"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://github.com

Signatures

Chaos

ransomware chaos

Chaos Ransomware

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Deletes shadow copies

ransomware defense_evasion impact execution

Modifies boot configuration data using bcdedit

ransomware evasion

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\system32\bcdedit.exe	N/A
N/A	N/A	C:\Windows\system32\bcdedit.exe	N/A

Renames multiple (217) files with added filename extension

ransomware

Deletes backup catalog

ransomware

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\system32\wbadmin.exe	N/A

Downloads MZ/PE file

Checks computer location settings

Description	Indicator	Process	Target
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\Downloads\A.exe	N/A
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Roaming\a.exe	N/A

Drops startup file

Description	Indicator	Process	Target
File opened for modification	\??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\a.url	C:\Windows\system32\taskmgr.exe	N/A
File opened for modification	\??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\decrypt.txt	C:\Windows\system32\taskmgr.exe	N/A
File opened for modification	\??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\desktop.ini.a_encrypted	C:\Windows\system32\taskmgr.exe	N/A
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a.url	C:\Users\Admin\AppData\Roaming\a.exe	N/A
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	C:\Users\Admin\AppData\Roaming\a.exe	N/A
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Decrypt.txt	C:\Users\Admin\AppData\Roaming\a.exe	N/A

Executes dropped EXE

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\Downloads\A.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\a.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\baby_ransomware_patched.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\baby_ransomware_patched.exe	N/A

Reads user/profile data of web browsers

spyware stealer

Drops desktop.ini file(s)

Description	Indicator	Process	Target
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-4124900551-4068476067-3491212533-1000\desktop.ini	C:\Users\Admin\AppData\Roaming\a.exe	N/A
File opened for modification	C:\Users\Admin\Videos\desktop.ini	C:\Users\Admin\AppData\Roaming\a.exe	N/A
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini	C:\Users\Admin\AppData\Roaming\a.exe	N/A
File opened for modification	C:\Users\Public\Documents\desktop.ini	C:\Users\Admin\AppData\Roaming\a.exe	N/A
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	C:\Users\Admin\AppData\Roaming\a.exe	N/A
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	C:\Users\Admin\AppData\Roaming\a.exe	N/A
File opened for modification	C:\Users\Public\Pictures\desktop.ini	C:\Users\Admin\AppData\Roaming\a.exe	N/A
File opened for modification	C:\Users\Admin\Music\desktop.ini	C:\Users\Admin\AppData\Roaming\a.exe	N/A
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	C:\Users\Admin\AppData\Roaming\a.exe	N/A
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	C:\Users\Admin\AppData\Roaming\a.exe	N/A
File opened for modification	C:\Users\Admin\Searches\desktop.ini	C:\Users\Admin\AppData\Roaming\a.exe	N/A
File opened for modification	C:\Users\Admin\Documents\desktop.ini	C:\Users\Admin\AppData\Roaming\a.exe	N/A
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	C:\Users\Admin\AppData\Roaming\a.exe	N/A
File opened for modification	C:\Users\Admin\OneDrive\desktop.ini	C:\Users\Admin\AppData\Roaming\a.exe	N/A
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini	C:\Users\Admin\AppData\Roaming\a.exe	N/A
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini	C:\Users\Admin\AppData\Roaming\a.exe	N/A
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	C:\Users\Admin\AppData\Roaming\a.exe	N/A
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini	C:\Users\Admin\AppData\Roaming\a.exe	N/A
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	C:\Users\Admin\AppData\Roaming\a.exe	N/A
File opened for modification	C:\Users\Admin\Links\desktop.ini	C:\Users\Admin\AppData\Roaming\a.exe	N/A
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	C:\Users\Admin\AppData\Roaming\a.exe	N/A
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	C:\Users\Admin\AppData\Roaming\a.exe	N/A
File opened for modification	C:\Users\Public\Videos\desktop.ini	C:\Users\Admin\AppData\Roaming\a.exe	N/A
File opened for modification	C:\Users\Admin\Pictures\Saved Pictures\desktop.ini	C:\Users\Admin\AppData\Roaming\a.exe	N/A
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini	C:\Users\Admin\AppData\Roaming\a.exe	N/A
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini	C:\Users\Admin\AppData\Roaming\a.exe	N/A
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	C:\Users\Admin\AppData\Roaming\a.exe	N/A
File opened for modification	C:\Users\Public\Desktop\desktop.ini	C:\Users\Admin\AppData\Roaming\a.exe	N/A
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini	C:\Users\Admin\AppData\Roaming\a.exe	N/A
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	C:\Users\Admin\AppData\Roaming\a.exe	N/A
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini	C:\Users\Admin\AppData\Roaming\a.exe	N/A
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	C:\Users\Admin\AppData\Roaming\a.exe	N/A
File opened for modification	C:\Users\Admin\Pictures\Camera Roll\desktop.ini	C:\Users\Admin\AppData\Roaming\a.exe	N/A
File opened for modification	C:\Users\Public\Music\desktop.ini	C:\Users\Admin\AppData\Roaming\a.exe	N/A

Legitimate hosting services abused for malware hosting/C2

Description	Indicator	Process	Target
N/A	raw.githubusercontent.com	N/A	N/A
N/A	raw.githubusercontent.com	N/A	N/A
N/A	raw.githubusercontent.com	N/A	N/A

Sets desktop wallpaper using registry

ransomware

Description	Indicator	Process	Target
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ucokh3hq7.jpg"	C:\Users\Admin\AppData\Roaming\a.exe	N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description	Indicator	Process	Target
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	C:\Windows\system32\taskmgr.exe	N/A
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	C:\Windows\System32\vds.exe	N/A
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	C:\Windows\System32\vds.exe	N/A
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	C:\Windows\System32\vds.exe	N/A
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	C:\Windows\System32\vds.exe	N/A
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	C:\Windows\system32\taskmgr.exe	N/A
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	C:\Windows\system32\taskmgr.exe	N/A

Enumerates system info in registry

Description	Indicator	Process	Target
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A

Interacts with shadow copies

ransomware

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\system32\vssadmin.exe	N/A

Modifies data under HKEY_USERS

Description	Indicator	Process	Target
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133601763552323797"	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A

Modifies registry class

Description	Indicator	Process	Target
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings	C:\Users\Admin\AppData\Roaming\a.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings	C:\Windows\system32\OpenWith.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\a_encrypted_auto_file\shell\edit\command	C:\Windows\system32\OpenWith.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\a_encrypted_auto_file\shell\edit	C:\Windows\system32\OpenWith.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\a_encrypted_auto_file\shell	C:\Windows\system32\OpenWith.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\a_encrypted_auto_file	C:\Windows\system32\OpenWith.exe	N/A
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\.a_encrypted\ = "a_encrypted_auto_file"	C:\Windows\system32\OpenWith.exe	N/A
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\a_encrypted_auto_file\shell\edit\command\ = "%SystemRoot%\\system32\\NOTEPAD.EXE %1"	C:\Windows\system32\OpenWith.exe	N/A
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\a_encrypted_auto_file\shell\open\command\ = "%SystemRoot%\\system32\\NOTEPAD.EXE %1"	C:\Windows\system32\OpenWith.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings	C:\Windows\system32\OpenWith.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\.a_encrypted	C:\Windows\system32\OpenWith.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\a_encrypted_auto_file\shell\open	C:\Windows\system32\OpenWith.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\a_encrypted_auto_file\shell\open\command	C:\Windows\system32\OpenWith.exe	N/A

Opens file in notepad (likely ransom note)

ransomware

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\system32\NOTEPAD.EXE	N/A

Suspicious behavior: AddClipboardFormatListener

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Roaming\a.exe	N/A

Suspicious behavior: EnumeratesProcesses

Description	Indicator	Process	Target
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\A.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\A.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\A.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\A.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\A.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\A.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\A.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\A.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\A.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\A.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\A.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\A.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\A.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\A.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\A.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\A.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\A.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\a.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\a.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\a.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\a.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\a.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\a.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\a.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\a.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\a.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\a.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\a.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\a.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\a.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\a.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\a.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\a.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\a.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\a.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\baby_ransomware_patched.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\baby_ransomware_patched.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\baby_ransomware_patched.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\baby_ransomware_patched.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\baby_ransomware_patched.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\baby_ransomware_patched.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\baby_ransomware_patched.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\baby_ransomware_patched.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\baby_ransomware_patched.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\baby_ransomware_patched.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\baby_ransomware_patched.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\baby_ransomware_patched.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\baby_ransomware_patched.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\baby_ransomware_patched.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\baby_ransomware_patched.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\baby_ransomware_patched.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\baby_ransomware_patched.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\baby_ransomware_patched.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\baby_ransomware_patched.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\baby_ransomware_patched.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\baby_ransomware_patched.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\baby_ransomware_patched.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\baby_ransomware_patched.exe	N/A

Suspicious behavior: GetForegroundWindowSpam

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\system32\OpenWith.exe	N/A

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Description	Indicator	Process	Target
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A

Suspicious use of AdjustPrivilegeToken

Description	Indicator	Process	Target
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A

Suspicious use of FindShellTrayWindow

Description	Indicator	Process	Target
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A

Suspicious use of SendNotifyMessage

Description	Indicator	Process	Target
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Windows\system32\taskmgr.exe	N/A
N/A	N/A	C:\Windows\system32\taskmgr.exe	N/A
N/A	N/A	C:\Windows\system32\taskmgr.exe	N/A
N/A	N/A	C:\Windows\system32\taskmgr.exe	N/A
N/A	N/A	C:\Windows\system32\taskmgr.exe	N/A
N/A	N/A	C:\Windows\system32\taskmgr.exe	N/A
N/A	N/A	C:\Windows\system32\taskmgr.exe	N/A
N/A	N/A	C:\Windows\system32\taskmgr.exe	N/A
N/A	N/A	C:\Windows\system32\taskmgr.exe	N/A
N/A	N/A	C:\Windows\system32\taskmgr.exe	N/A
N/A	N/A	C:\Windows\system32\taskmgr.exe	N/A
N/A	N/A	C:\Windows\system32\taskmgr.exe	N/A
N/A	N/A	C:\Windows\system32\taskmgr.exe	N/A
N/A	N/A	C:\Windows\system32\taskmgr.exe	N/A
N/A	N/A	C:\Windows\system32\taskmgr.exe	N/A
N/A	N/A	C:\Windows\system32\taskmgr.exe	N/A

Suspicious use of SetWindowsHookEx

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\system32\OpenWith.exe	N/A
N/A	N/A	C:\Windows\system32\OpenWith.exe	N/A
N/A	N/A	C:\Windows\system32\OpenWith.exe	N/A
N/A	N/A	C:\Windows\system32\OpenWith.exe	N/A
N/A	N/A	C:\Windows\system32\OpenWith.exe	N/A
N/A	N/A	C:\Windows\system32\OpenWith.exe	N/A
N/A	N/A	C:\Windows\system32\OpenWith.exe	N/A
N/A	N/A	C:\Windows\system32\OpenWith.exe	N/A
N/A	N/A	C:\Windows\system32\OpenWith.exe	N/A
N/A	N/A	C:\Windows\system32\OpenWith.exe	N/A
N/A	N/A	C:\Windows\system32\OpenWith.exe	N/A
N/A	N/A	C:\Windows\system32\OpenWith.exe	N/A
N/A	N/A	C:\Windows\system32\OpenWith.exe	N/A
N/A	N/A	C:\Windows\system32\OpenWith.exe	N/A
N/A	N/A	C:\Windows\system32\OpenWith.exe	N/A
N/A	N/A	C:\Windows\system32\OpenWith.exe	N/A
N/A	N/A	C:\Windows\system32\OpenWith.exe	N/A
N/A	N/A	C:\Windows\system32\OpenWith.exe	N/A
N/A	N/A	C:\Windows\system32\OpenWith.exe	N/A
N/A	N/A	C:\Windows\system32\OpenWith.exe	N/A
N/A	N/A	C:\Windows\system32\OpenWith.exe	N/A
N/A	N/A	C:\Windows\system32\OpenWith.exe	N/A
N/A	N/A	C:\Windows\system32\OpenWith.exe	N/A
N/A	N/A	C:\Windows\system32\OpenWith.exe	N/A
N/A	N/A	C:\Windows\system32\OpenWith.exe	N/A
N/A	N/A	C:\Windows\system32\OpenWith.exe	N/A
N/A	N/A	C:\Windows\system32\OpenWith.exe	N/A
N/A	N/A	C:\Windows\system32\OpenWith.exe	N/A
N/A	N/A	C:\Windows\system32\OpenWith.exe	N/A
N/A	N/A	C:\Windows\system32\OpenWith.exe	N/A
N/A	N/A	C:\Windows\system32\OpenWith.exe	N/A
N/A	N/A	C:\Windows\system32\OpenWith.exe	N/A
N/A	N/A	C:\Windows\system32\OpenWith.exe	N/A
N/A	N/A	C:\Windows\system32\OpenWith.exe	N/A
N/A	N/A	C:\Windows\system32\OpenWith.exe	N/A
N/A	N/A	C:\Windows\system32\OpenWith.exe	N/A
N/A	N/A	C:\Windows\system32\OpenWith.exe	N/A
N/A	N/A	C:\Windows\system32\OpenWith.exe	N/A
N/A	N/A	C:\Windows\system32\OpenWith.exe	N/A
N/A	N/A	C:\Windows\system32\OpenWith.exe	N/A

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

persistence

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffad028ab58,0x7ffad028ab68,0x7ffad028ab78

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1728 --field-trial-handle=1816,i,10928337994186516521,15873116998551267156,131072 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 --field-trial-handle=1816,i,10928337994186516521,15873116998551267156,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2184 --field-trial-handle=1816,i,10928337994186516521,15873116998551267156,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2996 --field-trial-handle=1816,i,10928337994186516521,15873116998551267156,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3012 --field-trial-handle=1816,i,10928337994186516521,15873116998551267156,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3652 --field-trial-handle=1816,i,10928337994186516521,15873116998551267156,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3384 --field-trial-handle=1816,i,10928337994186516521,15873116998551267156,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3388 --field-trial-handle=1816,i,10928337994186516521,15873116998551267156,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4572 --field-trial-handle=1816,i,10928337994186516521,15873116998551267156,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3000 --field-trial-handle=1816,i,10928337994186516521,15873116998551267156,131072 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=1536 --field-trial-handle=1816,i,10928337994186516521,15873116998551267156,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=2340 --field-trial-handle=1816,i,10928337994186516521,15873116998551267156,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5008 --field-trial-handle=1816,i,10928337994186516521,15873116998551267156,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4944 --field-trial-handle=1816,i,10928337994186516521,15873116998551267156,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=2608 --field-trial-handle=1816,i,10928337994186516521,15873116998551267156,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4536 --field-trial-handle=1816,i,10928337994186516521,15873116998551267156,131072 /prefetch:8

C:\Users\Admin\Downloads\A.exe

"C:\Users\Admin\Downloads\A.exe"

C:\Users\Admin\AppData\Roaming\a.exe

"C:\Users\Admin\AppData\Roaming\a.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C vssadmin delete shadows /all /quiet & wmic shadowcopy delete

C:\Windows\system32\vssadmin.exe

vssadmin delete shadows /all /quiet

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\System32\Wbem\WMIC.exe

wmic shadowcopy delete

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} recoveryenabled no

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet

C:\Windows\system32\wbadmin.exe

wbadmin delete catalog -quiet

C:\Windows\system32\wbengine.exe

"C:\Windows\system32\wbengine.exe"

C:\Windows\System32\vdsldr.exe

C:\Windows\System32\vdsldr.exe -Embedding

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

C:\Windows\system32\NOTEPAD.EXE

"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\Decrypt.txt

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

C:\Windows\system32\NOTEPAD.EXE

"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Microsoft Edge.lnk.a_encrypted

C:\Windows\system32\NOTEPAD.EXE

"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Public\Desktop\VLC media player.lnk.a_encrypted

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffad028ab58,0x7ffad028ab68,0x7ffad028ab78

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1768 --field-trial-handle=1980,i,7131772505576967414,16326573843730714754,131072 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2092 --field-trial-handle=1980,i,7131772505576967414,16326573843730714754,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2224 --field-trial-handle=1980,i,7131772505576967414,16326573843730714754,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3120 --field-trial-handle=1980,i,7131772505576967414,16326573843730714754,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3140 --field-trial-handle=1980,i,7131772505576967414,16326573843730714754,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3652 --field-trial-handle=1980,i,7131772505576967414,16326573843730714754,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4488 --field-trial-handle=1980,i,7131772505576967414,16326573843730714754,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4456 --field-trial-handle=1980,i,7131772505576967414,16326573843730714754,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4556 --field-trial-handle=1980,i,7131772505576967414,16326573843730714754,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4568 --field-trial-handle=1980,i,7131772505576967414,16326573843730714754,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5000 --field-trial-handle=1980,i,7131772505576967414,16326573843730714754,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=4644 --field-trial-handle=1980,i,7131772505576967414,16326573843730714754,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=4920 --field-trial-handle=1980,i,7131772505576967414,16326573843730714754,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4904 --field-trial-handle=1980,i,7131772505576967414,16326573843730714754,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3512 --field-trial-handle=1980,i,7131772505576967414,16326573843730714754,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3188 --field-trial-handle=1980,i,7131772505576967414,16326573843730714754,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3200 --field-trial-handle=1980,i,7131772505576967414,16326573843730714754,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3160 --field-trial-handle=1980,i,7131772505576967414,16326573843730714754,131072 /prefetch:8

C:\Users\Admin\Downloads\baby_ransomware_patched.exe

"C:\Users\Admin\Downloads\baby_ransomware_patched.exe"

C:\Users\Admin\Downloads\baby_ransomware_patched.exe

"C:\Users\Admin\Downloads\baby_ransomware_patched.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3596 --field-trial-handle=1980,i,7131772505576967414,16326573843730714754,131072 /prefetch:2

C:\Windows\system32\taskmgr.exe

"C:\Windows\system32\taskmgr.exe" /7

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	github.com	udp
GB	20.26.156.215:80	github.com	tcp
GB	20.26.156.215:80	github.com	tcp
GB	20.26.156.215:443	github.com	tcp
US	8.8.8.8:53	github.githubassets.com	udp
US	8.8.8.8:53	avatars.githubusercontent.com	udp
US	185.199.108.133:443	avatars.githubusercontent.com	tcp
US	185.199.108.154:443	github.githubassets.com	tcp
US	185.199.108.154:443	github.githubassets.com	tcp
US	185.199.108.154:443	github.githubassets.com	tcp
US	185.199.108.154:443	github.githubassets.com	tcp
US	185.199.108.154:443	github.githubassets.com	tcp
US	185.199.108.154:443	github.githubassets.com	tcp
US	8.8.8.8:53	github-cloud.s3.amazonaws.com	udp
US	8.8.8.8:53	user-images.githubusercontent.com	udp
US	185.199.108.154:443	github.githubassets.com	tcp
US	185.199.108.154:443	github.githubassets.com	tcp
US	185.199.108.154:443	github.githubassets.com	tcp
US	185.199.108.154:443	github.githubassets.com	tcp
US	185.199.108.154:443	github.githubassets.com	tcp
US	185.199.108.154:443	github.githubassets.com	tcp
US	8.8.8.8:53	8.8.8.8.in-addr.arpa	udp
US	8.8.8.8:53	170.201.250.142.in-addr.arpa	udp
US	8.8.8.8:53	215.156.26.20.in-addr.arpa	udp
US	8.8.8.8:53	133.108.199.185.in-addr.arpa	udp
US	8.8.8.8:53	154.108.199.185.in-addr.arpa	udp
US	8.8.8.8:53	content-autofill.googleapis.com	udp
FR	216.58.214.170:443	content-autofill.googleapis.com	tcp
US	8.8.8.8:53	collector.github.com	udp
US	140.82.113.22:443	collector.github.com	tcp
US	140.82.113.22:443	collector.github.com	tcp
US	140.82.113.22:443	collector.github.com	tcp
US	8.8.8.8:53	api.github.com	udp
GB	20.26.156.210:443	api.github.com	tcp
US	8.8.8.8:53	170.214.58.216.in-addr.arpa	udp
US	8.8.8.8:53	22.113.82.140.in-addr.arpa	udp
US	8.8.8.8:53	g.bing.com	udp
US	204.79.197.237:443	g.bing.com	tcp
US	8.8.8.8:53	210.156.26.20.in-addr.arpa	udp
US	8.8.8.8:53	237.197.79.204.in-addr.arpa	udp
US	8.8.8.8:53	79.190.18.2.in-addr.arpa	udp
US	8.8.8.8:53	23.177.190.20.in-addr.arpa	udp
BE	88.221.83.208:443	www.bing.com	tcp
N/A	224.0.0.251:5353		udp
US	8.8.8.8:53	208.83.221.88.in-addr.arpa	udp
US	8.8.8.8:53	50.23.12.20.in-addr.arpa	udp
US	8.8.8.8:53	15.164.165.52.in-addr.arpa	udp
US	8.8.8.8:53	240.221.184.93.in-addr.arpa	udp
US	8.8.8.8:53	44.56.20.217.in-addr.arpa	udp
US	8.8.8.8:53	api.github.com	udp
GB	20.26.156.210:443	api.github.com	tcp
US	8.8.8.8:53	github.com	udp
GB	20.26.156.215:443	github.com	tcp
US	185.199.108.133:443	user-images.githubusercontent.com	tcp
US	8.8.8.8:53	github-cloud.s3.amazonaws.com	udp
US	8.8.8.8:53	19.229.111.52.in-addr.arpa	udp
US	8.8.8.8:53	github.com	udp
US	8.8.8.8:53	api.github.com	udp
GB	20.26.156.215:443	github.com	tcp
GB	20.26.156.210:443	api.github.com	tcp
US	8.8.8.8:53	github-cloud.s3.amazonaws.com	udp
US	8.8.8.8:53	content-autofill.googleapis.com	udp
FR	142.250.179.74:443	content-autofill.googleapis.com	udp
US	8.8.8.8:53	74.179.250.142.in-addr.arpa	udp
US	8.8.8.8:53	raw.githubusercontent.com	udp
US	185.199.110.133:443	raw.githubusercontent.com	tcp
US	8.8.8.8:53	133.110.199.185.in-addr.arpa	udp
GB	20.26.156.210:443	api.github.com	tcp
US	8.8.8.8:53	www.google.com	udp
FR	142.250.178.132:443	www.google.com	tcp
FR	142.250.178.132:443	www.google.com	udp
US	8.8.8.8:53	227.75.250.142.in-addr.arpa	udp
US	8.8.8.8:53	132.178.250.142.in-addr.arpa	udp
US	8.8.8.8:53	play.google.com	udp
FR	142.250.179.78:443	play.google.com	udp
US	8.8.8.8:53	78.179.250.142.in-addr.arpa	udp
US	8.8.8.8:53	clients2.google.com	udp
FR	142.250.178.142:443	clients2.google.com	udp
FR	142.250.178.142:443	clients2.google.com	tcp
US	8.8.8.8:53	142.178.250.142.in-addr.arpa	udp
US	8.8.8.8:53	github.com	udp
GB	20.26.156.215:443	github.com	tcp
US	185.199.108.154:443	github.githubassets.com	tcp
US	185.199.108.133:443	raw.githubusercontent.com	tcp
US	8.8.8.8:53	github-cloud.s3.amazonaws.com	udp
US	8.8.8.8:53	collector.github.com	udp
US	140.82.113.22:443	collector.github.com	tcp
US	8.8.8.8:53	api.github.com	udp
GB	20.26.156.210:443	api.github.com	tcp
US	185.199.108.154:443	github.githubassets.com	tcp
US	8.8.8.8:53	25.173.189.20.in-addr.arpa	udp
US	8.8.8.8:53	github.com	udp
GB	20.26.156.215:443	github.com	tcp
US	185.199.108.154:443	github.githubassets.com	tcp
US	8.8.8.8:53	github-cloud.s3.amazonaws.com	udp
US	8.8.8.8:53	api.github.com	udp
GB	20.26.156.210:443	api.github.com	tcp
US	185.199.110.133:443	raw.githubusercontent.com	tcp
US	185.199.108.154:443	github.githubassets.com	tcp
US	8.8.8.8:53	github-cloud.s3.amazonaws.com	udp
US	8.8.8.8:53	github.com	udp
GB	20.26.156.215:443	github.com	tcp
US	8.8.8.8:53	api.github.com	udp
GB	20.26.156.210:443	api.github.com	tcp

Files

\??\pipe\crashpad_3016_USMRALMMYNUSHXFX

MD5	d41d8cd98f00b204e9800998ecf8427e
SHA1	da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256	e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512	cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

MD5	d751713988987e9331980363e24189ce
SHA1	97d170e1550eee4afc0af065b78cda302a97674c
SHA256	4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512	b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5	be99f41efb701ce0b386999d53f5b1fd
SHA1	42688e9279c205f2b2685957acde1ec51342477f
SHA256	73e2f80d05a597b422ae82333b8dfc5a6163ff3aae22014e09d1673410c0803f
SHA512	a75e19d0b939f789982343f9f159afe26e657f9feb6b70160a8ddf490ac6ab8c1d4dcdb83284f30c057a1c02a483e0f4cd464e06f337c764a1f7e5ee6db498dd

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5	24fdbb5641e55f60c3e8389baa209157
SHA1	efa6895e82a3ea3f7856f046c71dc0f09f6f6e15
SHA256	1f3ece7817ad9f3c73b9a316c9bf3951f32bca08873f345695d840dbf0e25edc
SHA512	7bc3593f89126421bdfa9cd301d7c25d2149bb317a0072069a1a6b1feb7f11e1213f02755d66318fec22309dfa2d400269bc032370b3bcb064667b0a4165ae9f

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5	f24782d76aeebc5e0175058e7e2ae61c
SHA1	61f15444cb517ce849cf1cc32cd108c40a453ec4
SHA256	d50069682a571158bfa7bc98e7a4e385f6e178a45e8dca522ae5e387165c9f7c
SHA512	751705cbe46f413de5624cd4da6a61bfff85a10fe58c24308f635f1918301af730f874d2df4e78c7d88e61047ef4fc913cd7b54a7878aa3abb64f679b80b66a6

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5	4f6872b861e4ec2a040c30c937a84ce6
SHA1	9f9ff6cdd391fc8cf2c9225a10f196edfcb16b58
SHA256	9f88cc097aac640745294a12ae29c0414c9456629d90cf603ea3f509ff8b12e0
SHA512	383fc7606a7959c601a0eccf2be64c217308518eaad2c2faf08747ef447c6112f857fe1e5660b7449525dd06e851b85cc6dbb313909e0aae81f473c457024836

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

MD5	6a282e837fb4dcbe6deb5f2e91574ecc
SHA1	74ef08b6f12470fa7f7d3c78d4a647dd74701f93
SHA256	bd26ee91ebaee1313e974faed566d0902289810a8be27455c9600ed965d00893
SHA512	bba7c3ce5cc73da70d8736a1c75241d2b73d18342b8f52a2a00200050357167424a40b1e737d351c8c1d903dc7c31595721188019ded0f81492da46b4af7903f

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5	0aa85bafe6c81d887a4a96f83a91bd1a
SHA1	2a9b34b448ca78334e165c23be72e9e86fc8d64b
SHA256	fcd0d5ccc16b07c235d489b79954c33f2cc8b8f7a1505b4962f5b916ab561a12
SHA512	4d973b363092922f25bb42bb1daa51b23a8cbf8ee4b9b702c4c02aaa9ae4d7f216f34fafe3b7ae5f4b33eafa2600d942412f550582f387e892d192a072cfd2e5

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\d32f5cdc-39e1-4051-b0cc-be7d3de5a2fb.tmp

MD5	0a22319eb43b57c64c0136767c2a2ef4
SHA1	13ece55f48c27967d7203de98a56a1814e64d8f6
SHA256	196c42049fc0eb2afea266ee5dc9a5228e838faa79c62c8374ec0cdef5504c8d
SHA512	168291b2d86f820d2e5426d491ada521cf2a2a8c0cf33c5285dc1edffbf486857bbbe23c0805b6526b7e29e3a11bfa67e38c42cf60891bb4cea1c7e14ec51a4c

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5	27378bf0dd6b46d110c7f75252dec0a1
SHA1	fd7c1210e9e174308e4b0929b5d0825f0b3dc33d
SHA256	38a855baa7b1057ec7cb65fbc545853e5cd5838f6eb8af67f62be2f26df67d90
SHA512	52c2dc76bad23d9175213c35b7b40fbc92cb8feda2166648846df5e1abf36fc0684f7bc107eda21a048c0e0924b5b9abfbe84c34ed2f8f6923b5f3d7e6acc8ca

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

MD5	aa8d3b4c455013292db740338a62d9c9
SHA1	46f455fb408fdff3ec1f2ff7de10a83b80017ce3
SHA256	ea9cc5af8691456c532eca608a695f2a811762979fe9246a064435a2065274ca
SHA512	ad883c733c3468b01f932b6b5158b58481e39c63cec4931630824439b10c0a1f91cda382bbc30f7cf9f675b5b58d1aff254111346e07e23d4caa28a759ecca3e

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5	a9ec03a1a7aa5a44745cfd721a51eaa3
SHA1	2c3ed286b6537fc89b5012d545faf75d7e5f7a72
SHA256	ca8e2b4d2f6e331c8e9d7188f2398ae12a0781fa50f61937595403b07eee90e6
SHA512	898da6c9ab50675751c13c360605fe6cbc9e3a42e93c9a0463e969320571ca0468b853990e6cde265b6dfee9c3c7084af95ac280984c8ba1212b172f2fbbe432

C:\Users\Admin\Downloads\A.exe

MD5	814645403a26c34ff569a283acf5d362
SHA1	e1e4619b7f15319d5fb398ac7cef0cdb6bc74872
SHA256	f070dee3ae82c72ce24336f836b6f513f6dc64a9959b647f0c47c77dc56b3bd0
SHA512	d56a7c8de9fd2e15bcb239a96e5bd7453beea9507f9e3da4fd5299d2e6e9b2a8d2646ea5be4cbc142ef0acc4870ba830f2dd233739b2ce4b81405c762d5f6e64

memory/208-455-0x00007FFABE313000-0x00007FFABE315000-memory.dmp

memory/208-454-0x00000000001E0000-0x0000000000212000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\a.exe.log

MD5	28d7fcc2b910da5e67ebb99451a5f598
SHA1	a5bf77a53eda1208f4f37d09d82da0b9915a6747
SHA256	2391511d0a66ed9f84ae54254f51c09e43be01ad685db80da3201ec880abd49c
SHA512	2d8eb65cbf04ca506f4ef3b9ae13ccf05ebefab702269ba70ffd1ce9e6c615db0a3ee3ac0e81a06f546fc3250b7b76155dd51241c41b507a441b658c8e761df6

memory/4780-469-0x00007FFABE310000-0x00007FFABEDD1000-memory.dmp

memory/4780-477-0x00007FFABE310000-0x00007FFABEDD1000-memory.dmp

C:\Users\Admin\Documents\Decrypt.txt

MD5	b13833f243ffbf4bd18609bde2d23c72
SHA1	ddd5c9ee674f02d3f37572374a07329cfeb0c04d
SHA256	242b9759f1ea24944d6b3dd5e93cd75c1460d9dc9070b08b65330ac6613fc5e4
SHA512	258cd1de7d7f3a84398aff7f082e8718bdc02e981606c1def3e0b3dff64f9b4545f73d53dc7276c1247845f8f9b97957050eb8a66ef30bddec835585c3a2134a

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5	f0cba6bb3e14b1dae2be2481a0be0c8c
SHA1	c084d445017db928744e237c482fbf1429d47d3e
SHA256	3bff2d111833cc1d20d9e20a2864a22364133415604d831813df8a5021d376eb
SHA512	b7854238dcb72db777d87d153a32ec342d0ad821a2a9df5253f0c9053fa6a3bb0fb488be64660b6a2dcb59143ea9b13ff9ce5d33dc9db7550730b791520f717b

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

MD5	7f8f329f89a5cb5b1abea51f0685baf8
SHA1	7a94372a3f72cd1d1728da8e60b8a95e8adccfe0
SHA256	c8f6472242799cf88539e8a93f0b92fd61f96477466e448783f5e26c9522efc1
SHA512	cc4e0553d5e1c640a1bac7d6d1856a6f41968804600ef6089b6280341221095521a21ab8a8da0ccd612b5bda4ecf35ed69659f52740f7062ad113e4ebed7a13b

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe5a5ebb.TMP

MD5	5c95906c3682941a6aeb1a6ff566f4bb
SHA1	55fbbd987b40427073d6f605195567b444684bc0
SHA256	90be26d83cd2b4c6176bb71469face6341b7ac79850e09a02d2a644caeb1ab6d
SHA512	6c6606f36f174ece700eec0356ee6d2412c89a14b3c1191467c7a065ae9917c5ca0fe85de6d8efa6200946be8facefc2d89470aabcc71d2b3d8f9beefbff40ea

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5	eba6e03969b68c40e54ddc564c995f2a
SHA1	32738bcf0fd5f0c8fdc7a7c313d016ae839871ba
SHA256	12f36b71724ba00a03d7322a351a8a7fc49993225250310a61d70a867e61586c
SHA512	c71f20b568b8b64665eece128a1883fe0b060ea19512dfbbdd537c3429c726fe524d08827cfe4f0d21e2adc2fa4a5b26ca8c43a032478f6e8028adb3287a90ef

memory/4780-995-0x00007FFABE310000-0x00007FFABEDD1000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Microsoft Edge.lnk.a_encrypted

MD5	e1d001241c11f919d135ff19a6fb01c5
SHA1	4f62d1614f21272b822089fe5dea04fdcc635172
SHA256	90ba3446abaddfa6a7637b70b4a5e9a34659f2a67d438e64c12adcd576785520
SHA512	9eef36fc600231c626e12eb60c9e609ef9987822aafaaea651d957f577cc4d7d17d7a4db050208f53b9f571c8c564a465646ec4b4dc028ad17320d80e0dff443

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5	da849fe4d71a988d9d4ce47af8a8219b
SHA1	f840c447229733feb7a27f147d3642eae2f477fe
SHA256	75fce19c5a4f1eb9659497951f68d35c8b026f01e0e0a3cb75c0dc5ac90c50a0
SHA512	8924eccdf1a03d3a5805e597dbefc7d1ce4d476fe609bc9180b55332055f1d6629a6985f0bffc63a9a1e3662c7821a3237bd6e6f4bad64910ec4b696a7d1983c

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5	e215af3665248bb795352f70d689d84a
SHA1	e0594d74398679d4b57e71f2114264f65ecece0c
SHA256	b4e78d42d611287468065b83f946706ed74e08e8412701b7009e3939806c70a5
SHA512	f9c1575da27a420278a4ffed56a145bd3b7cadedf2c92023b7f4be7b79c7629a47fdb460fbbc89d50d83c43b1f9f7b131f82af05e9ba856a4fe61abfa99fe899

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

MD5	52f711d729b4eda8964f2577329c7555
SHA1	d6ea65a73144cff7d03dffd3d360acae379c32c0
SHA256	462103b4171e81c90894c6cff0ee6898b7486929e4480786f06b8e452ab76c13
SHA512	bc6c2b813ae7bd114ce8c8e3895b889230ea24eeeed452e78e1629781024d1bb0d872d43178cae00cd80376859b076b7f2e1b7947fe58a2309817694cdfc6c3a

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

MD5	91dc50e60b60f902b4ec992be6b5a3e3
SHA1	45d5c8b3e33cd122e6755c363e329fa18a19340f
SHA256	13e050e18ef2380e814ee91e6d747067d0d1d933449b57cb3d69c5a4165e261a
SHA512	ed7ea0b849a215354016df6dd2640eaf419ea798b54de05fda72ebefd7810a264def296876e35c82978062756565ab85f9bd1d44efe5b708940aa977d348255a

C:\Users\Public\Desktop\VLC media player.lnk.a_encrypted

MD5	10e09d6aa489afd6d26f432aef98637c
SHA1	0c82bd1e7b8683cfe8338a09315578ccaaf831ee
SHA256	bee09f3c07e4a1b7fa84d302a3378586d34ab18552cc1bcb46f34e33dd1ee6dd
SHA512	5c8a381320272080519c2680dcffa85c1eef461138c66d9cccba9525cac792dae7ace3099ba1824567a5884de9f709a33370863dd0218d84c2f76fdcdf9611b8

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

MD5	23e6ef5a90e33c22bae14f76f2684f3a
SHA1	77c72b67f257c2dde499789fd62a0dc0503f3f21
SHA256	62d7beeb501a1dcd8ce49a2f96b3346f4a7823c6f5c47dac0e6dc6e486801790
SHA512	23be0240146ba8d857fc8d37d77eb722066065877d1f698f0d3e185fcdae3daf9e1b2580a1db839c1356a45b599996d5acc83fda2af36840d3a8748684df5122

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Variations

MD5	bc6142469cd7dadf107be9ad87ea4753
SHA1	72a9aa05003fab742b0e4dc4c5d9eda6b9f7565c
SHA256	b26da4f8c7e283aa74386da0229d66af14a37986b8ca828e054fc932f68dd557
SHA512	47d1a67a16f5dc6d50556c5296e65918f0a2fcad0e8cee5795b100fe8cd89eaf5e1fd67691e8a57af3677883a5d8f104723b1901d11845b286474c8ac56f6182

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version

MD5	009b9a2ee7afbf6dd0b9617fc8f8ecba
SHA1	c97ed0652e731fc412e3b7bdfca2994b7cc206a7
SHA256	de607a2c68f52e15a104ead9ecbaa3e6862fdb11eac080e408ba4d69f1f7a915
SHA512	6161dd952ae140a8fb8aa5e33f06bc65fdc15ce3fbfe4c576dc2668c86bce4a1d5c1112caee014e5efa3698547faad3bc80ec253eedb43148e36e1a02ce89910

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies

MD5	a4025d595d980b0409bcd7e8bb7a5f8b
SHA1	19668b52338e13dea9639a160f5ee731f6ea0485
SHA256	846f0a9611becb2f9438e5f24163598a05d7e9e66e9883a641e4cd7c09353706
SHA512	864778ce25df271edbcf72544a6ef73020264764c2e3192218b367a457f7fa4966e79f2c6f5bc4f9e4638603d6619eadb92af5179f1df49be2d7541ea2978594

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG

MD5	d36ab75ad091de092e63fe32b5030f65
SHA1	3c0bed5ba0e6d16790c88832ff5b2fe94dd15535
SHA256	f4fd9f1bbb93616e4b5038647be1ae0b474f20b1bf8e5bb513546ce9e241de08
SHA512	e4f23dc468478340bd911da2dd47b32f9ae2c2e4a5814e03bfe6046acfc2b8d2c10f2d0a4f225c233bf1cb9b09a65ef37a010637b4fbafc4c7b810bedf84b159

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Favicons

MD5	c1a077ee53579701f70794e4003321b1
SHA1	089cdbb4574117dfa753725e20d0a8fdefa29349
SHA256	4eeb77b36412ab8a0958563f4e66af5e59f42eaef31f4db5b2bdfa5124bd82cd
SHA512	3bab3916d66da69afc43061dc0c04fc1e924a3b765f121d971818b64be6a9aeccc7a60e61f783a04327d9bdad167a08a82fd3a0969dd2dbd3db5412e96c8cb83

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Visited Links

MD5	15de5c3c166d2240fcd8bf6250caed58
SHA1	97efbcac2dd1740b7577d64186e99438d5b551be
SHA256	14227e5ccc9645d5cb2bfb0fa5e775b35ad5359a579a833c31eb4836dea074c4
SHA512	29480cdc9ec9f96269b717f805022ba96c1965b5f9277300e2a3dadcfde51a50a0dc887d0bb08c7e399491bbfdd6e8419bf7a8de209e6b2af531c0b7e7b6c01c

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001d

MD5	21c02afc3645ed8d9a1b13e656f3aa2d
SHA1	720499fb1c219191a9890528bb6a1b4eefa1f873
SHA256	903d9bee1d2afabc2802371e65f778d6536da391257be2a007c1dd9bc1d2636f
SHA512	627b57fcdf47242adbc3fa5787b7f0ba00f212d6c212aeb22f364f8f3a2385ff172138f5e07eefe57fcbbc02dd641ba3d889bc4cb5507f586717900f878571cd

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001c

MD5	c7070ff819c02b997824562d1e8506ea
SHA1	47dca282d5f90e27e0c84fa9b6ec60f92a3f8892
SHA256	fa8fdfafde7cd4b1b92817e0f569757bb990d2b94afb5cc00076534cc32c7811
SHA512	c6f167c58c0732833ec71545d87a200b6cb6a33fd05044c35a4cfc915eb34646ba0bb5a73bc4ca27a1f76efebeb4efb51cf70e23660af71f11ebd911eecb58e5

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001b

MD5	20eb2919c6cff126cc0c70e0b3668753
SHA1	099abc5d9b36163fb553d4623388b82b916d9596
SHA256	255a5705756bccb6beeccf8a3021bb12628bcec129bada057a39e70a45c66d64
SHA512	1aefdca99e2268f62cd42acfd301a5ece3d2d947c5d2b3f4d64c0ac39b69cf8dbb1a00937492b325f686d6525ae9634f197fec5ea57fcd3e46b0d93371570e10

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001a

MD5	95de4388ce919e280deab81630f80dac
SHA1	97dceaf7c84e5313ff898af7620552f3a812bacf
SHA256	4e161daeaa2d8efbe9040307c5b8cc85bdfa15bbb376b7b5774375410732040f
SHA512	5cef016330a6c3f28a778736b32d568a5ee3a81790ce638fa21b298fbfac95ea40c5cfdaaf2138fdc9aafefab01e5ba6a6d5d9638f08f1f430899d601043d38b

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000019

MD5	b06fa3dfc52a8b8307d2b0cbc039a5bb
SHA1	26588a72932890663c6316230f630e52f5038fc9
SHA256	2ceb1cfc5718d43f62baa9b802554f79e4029384a625c01eada3c508a3c518ec
SHA512	271e62ea541a0b17c1e52dd79bfdfc35641abe1750013daa237441e2751839edfccde0e42f6f67235989d608dc27094c86c442c7c584248d0b9ad251edf57837

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000018

MD5	548f249bf172100264b39437aac66d46
SHA1	28c26c4d74b07f57ef08791c4676045709a2c431
SHA256	1440eff7b17ab714e3766c62adf334f849b19bfd108284bce48caee744590195
SHA512	c2f2301ab2e6794327717e8d1b7b4ae4e37a339e07c68a9c20fcd4b0a1f01b940f18a559cd387e5cd63692f1ce502ea016389105410d6601183c430a7614a2e3

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000017

MD5	ffca854c7b99d8cb5bb1538aa9192c8c
SHA1	ca0f3ba3915c74f80286a01e52009a2310fb70a0
SHA256	8020bf98ba61cffeaf4cb22c08d421cec68cb7640875461a88f53aa976f7c19b
SHA512	ac191359804a5248d08d49f9200d9e4788142e8f3260b8e2d53ee1a4f695bcfb87feee9e106295e1f629e33acdcc5c4f4a47e7c30b9c455beb3d085cd760657b

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000016

MD5	ec5e356ea4157855112f81733540d639
SHA1	762314168ee6300f9f532d804b7b8898015f8658
SHA256	cffc6dcaabbfd018ee8ad519ad49db920b1a0583873e236ac81cc8cfc8453739
SHA512	b2cbccb8f60ca2d0d8866d53eef6b00a185162f5853ede86fe1154d6b4f232a3017aa0ce85bc26b06fab503f992deef926dd23da028f51562f5727ecfd31c03c

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000014

MD5	12b3b06a215a92b61047d4d676009d5c
SHA1	bfaffa1420406892f96c14563413c12b22d5578d
SHA256	ebddde1fdfe55665db44af96d9a914ea833d5c74b510150b0aafcc6598c8ec72
SHA512	5f597b93c1bd9e9be7d7aa42ec1a69d1183d164096046af276546f907c7796cd5d1ea80d152ac8cab76f1ddf3a6e3d51ed74c6dc97d467a4f5519dbad8d42ea8

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000013

MD5	31527d26d2caae1819d8d8ef0b50a693
SHA1	4cd3ff01a2ced27cb8d90132da6b6349ce54291e
SHA256	4196d51f71ccbc4d235d34924da7db90348de6b816c9110d48d02a11d83371af
SHA512	07579621ac873ce4919ef3f8f9c8d4e335c38c7ff6945452e5a45c957049270d7fe520cb6edd9f23b91998da3ed36e4b862be223823326b40360979e90d2c196

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000012

MD5	992b11ff67a7a85ac361af5fa7b7d128
SHA1	8f6e96ef72e6f8d187555f3336ce2fa74bccd9a7
SHA256	e98f893415bb4a9e2490327239132725245b2388853aa451e61545cd0fcd9c03
SHA512	df8fbd1abaa320a175389cd8a28b69713261eeaf5a3d6a743817923281eb756c2c600c5bfae7c352861ee85894845bd392801bf9356f92283da50a2936163ef8

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000011

MD5	c5daadbdbbf6860d51598ca4cd565fa2
SHA1	ddfdc115feae3b15e02e181d6a1a7e9bb835edad
SHA256	c5fa7f955f72a8ef31883517badb2e5d2a4909f708c9f8ab7b53e9ecfacb99c1
SHA512	020a2e14bdc6fe57215e8146659e42651192d2ee7485de71072cf042a7e865a782a9a37f9e288f471bbc4fd1d24346d1109452b5e08f35ec6b4f7b43bbbbec5c

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000010

MD5	3a3cf52f53f8577c78e66bfc15978158
SHA1	324b5b2c607239df8cb04f0f44bf4e6656ff7840
SHA256	fc5baa051c20114c21a63f276e7eecb339e139dfc6096ea8acde15c60ad6fa3a
SHA512	27e461c76cbf8313ae24358658a5acdabb278470f7147e4423c5e268bcdff70d8eaed739d2d310fe0ddbfbdd5ccdd6e3c77735d87250fd4d6284fccf8f885438

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000f

MD5	5b930eab3067663e6a741af396cb830d
SHA1	eccc5387f9bfe4670191fbf44e7a06ef9710755c
SHA256	b8e04c5dbc18a4c58ffc243e7692fc23308328b1ce146063376609ef07d0c34c
SHA512	caac24b58acb883c1bf0dca9063d01b0a54f059fb50442d38218156b73d21e8f6dd0e226a7aa013b43db91619fcd3d04faf22985f1ca5afee43213dbe8e13c65

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\History

MD5	dc8ecdfc4ca40b186ad1a37a6aed548d
SHA1	8e90baf25ae8b548d0ef1b03ca2489c71034014c
SHA256	9c796bb076e9eb8944f7cebe6798a3b6679a1c59e752bee4d11a127a57ae598c
SHA512	699a2e8408a52f00893da8a7f09ea73ae25f48bb312a03383190383effee27e11c4638b4a6ca3359320d3cf63d0198e331dea98e07280c0f0c972c5568e463a9

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000e

MD5	18cc2d7df048032243f5f60028471e32
SHA1	0fa116b526c3cf9f6853c7f687e7e3776bf9d4a7
SHA256	d3bf4744666cc0b99f24f2769f0018027217fed7a2e18cf13e75c83c8fc569dc
SHA512	2c1944efc5afceb4bf652124e4a9050aafa322ac70435221b57cf7c2e2b2aa21053ba38eb57bbc78f87877bb5b8580c5aa4b22210aea92e9fafd65eb06c2574a

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000d

MD5	6861908211ccd069d674c208aa8a49fc
SHA1	7be8f854cd633fd6cc299ac6e2246d79314e008c
SHA256	f2541e1b3ce87f535b10372967cb4c2fd17aeaf5526925c3a0704e54a067c0cd
SHA512	0a53a59f16a4ea8ef53652b076cdc2cda9488a4df2f4c962c939a66fd20c46beac0a78661feb8de98c474f9c61938fd6dc53eb6e5a5dbfaad07d12311a87a821

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000c

MD5	9a21c78c3cfb129f395919dfb35bd678
SHA1	65e66cd7c7dbae0fa6f5346a1413414bae531d06
SHA256	f336b0f4882f58bcc4ffcea8aeb064c3f2999836ccb269eecc140bb401bbdf23
SHA512	8005c6594dd227e5dcd0e1a9dca2757c1e94ac1ee01f23f01130900f67382b5123b265ecd7f79ec01914ad8d8f743318fa2ba6fa70fa18a5597a9f492ccde04c

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000a

MD5	ec52a780fb628756883539d1daf3f68f
SHA1	cbfa20c69acbb5b75a16c81d12127be1ebcd47ae
SHA256	4db0f4e2991abbcf13c1fa0094672e2b3f453797e271a846a0eb3b4ffd6ebfce
SHA512	5191b287f7d15d882ced2bba912a327c351a29dfc4b457172f3f5886b60eb6d7683c6ca51c9734cc0385da9514d271d674313c049db5b0adec1b05a1a1ca29fd

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000009

MD5	8b36b954e5a8947dedbc720664fbccb7
SHA1	0310a60a8bbd7ac385b6e94aec8dee9aa05a6d24
SHA256	069b3e224154172e3c385b5ebbdde887253d596776b74b9fb2a326b875fb718e
SHA512	c2827251585fbb5e24bc38ef58822e8892d952c6e2a90743453502254550384cfcc9789858d66706c86f51c483fc28c23c796ba6285747689940460402b30f29

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000008

MD5	a5bb3bb3eda1301f6ac876a49d4b2f62
SHA1	1786309cdc2fb5c1d29cdac00dbdf13711f19f3a
SHA256	316ba0d916f3d3d945b42e589de9a0326836664f9a06e9680bb853c828c2bf35
SHA512	f2ab2d40d2ccd43c5e5bf2150ea79d575e0d4a41381a8fba3beb47a8944adeac0bd19dacdbe237f8dd1c06fc04403f0bda3fca1ec0fc429357dc705c6db1eea4

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000007

MD5	b5fc5b0b6968ae9340b5a7285f8edd3a
SHA1	efbe5d3d60642f18afdd151cc41bb88518aefc54
SHA256	6d883eeb269ae14cbd3dd15143d6834d949854568e7ae2d73f59df2651ae6d3c
SHA512	52d006f5ccfd86b8000647bbbf3777f14af65e79458c5bcc75abc630fed531579070127a9caeae052ed0aa4f9cf894d0d69d0c332f19e858047075849a879d5c

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000006

MD5	a6fbd16aa78215fdfc62823e38f4b264
SHA1	cf50b391805009d3c7e7af2a24348efca29e6e90
SHA256	2ba328624df49d1fb706179e6963a052f921a7202d1c339361c6abfbe4a52c06
SHA512	177896131c934a0e3c175e06e55d6b71ec1bfc90337889a7b6731cdab698c2c1182303a7be64b3c09fa028286bef68ab5051d03af9530c82e713d35525dbfee3

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000005

MD5	c17417a3b3d7acd4c2c2677963a844e1
SHA1	77702a99ee9df2b1659c1f536daeb6f35dd96555
SHA256	4e5edb8462824921bd2b47aff28a1dc169bb5ca4ac1990bfc42d8d897c961146
SHA512	b2ee97536296106bc112f0082027314219ffba85d14d46cc35a024c4f68533ab8992421fc49512b0323c7fc4f46552b0d878aaaea3140196a14a4517a5dc5cbc

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_3

MD5	cb8683869cb28b2df89136f554ff0f86
SHA1	45c96925a7626ef032fe4da20d87ff777fbaf9ed
SHA256	b42ce867529cdaf490591c5b728e29765f4262365b15a7e127ac011cf2359af4
SHA512	e2460fdc9c75094036e88bfdd1362c597ec221936afe0212b7ca86415f50101bd50f7dabec82912e5dcf94b7428c043882408da9d2724ea6d7e65a1fe90e56a2

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_2

MD5	43f2a651387391aa0d165663f66e6a05
SHA1	72835f8373bc3f111eea1e96bb10bc4d63d65ee1
SHA256	d9ab3f8f9b1da4360c57c0ded5de55082f78c4102c420b973e89bd6b6b35027d
SHA512	df477d7e27dc90d69726be7470207c9081b37e9580d06bb65d93dd306b62b9bdc7b8a5f90186d2229f563b4f228ae2ac8a968e6b8549019e537f6d944fba629d

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_1

MD5	a35e2c46944e08f660bc641765ca575a
SHA1	5bea39e2ba08907eb766a7d641f025c0e74e6816
SHA256	9a19e3c401357b6dcc016419e8466c8d4229132a68f7d75d0fbce58632f9498e
SHA512	4ac4e59bb9e21c1a714db7d9710d87fb42c1fca5990b212270f095e1a0b79086f25bf8e191503021121a9204e65901f32ee3abb26dfb1576bfbb21a721b7ec50

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000b

MD5	8b2813296f6e3577e9ac2eb518ac437e
SHA1	6c8066353b4d463018aa1e4e9bb9bf2e9a7d9a86
SHA256	befb3b0471067ac66b93fcdba75c11d743f70a02bb9f5eef7501fa874686319d
SHA512	a1ed4d23dfbe981bf749c2008ab55a3d76e8f41801a09475e7e0109600f288aa20036273940e8ba70a172dec57eec56fe7c567cb941ba71edae080f2fdcc1e0c

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_0

MD5	75eb72b94303c9fb7d118aa31e283114
SHA1	e05c695eb74a1d88b9ac3a7c1ed70f805756dda5
SHA256	a1a7bac34dcb1672b11b7794de73cdd19a3cc6757d08e569c2f3d50f94427ece
SHA512	9e2bfc17dfb6c4301c022b201f02c9267f19003c123cbd956ebcca5251cbf149633855a4e1aedfa4a5a78265cf3ac2ce51656416c17230faef1336fa9ac065a9

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1

MD5	1b08f28a4a1bbd2e083ee90655614d4d
SHA1	342bb8b0b214bf5a932a72d45384df1758fa1ae9
SHA256	0dab74e74223fbecc4b393606bc9756e88295a62a15941fe49fcea2dcd7fd11a
SHA512	c66ff02bff08b25b4b8594f198609d557a7343e5e88b5bcba632814f335577f003ad3486af5b31553845dad5a3d05d3e7c3cc3afaa408ce2ddfc5a96d7319fcf

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5	44c8c43581b30587e13a70dbc16c45a5
SHA1	3687b857bb828f19a8f144a3695b57506b7c0930
SHA256	2f0253d1ca2727777de75eee0f26cc16debc23fb5192ceaa280cbafb20e89786
SHA512	6ff7c4b76fe1883004ec70fc18d600a44e9450b8184a707c63721b62dea5eb4ba110c681cc8a21e944f4319352c95b493e69111e4a33015c6b08d42abca7285d

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5	06194e30e148ee35d6455a503b2dff8f
SHA1	2905e89e41e899f289a8bdbb16fb0c3e7184cd3e
SHA256	80d2900010a14ade8ee633febf98ffd9a7f9f12ce069dd1e0d79bdbe7d8f08a9
SHA512	fde068add7ee9c3a02f7c4dd7bbc8dfd865c46e6a3516e48c764fa41fae905ae5d76ec829162f4088809721e00f355bd124430e7fa6a678bec306240ecb9d453

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5	b06b55d25df436bc1a201cb4ca0e4a9f
SHA1	8919438a324c2c8f35f50099d4d23df5a4ee4b77
SHA256	764906d0827fad2c76bf079fe0be627e36aadac2539a3a2c0b76f9614fb1c601
SHA512	ceb64567cc35b90e896c165b9aea5f75cd74aa5b4c569f855c72b143aa4b3239f54ed1bf72fe3da7d541545f3993a480f0f85574d85343d64e0dc4266b075e49

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

MD5	d62a0c5714d05d2d53f13e898c7e3e7e
SHA1	552a6f422341caffdbe3feb3bf8e93f7187545c2
SHA256	40a15326df0ab1900ad9383a909e70fc58df22866bd70e29d69ca5d67fcd5ddd
SHA512	ba83ecad64bc837f1672da969a6bfd82b05edcca05d0a392ddce4c8ae2a7929ede722bff0779d5ba723b4025490aab776387bbc926638d7448d016bf0fb1add8

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

MD5	914017f697e64b57efded7d343e01eb5
SHA1	a5386f1dc5c057852a4b76ce93d412eb2ed3db29
SHA256	5d7fd6103d1812b2b70f7dbca030f4daf21741165fc2118d21638bad497a351c
SHA512	f3dc8a27841bd46bc9370b2933b800e5a8db12356043c6e0bd4c3ac1de390e6738083384cc886b6abb02e0800ccbbc68338b317fb1019492ace96fb6749e5d15

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5	3bd8f576713f03e81e266b991b497a10
SHA1	9e51e0a6fff3f7ef9b6bcd85cd27945334b90e32
SHA256	2cadbd6742a0242a6b994c8773c65b77a54fd4ae36301a918184836badff8a49
SHA512	19c33f9008e56d9989b46fc260537d4e6f57a8b5f1101c2e7dbf76362fa7c74c6e684b8be079d109b82e1c791d39126ba3755689da589bdefc407b2757dd74ff

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5	cc8a58c80c246cbf40e55896e35aeab5
SHA1	784eb90382b49b09b056496a5744b63531dd3ce2
SHA256	db31db5be1e26d5e3a0903e66c31294a4902ef2fd508f035f201d267d25c75c2
SHA512	ce90d5cb3d57e9e2d3fd8a61db5cec2aba30729f54216f7bfd4912c5cb90bc1d7a1404103fa164ff7d93df29a07227015dd0b220a4344c4cae08675ca4301d71

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5	f5682f63d52aed517a805ccc8d6e7fb8
SHA1	e29c51bb19c9666a9bbc36efd1fe6c3e8a23618b
SHA256	f51661305374e70cb913aa5febf43377e20b87d4a22ab5f2de7ebe14fc6db0c1
SHA512	c330948547002b307399c9615e463bffda177932cdcffb1049537873be68cccf74597416fa504a7b3b75c25ad8cf5c0f3e15ff28b9e5ee0911eb96ee9ff70fde

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5	b25d8b3f88125e149b7110f9d609ee08
SHA1	85eb1ab8bf22b6604f898a2e4a39e72408b8e73a
SHA256	9ff1cd136c8cb15b6a41cf61d9fbbc42aee62c07d384cabddeb873e0b48c620f
SHA512	fc41acc84c2d00f8c703c27e668bd34f335a5a79f578f2a552bfd9ff6bb23684e82380b23f5cf23a882824e90b41a8593290a606246619c7eb82927352392796

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

MD5	372cf8765944f312eff24240af81dea4
SHA1	78ba99d0d8cee2095587136bed640920e4515c7a
SHA256	74103856064907bdd3114e108ba55b6cc33909fdfdb589bd541920e4c8df553e
SHA512	6a4cbcc141d86a96101f35dbefa8dc4cdcf581861cf85983adbf20b8487959e258079618b39c7a9779b40c08fef807495ce63f3764b7135edf5ce46a2cc50fce

C:\Users\Admin\Downloads\baby_ransomware_patched.exe

MD5	ac7f09bdc8b2526933797e3436f602ce
SHA1	c6ca1a3af08ea6c37691ceabd2488725a5d12cd4
SHA256	3b306c87828f572cd6e8d1dd496fd18b35e3d0e5047cc44ff9a615fd86925109
SHA512	2e8912e333f9376a6a6e48fc2cc30446fbd73c6652a524fca9179474f466ce80e403b6d8c05de99922ae8b70c8ae9fe56cd3a08c45ebf363051d36804a15b544

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5	39e39d167230c993080898b32e6be239
SHA1	056c36153943a478a1c21cffbfc5da14dd3c8b56
SHA256	35ff2c5c7cfeb3d59071c8b78688fb77be3671cd018de04d976780a5cc91852b
SHA512	84e7b19046cc4826dc349f8ebc2747a0c35c5ac76b6d0ef5791d302c9f6c1ba10a5a1fbf102e698a9e7c9fff4119258a8dd4dd5b251170b61c9a3f97fb026f2e

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5	833a867843d5c3e69cccb4e00e8a9b4f
SHA1	b9f18755360e286075779aca7db3ffcd85452cb1
SHA256	aa0156b721d4e0604b5e4db19b5b74ba390f253a6144d71e0877cdf388d5d11f
SHA512	4f4eecf551b6a5fe33e3c4d513477d16400d0fbe9fbc221d7d4939945de6eaba61a451519bce499071c1e02383d1a2a753707bbd7d42e7ce017bd192db10ba80

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5	6cdb44c38a27efbaebc0c49d21bea4cb
SHA1	a07b7b2683d1cb9f4338c159cde183629e803709
SHA256	313ef84dff4c4e17e2cad9f49b5708756805e03c59a5e1e28dae307d1976084f
SHA512	a0ab9020130003768e258698ef2e68dc1099537d51d804f9030b74b56a8bf22a42c778a8b574a170013000678899414b6242cb03641424be670964cea8db2ead

memory/3188-1360-0x0000019DAABE0000-0x0000019DAABE1000-memory.dmp

memory/3188-1362-0x0000019DAABE0000-0x0000019DAABE1000-memory.dmp

memory/3188-1361-0x0000019DAABE0000-0x0000019DAABE1000-memory.dmp

memory/3188-1369-0x0000019DAABE0000-0x0000019DAABE1000-memory.dmp

memory/3188-1372-0x0000019DAABE0000-0x0000019DAABE1000-memory.dmp

memory/3188-1371-0x0000019DAABE0000-0x0000019DAABE1000-memory.dmp

memory/3188-1368-0x0000019DAABE0000-0x0000019DAABE1000-memory.dmp

memory/3188-1370-0x0000019DAABE0000-0x0000019DAABE1000-memory.dmp

memory/3188-1366-0x0000019DAABE0000-0x0000019DAABE1000-memory.dmp

memory/3188-1367-0x0000019DAABE0000-0x0000019DAABE1000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5	ba28617d471b0b0acad25d41cd906175
SHA1	f82089ef0130d3d50d7d09d9ec498351bfe306f1
SHA256	f4abd88c599b5704ff41f1b9ec546f23afb9b6750ef59411330ec4af561d2744
SHA512	0a8767e8190b6ca22c7be17df9b685a47ed73bbcc2a873d1ba7cd813347eaaf236d57d7b29546c16d312b5071d66df2e9c0c8a51988cd9497b26a10345936e34

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5	2c9e5d1f22c4e8469efbed0522ce0e23
SHA1	74fd143fe185086f1edad1e025020d86dfaa2be0
SHA256	2651083ce366c7327d7c54e269a12c6da9fcc75bac93cc138458dab59c669b9d
SHA512	8a13c171a5e9cae2cb91135c1bd462a0161f36dc8d62896e83be708ea840d10fa9b452bc543ca99ca25f0f3beebb5b7fd365cb01a25f8f497a6f267c37271c99

Malware Analysis Report

2024-08-06 15:50

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

Threat Level: Known bad

Malicious Activity Summary

MITRE ATT&CK Matrix V13

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Sample ID	240514-tjsmrsdg3t
Target	http://github.com
Tags	chaos defense_evasion evasion execution impact ransomware spyware stealer