	chrome.exe	90
PID 2796 wrote to memory of 1704	2796	chrome.exe	90
PID 2796 wrote to memory of 1704	2796	chrome.exe	90
PID 2796 wrote to memory of 1704	2796	chrome.exe	90
PID 2796 wrote to memory of 1704	2796	chrome.exe	90
PID 2796 wrote to memory of 1704	2796	chrome.exe	90
PID 2796 wrote to memory of 1704	2796	chrome.exe	90
PID 2796 wrote to memory of 1704	2796	chrome.exe	90
PID 2796 wrote to memory of 1704	2796	chrome.exe	90
PID 2796 wrote to memory of 1704	2796	chrome.exe	90
PID 2796 wrote to memory of 1704	2796	chrome.exe	90
PID 2796 wrote to memory of 1704	2796	chrome.exe	90
PID 2796 wrote to memory of 1704	2796	chrome.exe	90
PID 2796 wrote to memory of 1704	2796	chrome.exe	90
PID 2796 wrote to memory of 1704	2796	chrome.exe	90
PID 2796 wrote to memory of 1704	2796	chrome.exe	90
PID 2796 wrote to memory of 1704	2796	chrome.exe	90
PID 2796 wrote to memory of 1704	2796	chrome.exe	90
PID 2796 wrote to memory of 1704	2796	chrome.exe	90
PID 2796 wrote to memory of 1704	2796	chrome.exe	90
PID 2796 wrote to memory of 1704	2796	chrome.exe	90
PID 2796 wrote to memory of 1704	2796	chrome.exe	90
PID 2796 wrote to memory of 1704	2796	chrome.exe	90
PID 2796 wrote to memory of 1704	2796	chrome.exe	90
PID 2796 wrote to memory of 1704	2796	chrome.exe	90
PID 2796 wrote to memory of 1704	2796	chrome.exe	90
PID 2796 wrote to memory of 1704	2796	chrome.exe	90
PID 2796 wrote to memory of 1704	2796	chrome.exe	90
PID 2796 wrote to memory of 1704	2796	chrome.exe	90
PID 2796 wrote to memory of 1704	2796	chrome.exe	90
PID 2796 wrote to memory of 1704	2796	chrome.exe	90
PID 2796 wrote to memory of 1704	2796	chrome.exe	90
PID 2796 wrote to memory of 1704	2796	chrome.exe	90
PID 2796 wrote to memory of 4428	2796	chrome.exe	91
PID 2796 wrote to memory of 4428	2796	chrome.exe	91
PID 2796 wrote to memory of 328	2796	chrome.exe	92
PID 2796 wrote to memory of 328	2796	chrome.exe	92
PID 2796 wrote to memory of 328	2796	chrome.exe	92
PID 2796 wrote to memory of 328	2796	chrome.exe	92
PID 2796 wrote to memory of 328	2796	chrome.exe	92
PID 2796 wrote to memory of 328	2796	chrome.exe	92
PID 2796 wrote to memory of 328	2796	chrome.exe	92
PID 2796 wrote to memory of 328	2796	chrome.exe	92
PID 2796 wrote to memory of 328	2796	chrome.exe	92
PID 2796 wrote to memory of 328	2796	chrome.exe	92
PID 2796 wrote to memory of 328	2796	chrome.exe	92
PID 2796 wrote to memory of 328	2796	chrome.exe	92
PID 2796 wrote to memory of 328	2796	chrome.exe	92
PID 2796 wrote to memory of 328	2796	chrome.exe	92
PID 2796 wrote to memory of 328	2796	chrome.exe	92
PID 2796 wrote to memory of 328	2796	chrome.exe	92
PID 2796 wrote to memory of 328	2796	chrome.exe	92
PID 2796 wrote to memory of 328	2796	chrome.exe	92
PID 2796 wrote to memory of 328	2796	chrome.exe	92
PID 2796 wrote to memory of 328	2796	chrome.exe	92
PID 2796 wrote to memory of 328	2796	chrome.exe	92
PID 2796 wrote to memory of 328	2796	chrome.exe	92

C:\Users\Admin\AppData\Local\Temp\StartAllBack_3.x_Patch.exe
"C:\Users\Admin\AppData\Local\Temp\StartAllBack_3.x_Patch.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4936
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\kill.cmd"
  2⤵
  PID:3700
- - C:\Windows\system32\taskkill.exe
    TASKKILL /IM explorer.exe /f
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4088
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\start.cmd"
  2⤵
  PID:3704
- - C:\Windows\explorer.exe
    explorer.exe
    3⤵
    - Modifies Installed Components in the registry
    - Enumerates connected drives
    - Drops file in Windows directory
    - Checks SCSI registry key(s)
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:3728
  - - C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 3728 -s 5800
      4⤵
      Program crash
      PID:4100

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Adds Run key to start application
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x11c,0x120,0x124,0xfc,0x128,0x7ff8380a9758,0x7ff8380a9768,0x7ff8380a9778
  2⤵
  PID:3800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1768 --field-trial-handle=1736,i,14792078944574465571,2190138366301090566,131072 /prefetch:2
  2⤵
  PID:1704
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 --field-trial-handle=1736,i,14792078944574465571,2190138366301090566,131072 /prefetch:8
  2⤵
  PID:4428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2256 --field-trial-handle=1736,i,14792078944574465571,2190138366301090566,131072 /prefetch:8
  2⤵
  PID:328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3256 --field-trial-handle=1736,i,14792078944574465571,2190138366301090566,131072 /prefetch:1
  2⤵
  PID:984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3244 --field-trial-handle=1736,i,14792078944574465571,2190138366301090566,131072 /prefetch:1
  2⤵
  PID:3820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4620 --field-trial-handle=1736,i,14792078944574465571,2190138366301090566,131072 /prefetch:8
  2⤵
  PID:2080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4756 --field-trial-handle=1736,i,14792078944574465571,2190138366301090566,131072 /prefetch:1
  2⤵
  PID:1380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4908 --field-trial-handle=1736,i,14792078944574465571,2190138366301090566,131072 /prefetch:8
  2⤵
  PID:1388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5040 --field-trial-handle=1736,i,14792078944574465571,2190138366301090566,131072 /prefetch:8
  2⤵
  PID:1244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5200 --field-trial-handle=1736,i,14792078944574465571,2190138366301090566,131072 /prefetch:8
  2⤵
  PID:3264
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5488 --field-trial-handle=1736,i,14792078944574465571,2190138366301090566,131072 /prefetch:8
  2⤵
  PID:4232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5088 --field-trial-handle=1736,i,14792078944574465571,2190138366301090566,131072 /prefetch:8
  2⤵
  PID:3860
- C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe
  "C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe" --reenable-autoupdates --system-level
  2⤵
  PID:4824
- - C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe
    "C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x264,0x268,0x26c,0x240,0x270,0x7ff7355d7688,0x7ff7355d7698,0x7ff7355d76a8
    3⤵
    PID:2176
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=4992 --field-trial-handle=1736,i,14792078944574465571,2190138366301090566,131072 /prefetch:1
  2⤵
  PID:2168

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:3100

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:960

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 444 -p 3728 -ip 3728
1⤵
PID:3288

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:1792
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1792 -s 6028
  2⤵
  - Program crash
  PID:2040

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:4040

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 184 -p 1792 -ip 1792
1⤵
PID:1716

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:3808
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3808 -s 5980
  2⤵
  - Program crash
  PID:1964

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3788

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3596
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3596 -s 3936
  2⤵
  - Program crash
  PID:1580

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 484 -p 3596 -ip 3596
1⤵
PID:3328

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 412 -p 3808 -ip 3808
1⤵
PID:3152

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:5056
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 5056 -s 7868
  2⤵
  - Program crash
  PID:3452

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3676

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:328
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 328 -s 3680
  2⤵
  - Program crash
  PID:4760

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 416 -p 328 -ip 328
1⤵
PID:2292

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 420 -p 5056 -ip 5056
1⤵
PID:3076

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:4084
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 4084 -s 6248
  2⤵
  - Program crash
  PID:1704

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:2368

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 572 -p 4084 -ip 4084
1⤵
PID:1940

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:1540
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1540 -s 7716
  2⤵
  - Program crash
  PID:3928

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:4088

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3348
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3348 -s 2692
  2⤵
  - Program crash
  PID:1076

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 536 -p 3348 -ip 3348
1⤵
PID:1016

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 560 -p 1540 -ip 1540
1⤵
PID:4984

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:4844
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 4844 -s 6064
  2⤵
  - Program crash
  PID:4288

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:4756

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 448 -p 4844 -ip 4844
1⤵
PID:4812

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:4680

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3624

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
af23cc112ccf941aab8d3a2449eaeada

SHA1
0895b38d36d961a6e6efec9ebed3291368cb70bb

SHA256
a298945adb4afd0912a56f6f2df73f03c0114f5fe1685622e1bc60eab2822818

SHA512
a408b99d27fa90dca21d9818cfae4867c48573ec39375d319b711c3daf6aa8a8f247deb46f8d0c488aeb6862f6518976e9e928a7ce98b7d4708961b8b5598272

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
824817a8dd9016c15e3a57e7550e2481

SHA1
8607b8c4bef8d7a006acf75f1a295339e6eeed81

SHA256
beb6b034f67e3fc7ea7ce0f0aee553e33d3ab2cd5402a29f0f31e7412c67dc2d

SHA512
2b145ccd812e3deb8faac18bbf60d91364554de8f7d10fd5c5fe56e780dae86d119aa9985ef2721cc8e65784e5ac96ca5ff49edb6ce77fbd725f3e731e2391fb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
706B

MD5
71740f1a9b500d0691a162887870d201

SHA1
67436ef9008dd70575bd56dc3a96855938a97ec2

SHA256
1bd1e52d3619d27496c7c5469244b15d1588cf2edb4162363ccca4b0990b47ef

SHA512
c95ab2c6108db3ba2dd5664164b52cef03819c66daf517f5dc7f65a67f512aec13401368ae783fb61b976189b2d569ee3d2a2d8f1c5d4d6c5dc6dd9090698ff7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
b5f04a1e04e2e10e2704e7b669033cad

SHA1
793dec5a55e4bd7efc58ec5534eb8944f00edc44

SHA256
bacebbcf42b69ee780b02eb972c32a068a52adc5926a3d8595c0bad677f171ee

SHA512
6069ac201f2ab4f33543731af33f86f3c5d0d9e48dd3892207e3e0b16bbd0b69d5f4881f4ed396adefa597cfe615f422265c8c33fa4cd38467c93d9b15936358

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
1bab900a2be455cad7d6d043412446cb

SHA1
29576c8315b740ee60bac1bb7cace15d96148d93

SHA256
9d86c4bd62928559315dd33375cc4baf2bf5b190dda0e63bde8d23c022098d68

SHA512
120a19feeff46b5d57cbcc057a69ceed22e189a65f56873bca1ad57932c8127fb4170f843bc6738427fbe46d05a65b968c72a00efe8e5ed274fceac938372c96

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\blob_storage\1f00b3a3-e9d8-43f5-8290-1728b6e814b3\4

Filesize
5.7MB

MD5
b1d5d5d07c96aff979e54b2cbf1b8f58

SHA1
453b1e3943197e46e7f988dd224cb98823b80b1c

SHA256
20f6ee1bf12c392d5decadc2b9dd2787bc10a5ef8f785ba476314d42f59224a7

SHA512
8be03e411bdf12219c4e919fc0976e8dfa0a6c0c9b6e69012efd5b7222a97a5e9398d0a4c42a59ee80cd1ddf409f595971e0b51e877d4f9f832c8ab02730459a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
175KB

MD5
782c1d22af72faeccc02d1e963c8fdd5

SHA1
b5e680630a9fe073830289efa420d009f0ae678c

SHA256
c2271eb6980fa3795af33aad507de47c43507268116245ba138f3c13d1809663

SHA512
ae7e54be1c7b0792c207add8ad79e5d9200724bc5e19b781c3b3af7da72fd93babd2c0e5bf495250b035469e448a3fed49c6fb728916353bf5d2846a635c9ddb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
175KB

MD5
8d8b3e9b7e1a72bef36a74454f75a2ca

SHA1
137da7f82bfb2f5e615d0e2db3caa18d6b153569

SHA256
bced466955f09592cb685dfc9141cdc1f0de6fbee32708d9ce98389405b14a1d

SHA512
0ce01d23bd5e0cf149762313bbb02db82812c447aa4aba1eef19f89e8613caa4d4463f20c76af0336ad9945ecd624a45a5773376d0f4eda4ad490def68cd9afa

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\CAAHQQ1W\microsoft.windows[1].xml

Filesize
96B

MD5
6424805af3b71a828b3134d791979bbd

SHA1
62368d1bd11c73e236dc3888b14b359b7260af6f

SHA256
598e353da6c20a1ed5831bb4f929a414cbaf73d8fefde29ed99819faa35e7595

SHA512
784d9494fd7e5c70f5b4f2e8b2b736ab55b94b7df0be741c003ee79875aa50bc9ce1275cc51ac358e9947cdc17c71d794faab152d2ebe4d357dd8aa9d2114a30

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\CAAHQQ1W\microsoft.windows[1].xml

Filesize
96B

MD5
6424805af3b71a828b3134d791979bbd

SHA1
62368d1bd11c73e236dc3888b14b359b7260af6f

SHA256
598e353da6c20a1ed5831bb4f929a414cbaf73d8fefde29ed99819faa35e7595

SHA512
784d9494fd7e5c70f5b4f2e8b2b736ab55b94b7df0be741c003ee79875aa50bc9ce1275cc51ac358e9947cdc17c71d794faab152d2ebe4d357dd8aa9d2114a30

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\CAAHQQ1W\microsoft.windows[1].xml

Filesize
96B

MD5
6424805af3b71a828b3134d791979bbd

SHA1
62368d1bd11c73e236dc3888b14b359b7260af6f

SHA256
598e353da6c20a1ed5831bb4f929a414cbaf73d8fefde29ed99819faa35e7595

SHA512
784d9494fd7e5c70f5b4f2e8b2b736ab55b94b7df0be741c003ee79875aa50bc9ce1275cc51ac358e9947cdc17c71d794faab152d2ebe4d357dd8aa9d2114a30

Download Submit
C:\Users\Admin\AppData\Local\Temp\dup2patcher.dll

Filesize
57KB

MD5
2fcac0a53e9aaffa146e751f8a1e1ae4

SHA1
cc074e73c8b50cf1973185188ed2c1ca630f01a3

SHA256
62dca27bfcf3cfab9fe834ca78278be7a53d8c1b485c0fa5051a86703fe79059

SHA512
b2cf9577ab0c9d002d52de15dceb9e52e11686649e9ff5d6a9fdc565eb7ee2aa2ae735cf0c8712c1dde895792542d3d0426624cc62b11f885357646e7e5f3ac6

Download Submit
C:\Users\Admin\AppData\Local\Temp\kill.cmd

Filesize
28B

MD5
b8332745bd37b45e7ec3fc8cc04ec422

SHA1
26c9c21faff2c4d747d735d295e5eaee1495b58d

SHA256
f56d48597370f2b4417cab335f95485f065315375f41931fff5d782f3ac103d9

SHA512
9e1ef0e3b1fb29217b1755414ac3e07b5badb7c35059f8b8860b4b5f24c0cf40bc7d1f2dd1d41d3acd9333f5646989d1d1186e155d23c410dba6eb2ef51b18ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\start.cmd

Filesize
18B

MD5
911e338d3e70218de331bf02c38b4dac

SHA1
94c7c351621e4c7910fd90047d83698634519e0b

SHA256
ca3e34e1ecc3df0a2eb47429c1252c24a0fe16cb6805a4eaa698379e0896d999

SHA512
595fcbac0bb95477b539b5c5f7c3055df1dd1c3aac1144d00415f82e91593bdf5d99e7cccb5bed351eeee2da4e372ced61c46b09a4d1124396b65972ebfc1f5d

Download Submit
C:\Windows\INF\acpi.PNF

Filesize
10KB

MD5
02b278e199359f06ab71ba5092a0cde6

SHA1
3cb32076c17718fe61d82934e3affc2661769b53

SHA256
4932b7593fc27fc2836112f184da970635f3a44af041a8c1d6f88b56692d4de5

SHA512
9c1bb0c46462d121c0a510874f22bc41ae246a1b1ff33b82a620aff0637f8617d0b1ffd93c4428b1f7600de79ad47dadc51dfa2badd6733307f6db008e57cac0

Download Submit
C:\Windows\INF\cdrom.PNF

Filesize
11KB

MD5
ec7728e60d8d89a12ff0fdfe66b28d5f

SHA1
fafdb5334f56d988c0417d066e1701e9c776f198

SHA256
96d7bea93b0e238f4c6d172d7cf8578263a1bbda30e7671ea9ba6c3b65c59156

SHA512
47da413917f6e8ea80c033ac55918362fd19c36a6b3bc5566098a69718b9038de771c40e31a0f2e3d23d39a9d925d3421668e5beb8204d1d2982a9b40793c015

Download Submit
C:\Windows\INF\compositebus.PNF

Filesize
7KB

MD5
ba536714b7f997e11795f13ddb331f30

SHA1
e282e0df2fa0197f940267253be95f2ae2ae8aa3

SHA256
6b766f784f99c4bc852dda196757106f3244c9aff0d499094aa00e96e1895009

SHA512
b817e2739b634c16cb43705e9b1a3dce56214bf6dc7e7cc0c78c9a0b30f7089612406cfeb821789b9f0247fc59d9bcf354140b8474630362437e467d2265551f

Download Submit
C:\Windows\INF\hdaudbus.PNF

Filesize
10KB

MD5
49ac33fc42815c2f0f11528b39398636

SHA1
125a33a53fcc97c1a2214321040c4c11189621ec

SHA256
c5153136023a16445697c2772b5a973733859864441c5cac9a2dcca6c067d1dc

SHA512
0ffab5bce09d3b3572f8e92f4043db8a87f4637bc5b3704a189b8aea8036adc5a40f2f4ee20c1a9746df27b929673cbffa031fe3531216d5f3eca0ce96e73301

Download Submit
C:\Windows\INF\hdaudio.PNF

Filesize
102KB

MD5
1870469b560a69efc63fe9a31c10894c

SHA1
1bb9a2e2942ea18c3a581f5122af753e660a2f08

SHA256
c370a34e27fa4753edab578b325ceec426f2a265ab78a1355c7374f9f89691a9

SHA512
40985781c2af7d238e9d9426d3f3ac285ced20c18dcfddb48c5a273ef9842f44bcc88a6fe805f1ef629b0244afa1ef7a7bf136191473ff099fe5767fc1badafa

Download Submit
C:\Windows\INF\input.PNF

Filesize
149KB

MD5
a0e2ef71fc35e52ef90dbdedac1dfa37

SHA1
e55658782f7950ce54a4c30843c1e2be3b738051

SHA256
1eb2e823648fc702def9816e533ade878e8202c09c42d1c75726495f1445b6f0

SHA512
1805841c308ed84b01f615de278d4cc2e27e999ca387e7036a2bd083c16285bed03c2b4a91e715653c87b79ee0d4f74d604bf3aeacca135328cb2e309e935608

Download Submit
C:\Windows\INF\keyboard.PNF

Filesize
117KB

MD5
42cc141a2129f10a47059c4d2b755134

SHA1
442c8054876ddd951283400c36d5707883c64a8b

SHA256
6efecd01e746af1826a9b269485ace62816aea0c74e98bb61e7149fc8a3d4f38

SHA512
6f8836b541d025bde60c4dd3c50f55e67b79f320ee8670857316d6bd3201edea1942ec481717f916f3841a1589f537aa00164d4d601e53fd8e767c92a1db9ed4

Download Submit
C:\Windows\INF\monitor.PNF

Filesize
1.1MB

MD5
48a19199df3e9df41c0b2a89b8e22ab2

SHA1
2115dc8dfeeacab0c51761f18b2d182e579eda45

SHA256
147d35155a8e1a7b3ae8a8716fecfee646c13b9a3dad7e71964e9049e1628425

SHA512
71286c659cb412fd981c67ec82c0e1ba99058e2d8b7b0a26041596f40663d899ea1614b2277f8eb704d4049a4a5a831d016413462bd1b62922300f3aaf071eb2

Download Submit
C:\Windows\INF\mshdc.PNF

Filesize
69KB

MD5
069716e48f5e73b25fe496678d520727

SHA1
bcc25bc8de96c67fdc6d1ad7118fc044904df6a2

SHA256
9b5364b004916d3014f093ca60455154d33137a7c4d06ae97709d25f816d34a9

SHA512
bc731cfca6be67e622f3f9c5e0f919a91d9c144b5a112bf0e6639bd12cdffb772a14f6c086044435b2d14e6fa8603cb2d6dc5d679000080515d99baf5bf0ca0a

Download Submit
C:\Windows\INF\msmouse.PNF

Filesize
94KB

MD5
2a1d472a99d71d59e5318e0e15d3b9a7

SHA1
f09f666da56b90a93ca85abcbe9df9ee8153135e

SHA256
4984a5106368ac9c7910757dc4112bb6c000d12b3eb8ea7964a0db0530244ca3

SHA512
d66fe7cb22cc8cbc02a4989d5fc67a6c6fcdaaed0b71fd39ba8e9ad7a431019eec8cf118c04037e5082fbec622299f55dcb3ae58b4e000077c20b579a3b2f598

Download Submit
C:\Windows\INF\mssmbios.PNF

Filesize
7KB

MD5
85b98b889dd201a7907f4e31f1843da1

SHA1
31010ef862c36b874b68c74a1073b107b3de8b1b

SHA256
c85174a4f9c17b892d088943254b4e48d8fe5281fc3d763007d51267861fcd35

SHA512
e1822c197580c94e14202d9d68770ea53646c0793b24f26be6d8757cec6d4ce5419c1c61e4550afb02ad08d0774e049e5531712f7b21c99a86f408ebfea5c0f2

Download Submit
C:\Windows\INF\pci.PNF

Filesize
21KB

MD5
6eff014213f0cac1baedb076d0d7560b

SHA1
0d518c6a4772dd5b9e3cc019ff27e7282eda2f46

SHA256
9199fe2c251fb49b741a92752dc0edd3fe3fe7630d61e6b1b8cb6250ebf417b5

SHA512
eb032448d1e5d6fce504e303d354d30a4f211c036e2e458aa975753bdfef65800c64d2cf126b5b4f333cabbb708bdf13679f9c9ce9801404e4e1729ab9e83d36

Download Submit
C:\Windows\INF\rdpbus.PNF

Filesize
7KB

MD5
3120850965953f64e19886d7b7e62e56

SHA1
9d449c0831b615b39b9dfc4869d80116b6d267a3

SHA256
1660f1985e9ac5a328387030537979268410f864b2562d28894fa4c949df2bf4

SHA512
1021074f48d14cd9bfa5add3c366d15053db8cceac4c7a531b1aae45ee3c7537cfa479f500007fed551fe7d31440f7835536af5b49089e9ab3da35960de8a35a

Download Submit
C:\Windows\INF\spaceport.PNF

Filesize
7KB

MD5
9c398859b94992fa7b64673d7769f4ba

SHA1
b7e1093e57814a937b42c1fff7b104316157b490

SHA256
dfbd78c0457f16f1340279ec45409e7cff4f07d55dec8150412293fdf82cdd4e

SHA512
d18d00c203b2d981d91cb5252964404ba2d44244f77bad49411168f3c0f74b734e1ed54fd84e1f10f3b0833521e22972a148b8c4d8743127772789e413c07565

Download Submit
C:\Windows\INF\swenum.PNF

Filesize
7KB

MD5
721cfec05da4719bcd627cb160e053d0

SHA1
f93ddc9b6f5887d2d4dcb1b50007ec62a8b658d2

SHA256
d5687fc33025879c8b06c75a3259b75a2a869f2a12a247e680ccfdf2368cd680

SHA512
fc9836bb365317e85a901ca2013d9485b2d47bc57852381653aa13d6d332a61a3efd0637af0180d87bd1cde0fc00825420bf659b5ad54e60525b5dd77a92502f

Download Submit
C:\Windows\INF\umbus.PNF

Filesize
9KB

MD5
745b94154b48f0b0d927f9dd4ae44f53

SHA1
9face6801033e1f49f546b03469a6814151a5310

SHA256
ccb713faaf2049baca0cae9958304488f8cf55fbfa1ccfe5946ae1fd8ab92e0e

SHA512
dd72a6d1c8a3ccdc0253dd161caf302a40daa25b8e83d94cd20c39c5b25614fe4670cdb954dd26e27c0392f49b0cc03569c3c50d91bae4f40e0b2ed5aa38e9ab

Download Submit
C:\Windows\INF\usbport.PNF

Filesize
153KB

MD5
a6c7ee90ec86516bc91fb255ae0023ce

SHA1
d68b85622926faf4e9b3f48ae185d1e909e15b72

SHA256
5ec936c87268626c058871d161ddc1988f92df93ea5e5d235e4573fef0c73a1f

SHA512
e0d65a0d9e4e3820fe5cdf1e3ccb9cbdb6152c3a25be04c740e8c1b26dbad60d4d1f1c92680498389ff08a77383da9f09fa32f73296243e591165e876f68fb25

Download Submit
C:\Windows\INF\vdrvroot.PNF

Filesize
8KB

MD5
5865b6746218be86895801cba46b86ff

SHA1
92019e7a192fb514a56f4391842b494b298ed686

SHA256
517d41714174e122990ee48d894ad4ec7ad7fb4f1cd540efc5686d338584be27

SHA512
1ca585c623b5d049317c814bc1000c4478467b567345162eca78ad84db3a7b786682c99cd0f3ef2676e5d7fe218c4436d4c471dcad3a675ba6eae3a20557a2ab

Download Submit
C:\Windows\INF\vhdmp.PNF

Filesize
7KB

MD5
1cc1ad5d720485ab2b6289855187a699

SHA1
9f364204349e2d0f5ccb8645e41dda49eba59e4e

SHA256
3369bee05aa9c3f0f3bce7f9780be8650b4e251abe63dbbd02da05c807e331ea

SHA512
e9a24a5f8df37def565d5be82261c2713130b07adb492eff651f2e6d74c5a058b298207f1db48099f774ce5b1bbcd260c5497040d4b8f0b94abf22c158f1fc9c

Download Submit
C:\Windows\INF\volmgr.PNF

Filesize
8KB

MD5
74a95ad5d04a085891a337f326e404f1

SHA1
1fb84daa373970c50c6022c4e621add65d868180

SHA256
a80d5b36c41de83494939402efcaac89937c2643e7140e43deb51c72d645a808

SHA512
c45f8b5cd3b6ef3de3e5a2a4c2ca50a566cc591d6cba0fdf93b577c5e5405d74138a3c4ed72fe4c2e3bbe09b0d9509f7be09e1599d1c31fd9c482d769dfdd076

Download Submit
C:\Windows\INF\volume.PNF

Filesize
5KB

MD5
c91e051f3655cf81071195307aca670a

SHA1
fc80e6bcc8f8fa3d9299d6d09a41f5c36bfb011c

SHA256
2a1adeaa987722dd076d91f6696ec62f5c0f882cc8650c5286a6d65cd5ad2777

SHA512
6f189cccd2dad77d5261e4b2807578ebd4cdcb12860e3a27697fb5ad5f27fb5aa48c45a4c3808349eb1db7a490bd7d0dd63abee4afac04eeffa5f4325baf2f8f

Download Submit
memory/328-414-0x00000291A7D80000-0x00000291A7DA0000-memory.dmp

Filesize
128KB

Download
memory/328-412-0x00000291A7970000-0x00000291A7990000-memory.dmp

Filesize
128KB

Download
memory/328-410-0x00000291A79B0000-0x00000291A79D0000-memory.dmp

Filesize
128KB

Download
memory/1540-427-0x00000000040D0000-0x00000000040D1000-memory.dmp

Filesize
4KB

Download
memory/3348-435-0x000002898D8C0000-0x000002898D8E0000-memory.dmp

Filesize
128KB

Download
memory/3348-438-0x000002898D880000-0x000002898D8A0000-memory.dmp

Filesize
128KB

Download
memory/3348-441-0x000002898DEA0000-0x000002898DEC0000-memory.dmp

Filesize
128KB

Download
memory/3596-393-0x0000026AF0640000-0x0000026AF0660000-memory.dmp

Filesize
128KB

Download
memory/3596-391-0x0000026AF0230000-0x0000026AF0250000-memory.dmp

Filesize
128KB

Download
memory/3596-387-0x0000026AF0270000-0x0000026AF0290000-memory.dmp

Filesize
128KB

Download
memory/3808-380-0x0000000004CC0000-0x0000000004CC1000-memory.dmp

Filesize
4KB

Download
memory/4936-135-0x0000000075C20000-0x0000000075C47000-memory.dmp

Filesize
156KB

Download
memory/4936-425-0x0000000075C20000-0x0000000075C47000-memory.dmp

Filesize
156KB

Download
memory/5056-402-0x00000000046A0000-0x00000000046A1000-memory.dmp

Filesize
4KB

Download