xenorat | 9c8bf9ebe2a4086492d67929fd36c4918e7d9069d67d3aa43faf24e25cb6bfe0

Analysis

max time kernel
53s
max time network
80s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
13-05-2024 15:43

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

chat.exe
Size

45KB
MD5

87639df87df52ab646411f86c2fce0c3
SHA1

6d6d21dd0af987380edc0b4fafebfc6d3e5d9a1c
SHA256

9c8bf9ebe2a4086492d67929fd36c4918e7d9069d67d3aa43faf24e25cb6bfe0
SHA512

39dacf01b97b0189644533dd545594d8daa755ea6d9cd1a2b61fa4dead15e6a088edf969c1487683fb35a623ac4e22ab0ecbb72bad4e5a9e770c6f0fc986e578
SSDEEP

768:BdhO/poiiUcjlJInwr6BH9Xqk5nWEZ5SbTDaTuI7CPW5Q:/w+jjgndH9XqcnW85SbT2uI4

Score

10^/10

xenorat persistence rat trojan

Malware Config

Extracted

Family

xenorat

0.tcp.eu.ngrok.io

Mutex

radnom123_34X41

Attributes

delay
5000
install_path
appdata
port
15597
startup_name
window system

Signatures

XenorRat
XenorRat is a remote access trojan written in C#.
trojan rat xenorat

Modifies Installed Components in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

chat.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation chat.exe
Executes dropped EXE 2 IoCs

Processes:

chat.exechat.exe

pid process

2340 chat.exe
2440 chat.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	chat.exe

Drops desktop.ini file(s) 1 IoCs

Processes:

explorer.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini	explorer.exe

Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.

Query Registry
T1012

Peripheral Device Discovery
T1120

System Information Discovery
T1082

Processes:

explorer.exe

description ioc process

File opened (read-only) \??\F: explorer.exe
File opened (read-only) \??\D: explorer.exe
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

1 0.tcp.eu.ngrok.io
13 0.tcp.eu.ngrok.io

description	ioc	process
File opened (read-only)	\??\F:	explorer.exe
File opened (read-only)	\??\D:	explorer.exe

flow	ioc
1	0.tcp.eu.ngrok.io
13	0.tcp.eu.ngrok.io

Drops file in Program Files directory 2 IoCs

Processes:

setup.exe

description	ioc	process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\f524c482-4a43-455a-a755-5ccac4f8f065.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20240513154442.pma	setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 22 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

explorer.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe

Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exe

pid process

996 schtasks.exe
4832 schtasks.exe

pid	process
996	schtasks.exe
4832	schtasks.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exechrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

Processes:

SearchApp.exerundll32.exeexplorer.exerundll32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Software\Microsoft\Internet Explorer\TypedURLs	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Software\Microsoft\Internet Explorer\TypedURLs	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Software\Microsoft\Internet Explorer\GPU	SearchApp.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

chrome.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133600886822574146"	chrome.exe

Modifies registry class 44 IoCs

Processes:

chat.exemsedge.exeexplorer.exeSearchApp.exeexplorer.exechrmstp.exemsedge.exeStartMenuExperienceHost.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\ms-settings\Shell\Open	chat.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\MuiCache	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\windows.search	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoft.windows.search	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search	SearchApp.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\ms-settings\Shell\Open	chat.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\ms-settings	chat.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	chrmstp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search\Total = "56"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search\Total = "23"	SearchApp.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2539840389-1261165778-1087677076-1000\{6935D8CF-A09B-419B-BAFF-3004E3A4418E}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\ms-settings\Shell	chat.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\ms-settings\Shell\Open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\XenoManager\\chat.exe\""	chat.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "185"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search\ = "56"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search\ = "23"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "152"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\ms-settings\Shell\Open\command	chat.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\ms-settings\Shell\Open\command	chat.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2539840389-1261165778-1087677076-1000\{58A84DA4-3286-4485-82C2-2B9FA3949C63}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\ms-settings	chat.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\ms-settings\Shell\Open\command\DelegateExecute	chat.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\ms-settings\Shell	chat.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchApp.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

chat.exechat.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exe

pid	process
2340	chat.exe
2340	chat.exe
2340	chat.exe
2340	chat.exe
2340	chat.exe
2340	chat.exe
2340	chat.exe
2340	chat.exe
2340	chat.exe
2340	chat.exe
2340	chat.exe
2340	chat.exe
2340	chat.exe
2340	chat.exe
2340	chat.exe
2340	chat.exe
2340	chat.exe
2340	chat.exe
2340	chat.exe
2340	chat.exe
2340	chat.exe
2340	chat.exe
2340	chat.exe
2340	chat.exe
2340	chat.exe
2340	chat.exe
2340	chat.exe
2340	chat.exe
2340	chat.exe
2340	chat.exe
2440	chat.exe
2440	chat.exe
2440	chat.exe
2340	chat.exe
2340	chat.exe
2340	chat.exe
2440	chat.exe
2440	chat.exe
2440	chat.exe
2340	chat.exe
2340	chat.exe
2340	chat.exe
2440	chat.exe
2440	chat.exe
2440	chat.exe
2340	chat.exe
2340	chat.exe
2340	chat.exe
3076	msedge.exe
3076	msedge.exe
2440	chat.exe
2440	chat.exe
2440	chat.exe
2356	msedge.exe
2356	msedge.exe
1184	msedge.exe
1184	msedge.exe
2660	msedge.exe
2660	msedge.exe
4728	msedge.exe
4728	msedge.exe
1948	msedge.exe
1948	msedge.exe
2868	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

chat.exechat.exeexplorer.exechrome.exe

description	pid	process
Token: SeDebugPrivilege	2340	chat.exe
Token: SeDebugPrivilege	2440	chat.exe
Token: SeShutdownPrivilege	1320	explorer.exe
Token: SeCreatePagefilePrivilege	1320	explorer.exe
Token: SeShutdownPrivilege	1320	explorer.exe
Token: SeCreatePagefilePrivilege	1320	explorer.exe
Token: SeShutdownPrivilege	1320	explorer.exe
Token: SeCreatePagefilePrivilege	1320	explorer.exe
Token: SeShutdownPrivilege	1320	explorer.exe
Token: SeCreatePagefilePrivilege	1320	explorer.exe
Token: SeShutdownPrivilege	1320	explorer.exe
Token: SeCreatePagefilePrivilege	1320	explorer.exe
Token: SeShutdownPrivilege	1320	explorer.exe
Token: SeCreatePagefilePrivilege	1320	explorer.exe
Token: SeShutdownPrivilege	1320	explorer.exe
Token: SeCreatePagefilePrivilege	1320	explorer.exe
Token: SeShutdownPrivilege	996	chrome.exe
Token: SeCreatePagefilePrivilege	996	chrome.exe
Token: SeShutdownPrivilege	1320	explorer.exe
Token: SeCreatePagefilePrivilege	1320	explorer.exe
Token: SeShutdownPrivilege	1320	explorer.exe
Token: SeCreatePagefilePrivilege	1320	explorer.exe
Token: SeShutdownPrivilege	996	chrome.exe
Token: SeCreatePagefilePrivilege	996	chrome.exe
Token: SeShutdownPrivilege	1320	explorer.exe
Token: SeCreatePagefilePrivilege	1320	explorer.exe
Token: SeShutdownPrivilege	1320	explorer.exe
Token: SeCreatePagefilePrivilege	1320	explorer.exe
Token: SeShutdownPrivilege	1320	explorer.exe
Token: SeCreatePagefilePrivilege	1320	explorer.exe
Token: SeShutdownPrivilege	1320	explorer.exe
Token: SeCreatePagefilePrivilege	1320	explorer.exe
Token: SeShutdownPrivilege	996	chrome.exe
Token: SeCreatePagefilePrivilege	996	chrome.exe
Token: SeShutdownPrivilege	996	chrome.exe
Token: SeCreatePagefilePrivilege	996	chrome.exe
Token: SeShutdownPrivilege	1320	explorer.exe
Token: SeCreatePagefilePrivilege	1320	explorer.exe
Token: SeShutdownPrivilege	1320	explorer.exe
Token: SeCreatePagefilePrivilege	1320	explorer.exe
Token: SeShutdownPrivilege	1320	explorer.exe
Token: SeCreatePagefilePrivilege	1320	explorer.exe
Token: SeShutdownPrivilege	996	chrome.exe
Token: SeCreatePagefilePrivilege	996	chrome.exe
Token: SeShutdownPrivilege	1320	explorer.exe
Token: SeCreatePagefilePrivilege	1320	explorer.exe
Token: SeShutdownPrivilege	1320	explorer.exe
Token: SeCreatePagefilePrivilege	1320	explorer.exe
Token: SeShutdownPrivilege	996	chrome.exe
Token: SeCreatePagefilePrivilege	996	chrome.exe
Token: SeShutdownPrivilege	1320	explorer.exe
Token: SeCreatePagefilePrivilege	1320	explorer.exe
Token: SeShutdownPrivilege	1320	explorer.exe
Token: SeCreatePagefilePrivilege	1320	explorer.exe
Token: SeShutdownPrivilege	1320	explorer.exe
Token: SeCreatePagefilePrivilege	1320	explorer.exe
Token: SeShutdownPrivilege	1320	explorer.exe
Token: SeCreatePagefilePrivilege	1320	explorer.exe
Token: SeShutdownPrivilege	1320	explorer.exe
Token: SeCreatePagefilePrivilege	1320	explorer.exe
Token: SeShutdownPrivilege	996	chrome.exe
Token: SeCreatePagefilePrivilege	996	chrome.exe
Token: SeShutdownPrivilege	996	chrome.exe
Token: SeCreatePagefilePrivilege	996	chrome.exe

Suspicious use of FindShellTrayWindow 54 IoCs

Processes:

rundll32.exemsedge.exeexplorer.exechrome.exechrmstp.exerundll32.exe

pid	process
4752	rundll32.exe
1948	msedge.exe
1320	explorer.exe
1320	explorer.exe
1320	explorer.exe
1320	explorer.exe
1320	explorer.exe
1320	explorer.exe
996	chrome.exe
996	chrome.exe
6284	chrmstp.exe
1320	explorer.exe
1320	explorer.exe
1320	explorer.exe
1320	explorer.exe
1320	explorer.exe
1320	explorer.exe
1320	explorer.exe
1320	explorer.exe
1320	explorer.exe
1320	explorer.exe
1320	explorer.exe
1320	explorer.exe
1320	explorer.exe
1320	explorer.exe
1320	explorer.exe
1320	explorer.exe
1320	explorer.exe
1320	explorer.exe
1320	explorer.exe
1320	explorer.exe
1320	explorer.exe
1320	explorer.exe
1320	explorer.exe
1320	explorer.exe
1320	explorer.exe
1320	explorer.exe
1320	explorer.exe
1320	explorer.exe
1320	explorer.exe
1320	explorer.exe
1320	explorer.exe
1320	explorer.exe
1320	explorer.exe
1320	explorer.exe
1320	explorer.exe
1320	explorer.exe
1320	explorer.exe
1320	explorer.exe
1320	explorer.exe
1320	explorer.exe
1320	explorer.exe
1320	explorer.exe
6880	rundll32.exe

Suspicious use of SendNotifyMessage 21 IoCs

Processes:

explorer.exe

pid	process
1320	explorer.exe
1320	explorer.exe
1320	explorer.exe
1320	explorer.exe
1320	explorer.exe
1320	explorer.exe
1320	explorer.exe
1320	explorer.exe
1320	explorer.exe
1320	explorer.exe
1320	explorer.exe
1320	explorer.exe
1320	explorer.exe
1320	explorer.exe
1320	explorer.exe
1320	explorer.exe
1320	explorer.exe
1320	explorer.exe
1320	explorer.exe
1320	explorer.exe
1320	explorer.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

StartMenuExperienceHost.exeSearchApp.exeexplorer.exe

pid process

5732 StartMenuExperienceHost.exe
6656 SearchApp.exe
1320 explorer.exe
1320 explorer.exe

pid	process
5732	StartMenuExperienceHost.exe
6656	SearchApp.exe
1320	explorer.exe
1320	explorer.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chat.exechat.execmd.exefodhelper.exechat.exemsedge.exechrome.exe

description	pid	process	target process
PID 3856 wrote to memory of 2340	3856	chat.exe	chat.exe
PID 3856 wrote to memory of 2340	3856	chat.exe	chat.exe
PID 3856 wrote to memory of 2340	3856	chat.exe	chat.exe
PID 2340 wrote to memory of 996	2340	chat.exe	schtasks.exe
PID 2340 wrote to memory of 996	2340	chat.exe	schtasks.exe
PID 2340 wrote to memory of 996	2340	chat.exe	schtasks.exe
PID 2340 wrote to memory of 4420	2340	chat.exe	cmd.exe
PID 2340 wrote to memory of 4420	2340	chat.exe	cmd.exe
PID 4420 wrote to memory of 3412	4420	cmd.exe	fodhelper.exe
PID 4420 wrote to memory of 3412	4420	cmd.exe	fodhelper.exe
PID 3412 wrote to memory of 2440	3412	fodhelper.exe	chat.exe
PID 3412 wrote to memory of 2440	3412	fodhelper.exe	chat.exe
PID 3412 wrote to memory of 2440	3412	fodhelper.exe	chat.exe
PID 2440 wrote to memory of 4832	2440	chat.exe	schtasks.exe
PID 2440 wrote to memory of 4832	2440	chat.exe	schtasks.exe
PID 2440 wrote to memory of 4832	2440	chat.exe	schtasks.exe
PID 2340 wrote to memory of 4752	2340	chat.exe	rundll32.exe
PID 2340 wrote to memory of 4752	2340	chat.exe	rundll32.exe
PID 2340 wrote to memory of 4752	2340	chat.exe	rundll32.exe
PID 2340 wrote to memory of 1948	2340	chat.exe	msedge.exe
PID 2340 wrote to memory of 1948	2340	chat.exe	msedge.exe
PID 1948 wrote to memory of 3404	1948	msedge.exe	msedge.exe
PID 1948 wrote to memory of 3404	1948	msedge.exe	msedge.exe
PID 1948 wrote to memory of 3076	1948	msedge.exe	msedge.exe
PID 1948 wrote to memory of 3076	1948	msedge.exe	msedge.exe
PID 1948 wrote to memory of 1184	1948	msedge.exe	msedge.exe
PID 1948 wrote to memory of 1184	1948	msedge.exe	msedge.exe
PID 1948 wrote to memory of 2356	1948	msedge.exe	msedge.exe
PID 1948 wrote to memory of 2356	1948	msedge.exe	msedge.exe
PID 1948 wrote to memory of 2660	1948	msedge.exe	msedge.exe
PID 1948 wrote to memory of 2660	1948	msedge.exe	msedge.exe
PID 1948 wrote to memory of 4728	1948	msedge.exe	msedge.exe
PID 1948 wrote to memory of 4728	1948	msedge.exe	msedge.exe
PID 1948 wrote to memory of 2868	1948	msedge.exe	msedge.exe
PID 1948 wrote to memory of 2868	1948	msedge.exe	msedge.exe
PID 2340 wrote to memory of 996	2340	chat.exe	chrome.exe
PID 2340 wrote to memory of 996	2340	chat.exe	chrome.exe
PID 1948 wrote to memory of 1080	1948	msedge.exe	msedge.exe
PID 1948 wrote to memory of 1080	1948	msedge.exe	msedge.exe
PID 996 wrote to memory of 2844	996	chrome.exe	chrome.exe
PID 996 wrote to memory of 2844	996	chrome.exe	chrome.exe
PID 1948 wrote to memory of 1204	1948	msedge.exe	msedge.exe
PID 1948 wrote to memory of 1204	1948	msedge.exe	msedge.exe
PID 1948 wrote to memory of 3444	1948	msedge.exe	msedge.exe
PID 1948 wrote to memory of 3444	1948	msedge.exe	msedge.exe
PID 1948 wrote to memory of 1988	1948	msedge.exe	msedge.exe
PID 1948 wrote to memory of 1988	1948	msedge.exe	msedge.exe
PID 1948 wrote to memory of 2392	1948	msedge.exe	msedge.exe
PID 1948 wrote to memory of 2392	1948	msedge.exe	msedge.exe
PID 2340 wrote to memory of 1320	2340	chat.exe	explorer.exe
PID 2340 wrote to memory of 1320	2340	chat.exe	explorer.exe
PID 996 wrote to memory of 4348	996	chrome.exe	chrome.exe
PID 996 wrote to memory of 4348	996	chrome.exe	chrome.exe
PID 996 wrote to memory of 2736	996	chrome.exe	chrome.exe
PID 996 wrote to memory of 2736	996	chrome.exe	chrome.exe
PID 996 wrote to memory of 4024	996	chrome.exe	chrome.exe
PID 996 wrote to memory of 4024	996	chrome.exe	chrome.exe
PID 996 wrote to memory of 3436	996	chrome.exe	chrome.exe
PID 996 wrote to memory of 3436	996	chrome.exe	chrome.exe
PID 996 wrote to memory of 4392	996	chrome.exe	chrome.exe
PID 996 wrote to memory of 4392	996	chrome.exe	chrome.exe
PID 996 wrote to memory of 5428	996	chrome.exe	chrome.exe
PID 996 wrote to memory of 5428	996	chrome.exe	chrome.exe
PID 996 wrote to memory of 5464	996	chrome.exe	chrome.exe

C:\Users\Admin\AppData\Local\Temp\chat.exe
"C:\Users\Admin\AppData\Local\Temp\chat.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3856

C:\Users\Admin\AppData\Roaming\XenoManager\chat.exe
"C:\Users\Admin\AppData\Roaming\XenoManager\chat.exe"
2⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2340

C:\Windows\SysWOW64\schtasks.exe
"schtasks.exe" /Create /TN "window system" /XML "C:\Users\Admin\AppData\Local\Temp\tmp59E7.tmp" /F
3⤵
- Creates scheduled task(s)
PID:996

C:\Windows\SYSTEM32\cmd.exe
cmd /c start "" "%windir%\system32\fodhelper.exe"
3⤵
- Suspicious use of WriteProcessMemory
PID:4420

C:\Windows\system32\fodhelper.exe
"C:\Windows\system32\fodhelper.exe"
4⤵
- Suspicious use of WriteProcessMemory
PID:3412

C:\Users\Admin\AppData\Roaming\XenoManager\chat.exe
"C:\Users\Admin\AppData\Roaming\XenoManager\chat.exe"
5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2440

C:\Windows\SysWOW64\schtasks.exe
"schtasks.exe" /Create /TN "window system" /XML "C:\Users\Admin\AppData\Local\Temp\tmpBD26.tmp" /F
6⤵
- Creates scheduled task(s)
PID:4832

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,#61
3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
PID:4752

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --user-data-dir=C:\EdgeAutomationData
3⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1948

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\EdgeAutomationData /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\EdgeAutomationData\Crashpad --metrics-dir=C:\EdgeAutomationData --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ff98fe346f8,0x7ff98fe34708,0x7ff98fe34718
4⤵
PID:3404

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1880,5448175122160715051,2333791721355355704,131072 --no-sandbox --user-data-dir="C:\EdgeAutomationData" --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=2188 --allow-no-sandbox-job /prefetch:2
4⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3076

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1880,5448175122160715051,2333791721355355704,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\EdgeAutomationData" --mojo-platform-channel-handle=2276 --allow-no-sandbox-job /prefetch:3
4⤵
- Suspicious behavior: EnumeratesProcesses
PID:1184

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1880,5448175122160715051,2333791721355355704,131072 --lang=en-US --service-sandbox-type=utility --no-sandbox --user-data-dir="C:\EdgeAutomationData" --mojo-platform-channel-handle=2496 --allow-no-sandbox-job /prefetch:8
4⤵
- Suspicious behavior: EnumeratesProcesses
PID:2356

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-sandbox --field-trial-handle=1880,5448175122160715051,2333791721355355704,131072 --disable-gpu-compositing --lang=en-US --user-data-dir="C:\EdgeAutomationData" --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 --allow-no-sandbox-job /prefetch:1
4⤵
- Suspicious behavior: EnumeratesProcesses
PID:2660

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-sandbox --field-trial-handle=1880,5448175122160715051,2333791721355355704,131072 --disable-gpu-compositing --lang=en-US --user-data-dir="C:\EdgeAutomationData" --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 --allow-no-sandbox-job /prefetch:1
4⤵
- Suspicious behavior: EnumeratesProcesses
PID:4728

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-sandbox --field-trial-handle=1880,5448175122160715051,2333791721355355704,131072 --disable-gpu-compositing --lang=en-US --user-data-dir="C:\EdgeAutomationData" --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3580 --allow-no-sandbox-job /prefetch:1
4⤵
- Suspicious behavior: EnumeratesProcesses
PID:2868

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-sandbox --field-trial-handle=1880,5448175122160715051,2333791721355355704,131072 --disable-gpu-compositing --lang=en-US --user-data-dir="C:\EdgeAutomationData" --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3688 --allow-no-sandbox-job /prefetch:1
4⤵
PID:1080

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-sandbox --field-trial-handle=1880,5448175122160715051,2333791721355355704,131072 --disable-gpu-compositing --lang=en-US --user-data-dir="C:\EdgeAutomationData" --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3796 --allow-no-sandbox-job /prefetch:1
4⤵
PID:1204

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-sandbox --field-trial-handle=1880,5448175122160715051,2333791721355355704,131072 --disable-gpu-compositing --lang=en-US --user-data-dir="C:\EdgeAutomationData" --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3884 --allow-no-sandbox-job /prefetch:1
4⤵
PID:3444

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-sandbox --field-trial-handle=1880,5448175122160715051,2333791721355355704,131072 --disable-gpu-compositing --lang=en-US --user-data-dir="C:\EdgeAutomationData" --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3928 --allow-no-sandbox-job /prefetch:1
4⤵
PID:1988

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-sandbox --field-trial-handle=1880,5448175122160715051,2333791721355355704,131072 --disable-gpu-compositing --lang=en-US --user-data-dir="C:\EdgeAutomationData" --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3964 --allow-no-sandbox-job /prefetch:1
4⤵
PID:2392

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-sandbox --field-trial-handle=1880,5448175122160715051,2333791721355355704,131072 --disable-gpu-compositing --lang=en-US --user-data-dir="C:\EdgeAutomationData" --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3404 --allow-no-sandbox-job /prefetch:1
4⤵
PID:5808

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-sandbox --field-trial-handle=1880,5448175122160715051,2333791721355355704,131072 --disable-gpu-compositing --lang=en-US --user-data-dir="C:\EdgeAutomationData" --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3412 --allow-no-sandbox-job /prefetch:1
4⤵
PID:5832

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-sandbox --field-trial-handle=1880,5448175122160715051,2333791721355355704,131072 --disable-gpu-compositing --lang=en-US --user-data-dir="C:\EdgeAutomationData" --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5048 --allow-no-sandbox-job /prefetch:1
4⤵
PID:5156

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1880,5448175122160715051,2333791721355355704,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\EdgeAutomationData" --mojo-platform-channel-handle=5480 --allow-no-sandbox-job /prefetch:8
4⤵
PID:6000

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
4⤵
- Drops file in Program Files directory
PID:5544

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff709325460,0x7ff709325470,0x7ff709325480
5⤵
PID:6728

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1880,5448175122160715051,2333791721355355704,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\EdgeAutomationData" --mojo-platform-channel-handle=5480 --allow-no-sandbox-job /prefetch:8
4⤵
PID:6572

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-sandbox --field-trial-handle=1880,5448175122160715051,2333791721355355704,131072 --disable-gpu-compositing --lang=en-US --user-data-dir="C:\EdgeAutomationData" --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4972 --allow-no-sandbox-job /prefetch:1
4⤵
PID:6652

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --user-data-dir=C:\ChromeAutomationData
3⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:996

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\ChromeAutomationData /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\ChromeAutomationData\Crashpad --metrics-dir=C:\ChromeAutomationData --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ff9803aab58,0x7ff9803aab68,0x7ff9803aab78
4⤵
PID:2844

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\ChromeAutomationData" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1716 --field-trial-handle=2240,i,6584526138081767347,14908404734219739407,131072 /prefetch:2
4⤵
PID:4348

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\ChromeAutomationData" --mojo-platform-channel-handle=1920 --field-trial-handle=2240,i,6584526138081767347,14908404734219739407,131072 /prefetch:8
4⤵
PID:2736

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --user-data-dir="C:\ChromeAutomationData" --mojo-platform-channel-handle=2012 --field-trial-handle=2240,i,6584526138081767347,14908404734219739407,131072 /prefetch:8
4⤵
PID:4024

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\ChromeAutomationData" --first-renderer-process --no-sandbox --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2772 --field-trial-handle=2240,i,6584526138081767347,14908404734219739407,131072 /prefetch:1
4⤵
PID:3436

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\ChromeAutomationData" --no-sandbox --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2796 --field-trial-handle=2240,i,6584526138081767347,14908404734219739407,131072 /prefetch:1
4⤵
PID:4392

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\ChromeAutomationData" --extension-process --no-sandbox --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3444 --field-trial-handle=2240,i,6584526138081767347,14908404734219739407,131072 /prefetch:1
4⤵
PID:5428

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\ChromeAutomationData" --extension-process --no-sandbox --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3524 --field-trial-handle=2240,i,6584526138081767347,14908404734219739407,131072 /prefetch:1
4⤵
PID:5464

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\ChromeAutomationData" --no-sandbox --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=3864 --field-trial-handle=2240,i,6584526138081767347,14908404734219739407,131072 /prefetch:1
4⤵
PID:5820

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --user-data-dir="C:\ChromeAutomationData" --mojo-platform-channel-handle=3076 --field-trial-handle=2240,i,6584526138081767347,14908404734219739407,131072 /prefetch:8
4⤵
PID:6024

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --user-data-dir="C:\ChromeAutomationData" --mojo-platform-channel-handle=3968 --field-trial-handle=2240,i,6584526138081767347,14908404734219739407,131072 /prefetch:8
4⤵
PID:6124

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --user-data-dir="C:\ChromeAutomationData" --mojo-platform-channel-handle=4016 --field-trial-handle=2240,i,6584526138081767347,14908404734219739407,131072 /prefetch:8
4⤵
PID:5500

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\ChromeAutomationData" --mojo-platform-channel-handle=4128 --field-trial-handle=2240,i,6584526138081767347,14908404734219739407,131072 /prefetch:8
4⤵
PID:3888

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\ChromeAutomationData" --no-sandbox --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=4204 --field-trial-handle=2240,i,6584526138081767347,14908404734219739407,131072 /prefetch:1
4⤵
PID:6172

C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
4⤵
PID:6420

C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x238,0x23c,0x240,0x214,0x244,0x7ff716dbae48,0x7ff716dbae58,0x7ff716dbae68
5⤵
PID:6280

C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\master_preferences" --create-shortcuts=1 --install-level=0
5⤵
- Modifies registry class
- Suspicious use of FindShellTrayWindow
PID:6284

C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x238,0x23c,0x240,0x214,0x244,0x7ff716dbae48,0x7ff716dbae58,0x7ff716dbae68
6⤵
PID:6248

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --user-data-dir="C:\ChromeAutomationData" --mojo-platform-channel-handle=4320 --field-trial-handle=2240,i,6584526138081767347,14908404734219739407,131072 /prefetch:8
4⤵
PID:6392

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\ChromeAutomationData" --mojo-platform-channel-handle=4848 --field-trial-handle=2240,i,6584526138081767347,14908404734219739407,131072 /prefetch:8
4⤵
PID:6264

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --user-data-dir="C:\ChromeAutomationData" --mojo-platform-channel-handle=4540 --field-trial-handle=2240,i,6584526138081767347,14908404734219739407,131072 /prefetch:8
4⤵
PID:6520

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --user-data-dir="C:\ChromeAutomationData" --mojo-platform-channel-handle=4648 --field-trial-handle=2240,i,6584526138081767347,14908404734219739407,131072 /prefetch:8
4⤵
PID:7276

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --user-data-dir="C:\ChromeAutomationData" --mojo-platform-channel-handle=4596 --field-trial-handle=2240,i,6584526138081767347,14908404734219739407,131072 /prefetch:8
4⤵
PID:7728

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\ChromeAutomationData" --extension-process --no-sandbox --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --mojo-platform-channel-handle=4764 --field-trial-handle=2240,i,6584526138081767347,14908404734219739407,131072 /prefetch:1
4⤵
PID:8088

C:\Windows\explorer.exe
C:\Windows\explorer.exe
3⤵
- Modifies Installed Components in the registry
- Drops desktop.ini file(s)
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1320

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell
3⤵
PID:5144

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,#61
3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
PID:6880

C:\Windows\explorer.exe
C:\Windows\explorer.exe
3⤵
- Modifies registry class
PID:6700

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:5448

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5732

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:6656

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Peripheral Device Discovery

T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

T1102

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ChromeAutomationData\Default\Code Cache\js\index
Filesize
24B

MD5
54cb446f628b2ea4a5bce5769910512e

SHA1
c27ca848427fe87f5cf4d0e0e3cd57151b0d820d

SHA256
fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d

SHA512
8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0

Download Submit
C:\ChromeAutomationData\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.76.2_0\_locales\en_CA\messages.json
Filesize
851B

MD5
07ffbe5f24ca348723ff8c6c488abfb8

SHA1
6dc2851e39b2ee38f88cf5c35a90171dbea5b690

SHA256
6895648577286002f1dc9c3366f558484eb7020d52bbf64a296406e61d09599c

SHA512
7ed2c8db851a84f614d5daf1d5fe633bd70301fd7ff8a6723430f05f642ceb3b1ad0a40de65b224661c782ffcec69d996ebe3e5bb6b2f478181e9a07d8cd41f6

Download Submit
C:\ChromeAutomationData\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.76.2_0\dasherSettingSchema.json
Filesize
854B

MD5
4ec1df2da46182103d2ffc3b92d20ca5

SHA1
fb9d1ba3710cf31a87165317c6edc110e98994ce

SHA256
6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6

SHA512
939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d

Download Submit
C:\ChromeAutomationData\Default\GPUCache\data_0
Filesize
8KB

MD5
cf89d16bb9107c631daabf0c0ee58efb

SHA1
3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b

SHA256
d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e

SHA512
8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

Download Submit
C:\ChromeAutomationData\Default\GPUCache\data_1
Filesize
264KB

MD5
d0d388f3865d0523e451d6ba0be34cc4

SHA1
8571c6a52aacc2747c048e3419e5657b74612995

SHA256
902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b

SHA512
376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17

Download Submit
C:\ChromeAutomationData\Default\Network\SCT Auditing Pending Reports
Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\ChromeAutomationData\Default\Preferences
Filesize
7KB

MD5
a0e8698f4258da486021d0cc62b5ceef

SHA1
d42273cd437bc500e6b4044ffd95c475bbab29dd

SHA256
3d93d95430f0f56cd4f2b3e4f31642bc8209a6a5377bfb61f8e55a51dbda642b

SHA512
97fea31d645eddc6eaa3eb05c99615b791dcc18ddee9fd1f20722e149e618717931dd43ad11a84560af01845ce5bf4f92e80c908397ea8462ad571afedb1030a

Download Submit
C:\ChromeAutomationData\Default\Preferences
Filesize
8KB

MD5
7000e8e6115be0adb582dad62faed307

SHA1
8690e442249ac83c8cee5d90a32e34bda0cf46dc

SHA256
c6ca5c22824037885b15f41b894b7948b8a47d111549724e84fd00cfb75cbc24

SHA512
d151ca2b2a8d0dfaa795af98d4f25ac0f5331264820dd55820641cfb7b510ee38ecc44e3348a10258afcc8b4203041d3727a95a7cdb467066b9534587a979db5

Download Submit
C:\ChromeAutomationData\Default\Preferences~RFe58194f.TMP
Filesize
2KB

MD5
8e5632bb5baca5f24f88c9e2a8eb2b6d

SHA1
71f7dee86640b602595b40c6a65d7ed4498cf00d

SHA256
88575950e262396bd009db3c75b18b3a1cd44b7b869b90f9b2c961ce9b74c1ad

SHA512
def476d83ba944f2fe83839108072677672a230218192751dd5e37305d42816e2db59b6f368fe8d3ca8848542ac3e3732dea3a58187c1e14f372ff2f721dffcc

Download Submit
C:\ChromeAutomationData\Default\Secure Preferences
Filesize
13KB

MD5
2007e94799b1c598e8e90fe592e2e33a

SHA1
bf81cd28c9fbd91d978e064d620607f6dc1659ca

SHA256
6ccba1a4069a88bd878142a32a48a8ec82d6ac956b892c7a3ad75723186bd142

SHA512
69f9b0fe17bd50c3796f716d5ed715236c08ceb3c9b1a5ec437322883f23b0452be0915cd93652eb7624b75a4eb72d674d33ebd4abc5d8a9144a784528a367dc

Download Submit
C:\ChromeAutomationData\Default\Secure Preferences~RFe58468a.TMP
Filesize
10KB

MD5
0f6c6c8ce29647ad50b866ab5c8cf77a

SHA1
6bbd186190962f42fc7bdcbf4757651a8a55c76d

SHA256
9023fa59eb81f5c96cebe4285c07889881f5ccb0b8532e6a21402164b0dc3cf7

SHA512
a8482669e04920ccfa20038984a1badeeb86764ad44818929b2b377bdb99f8911caf59c98d188e07e808283b062bc065b42a87e10cc2377f322e498caa01dc3b

Download Submit
C:\ChromeAutomationData\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\32.png
Filesize
1KB

MD5
2208a92644dcb1f39eb0eb2a6cd5627e

SHA1
92b1bb3f52841272dd5103058d10b8938d82f582

SHA256
1a087dddaed584b9df580672ff112d538b02a3005862ba2a38147c498a5f4c01

SHA512
f155b86f9a3806e7e204fded36c722b69f94e778b3d12684b2b5dd2ca649b02bbca24e6ec01f27e864e8004139e800cb1f7f098c9dd380363a90e686e617d90a

Download Submit
C:\ChromeAutomationData\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\32.png
Filesize
1KB

MD5
9bfaee3c6dba29e30e8ff9820e7495c6

SHA1
2baa05f75dbaf11d53aee194e3c94dc2ed2e7696

SHA256
ede1cb37b65751a20f1c21b1243c5628a5e0dd5afac7ce275c65f3204dc54683

SHA512
ab401201b612e9dd035aea184b9980eb7ca291d51ede3a0d7fbbf6d7d2f688a7a1d8efd6de27abdb29e531dc0a987f2a1aeb14dc0a54e0a05bf022e94d89911b

Download Submit
C:\ChromeAutomationData\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\32.png
Filesize
1KB

MD5
7ccd89bd73287c34e2f93232b5794397

SHA1
f67272153f3beb99df55c2d321b394bd855df693

SHA256
afc439984c9fb4c04101cbb7d3f72b2b123ac30d788ab58271d2f1db14ae36d4

SHA512
1cc7ea3206112916750018a3aa0c90e73ba80d4e5f8652102cd9467ac68c86b99b4584e8f850dd21e9dad454c3230b3661b05f696bbf35aeff6d29951d582b47

Download Submit
C:\ChromeAutomationData\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\32.png
Filesize
1KB

MD5
5d7f01d87cf03ea2349c7aa61f44a8ad

SHA1
3b1819d2711806dafb4dc690796a39d62752c34a

SHA256
709faf4aa39e22c3f77f5ec580be7d0e227506d3cc2d0b892e66d6fc5c27822c

SHA512
6e149adcb9eed2b00827dbca072cf9457dc8e68de532720b570e06264e131afe226ec8fb78156c140a075998a1da260e7ce737677039e5d9497ab8f69ab5dc62

Download Submit
C:\ChromeAutomationData\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\32.png
Filesize
890B

MD5
920e94dfc0a5448e1da40d06aa873d5f

SHA1
b88fd200e5f7771b897528a4e869ead72144fca0

SHA256
c10d2f537e072336c10afa11b9621b25d0d600ff04d12d1070dab942bdfae62a

SHA512
c893a6d711249d5b546553813d5ec21dd7c8db0bf144a7f2bc47c3a4ff00615708f679f499452ce68e1bae3cb9098593c519a3055e207c86d571079f05bff4e0

Download Submit
C:\ChromeAutomationData\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\32.png
Filesize
913B

MD5
c2041f6fef10364434abcc7e198eec0f

SHA1
38d2ed3af17e64f96f21df12c5c444138489da48

SHA256
dae8a0a9c81dd21b5b593cd90968507f5eabb85f7912135143da60ea62d3ee9f

SHA512
821fe3091cc3de86c642e771f606af9fe0d34f626ead5811dd136ac427475bce69893bfc11f7db5beb1bba7f74cbc49ba3bef01dbe793f9b507f343a80f7d901

Download Submit
C:\ChromeAutomationData\Local State
Filesize
130KB

MD5
31fe408f05925788ed977ee8880116a5

SHA1
867ac0da33498fe7f652dfa626a992ea452c2d65

SHA256
0e3ec2238cfba77f57ef54c19e3beb2c1212a8aa7f08dec48a0a55073e6c9f16

SHA512
c18fa25c5b38900d8d1ee37ae14f567db55d3b5238af5ea2e70197a30b630ab19ca9d840541404e1c12a14a2cae55cc30184fba73bb0cf0d62dc24281e41b738

Download Submit
C:\ChromeAutomationData\Local State~RFe581940.TMP
Filesize
870B

MD5
67d4da45b203eb168e51c68fb1c71001

SHA1
d338b4c49587026090f6ca3df05fd2cb3c483a3a

SHA256
07bb425dae7412cbeaef7d66284a109c6cc8a9d8cb878b78de9e8c4584436a24

SHA512
6fa4c6bd54f899741d073b687090e3635373c33792d2282b6a83924c6084e1c8dc14ea2db58a1f0b1f25754ef54ca93da1ead4b5d68d4970e5a7c636b381b139

Download Submit
C:\EdgeAutomationData\9f42a793-f122-46c9-8a45-a1068fe5c97e.tmp
Filesize
10KB

MD5
3427b76d091f41a929da61b69ba02a09

SHA1
8262faeb3d75914a344ae1cd69730b84ddddecae

SHA256
500aad47329374e1fe3ba860b02ef47c60dc347f38aecddd492ab7f0b370aaee

SHA512
0c3d2d89f2dc8a7cb348ae5efff774cea04d61a6b9036aa3c6d4b994a1cfc91b001d06fa42a47dcafb7b9bc5d87f0c9305ffe10d3f1a2c870ee567ca72874a5b

Download Submit
C:\EdgeAutomationData\Crashpad\settings.dat
Filesize
152B

MD5
e87d87b1b67c41663aa0bc832ee2378b

SHA1
ac6e59d9f851c4a81f0f8673afc69ba54e2f6030

SHA256
7b99ccd709ebe38f8b00ff00e74905819b6111f02707fd7e79c18d7083e7d2c3

SHA512
4674db294d2031fb5568909c1a82538f22fd210d687643a3e4bff67a39e57ac20a1b094b8397479fdfc6452836cfbb28226b128513eb3128986932717eed6043

Download Submit
C:\EdgeAutomationData\Crashpad\settings.dat
Filesize
152B

MD5
9ee98a2bae9c740ee8dbd84da4dcfb5c

SHA1
8b5b7181c7fca1940e8f964cc9b7c2497c68f9e7

SHA256
768c23d0595f0022729949d0569b0b64ad5fe704894eae5616c2386787d8aa51

SHA512
b186b14601fceac6b6220c430de09dba04fd9385c9bd0d685afea310c221d02214fad7e57f609dc23351e0153b4fbc4692947488d7edd2b292609cf329b55aca

Download Submit
C:\EdgeAutomationData\Crashpad\settings.dat
Filesize
152B

MD5
50fe1d19d78b96c98b83f15b114781f9

SHA1
e3646e23e333bf769bd878000f3f5500aa2cb319

SHA256
fb69eabda649b33f5018d325a87f1517d87021339a21c66a641c9181fcbf4620

SHA512
662ed4d9dfd27648ca76a459b37a6acc6fd21950435790dec79796c1d5420d12db0a3039800ba5c23f6f19518b97b93e6b7829423615e4e0547c258c0f9d4970

Download Submit
C:\EdgeAutomationData\Crashpad\throttle_store.dat
Filesize
20B

MD5
9e4e94633b73f4a7680240a0ffd6cd2c

SHA1
e68e02453ce22736169a56fdb59043d33668368f

SHA256
41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304

SHA512
193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337

Download Submit
C:\EdgeAutomationData\Default\0b7fba70-d893-4efd-b200-61b758dde567.tmp
Filesize
4KB

MD5
471206f68576fbbf317eb2e574131508

SHA1
574923c249df4590b77bb512b070f32269fd054d

SHA256
110d9f8a3edf84362281d95c8b5de4aeddc980744dbc25b2136e489db9603a8f

SHA512
1c96cef65dd375098f2f5191581206e68e256378c22a08334f759928ce48b2634122eaf3ef168a8a7d7ae0773f3a830f1f4e991656d62ccc5bfe2b1201a2b839

Download Submit
C:\EdgeAutomationData\Default\Cache\data_2
Filesize
8KB

MD5
0962291d6d367570bee5454721c17e11

SHA1
59d10a893ef321a706a9255176761366115bedcb

SHA256
ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

SHA512
f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

Download Submit
C:\EdgeAutomationData\Default\Cache\data_3
Filesize
8KB

MD5
41876349cb12d6db992f1309f22df3f0

SHA1
5cf26b3420fc0302cd0a71e8d029739b8765be27

SHA256
e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

SHA512
e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

Download Submit
C:\EdgeAutomationData\Default\Local Storage\leveldb\MANIFEST-000001
Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\EdgeAutomationData\Default\Preferences
Filesize
4KB

MD5
a9606de631d404dc0492fd1c0955f686

SHA1
f7d620f56e30ef702acf0d1758e09d2f8acb62dd

SHA256
77470eda69effdb7e926b5b78d75930910fac4fc12eded1dab1358663bbf1bec

SHA512
6432e729f98d77ab284c15cc9524472db0947e5a6c1332958cc1d0e95d521dfc1ee5a722d0f4284801a525199e9f06bb03d79e43c39e0c7f40729c99b361324a

Download Submit
C:\EdgeAutomationData\Default\Secure Preferences
Filesize
24KB

MD5
265954554dd186fde0ca9bea27ecbab6

SHA1
d07a5baffd116dd4c48025cdd0a2b018780c7f5f

SHA256
26134bb29e726d2b7929ae75b06efa9156e9ffe6e1771057e927f936a03c384d

SHA512
91b7b291f1d95e9134788d7402bae796bab9f68e3b58b50cf00322ecb4302b9291bc7abb94de4b134092acffe3560de5a281f257f73dbd894f4a20302a606d1f

Download Submit
C:\EdgeAutomationData\Default\Secure Preferences~RFe58170d.TMP
Filesize
24KB

MD5
f84ee5d94fcf45dac38943f74ecdaffa

SHA1
154ed74e16f48ce79b657f6ac9937528e5ecc3ef

SHA256
b4c25221e2f6435202b83c2e54dea1df47d6ba44945af7e2833b82df562aca22

SHA512
f7889ead7f3d96b55fdb5da5adad2dbc0d042317fac6ed40855d2b07c2974689b4f123c1dbe5ae1e78d5bdae9cd0e1dfb873176d351724e0f6e14175070a1705

Download Submit
C:\EdgeAutomationData\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\48eb01f0-a54d-436e-9eff-34cea45e6461.tmp
Filesize
59B

MD5
2800881c775077e1c4b6e06bf4676de4

SHA1
2873631068c8b3b9495638c865915be822442c8b

SHA256
226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

SHA512
e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

Download Submit
C:\EdgeAutomationData\Default\Sync Data\LevelDB\CURRENT
Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\EdgeAutomationData\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Program Files\Google\Chrome\Application\SetupMetrics\011e9eaf-20e8-4d13-8c71-24e1824d666f.tmp
Filesize
488B

MD5
6d971ce11af4a6a93a4311841da1a178

SHA1
cbfdbc9b184f340cbad764abc4d8a31b9c250176

SHA256
338ddefb963d5042cae01de7b87ac40f4d78d1bfa2014ff774036f4bc7486783

SHA512
c58b59b9677f70a5bb5efd0ecbf59d2ac21cbc52e661980241d3be33663825e2a7a77adafbcec195e1d9d89d05b9ccb5e5be1a201f92cb1c1f54c258af16e29f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\chat.exe.log
Filesize
226B

MD5
916851e072fbabc4796d8916c5131092

SHA1
d48a602229a690c512d5fdaf4c8d77547a88e7a2

SHA256
7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d

SHA512
07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{b55e0e6e-1203-45f6-9ab6-5938f9296b11}\0.0.filtertrie.intermediate.txt
Filesize
28KB

MD5
ab6db363a3fc9e4af2864079fd88032d

SHA1
aa52099313fd6290cd6e57d37551d63cd96dbe45

SHA256
373bb433c2908af2e3de58ede2087642814564560d007e61748cdb48d4e9da3f

SHA512
d3d13d17df96705d0de119ad0f8380bfe6b7bc44c618e2fcd0233061a0ab15beae44d38c48a880121b35f90f56c1529e5f4cf1a19acb9e2cbba5d1c402c749c0

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{b55e0e6e-1203-45f6-9ab6-5938f9296b11}\0.1.filtertrie.intermediate.txt
Filesize
5B

MD5
34bd1dfb9f72cf4f86e6df6da0a9e49a

SHA1
5f96d66f33c81c0b10df2128d3860e3cb7e89563

SHA256
8e1e6a3d56796a245d0c7b0849548932fee803bbdb03f6e289495830e017f14c

SHA512
e3787de7c4bc70ca62234d9a4cdc6bd665bffa66debe3851ee3e8e49e7498b9f1cbc01294bf5e9f75de13fb78d05879e82fa4b89ee45623fe5bf7ac7e48eda96

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{b55e0e6e-1203-45f6-9ab6-5938f9296b11}\0.2.filtertrie.intermediate.txt
Filesize
5B

MD5
c204e9faaf8565ad333828beff2d786e

SHA1
7d23864f5e2a12c1a5f93b555d2d3e7c8f78eec1

SHA256
d65b6a3bf11a27a1ced1f7e98082246e40cf01289fd47fe4a5ed46c221f2f73f

SHA512
e72f4f79a4ae2e5e40a41b322bc0408a6dec282f90e01e0a8aaedf9fb9d6f04a60f45a844595727539c1643328e9c1b989b90785271cc30a6550bbda6b1909f8

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{b55e0e6e-1203-45f6-9ab6-5938f9296b11}\Apps.ft
Filesize
38KB

MD5
84ac0c242b77b8fc326db0a5926b089e

SHA1
cc6b367ae8eb38561de01813b7d542067fb2318f

SHA256
b1557167a6df424f8b28aabd31d1b7e8a469dd50d2ae4cbbd43afd8f9c62cf92

SHA512
8f63084bd5a270b7b05e80454d26127b69bcb98ec93d9fad58d77203934f46b677a3aaf20f29e73dcd7035deb61f4c0aa3b10acbc4c0fc210632c1d74f705d2f

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{b55e0e6e-1203-45f6-9ab6-5938f9296b11}\Apps.index
Filesize
1.0MB

MD5
f4514c93191e0efc0f61036e4ebb341a

SHA1
c80478e9a734790c18584f67a43518aa4a7dcf58

SHA256
43da4fa5f62affe399ceaac2d489b7cde610963a48e72d445bebe6f2c63a3600

SHA512
8aecb3491767e040a52f351908004db2c8f2f083397744585c2832212ec8aa288d3492be941a48b04774e16b43672ab167209776cbdef6692fef684fc54666a6

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133600886831198745.txt
Filesize
75KB

MD5
79ea60e4feeffe4483ba2d0ea61852fb

SHA1
7d5921a1b6240cc717ad4f4478bbcfc42f3af8e8

SHA256
1e85f6cd486b20682b1a6af9f34e7993a558f3b5dccd1e80a55178847e794923

SHA512
4d0866c2b63af9570fa20bca628a6e67b3704d7ab5a8a1311fb614f38b54444cc6630390092282f075751cae38000a17e4bf1cb992a8900b0c72965c0b24dbf4

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_53w1yauj.14m.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\b98c713f-61d1-4826-ab82-4249ce9e1b66.tmp
Filesize
1B

MD5
5058f1af8388633f609cadb75a75dc9d

SHA1
3a52ce780950d4d969792a2559cd519d7ee8c727

SHA256
cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

SHA512
0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

Download Submit
C:\Users\Admin\AppData\Local\Temp\chrome_installer.log
Filesize
8KB

MD5
5dc9ac98bbfbb2822be90c9ac4604bc3

SHA1
ef01ef7af4868a63cb21500718d8250be570d23d

SHA256
d2ad931b47b3ae3d1594c251c4731e06baa03009b487666d3b2fc587790996f5

SHA512
495fe6641b9790d38fc3e6fb06e78d97f57f52f327ec7ab092fbf8ec699b6a20e7a71270a3738cdbc01716449fc804fa7c07bea6abe3004d96de855fe3a3beee

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir996_918511415\9f06e7db-03fa-4c27-b288-63961817b9ed.tmp
Filesize
99KB

MD5
e0bf4de8cdda0b744131562838ba81d2

SHA1
44990a237dce7eb1543b4e2c572fd098af3be4f1

SHA256
506e1674928b76193ce69e72bae0e0eec9484337eee6e241267678c49a5623c4

SHA512
8d976b8f1aef23eb8d3bddda99d2ba8a3c4f686be0a767a373a1ba071bfea701cf3247b0202df79130293e73ac85c30ff1d94b41f04c319588f97b8079e1ca5f

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir996_918511415\CRX_INSTALL\_locales\en_CA\messages.json
Filesize
711B

MD5
558659936250e03cc14b60ebf648aa09

SHA1
32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825

SHA256
2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b

SHA512
1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp59E7.tmp
Filesize
1KB

MD5
b6a77db7c8b31f65bb26c9e724d7fa68

SHA1
d0f030fb9977352ff658d4b562c474b3126d6e41

SHA256
d4aed55472970da1681ce6ae1ddb9a64ca6369e5aa2dee4a568f7ae78264e182

SHA512
cdffa7d32d7b9d4c6d264d2d853d6b5e12718071d1323d24be03f0ea76e18c29e7691514c07a737071d101cbb774837efaf5da1c735bf3062d5f1bbab41e0bd6

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome (2).lnk
Filesize
2KB

MD5
241ba602d4839c5cbdf3f6c4a35b8924

SHA1
889098555dc80ddb1d3926a8638dd7feb390172c

SHA256
8456e7ee8bd36795d2c31b598ba0603e07a048760261695b458a7e0b73a8d465

SHA512
121974d4f341bdbfc96a6dc2b7628df51380b8a48de8162ac87123350de376e5bf4c9d4ca1f02e5d202d6d8cca298dfc7bceca0ef4b521e63c02da58473c5c87

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\L97WHYZU0JIJ17863ZBV.temp
Filesize
3KB

MD5
ffcaf96fe2229e23b454d2be60c0ce5c

SHA1
02e59149009a45ae7ca75e66f15280d9c0bc8f26

SHA256
6fa4ca9e0b60a4fa09974d257961e2cc96d6c12347a9181067b79d86e2a19618

SHA512
9586bec14b0adca155004977a750e7c948ea08db90109b139a560ecbc44e8d67fa542acbc8269490721ee980c3d85a1011d3c7c4ac0d5c699276b2cfe0600c35

Download Submit
C:\Users\Admin\AppData\Roaming\XenoManager\chat.exe
Filesize
45KB

MD5
87639df87df52ab646411f86c2fce0c3

SHA1
6d6d21dd0af987380edc0b4fafebfc6d3e5d9a1c

SHA256
9c8bf9ebe2a4086492d67929fd36c4918e7d9069d67d3aa43faf24e25cb6bfe0

SHA512
39dacf01b97b0189644533dd545594d8daa755ea6d9cd1a2b61fa4dead15e6a088edf969c1487683fb35a623ac4e22ab0ecbb72bad4e5a9e770c6f0fc986e578

Download Submit
C:\Users\Admin\Desktop\Microsoft Edge.lnk
Filesize
2KB

MD5
4c81090a5051487e1ff231ccb85d395d

SHA1
8eec3f85a19089e933a54ece6fd48712caf0910f

SHA256
160a76f01a69e1e9e9b1db6228364d6f81cbc30a289f849022f2c60c2005c035

SHA512
14cbac016729227109e450c68d5b3b4ae8bdf40c466336f39566b060f9482d471d65adfa9904e72700de6b1c65022afbb5a88a8535ac827b214b09e67dbe3e15

Download Submit
C:\Windows\TEMP\Crashpad\settings.dat
Filesize
40B

MD5
6e9319c87d01b21884d7f851cb25d666

SHA1
4d08696e6b04bd0932925cb09d5ef21091b777a5

SHA256
40c16af51c11d7adc21004018a8d0fb7f4450fa2b96563559fca1add101264a2

SHA512
bae6da753827bcbdb90d2d47d4228a44c02fd79cea631eab033c675794809d0b24da3d51b1ebe6a3b3a5ad6b1c2889a52aafe535f02241ab68529709f8040e40

Download Submit
\??\pipe\LOCAL\crashpad_1948_PLNKXEIKQQHKMQFW
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1320-537-0x00000000031D0000-0x00000000031D1000-memory.dmp

Filesize
4KB

Download
memory/2340-28-0x0000000006850000-0x0000000006862000-memory.dmp

Filesize
72KB

Download
memory/2340-29-0x0000000006A60000-0x0000000006AF2000-memory.dmp

Filesize
584KB

Download
memory/2340-16-0x0000000074640000-0x0000000074DF0000-memory.dmp

Filesize
7.7MB

Download
memory/2340-1296-0x00000000018E0000-0x00000000018EA000-memory.dmp

Filesize
40KB

Download
memory/2340-1297-0x0000000008C50000-0x00000000091F4000-memory.dmp

Filesize
5.6MB

Download
memory/2340-23-0x00000000063C0000-0x00000000063CC000-memory.dmp

Filesize
48KB

Download
memory/2340-27-0x00000000067C0000-0x00000000067CA000-memory.dmp

Filesize
40KB

Download
memory/2340-15-0x0000000074640000-0x0000000074DF0000-memory.dmp

Filesize
7.7MB

Download
memory/2340-22-0x0000000074640000-0x0000000074DF0000-memory.dmp

Filesize
7.7MB

Download
memory/2340-21-0x0000000074640000-0x0000000074DF0000-memory.dmp

Filesize
7.7MB

Download
memory/2340-20-0x0000000006380000-0x0000000006392000-memory.dmp

Filesize
72KB

Download
memory/2340-19-0x00000000063D0000-0x0000000006436000-memory.dmp

Filesize
408KB

Download
memory/3856-1-0x0000000000D20000-0x0000000000D32000-memory.dmp

Filesize
72KB

Download
memory/3856-0-0x000000007464E000-0x000000007464F000-memory.dmp

Filesize
4KB

Download
memory/5144-741-0x0000000004BC0000-0x0000000004BE2000-memory.dmp

Filesize
136KB

Download
memory/5144-885-0x0000000006C30000-0x0000000006C4A000-memory.dmp

Filesize
104KB

Download
memory/5144-884-0x0000000007290000-0x000000000790A000-memory.dmp

Filesize
6.5MB

Download
memory/5144-861-0x0000000006B90000-0x0000000006C06000-memory.dmp

Filesize
472KB

Download
memory/5144-859-0x0000000005FE0000-0x0000000006024000-memory.dmp

Filesize
272KB

Download
memory/5144-759-0x0000000006060000-0x00000000060AC000-memory.dmp

Filesize
304KB

Download
memory/5144-758-0x0000000005A90000-0x0000000005AAE000-memory.dmp

Filesize
120KB

Download
memory/5144-752-0x0000000005470000-0x00000000057C4000-memory.dmp

Filesize
3.3MB

Download
memory/5144-742-0x0000000005390000-0x00000000053F6000-memory.dmp

Filesize
408KB

Download
memory/5144-736-0x0000000004D60000-0x0000000005388000-memory.dmp

Filesize
6.2MB

Download
memory/5144-735-0x0000000002150000-0x0000000002186000-memory.dmp

Filesize
216KB

Download
memory/6656-576-0x000001F00C820000-0x000001F00C840000-memory.dmp

Filesize
128KB

Download
memory/6656-591-0x000001F00CC20000-0x000001F00CC40000-memory.dmp

Filesize
128KB

Download
memory/6656-568-0x000001F00C860000-0x000001F00C880000-memory.dmp

Filesize
128KB

Download
memory/6656-562-0x000001E80A500000-0x000001E80A600000-memory.dmp

Filesize
1024KB

Download

Analysis

Sharing

Errors

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads