839042d0944390e6b5164e705398b73b3337392cc7a94f92ca773bddc3b69f04

Analysis

max time kernel
645s
max time network
650s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
05-03-2024 16:55

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

sample.html
Size

15KB
MD5

afbbe269b354deb00088ad215842b358
SHA1

da491423e2cb0d700c88adf439d1c02ac41722b0
SHA256

839042d0944390e6b5164e705398b73b3337392cc7a94f92ca773bddc3b69f04
SHA512

1c2285c0b8e97f627f01df623e29756fca0fd3836bbdc5f35cdf053eeb687e7eb49ec52b293b79657b7a8f42945d8ec35da10c10bffce005b411365b8a866970
SSDEEP

192:PNx5Ssv99qXoqTJkNr423eSRRVv9ohKK1PZINIIoV7C+UGjM4oyjN:5Ssl9qYoJkN0xqlNSIoV7C+VLN

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 17 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133541313720013134"	chrome.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "124"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe

Modifies registry class 60 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	notepad.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	notepad.exe
Key created	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1"	notepad.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	notepad.exe
Key created	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	notepad.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\MRUListEx = ffffffff	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	notepad.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	notepad.exe
Key created	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	notepad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257"	notepad.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1 = 14002e8005398e082303024b98265d99428e115f0000	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\NodeSlot = "2"	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4"	notepad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	notepad.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	notepad.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	notepad.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	notepad.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	notepad.exe
Key created	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	notepad.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	notepad.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e80922b16d365937a46956b92703aca08af0000	notepad.exe
Key created	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	notepad.exe
Key created	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1	notepad.exe
Key created	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\Local Settings	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	notepad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Downloads"	notepad.exe
Key created	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616257"	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1"	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Version = "1"	notepad.exe
Key created	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	notepad.exe
Key created	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	notepad.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0000000001000000ffffffff	notepad.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	notepad.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0"	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4"	notepad.exe
Key created	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	notepad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\KnownFolderDerivedFolderType = "{885A186E-A440-4ADA-812B-DB871B942259}"	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1"	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16"	notepad.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	notepad.exe
Key created	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	notepad.exe
Key created	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	notepad.exe
Key created	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1"	notepad.exe
Key created	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295"	notepad.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	notepad.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	notepad.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0000000001000000ffffffff	notepad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents"	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0"	notepad.exe
Key created	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	notepad.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0100000000000000ffffffff	notepad.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	notepad.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3964	chrome.exe
3964	chrome.exe
4428	msedge.exe
4428	msedge.exe
2164	msedge.exe
2164	msedge.exe
2140	identity_helper.exe
2140	identity_helper.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
568	notepad.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3964	chrome.exe
3964	chrome.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3964	chrome.exe
Token: SeCreatePagefilePrivilege	3964	chrome.exe
Token: SeShutdownPrivilege	3964	chrome.exe
Token: SeCreatePagefilePrivilege	3964	chrome.exe
Token: SeShutdownPrivilege	3964	chrome.exe
Token: SeCreatePagefilePrivilege	3964	chrome.exe
Token: SeShutdownPrivilege	3964	chrome.exe
Token: SeCreatePagefilePrivilege	3964	chrome.exe
Token: SeShutdownPrivilege	3964	chrome.exe
Token: SeCreatePagefilePrivilege	3964	chrome.exe
Token: SeShutdownPrivilege	3964	chrome.exe
Token: SeCreatePagefilePrivilege	3964	chrome.exe
Token: SeShutdownPrivilege	3964	chrome.exe
Token: SeCreatePagefilePrivilege	3964	chrome.exe
Token: SeShutdownPrivilege	3964	chrome.exe
Token: SeCreatePagefilePrivilege	3964	chrome.exe
Token: SeShutdownPrivilege	3964	chrome.exe
Token: SeCreatePagefilePrivilege	3964	chrome.exe
Token: SeShutdownPrivilege	3964	chrome.exe
Token: SeCreatePagefilePrivilege	3964	chrome.exe
Token: SeShutdownPrivilege	3964	chrome.exe
Token: SeCreatePagefilePrivilege	3964	chrome.exe
Token: SeShutdownPrivilege	3964	chrome.exe
Token: SeCreatePagefilePrivilege	3964	chrome.exe
Token: SeShutdownPrivilege	3964	chrome.exe
Token: SeCreatePagefilePrivilege	3964	chrome.exe
Token: SeShutdownPrivilege	3964	chrome.exe
Token: SeCreatePagefilePrivilege	3964	chrome.exe
Token: SeShutdownPrivilege	3964	chrome.exe
Token: SeCreatePagefilePrivilege	3964	chrome.exe
Token: SeShutdownPrivilege	3964	chrome.exe
Token: SeCreatePagefilePrivilege	3964	chrome.exe
Token: SeShutdownPrivilege	3964	chrome.exe
Token: SeCreatePagefilePrivilege	3964	chrome.exe
Token: SeShutdownPrivilege	3964	chrome.exe
Token: SeCreatePagefilePrivilege	3964	chrome.exe
Token: SeShutdownPrivilege	3964	chrome.exe
Token: SeCreatePagefilePrivilege	3964	chrome.exe
Token: SeShutdownPrivilege	3964	chrome.exe
Token: SeCreatePagefilePrivilege	3964	chrome.exe
Token: SeShutdownPrivilege	3964	chrome.exe
Token: SeCreatePagefilePrivilege	3964	chrome.exe
Token: SeShutdownPrivilege	3964	chrome.exe
Token: SeCreatePagefilePrivilege	3964	chrome.exe
Token: SeShutdownPrivilege	3964	chrome.exe
Token: SeCreatePagefilePrivilege	3964	chrome.exe
Token: SeShutdownPrivilege	3964	chrome.exe
Token: SeCreatePagefilePrivilege	3964	chrome.exe
Token: SeShutdownPrivilege	3964	chrome.exe
Token: SeCreatePagefilePrivilege	3964	chrome.exe
Token: SeShutdownPrivilege	3964	chrome.exe
Token: SeCreatePagefilePrivilege	3964	chrome.exe
Token: SeShutdownPrivilege	3964	chrome.exe
Token: SeCreatePagefilePrivilege	3964	chrome.exe
Token: SeShutdownPrivilege	3964	chrome.exe
Token: SeCreatePagefilePrivilege	3964	chrome.exe
Token: SeShutdownPrivilege	3964	chrome.exe
Token: SeCreatePagefilePrivilege	3964	chrome.exe
Token: SeShutdownPrivilege	3964	chrome.exe
Token: SeCreatePagefilePrivilege	3964	chrome.exe
Token: SeShutdownPrivilege	3964	chrome.exe
Token: SeCreatePagefilePrivilege	3964	chrome.exe
Token: SeShutdownPrivilege	3964	chrome.exe
Token: SeCreatePagefilePrivilege	3964	chrome.exe

Suspicious use of FindShellTrayWindow 53 IoCs

pid	Process
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe

Suspicious use of SendNotifyMessage 48 IoCs

pid	Process
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
3964	chrome.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
568	notepad.exe
568	notepad.exe
568	notepad.exe
568	notepad.exe
568	notepad.exe
416	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3964 wrote to memory of 4944	3964	chrome.exe	88
PID 3964 wrote to memory of 4944	3964	chrome.exe	88
PID 3964 wrote to memory of 212	3964	chrome.exe	90
PID 3964 wrote to memory of 212	3964	chrome.exe	90
PID 3964 wrote to memory of 212	3964	chrome.exe	90
PID 3964 wrote to memory of 212	3964	chrome.exe	90
PID 3964 wrote to memory of 212	3964	chrome.exe	90
PID 3964 wrote to memory of 212	3964	chrome.exe	90
PID 3964 wrote to memory of 212	3964	chrome.exe	90
PID 3964 wrote to memory of 212	3964	chrome.exe	90
PID 3964 wrote to memory of 212	3964	chrome.exe	90
PID 3964 wrote to memory of 212	3964	chrome.exe	90
PID 3964 wrote to memory of 212	3964	chrome.exe	90
PID 3964 wrote to memory of 212	3964	chrome.exe	90
PID 3964 wrote to memory of 212	3964	chrome.exe	90
PID 3964 wrote to memory of 212	3964	chrome.exe	90
PID 3964 wrote to memory of 212	3964	chrome.exe	90
PID 3964 wrote to memory of 212	3964	chrome.exe	90
PID 3964 wrote to memory of 212	3964	chrome.exe	90
PID 3964 wrote to memory of 212	3964	chrome.exe	90
PID 3964 wrote to memory of 212	3964	chrome.exe	90
PID 3964 wrote to memory of 212	3964	chrome.exe	90
PID 3964 wrote to memory of 212	3964	chrome.exe	90
PID 3964 wrote to memory of 212	3964	chrome.exe	90
PID 3964 wrote to memory of 212	3964	chrome.exe	90
PID 3964 wrote to memory of 212	3964	chrome.exe	90
PID 3964 wrote to memory of 212	3964	chrome.exe	90
PID 3964 wrote to memory of 212	3964	chrome.exe	90
PID 3964 wrote to memory of 212	3964	chrome.exe	90
PID 3964 wrote to memory of 212	3964	chrome.exe	90
PID 3964 wrote to memory of 212	3964	chrome.exe	90
PID 3964 wrote to memory of 212	3964	chrome.exe	90
PID 3964 wrote to memory of 212	3964	chrome.exe	90
PID 3964 wrote to memory of 212	3964	chrome.exe	90
PID 3964 wrote to memory of 212	3964	chrome.exe	90
PID 3964 wrote to memory of 212	3964	chrome.exe	90
PID 3964 wrote to memory of 212	3964	chrome.exe	90
PID 3964 wrote to memory of 212	3964	chrome.exe	90
PID 3964 wrote to memory of 212	3964	chrome.exe	90
PID 3964 wrote to memory of 212	3964	chrome.exe	90
PID 3964 wrote to memory of 1696	3964	chrome.exe	91
PID 3964 wrote to memory of 1696	3964	chrome.exe	91
PID 3964 wrote to memory of 1968	3964	chrome.exe	92
PID 3964 wrote to memory of 1968	3964	chrome.exe	92
PID 3964 wrote to memory of 1968	3964	chrome.exe	92
PID 3964 wrote to memory of 1968	3964	chrome.exe	92
PID 3964 wrote to memory of 1968	3964	chrome.exe	92
PID 3964 wrote to memory of 1968	3964	chrome.exe	92
PID 3964 wrote to memory of 1968	3964	chrome.exe	92
PID 3964 wrote to memory of 1968	3964	chrome.exe	92
PID 3964 wrote to memory of 1968	3964	chrome.exe	92
PID 3964 wrote to memory of 1968	3964	chrome.exe	92
PID 3964 wrote to memory of 1968	3964	chrome.exe	92
PID 3964 wrote to memory of 1968	3964	chrome.exe	92
PID 3964 wrote to memory of 1968	3964	chrome.exe	92
PID 3964 wrote to memory of 1968	3964	chrome.exe	92
PID 3964 wrote to memory of 1968	3964	chrome.exe	92
PID 3964 wrote to memory of 1968	3964	chrome.exe	92
PID 3964 wrote to memory of 1968	3964	chrome.exe	92
PID 3964 wrote to memory of 1968	3964	chrome.exe	92
PID 3964 wrote to memory of 1968	3964	chrome.exe	92
PID 3964 wrote to memory of 1968	3964	chrome.exe	92
PID 3964 wrote to memory of 1968	3964	chrome.exe	92
PID 3964 wrote to memory of 1968	3964	chrome.exe	92

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffeba2e9758,0x7ffeba2e9768,0x7ffeba2e9778
  2⤵
  PID:4944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1724 --field-trial-handle=1900,i,12026350252410212532,10774163742757000738,131072 /prefetch:2
  2⤵
  PID:212
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 --field-trial-handle=1900,i,12026350252410212532,10774163742757000738,131072 /prefetch:8
  2⤵
  PID:1696
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2236 --field-trial-handle=1900,i,12026350252410212532,10774163742757000738,131072 /prefetch:8
  2⤵
  PID:1968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3024 --field-trial-handle=1900,i,12026350252410212532,10774163742757000738,131072 /prefetch:1
  2⤵
  PID:1208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3032 --field-trial-handle=1900,i,12026350252410212532,10774163742757000738,131072 /prefetch:1
  2⤵
  PID:3752
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4792 --field-trial-handle=1900,i,12026350252410212532,10774163742757000738,131072 /prefetch:8
  2⤵
  PID:4620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4880 --field-trial-handle=1900,i,12026350252410212532,10774163742757000738,131072 /prefetch:8
  2⤵
  PID:964

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:3432

C:\Windows\system32\notepad.exe
"C:\Windows\system32\notepad.exe"
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:568

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4628

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffea9bd46f8,0x7ffea9bd4708,0x7ffea9bd4718
  2⤵
  PID:3240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,17487714222854787526,13036320823609433653,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
  2⤵
  PID:3520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,17487714222854787526,13036320823609433653,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,17487714222854787526,13036320823609433653,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2852 /prefetch:8
  2⤵
  PID:3152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,17487714222854787526,13036320823609433653,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:1
  2⤵
  PID:2140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,17487714222854787526,13036320823609433653,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3408 /prefetch:1
  2⤵
  PID:3432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,17487714222854787526,13036320823609433653,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4684 /prefetch:1
  2⤵
  PID:2204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,17487714222854787526,13036320823609433653,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4640 /prefetch:1
  2⤵
  PID:184
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,17487714222854787526,13036320823609433653,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5500 /prefetch:8
  2⤵
  PID:2988
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,17487714222854787526,13036320823609433653,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5500 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2140

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2524

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4724

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
1⤵
PID:576

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
PID:2580

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\tiktok.bat" "
1⤵
PID:504
- C:\Windows\system32\shutdown.exe
  shutdown.exe -s -t 05
  2⤵
  PID:4632

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa38b4055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:416

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Comms\UnistoreDB\USS.jcp

Filesize
8KB

MD5
bdd5bc7ae8e3deff644893a2e06ed15a

SHA1
05a335c5643dd1882e53af2b21fd0ee91cc4c99d

SHA256
87e69c9ba08bc57472dc29e91a906e5515767fb74e8d9f4fbd0286837df652f5

SHA512
1291026ba39887db4d6af2fbab09309b953e611bb852a5132c5df55f5dfc9b74d253278b05e4e4419c2ec69560342334ebdfc0bae97dad27ac237e0c8cc14cad

Download Submit
C:\Users\Admin\AppData\Local\Comms\UnistoreDB\store.jfm

Filesize
16KB

MD5
850b05c0435b115b387c205011c693d6

SHA1
fe320250502ef27b70ef1dcec6ad09f7bd2c7262

SHA256
22b7b3f904c4e56c7fa0fdbcdc32c8016435097b188e3cb2b0245bddfaa1e527

SHA512
607da9dff3a5ee60a5efe70c45271703c9f335f2311324cdba8ed22f2c03255679ba2e1fc3366e613ef3e671e988888e28cfaacdff9bbf7468b35f80bb9d04d4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
68eca8491b686d14c210654b52de822c

SHA1
d67113feffaa3c3c0e7d1c5fb0773c44e138650a

SHA256
c5b5d407926d3aa0b4768ed65f28028935aa0ed0bb75777155fd4ba9ff7f0764

SHA512
ad34d5c06edc039d5259f842dcc8dab2a26ea9e0970ea4793efac5fd5334758b2b1bb860a6a0fb6b0e7f20ff47429ea9b85dbfa894134ea6dddce7714ac8cb0e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
4b08c36a37bac133c8bed3d646f1d02b

SHA1
ad27d3afbda6ce663528d781d80d937c44d6b357

SHA256
c4ff2db091fbeada7db1dd0ecc1a2762fc003f85f6add30455b35b452a41ba2e

SHA512
4caacdd5bc07d3542db86ebd3938eefe371f4bb908db8c4dbe12f4ef270dc98f43a35ce9068d854cd86fc6f5c360b72204ddf7d2c0fa91da9ab5bfae2ee515e7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
d83624efbcd0c0ebeaf65e9eb87f8435

SHA1
6c438f35c159c6688ae4da4bbf44c349d15fc054

SHA256
c274ed2afe636d0df16cbff7a0751a78e4340253f9898685aa369996b2fd0ecc

SHA512
f98b2cc56230c727a6060dddbdc61d85140bf9dfa89c11dd7734e1a723b0473027e6dcc546904e471e868482c7f2822f3a2a8d390482b0b631308991dc5d3953

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
45a52b30a07459610da14b8cb9903b58

SHA1
5dd883f50acae637d11b9f4fd2416dcb1809646d

SHA256
0ad3d8b247dceeaa1f9d5592601a2665db622ffdeee2609e5324c90dd972ecd9

SHA512
ab3df241f8f62b1e51f3016e06d73caa298c95c901ed29677379baefa968c654903f379e9fc75136fe64062e5c76ca628e2b691cb324280cb8e49bf016ef8d75

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
128KB

MD5
71d5f54f608bb0a3ce2aa6e8f07f796a

SHA1
e52eb7c0fbb3edecc4abca0f82d01ada4bd21451

SHA256
80f9aac74022b491925d85b867101c5a5f8eadb0d749067091ebcb3dc8f81c18

SHA512
e05113d4e801e451f0581c8eeb78fc8f443c2a3cbffade841e16465a11da0664d1e2998dc186418933b1d9edb5fa2cb246c5fb2836e143ac3c7388f8abc581f9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
128KB

MD5
e74f90514528b50944174ae5648061a3

SHA1
231110f591f6716146902d99ef008ae0ce193257

SHA256
db725aacd2dc42be69ecdfc7e97e88b2f8783ebfbddf058facdb2b431cf92a17

SHA512
b8f36a503962a0df4cf9d614099a2874efa22216ee00d4cc8f5dfa66f839b706e5f9a98e90e591fb9882abf5c821fd64c4e9c20e2c179b9ec24d1fdc67b8c75e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1

Filesize
264KB

MD5
1b852ac0006d297b134ee2de039457ff

SHA1
6da606cab4198b95c6f320c6fc0a781fc9e0e473

SHA256
a390f13ae2245ab8640442f31a4d722248b6a71468ea32f7308497dd1c26926f

SHA512
9eebd9b17bd66b8b0a8b88e93b462e4d0c8856cbbdc42b5bb28fe54ace469dd65cdfe4e42bc346e7dada634a26f0f49397b060a78cce6c301659c616e2fbd575

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a774512b00820b61a51258335097b2c9

SHA1
38c28d1ea3907a1af6c0443255ab610dd9285095

SHA256
01946a2d65e59b66ebc256470ff4861f32edee90a44e31bf67529add95cafef4

SHA512
ce109be65060a5e7a872707c6c2ccce3aacd577e59c59d6e23e78d03e3d502f2707713fda40a546ed332e41a56ef90297af99590a5ab02f686a58bcbf3a82da1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fd7944a4ff1be37517983ffaf5700b11

SHA1
c4287796d78e00969af85b7e16a2d04230961240

SHA256
b54b41e7ce5600bc653aa7c88abb666976872b2d5e2d657bfc1147a0b49e9d74

SHA512
28c58a2ccf39963a8d9f67ea5b93dbccf70b0109b2c8a396a58389cdec9db1205523a95730485bcbc9d533867cbf0e7167ad370fd45740e23656d01d96ee543b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1984aba65a710aee2556c44239e397df

SHA1
1f87ec28bb159392979d87a72265612d0f58833c

SHA256
b451496689af1dedb70dd01775161d17a128a6776d46fa0ee24b8abed604cd2b

SHA512
9869eb655324be17df0eea40d3d907d9fcb899515f0e138125a6effc1e30ca5db202da4c67f50b44d48df72ee631f5248b3e1584ddf663778e23ebca55a1eb15

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7a84eea086d8f45ee7b8db4816404355

SHA1
968893b11ba8c36b25087a0de43a632a290c7a4c

SHA256
b2d65346e1bbabc96fdb88c557288e7da2da8d7b16885de7eec086e22e2a542a

SHA512
c076c9647a35dbffc48d86cabe148f77536eec7236936d1d5f8b391b40a27362ccbcf5593ee222cae1ef2332409bce8b784ab0677a1efa702e227946c5b54fa1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7ae8581d727e6050dc4e4a4d226f736f

SHA1
f70bf4f3b7aacfaf06fadd2d8da4818c681128bb

SHA256
56427024cf3d256a5f189d0fc73021b4bb47b2b99510fbf3696dbda2ab4ce045

SHA512
f66aa71772c8545195f3888ba9edddf36d4fe5ccc3ba176aa1a6e940bbf63f31f21c1f4662d2ca62dc187d1e0a6b359caae3dd51eef6eb6a240113efca9ffea5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
801ce406f9dbb18b9be3066eafbc47bb

SHA1
ff785f8121ae772a75e5135f3d7d28ea8c7677f7

SHA256
36e93e51b5f7aab8be50d925db5d2b5a49d17833293175dbbf1f52f2ec7d01ac

SHA512
db7403af48bec62e1816bceda4589fbd361f02264b81e2fb24f4c9ac33bd770f6ddcf052f2dffb4ad79ad99ef517775a33bcaed2593f8e884f5663dce1063df4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
f1e695b2b26e6436b56d220d393d4627

SHA1
a93790cb37c0c30e06e20ea64bac83da6e1de3da

SHA256
d03367d3b062e7bc912226826777e8ba7544f733c850a7efa914c6faeda2fa1d

SHA512
2fdc7c317401e237d44d3029435372231bb44d4713153e1bf4d57b07d1e0004e6d7e80839ccdbb83901d4ba049752ae382598262fc60e741032e5579e156a4c2

Download Submit
C:\Users\Admin\Downloads\test.exe

Filesize
11B

MD5
08db5d8a765a8a7ca1967a08682aa9eb

SHA1
4808389c5b09ba897eae3e974010781134a3743c

SHA256
ce7a2e7648c392a244cf70fa7b13da29415ca1f3554b5ed5d211e3f0b69a09fa

SHA512
3a92ca2000e19641763323c1fb78b640091d0c557061ad635fb5b6875e9314ca8fb996ad11cecc4eb428d7bcadd4646ab4e787b2f464e79511fe6c163777244e

Download Submit
C:\Users\Admin\Downloads\tiktok.bat

Filesize
21B

MD5
4fa70f3f8225e29773147571a3678b96

SHA1
e58a621e518ad0d3bf9824c60b92513386214976

SHA256
9099a7f5a94509300521aaa459fdb746d8980ca9be184c6c97779d3b4b3086e8

SHA512
c6f6c0059c7f831d3f9e59d40770e4ccaeb22220e9aae098ae070c1edb15c8a0b2318bdd796a57c9499e1c16246c38a1f0f188318d91ae5694fcff467c5c47fd

Download Submit
memory/568-148-0x0000025CB3370000-0x0000025CB3380000-memory.dmp

Filesize
64KB

Download
memory/568-127-0x0000025CB3370000-0x0000025CB3380000-memory.dmp

Filesize
64KB

Download
memory/568-135-0x0000025CB3370000-0x0000025CB3380000-memory.dmp

Filesize
64KB

Download
memory/568-136-0x0000025CB2E10000-0x0000025CB2E20000-memory.dmp

Filesize
64KB

Download
memory/568-137-0x0000025CB3370000-0x0000025CB3380000-memory.dmp

Filesize
64KB

Download
memory/568-139-0x0000025CB3370000-0x0000025CB3380000-memory.dmp

Filesize
64KB

Download
memory/568-141-0x0000025CB3370000-0x0000025CB3380000-memory.dmp

Filesize
64KB

Download
memory/568-142-0x0000025CB3370000-0x0000025CB3380000-memory.dmp

Filesize
64KB

Download
memory/568-143-0x0000025CB3370000-0x0000025CB3380000-memory.dmp

Filesize
64KB

Download
memory/568-144-0x0000025CB3380000-0x0000025CB3390000-memory.dmp

Filesize
64KB

Download
memory/568-145-0x0000025CB3370000-0x0000025CB3380000-memory.dmp

Filesize
64KB

Download
memory/568-146-0x0000025CB2E10000-0x0000025CB2E20000-memory.dmp

Filesize
64KB

Download
memory/568-147-0x0000025CB3370000-0x0000025CB3380000-memory.dmp

Filesize
64KB

Download
memory/568-133-0x0000025CB2E10000-0x0000025CB2E20000-memory.dmp

Filesize
64KB

Download
memory/568-149-0x0000025CB3370000-0x0000025CB3380000-memory.dmp

Filesize
64KB

Download
memory/568-151-0x0000025CB3370000-0x0000025CB3380000-memory.dmp

Filesize
64KB

Download
memory/568-150-0x0000025CB3370000-0x0000025CB3380000-memory.dmp

Filesize
64KB

Download
memory/568-153-0x0000025CB3370000-0x0000025CB3380000-memory.dmp

Filesize
64KB

Download
memory/568-154-0x0000025CB3370000-0x0000025CB3380000-memory.dmp

Filesize
64KB

Download
memory/568-132-0x0000025CB3370000-0x0000025CB3380000-memory.dmp

Filesize
64KB

Download
memory/568-131-0x0000025CB3370000-0x0000025CB3380000-memory.dmp

Filesize
64KB

Download
memory/568-130-0x0000025CB3370000-0x0000025CB3380000-memory.dmp

Filesize
64KB

Download
memory/568-129-0x0000025CB3370000-0x0000025CB3380000-memory.dmp

Filesize
64KB

Download
memory/568-134-0x0000025CB3370000-0x0000025CB3380000-memory.dmp

Filesize
64KB

Download
memory/568-126-0x0000025CB3370000-0x0000025CB3380000-memory.dmp

Filesize
64KB

Download
memory/568-125-0x0000025CB3370000-0x0000025CB3380000-memory.dmp

Filesize
64KB

Download
memory/568-124-0x0000025CB3370000-0x0000025CB3380000-memory.dmp

Filesize
64KB

Download
memory/568-120-0x0000025CB3370000-0x0000025CB3380000-memory.dmp

Filesize
64KB

Download
memory/568-121-0x0000025CB3370000-0x0000025CB3380000-memory.dmp

Filesize
64KB

Download
memory/568-122-0x0000025CB3380000-0x0000025CB3390000-memory.dmp

Filesize
64KB

Download
memory/568-123-0x0000025CB3370000-0x0000025CB3380000-memory.dmp

Filesize
64KB

Download
memory/2580-324-0x00000221E1620000-0x00000221E1621000-memory.dmp

Filesize
4KB

Download
memory/2580-320-0x00000221E1620000-0x00000221E1621000-memory.dmp

Filesize
4KB

Download
memory/2580-316-0x00000221E1620000-0x00000221E1621000-memory.dmp

Filesize
4KB

Download
memory/2580-319-0x00000221E1620000-0x00000221E1621000-memory.dmp

Filesize
4KB

Download
memory/2580-325-0x00000221E1240000-0x00000221E1241000-memory.dmp

Filesize
4KB

Download
memory/2580-321-0x00000221E1620000-0x00000221E1621000-memory.dmp

Filesize
4KB

Download
memory/2580-322-0x00000221E1620000-0x00000221E1621000-memory.dmp

Filesize
4KB

Download
memory/2580-326-0x00000221E1230000-0x00000221E1231000-memory.dmp

Filesize
4KB

Download
memory/2580-318-0x00000221E1620000-0x00000221E1621000-memory.dmp

Filesize
4KB

Download
memory/2580-317-0x00000221E1620000-0x00000221E1621000-memory.dmp

Filesize
4KB

Download
memory/2580-323-0x00000221E1620000-0x00000221E1621000-memory.dmp

Filesize
4KB

Download
memory/2580-328-0x00000221E1240000-0x00000221E1241000-memory.dmp

Filesize
4KB

Download
memory/2580-331-0x00000221E1230000-0x00000221E1231000-memory.dmp

Filesize
4KB

Download
memory/2580-315-0x00000221E1620000-0x00000221E1621000-memory.dmp

Filesize
4KB

Download
memory/2580-314-0x00000221E15F0000-0x00000221E15F1000-memory.dmp

Filesize
4KB

Download
memory/2580-298-0x00000221D9040000-0x00000221D9050000-memory.dmp

Filesize
64KB

Download
memory/2580-282-0x00000221D8F40000-0x00000221D8F50000-memory.dmp

Filesize
64KB

Download