Description	Indicator	Process	Target
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Active Setup\Installed Components	C:\Windows\explorer.exe	N/A

Possible privilege escalation attempt

exploit

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\system32\icacls.exe	N/A
N/A	N/A	C:\Windows\system32\icacls.exe	N/A
N/A	N/A	C:\Windows\system32\takeown.exe	N/A
N/A	N/A	C:\Windows\system32\takeown.exe	N/A
N/A	N/A	C:\Windows\system32\takeown.exe	N/A
N/A	N/A	C:\Windows\system32\icacls.exe	N/A

Executes dropped EXE

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\Downloads\1d9bd899e9470b5e4c4f42d2a337918a5686dcb936a3563e19622483f0bf3027\1d9bd899e9470b5e4c4f42d2a337918a5686dcb936a3563e19622483f0bf3027.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\1d9bd899e9470b5e4c4f42d2a337918a5686dcb936a3563e19622483f0bf3027\1d9bd899e9470b5e4c4f42d2a337918a5686dcb936a3563e19622483f0bf3027.exe	N/A

Modifies file permissions

discovery

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\system32\takeown.exe	N/A
N/A	N/A	C:\Windows\system32\takeown.exe	N/A
N/A	N/A	C:\Windows\system32\icacls.exe	N/A
N/A	N/A	C:\Windows\system32\icacls.exe	N/A
N/A	N/A	C:\Windows\system32\icacls.exe	N/A
N/A	N/A	C:\Windows\system32\takeown.exe	N/A

Modifies system executable filetype association

persistence

Description	Indicator	Process	Target
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\DefaultIcon\ = "%SystemRoot%\\System32\\imageres.dll,-105"	C:\Users\Admin\Downloads\1d9bd899e9470b5e4c4f42d2a337918a5686dcb936a3563e19622483f0bf3027\1d9bd899e9470b5e4c4f42d2a337918a5686dcb936a3563e19622483f0bf3027.exe	N/A

Enumerates connected drives

Description	Indicator	Process	Target
File opened (read-only)	\??\F:	C:\Windows\explorer.exe	N/A
File opened (read-only)	\??\D:	C:\Windows\explorer.exe	N/A

Legitimate hosting services abused for malware hosting/C2

Description	Indicator	Process	Target
N/A	camo.githubusercontent.com	N/A	N/A
N/A	camo.githubusercontent.com	N/A	N/A
N/A	camo.githubusercontent.com	N/A	N/A
N/A	camo.githubusercontent.com	N/A	N/A
N/A	camo.githubusercontent.com	N/A	N/A
N/A	camo.githubusercontent.com	N/A	N/A
N/A	camo.githubusercontent.com	N/A	N/A
N/A	raw.githubusercontent.com	N/A	N/A
N/A	raw.githubusercontent.com	N/A	N/A

Drops file in Windows directory

Description	Indicator	Process	Target
File created	C:\Windows\rescache\_merged\2717123927\1590785016.pri	C:\Windows\explorer.exe	N/A
File created	C:\Windows\rescache\_merged\1601268389\715946058.pri	C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe	N/A
File created	C:\Windows\rescache\_merged\4032412167\4002656488.pri	C:\Windows\explorer.exe	N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description	Indicator	Process	Target
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	C:\Windows\explorer.exe	N/A
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	C:\Windows\explorer.exe	N/A
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	C:\Windows\explorer.exe	N/A
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	C:\Windows\explorer.exe	N/A
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	C:\Windows\explorer.exe	N/A
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	C:\Windows\explorer.exe	N/A
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	C:\Windows\explorer.exe	N/A
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	C:\Windows\explorer.exe	N/A
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	C:\Windows\explorer.exe	N/A
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	C:\Windows\explorer.exe	N/A
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	C:\Windows\explorer.exe	N/A
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	C:\Windows\explorer.exe	N/A
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000	C:\Windows\explorer.exe	N/A
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	C:\Windows\explorer.exe	N/A
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Capabilities	C:\Windows\explorer.exe	N/A
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	C:\Windows\explorer.exe	N/A
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	C:\Windows\explorer.exe	N/A
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	C:\Windows\explorer.exe	N/A
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Capabilities	C:\Windows\explorer.exe	N/A
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	C:\Windows\explorer.exe	N/A
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	C:\Windows\explorer.exe	N/A
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	C:\Windows\explorer.exe	N/A
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	C:\Windows\explorer.exe	N/A
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	C:\Windows\explorer.exe	N/A
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	C:\Windows\explorer.exe	N/A
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	C:\Windows\explorer.exe	N/A

Enumerates system info in registry

Description	Indicator	Process	Target
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe	N/A
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe	N/A
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A

Modifies File Icons

ransomware

Description	Indicator	Process	Target
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Icons	C:\Users\Admin\Downloads\1d9bd899e9470b5e4c4f42d2a337918a5686dcb936a3563e19622483f0bf3027\1d9bd899e9470b5e4c4f42d2a337918a5686dcb936a3563e19622483f0bf3027.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Icons\3 = "%SystemRoot%\\System32\\imageres.dll,-105"	C:\Users\Admin\Downloads\1d9bd899e9470b5e4c4f42d2a337918a5686dcb936a3563e19622483f0bf3027\1d9bd899e9470b5e4c4f42d2a337918a5686dcb936a3563e19622483f0bf3027.exe	N/A

Modifies Internet Explorer settings

adware spyware

Description	Indicator	Process	Target
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	C:\Windows\explorer.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\Toolbar	C:\Windows\explorer.exe	N/A
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	C:\Windows\explorer.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser	C:\Windows\explorer.exe	N/A
Set value (data)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	C:\Windows\explorer.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\GPU	C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	C:\Windows\explorer.exe	N/A

Modifies data under HKEY_USERS

Description	Indicator	Process	Target
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133608700462862386"	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A

Modifies registry class

Description	Indicator	Process	Target
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\GroupView = "4294967295"	C:\Windows\explorer.exe	N/A
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\ShowCmd = "1"	C:\Windows\explorer.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe	N/A
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\{80213E82-BCFD-4C4F-8817-BB27601267A9}\Mode = "4"	C:\Windows\explorer.exe	N/A
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.cortana\Total = "56"	C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe	N/A
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\SniffedFolderType = "Generic"	C:\Windows\explorer.exe	N/A
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\{80213E82-BCFD-4C4F-8817-BB27601267A9}\GroupByKey:PID = "0"	C:\Windows\explorer.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings	C:\Windows\Explorer.EXE	N/A
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Rev = "0"	C:\Windows\explorer.exe	N/A
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	C:\Windows\explorer.exe	N/A
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "152"	C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe	N/A
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	C:\Windows\explorer.exe	N/A
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\WFlags = "0"	C:\Windows\explorer.exe	N/A
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	C:\Windows\explorer.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\dllfile\DefaultIcon\ = "%SystemRoot%\\System32\\imageres.dll,-105"	C:\Users\Admin\Downloads\1d9bd899e9470b5e4c4f42d2a337918a5686dcb936a3563e19622483f0bf3027\1d9bd899e9470b5e4c4f42d2a337918a5686dcb936a3563e19622483f0bf3027.exe	N/A
Set value (data)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0000000001000000ffffffff	C:\Windows\explorer.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\WorkFolders	C:\Windows\explorer.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings	C:\Windows\system32\cmd.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5	C:\Windows\explorer.exe	N/A
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Vid = "{137E7700-3573-11CF-AE69-08002B2E1262}"	C:\Windows\explorer.exe	N/A
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\3\NodeSlot = "6"	C:\Windows\explorer.exe	N/A
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\{80213E82-BCFD-4C4F-8817-BB27601267A9}\IconSize = "16"	C:\Windows\explorer.exe	N/A
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	C:\Windows\explorer.exe	N/A
Set value (data)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\MRUListEx = 03000000010000000200000000000000ffffffff	C:\Windows\explorer.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage	C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\{80213E82-BCFD-4C4F-8817-BB27601267A9}	C:\Windows\explorer.exe	N/A
Set value (data)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\MRUListEx = 010000000200000000000000ffffffff	C:\Windows\explorer.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	C:\Windows\explorer.exe	N/A
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\IconSize = "48"	C:\Windows\explorer.exe	N/A
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	C:\Windows\explorer.exe	N/A
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616209"	C:\Windows\explorer.exe	N/A
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\LogicalViewMode = "2"	C:\Windows\explorer.exe	N/A
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Generic"	C:\Windows\explorer.exe	N/A
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify\UserStartTime = "133567065867241975"	C:\Windows\explorer.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\2	C:\Windows\explorer.exe	N/A
Set value (data)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\MRUListEx = 020000000100000000000000ffffffff	C:\Windows\explorer.exe	N/A
Set value (data)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\{80213E82-BCFD-4C4F-8817-BB27601267A9}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000070000001800000030f125b7ef471a10a5f102608c9eebac0a000000f000000030f125b7ef471a10a5f102608c9eebac04000000a0000000e0cc8de8b3b7d111a9f000aa0060fa310600000080000000e0cc8de8b3b7d111a9f000aa0060fa31020000005000000030f125b7ef471a10a5f102608c9eebac0c00000080000000e0cc8de8b3b7d111a9f000aa0060fa31040000005000000030f125b7ef471a10a5f102608c9eebac0e000000a0000000	C:\Windows\explorer.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	C:\Windows\explorer.exe	N/A
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\{80213E82-BCFD-4C4F-8817-BB27601267A9}\LogicalViewMode = "1"	C:\Windows\explorer.exe	N/A
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\Rev = "0"	C:\Windows\explorer.exe	N/A
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\GroupByDirection = "1"	C:\Windows\explorer.exe	N/A
Set value (data)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\2\MRUListEx = ffffffff	C:\Windows\explorer.exe	N/A
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6	C:\Windows\explorer.exe	N/A
Set value (data)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	C:\Windows\explorer.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings	C:\Windows\explorer.exe	N/A
Set value (data)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000007800000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	C:\Windows\explorer.exe	N/A
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\GroupByKey:FMTID = "{30C8EEF4-A832-41E2-AB32-E3C3CA28FD29}"	C:\Windows\explorer.exe	N/A
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	C:\Windows\explorer.exe	N/A
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\{80213E82-BCFD-4C4F-8817-BB27601267A9}\Rev = "0"	C:\Windows\explorer.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell	C:\Windows\explorer.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\3	C:\Windows\explorer.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings	C:\Users\Admin\Downloads\1d9bd899e9470b5e4c4f42d2a337918a5686dcb936a3563e19622483f0bf3027\1d9bd899e9470b5e4c4f42d2a337918a5686dcb936a3563e19622483f0bf3027.exe	N/A
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\{80213E82-BCFD-4C4F-8817-BB27601267A9}\Vid = "{137E7700-3573-11CF-AE69-08002B2E1262}"	C:\Windows\explorer.exe	N/A
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	C:\Windows\explorer.exe	N/A
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\{80213E82-BCFD-4C4F-8817-BB27601267A9}\FFlags = "18874369"	C:\Windows\explorer.exe	N/A
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\{80213E82-BCFD-4C4F-8817-BB27601267A9}\GroupView = "0"	C:\Windows\explorer.exe	N/A
Set value (data)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify\IconStreams = 14000000070000000100010005000000140000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b0072000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c100000000000002000000e80705004100720067006a006200650078002000200033000a005600610067007200650061007200670020006e007000700072006600660000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000074ae2078e323294282c1e41cb67d5b9c000000000000000000000000e04b1ba968acda0100000000000000000000000000000d20feb05a007600700065006200660062007300670020004a0076006100710062006a006600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000640000000000000002000000e80705004600630072006e0078007200650066003a002000360037002500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000100000073ae2078e323294282c1e41cb67d5b9c0000000000000000000000008f6aeea868acda0100000000000000000000000000000d20feb05a007600700065006200660062007300670020004a0076006100710062006a006600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030000007b00360051003800300039003300370037002d0036004e00530030002d003400340034004f002d0038003900350037002d004e00330037003700330053003000320032003000300052007d005c004a0076006100710062006a0066002000510072007300720061007100720065005c005a0046004e00460050006800760059002e0072006b007200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000640000000000000000000000e80704004e0070006700760062006100660020006100720072007100720071002e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000fffffffff9a6406d323dcb4f8a86be992e03dc760000000000000000000000003631b1288a86da0100000000000000000000000000000d20feb05a007600700065006200660062007300670020004a0076006100710062006a006600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000e8070400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff75ae2078e323294282c1e41cb67d5b9c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000e8070400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff81ae2078e323294282c1e41cb67d5b9c00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	C:\Windows\explorer.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.cortana	C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe	N/A
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\Vid = "{65F125E5-7BE1-4810-BA9D-D271C8432CE3}"	C:\Windows\explorer.exe	N/A
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\FFlags = "1092616209"	C:\Windows\explorer.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\1	C:\Windows\explorer.exe	N/A

Opens file in notepad (likely ransom note)

ransomware

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\system32\NOTEPAD.EXE	N/A

Suspicious behavior: AddClipboardFormatListener

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\explorer.exe	N/A
N/A	N/A	C:\Windows\explorer.exe	N/A

Suspicious behavior: EnumeratesProcesses

Description	Indicator	Process	Target
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\1d9bd899e9470b5e4c4f42d2a337918a5686dcb936a3563e19622483f0bf3027\1d9bd899e9470b5e4c4f42d2a337918a5686dcb936a3563e19622483f0bf3027.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\1d9bd899e9470b5e4c4f42d2a337918a5686dcb936a3563e19622483f0bf3027\1d9bd899e9470b5e4c4f42d2a337918a5686dcb936a3563e19622483f0bf3027.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\1d9bd899e9470b5e4c4f42d2a337918a5686dcb936a3563e19622483f0bf3027\1d9bd899e9470b5e4c4f42d2a337918a5686dcb936a3563e19622483f0bf3027.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\1d9bd899e9470b5e4c4f42d2a337918a5686dcb936a3563e19622483f0bf3027\1d9bd899e9470b5e4c4f42d2a337918a5686dcb936a3563e19622483f0bf3027.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\1d9bd899e9470b5e4c4f42d2a337918a5686dcb936a3563e19622483f0bf3027\1d9bd899e9470b5e4c4f42d2a337918a5686dcb936a3563e19622483f0bf3027.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\1d9bd899e9470b5e4c4f42d2a337918a5686dcb936a3563e19622483f0bf3027\1d9bd899e9470b5e4c4f42d2a337918a5686dcb936a3563e19622483f0bf3027.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\1d9bd899e9470b5e4c4f42d2a337918a5686dcb936a3563e19622483f0bf3027\1d9bd899e9470b5e4c4f42d2a337918a5686dcb936a3563e19622483f0bf3027.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\1d9bd899e9470b5e4c4f42d2a337918a5686dcb936a3563e19622483f0bf3027\1d9bd899e9470b5e4c4f42d2a337918a5686dcb936a3563e19622483f0bf3027.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\1d9bd899e9470b5e4c4f42d2a337918a5686dcb936a3563e19622483f0bf3027\1d9bd899e9470b5e4c4f42d2a337918a5686dcb936a3563e19622483f0bf3027.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\1d9bd899e9470b5e4c4f42d2a337918a5686dcb936a3563e19622483f0bf3027\1d9bd899e9470b5e4c4f42d2a337918a5686dcb936a3563e19622483f0bf3027.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\1d9bd899e9470b5e4c4f42d2a337918a5686dcb936a3563e19622483f0bf3027\1d9bd899e9470b5e4c4f42d2a337918a5686dcb936a3563e19622483f0bf3027.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\1d9bd899e9470b5e4c4f42d2a337918a5686dcb936a3563e19622483f0bf3027\1d9bd899e9470b5e4c4f42d2a337918a5686dcb936a3563e19622483f0bf3027.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\1d9bd899e9470b5e4c4f42d2a337918a5686dcb936a3563e19622483f0bf3027\1d9bd899e9470b5e4c4f42d2a337918a5686dcb936a3563e19622483f0bf3027.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\1d9bd899e9470b5e4c4f42d2a337918a5686dcb936a3563e19622483f0bf3027\1d9bd899e9470b5e4c4f42d2a337918a5686dcb936a3563e19622483f0bf3027.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\1d9bd899e9470b5e4c4f42d2a337918a5686dcb936a3563e19622483f0bf3027\1d9bd899e9470b5e4c4f42d2a337918a5686dcb936a3563e19622483f0bf3027.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\1d9bd899e9470b5e4c4f42d2a337918a5686dcb936a3563e19622483f0bf3027\1d9bd899e9470b5e4c4f42d2a337918a5686dcb936a3563e19622483f0bf3027.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\1d9bd899e9470b5e4c4f42d2a337918a5686dcb936a3563e19622483f0bf3027\1d9bd899e9470b5e4c4f42d2a337918a5686dcb936a3563e19622483f0bf3027.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\1d9bd899e9470b5e4c4f42d2a337918a5686dcb936a3563e19622483f0bf3027\1d9bd899e9470b5e4c4f42d2a337918a5686dcb936a3563e19622483f0bf3027.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\1d9bd899e9470b5e4c4f42d2a337918a5686dcb936a3563e19622483f0bf3027\1d9bd899e9470b5e4c4f42d2a337918a5686dcb936a3563e19622483f0bf3027.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\1d9bd899e9470b5e4c4f42d2a337918a5686dcb936a3563e19622483f0bf3027\1d9bd899e9470b5e4c4f42d2a337918a5686dcb936a3563e19622483f0bf3027.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\1d9bd899e9470b5e4c4f42d2a337918a5686dcb936a3563e19622483f0bf3027\1d9bd899e9470b5e4c4f42d2a337918a5686dcb936a3563e19622483f0bf3027.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\1d9bd899e9470b5e4c4f42d2a337918a5686dcb936a3563e19622483f0bf3027\1d9bd899e9470b5e4c4f42d2a337918a5686dcb936a3563e19622483f0bf3027.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\1d9bd899e9470b5e4c4f42d2a337918a5686dcb936a3563e19622483f0bf3027\1d9bd899e9470b5e4c4f42d2a337918a5686dcb936a3563e19622483f0bf3027.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\1d9bd899e9470b5e4c4f42d2a337918a5686dcb936a3563e19622483f0bf3027\1d9bd899e9470b5e4c4f42d2a337918a5686dcb936a3563e19622483f0bf3027.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\1d9bd899e9470b5e4c4f42d2a337918a5686dcb936a3563e19622483f0bf3027\1d9bd899e9470b5e4c4f42d2a337918a5686dcb936a3563e19622483f0bf3027.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\1d9bd899e9470b5e4c4f42d2a337918a5686dcb936a3563e19622483f0bf3027\1d9bd899e9470b5e4c4f42d2a337918a5686dcb936a3563e19622483f0bf3027.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\1d9bd899e9470b5e4c4f42d2a337918a5686dcb936a3563e19622483f0bf3027\1d9bd899e9470b5e4c4f42d2a337918a5686dcb936a3563e19622483f0bf3027.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\1d9bd899e9470b5e4c4f42d2a337918a5686dcb936a3563e19622483f0bf3027\1d9bd899e9470b5e4c4f42d2a337918a5686dcb936a3563e19622483f0bf3027.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\1d9bd899e9470b5e4c4f42d2a337918a5686dcb936a3563e19622483f0bf3027\1d9bd899e9470b5e4c4f42d2a337918a5686dcb936a3563e19622483f0bf3027.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\1d9bd899e9470b5e4c4f42d2a337918a5686dcb936a3563e19622483f0bf3027\1d9bd899e9470b5e4c4f42d2a337918a5686dcb936a3563e19622483f0bf3027.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\1d9bd899e9470b5e4c4f42d2a337918a5686dcb936a3563e19622483f0bf3027\1d9bd899e9470b5e4c4f42d2a337918a5686dcb936a3563e19622483f0bf3027.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\1d9bd899e9470b5e4c4f42d2a337918a5686dcb936a3563e19622483f0bf3027\1d9bd899e9470b5e4c4f42d2a337918a5686dcb936a3563e19622483f0bf3027.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\1d9bd899e9470b5e4c4f42d2a337918a5686dcb936a3563e19622483f0bf3027\1d9bd899e9470b5e4c4f42d2a337918a5686dcb936a3563e19622483f0bf3027.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\1d9bd899e9470b5e4c4f42d2a337918a5686dcb936a3563e19622483f0bf3027\1d9bd899e9470b5e4c4f42d2a337918a5686dcb936a3563e19622483f0bf3027.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\1d9bd899e9470b5e4c4f42d2a337918a5686dcb936a3563e19622483f0bf3027\1d9bd899e9470b5e4c4f42d2a337918a5686dcb936a3563e19622483f0bf3027.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\1d9bd899e9470b5e4c4f42d2a337918a5686dcb936a3563e19622483f0bf3027\1d9bd899e9470b5e4c4f42d2a337918a5686dcb936a3563e19622483f0bf3027.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\1d9bd899e9470b5e4c4f42d2a337918a5686dcb936a3563e19622483f0bf3027\1d9bd899e9470b5e4c4f42d2a337918a5686dcb936a3563e19622483f0bf3027.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\1d9bd899e9470b5e4c4f42d2a337918a5686dcb936a3563e19622483f0bf3027\1d9bd899e9470b5e4c4f42d2a337918a5686dcb936a3563e19622483f0bf3027.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\1d9bd899e9470b5e4c4f42d2a337918a5686dcb936a3563e19622483f0bf3027\1d9bd899e9470b5e4c4f42d2a337918a5686dcb936a3563e19622483f0bf3027.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\1d9bd899e9470b5e4c4f42d2a337918a5686dcb936a3563e19622483f0bf3027\1d9bd899e9470b5e4c4f42d2a337918a5686dcb936a3563e19622483f0bf3027.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\1d9bd899e9470b5e4c4f42d2a337918a5686dcb936a3563e19622483f0bf3027\1d9bd899e9470b5e4c4f42d2a337918a5686dcb936a3563e19622483f0bf3027.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\1d9bd899e9470b5e4c4f42d2a337918a5686dcb936a3563e19622483f0bf3027\1d9bd899e9470b5e4c4f42d2a337918a5686dcb936a3563e19622483f0bf3027.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\1d9bd899e9470b5e4c4f42d2a337918a5686dcb936a3563e19622483f0bf3027\1d9bd899e9470b5e4c4f42d2a337918a5686dcb936a3563e19622483f0bf3027.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\1d9bd899e9470b5e4c4f42d2a337918a5686dcb936a3563e19622483f0bf3027\1d9bd899e9470b5e4c4f42d2a337918a5686dcb936a3563e19622483f0bf3027.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\1d9bd899e9470b5e4c4f42d2a337918a5686dcb936a3563e19622483f0bf3027\1d9bd899e9470b5e4c4f42d2a337918a5686dcb936a3563e19622483f0bf3027.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\1d9bd899e9470b5e4c4f42d2a337918a5686dcb936a3563e19622483f0bf3027\1d9bd899e9470b5e4c4f42d2a337918a5686dcb936a3563e19622483f0bf3027.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\1d9bd899e9470b5e4c4f42d2a337918a5686dcb936a3563e19622483f0bf3027\1d9bd899e9470b5e4c4f42d2a337918a5686dcb936a3563e19622483f0bf3027.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\1d9bd899e9470b5e4c4f42d2a337918a5686dcb936a3563e19622483f0bf3027\1d9bd899e9470b5e4c4f42d2a337918a5686dcb936a3563e19622483f0bf3027.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\1d9bd899e9470b5e4c4f42d2a337918a5686dcb936a3563e19622483f0bf3027\1d9bd899e9470b5e4c4f42d2a337918a5686dcb936a3563e19622483f0bf3027.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\1d9bd899e9470b5e4c4f42d2a337918a5686dcb936a3563e19622483f0bf3027\1d9bd899e9470b5e4c4f42d2a337918a5686dcb936a3563e19622483f0bf3027.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\1d9bd899e9470b5e4c4f42d2a337918a5686dcb936a3563e19622483f0bf3027\1d9bd899e9470b5e4c4f42d2a337918a5686dcb936a3563e19622483f0bf3027.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\1d9bd899e9470b5e4c4f42d2a337918a5686dcb936a3563e19622483f0bf3027\1d9bd899e9470b5e4c4f42d2a337918a5686dcb936a3563e19622483f0bf3027.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\1d9bd899e9470b5e4c4f42d2a337918a5686dcb936a3563e19622483f0bf3027\1d9bd899e9470b5e4c4f42d2a337918a5686dcb936a3563e19622483f0bf3027.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\1d9bd899e9470b5e4c4f42d2a337918a5686dcb936a3563e19622483f0bf3027\1d9bd899e9470b5e4c4f42d2a337918a5686dcb936a3563e19622483f0bf3027.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\1d9bd899e9470b5e4c4f42d2a337918a5686dcb936a3563e19622483f0bf3027\1d9bd899e9470b5e4c4f42d2a337918a5686dcb936a3563e19622483f0bf3027.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\1d9bd899e9470b5e4c4f42d2a337918a5686dcb936a3563e19622483f0bf3027\1d9bd899e9470b5e4c4f42d2a337918a5686dcb936a3563e19622483f0bf3027.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\1d9bd899e9470b5e4c4f42d2a337918a5686dcb936a3563e19622483f0bf3027\1d9bd899e9470b5e4c4f42d2a337918a5686dcb936a3563e19622483f0bf3027.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\1d9bd899e9470b5e4c4f42d2a337918a5686dcb936a3563e19622483f0bf3027\1d9bd899e9470b5e4c4f42d2a337918a5686dcb936a3563e19622483f0bf3027.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\1d9bd899e9470b5e4c4f42d2a337918a5686dcb936a3563e19622483f0bf3027\1d9bd899e9470b5e4c4f42d2a337918a5686dcb936a3563e19622483f0bf3027.exe	N/A
N/A	N/A	C:\Users\Admin\Downloads\1d9bd899e9470b5e4c4f42d2a337918a5686dcb936a3563e19622483f0bf3027\1d9bd899e9470b5e4c4f42d2a337918a5686dcb936a3563e19622483f0bf3027.exe	N/A

Suspicious behavior: GetForegroundWindowSpam

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\explorer.exe	N/A

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Description	Indicator	Process	Target
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A

Suspicious use of AdjustPrivilegeToken

Description	Indicator	Process	Target
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A

Suspicious use of FindShellTrayWindow

Description	Indicator	Process	Target
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\7-Zip\7zG.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Windows\explorer.exe	N/A
N/A	N/A	C:\Windows\explorer.exe	N/A
N/A	N/A	C:\Windows\explorer.exe	N/A
N/A	N/A	C:\Windows\explorer.exe	N/A
N/A	N/A	C:\Windows\explorer.exe	N/A
N/A	N/A	C:\Windows\explorer.exe	N/A
N/A	N/A	C:\Windows\explorer.exe	N/A
N/A	N/A	C:\Windows\explorer.exe	N/A
N/A	N/A	C:\Windows\explorer.exe	N/A
N/A	N/A	C:\Windows\explorer.exe	N/A
N/A	N/A	C:\Windows\explorer.exe	N/A
N/A	N/A	C:\Windows\explorer.exe	N/A
N/A	N/A	C:\Windows\explorer.exe	N/A
N/A	N/A	C:\Windows\explorer.exe	N/A
N/A	N/A	C:\Windows\explorer.exe	N/A
N/A	N/A	C:\Windows\explorer.exe	N/A
N/A	N/A	C:\Windows\explorer.exe	N/A
N/A	N/A	C:\Windows\explorer.exe	N/A
N/A	N/A	C:\Windows\explorer.exe	N/A
N/A	N/A	C:\Windows\explorer.exe	N/A
N/A	N/A	C:\Windows\explorer.exe	N/A
N/A	N/A	C:\Windows\explorer.exe	N/A
N/A	N/A	C:\Windows\explorer.exe	N/A

Suspicious use of SendNotifyMessage

Description	Indicator	Process	Target
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Windows\explorer.exe	N/A
N/A	N/A	C:\Windows\explorer.exe	N/A
N/A	N/A	C:\Windows\explorer.exe	N/A
N/A	N/A	C:\Windows\explorer.exe	N/A
N/A	N/A	C:\Windows\explorer.exe	N/A
N/A	N/A	C:\Windows\explorer.exe	N/A
N/A	N/A	C:\Windows\explorer.exe	N/A
N/A	N/A	C:\Windows\explorer.exe	N/A
N/A	N/A	C:\Windows\explorer.exe	N/A
N/A	N/A	C:\Windows\explorer.exe	N/A
N/A	N/A	C:\Windows\explorer.exe	N/A
N/A	N/A	C:\Windows\explorer.exe	N/A
N/A	N/A	C:\Windows\explorer.exe	N/A
N/A	N/A	C:\Windows\explorer.exe	N/A
N/A	N/A	C:\Windows\explorer.exe	N/A
N/A	N/A	C:\Windows\explorer.exe	N/A
N/A	N/A	C:\Windows\explorer.exe	N/A
N/A	N/A	C:\Windows\explorer.exe	N/A
N/A	N/A	C:\Windows\explorer.exe	N/A
N/A	N/A	C:\Windows\explorer.exe	N/A
N/A	N/A	C:\Windows\explorer.exe	N/A
N/A	N/A	C:\Windows\explorer.exe	N/A
N/A	N/A	C:\Windows\explorer.exe	N/A
N/A	N/A	C:\Windows\explorer.exe	N/A
N/A	N/A	C:\Windows\explorer.exe	N/A
N/A	N/A	C:\Windows\explorer.exe	N/A
N/A	N/A	C:\Windows\explorer.exe	N/A
N/A	N/A	C:\Windows\explorer.exe	N/A
N/A	N/A	C:\Windows\explorer.exe	N/A
N/A	N/A	C:\Windows\explorer.exe	N/A
N/A	N/A	C:\Windows\explorer.exe	N/A
N/A	N/A	C:\Windows\explorer.exe	N/A
N/A	N/A	C:\Windows\explorer.exe	N/A
N/A	N/A	C:\Windows\explorer.exe	N/A
N/A	N/A	C:\Windows\explorer.exe	N/A
N/A	N/A	C:\Windows\explorer.exe	N/A
N/A	N/A	C:\Windows\explorer.exe	N/A
N/A	N/A	C:\Windows\explorer.exe	N/A
N/A	N/A	C:\Windows\explorer.exe	N/A
N/A	N/A	C:\Windows\explorer.exe	N/A

Suspicious use of SetWindowsHookEx

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\system32\OpenWith.exe	N/A
N/A	N/A	C:\Windows\explorer.exe	N/A
N/A	N/A	C:\Windows\explorer.exe	N/A
N/A	N/A	C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe	N/A
N/A	N/A	C:\Windows\explorer.exe	N/A
N/A	N/A	C:\Windows\explorer.exe	N/A
N/A	N/A	C:\Windows\explorer.exe	N/A
N/A	N/A	C:\Windows\explorer.exe	N/A

Suspicious use of WriteProcessMemory

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\240522-t14flahc41-behavioral1.pcap

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

C:\Windows\System32\rundll32.exe

C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ff9315b9758,0x7ff9315b9768,0x7ff9315b9778

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1528 --field-trial-handle=1772,i,4124983380613573107,14630959394029483154,131072 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1908 --field-trial-handle=1772,i,4124983380613573107,14630959394029483154,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2056 --field-trial-handle=1772,i,4124983380613573107,14630959394029483154,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2896 --field-trial-handle=1772,i,4124983380613573107,14630959394029483154,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2904 --field-trial-handle=1772,i,4124983380613573107,14630959394029483154,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4440 --field-trial-handle=1772,i,4124983380613573107,14630959394029483154,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3856 --field-trial-handle=1772,i,4124983380613573107,14630959394029483154,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4720 --field-trial-handle=1772,i,4124983380613573107,14630959394029483154,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4892 --field-trial-handle=1772,i,4124983380613573107,14630959394029483154,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4972 --field-trial-handle=1772,i,4124983380613573107,14630959394029483154,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4892 --field-trial-handle=1772,i,4124983380613573107,14630959394029483154,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=2468 --field-trial-handle=1772,i,4124983380613573107,14630959394029483154,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4720 --field-trial-handle=1772,i,4124983380613573107,14630959394029483154,131072 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=5152 --field-trial-handle=1772,i,4124983380613573107,14630959394029483154,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=4812 --field-trial-handle=1772,i,4124983380613573107,14630959394029483154,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3196 --field-trial-handle=1772,i,4124983380613573107,14630959394029483154,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5124 --field-trial-handle=1772,i,4124983380613573107,14630959394029483154,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5380 --field-trial-handle=1772,i,4124983380613573107,14630959394029483154,131072 /prefetch:8

C:\Program Files\7-Zip\7zG.exe

"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\1d9bd899e9470b5e4c4f42d2a337918a5686dcb936a3563e19622483f0bf3027\" -ad -an -ai#7zMap9849:190:7zEvent14971

C:\Users\Admin\Downloads\1d9bd899e9470b5e4c4f42d2a337918a5686dcb936a3563e19622483f0bf3027\1d9bd899e9470b5e4c4f42d2a337918a5686dcb936a3563e19622483f0bf3027.exe

"C:\Users\Admin\Downloads\1d9bd899e9470b5e4c4f42d2a337918a5686dcb936a3563e19622483f0bf3027\1d9bd899e9470b5e4c4f42d2a337918a5686dcb936a3563e19622483f0bf3027.exe"

C:\Windows\system32\NOTEPAD.EXE

"C:\Windows\system32\NOTEPAD.EXE" C:\notice.txt

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /k takeown /f C:\Windows\System32\drivers\disk.sys && icacls C:\Windows\System32\drivers\disk.sys /grant %username%:F

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /k takeown /f C:\Windows\System32\bcdboot.exe && icacls C:\Windows\System32\bcdboot.exe /grant %username%:F

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /k takeown /f C:\Windows\System32\hal.dll && icacls C:\Windows\System32\hal.dll /grant %username%:F

C:\Windows\system32\takeown.exe

takeown /f C:\Windows\System32\drivers\disk.sys

C:\Windows\system32\takeown.exe

takeown /f C:\Windows\System32\hal.dll

C:\Windows\system32\icacls.exe

icacls C:\Windows\System32\drivers\disk.sys /grant Admin:F

C:\Windows\system32\takeown.exe

takeown /f C:\Windows\System32\bcdboot.exe

C:\Windows\system32\icacls.exe

icacls C:\Windows\System32\hal.dll /grant Admin:F

C:\Windows\system32\icacls.exe

icacls C:\Windows\System32\bcdboot.exe /grant Admin:F

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5008 --field-trial-handle=1772,i,4124983380613573107,14630959394029483154,131072 /prefetch:8

C:\Windows\explorer.exe

explorer.exe

C:\Windows\Explorer.EXE

"C:\Windows\Explorer.EXE"

C:\Windows\System32\rundll32.exe

C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding

C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe

"C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca

C:\Windows\System32\rundll32.exe

C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

C:\Users\Admin\Downloads\1d9bd899e9470b5e4c4f42d2a337918a5686dcb936a3563e19622483f0bf3027\1d9bd899e9470b5e4c4f42d2a337918a5686dcb936a3563e19622483f0bf3027.exe

"C:\Users\Admin\Downloads\1d9bd899e9470b5e4c4f42d2a337918a5686dcb936a3563e19622483f0bf3027\1d9bd899e9470b5e4c4f42d2a337918a5686dcb936a3563e19622483f0bf3027.exe"

C:\Windows\system32\AUDIODG.EXE

C:\Windows\system32\AUDIODG.EXE 0x3e8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5060 --field-trial-handle=1772,i,4124983380613573107,14630959394029483154,131072 /prefetch:8

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	www.google.com	udp
US	8.8.8.8:53	195.187.250.142.in-addr.arpa	udp
GB	142.250.187.196:443	www.google.com	tcp
GB	142.250.187.196:443	www.google.com	tcp
GB	142.250.187.196:443	www.google.com	tcp
US	8.8.8.8:53	196.187.250.142.in-addr.arpa	udp
US	8.8.8.8:53	apis.google.com	udp
GB	142.250.200.14:443	apis.google.com	tcp
US	8.8.8.8:53	195.212.58.216.in-addr.arpa	udp
US	8.8.8.8:53	14.200.250.142.in-addr.arpa	udp
US	8.8.8.8:53	play.google.com	udp
GB	142.250.179.238:443	play.google.com	tcp
US	8.8.8.8:53	clients2.google.com	udp
GB	142.250.187.238:443	clients2.google.com	tcp
N/A	224.0.0.251:5353		udp
US	8.8.8.8:53	238.179.250.142.in-addr.arpa	udp
US	8.8.8.8:53	238.187.250.142.in-addr.arpa	udp
US	8.8.8.8:53	ogs.google.com	udp
US	8.8.8.8:53	ssl.gstatic.com	udp
GB	172.217.169.3:443	ssl.gstatic.com	tcp
US	8.8.8.8:53	3.169.217.172.in-addr.arpa	udp
US	8.8.8.8:53	99.201.58.216.in-addr.arpa	udp
US	8.8.8.8:53	16.173.189.20.in-addr.arpa	udp
GB	142.250.179.238:443	play.google.com	udp
GB	142.250.179.238:443	play.google.com	udp
US	8.8.8.8:53	249.197.17.2.in-addr.arpa	udp
NL	52.142.223.178:80		tcp
US	8.8.8.8:53	56.94.73.104.in-addr.arpa	udp
US	8.8.8.8:53	www.google.com	udp
GB	142.250.187.196:443	www.google.com	udp
US	8.8.8.8:53	beacons.gcp.gvt2.com	udp
US	192.178.49.195:443	beacons.gcp.gvt2.com	tcp
US	8.8.8.8:53	195.49.178.192.in-addr.arpa	udp
GB	142.250.179.238:443	play.google.com	udp
US	8.8.8.8:53	consent.google.com	udp
US	8.8.8.8:53	github.com	udp
GB	20.26.156.215:443	github.com	tcp
GB	20.26.156.215:443	github.com	tcp
US	8.8.8.8:53	github.githubassets.com	udp
US	8.8.8.8:53	avatars.githubusercontent.com	udp
US	185.199.110.133:443	avatars.githubusercontent.com	tcp
US	185.199.108.154:443	github.githubassets.com	tcp
US	185.199.108.154:443	github.githubassets.com	tcp
US	185.199.108.154:443	github.githubassets.com	tcp
US	8.8.8.8:53	github-cloud.s3.amazonaws.com	udp
US	185.199.108.154:443	github.githubassets.com	tcp
US	185.199.108.154:443	github.githubassets.com	tcp
US	185.199.108.154:443	github.githubassets.com	tcp
US	8.8.8.8:53	user-images.githubusercontent.com	udp
US	8.8.8.8:53	215.156.26.20.in-addr.arpa	udp
US	8.8.8.8:53	camo.githubusercontent.com	udp
US	185.199.109.133:443	camo.githubusercontent.com	tcp
US	185.199.109.133:443	camo.githubusercontent.com	tcp
US	185.199.109.133:443	camo.githubusercontent.com	tcp
US	185.199.109.133:443	camo.githubusercontent.com	tcp
US	185.199.109.133:443	camo.githubusercontent.com	tcp
US	185.199.109.133:443	camo.githubusercontent.com	tcp
US	8.8.8.8:53	content-autofill.googleapis.com	udp
GB	172.217.169.10:443	content-autofill.googleapis.com	tcp
US	8.8.8.8:53	133.110.199.185.in-addr.arpa	udp
US	8.8.8.8:53	154.108.199.185.in-addr.arpa	udp
US	8.8.8.8:53	133.109.199.185.in-addr.arpa	udp
US	8.8.8.8:53	10.169.217.172.in-addr.arpa	udp
US	8.8.8.8:53	collector.github.com	udp
US	140.82.114.21:443	collector.github.com	tcp
US	185.199.108.154:443	github.githubassets.com	tcp
US	140.82.114.21:443	collector.github.com	tcp
US	8.8.8.8:53	api.github.com	udp
GB	20.26.156.210:443	api.github.com	tcp
GB	172.217.169.10:443	content-autofill.googleapis.com	udp
US	8.8.8.8:53	21.114.82.140.in-addr.arpa	udp
US	8.8.8.8:53	210.156.26.20.in-addr.arpa	udp
US	8.8.8.8:53	raw.githubusercontent.com	udp
US	185.199.111.133:443	raw.githubusercontent.com	tcp
US	8.8.8.8:53	133.111.199.185.in-addr.arpa	udp
US	192.178.49.195:443	beacons.gcp.gvt2.com	udp
US	8.8.8.8:53	clients2.google.com	udp
GB	142.250.187.238:443	clients2.google.com	udp
US	8.8.8.8:53	beacons4.gvt2.com	udp
US	216.239.32.116:443	beacons4.gvt2.com	tcp
US	216.239.32.116:443	beacons4.gvt2.com	udp
US	192.178.49.195:443	beacons.gcp.gvt2.com	udp
US	8.8.8.8:53	116.32.239.216.in-addr.arpa	udp
US	8.8.8.8:53	github.com	udp
GB	20.26.156.215:443	github.com	tcp
US	8.8.8.8:53	beacons.gvt2.com	udp
US	192.178.49.163:443	beacons.gvt2.com	tcp
US	192.178.49.163:443	beacons.gvt2.com	tcp
US	192.178.49.163:443	beacons.gvt2.com	udp
US	8.8.8.8:53	163.49.178.192.in-addr.arpa	udp
US	8.8.8.8:53	github.com	udp
GB	20.26.156.215:443	github.com	tcp
US	8.8.8.8:53	api.github.com	udp
GB	20.26.156.210:443	api.github.com	tcp
GB	20.26.156.210:443	api.github.com	tcp

Files

\??\pipe\crashpad_4888_TUZONDCPDKZYAXGX

MD5	d41d8cd98f00b204e9800998ecf8427e
SHA1	da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256	e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512	cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

MD5	99914b932bd37a50b983c5e7c90ae93b
SHA1	bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA256	44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA512	27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5	c161dfc01a4c5af9f71a204e12c5b2f0
SHA1	5679ab683719a3081e1a74a6384e66857fa654cb
SHA256	43d958e9978e2613714caad781256d41c3062b3a2133c98edf9afeef71811855
SHA512	48b422f5495d603e7cd6a0746c73ca723898020004f568f210cfabec43fa5b211d834e4d94f0e8c524bcfe44e481ed9aadd24772633affc887531b66ff77261e

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5	6cc370c212c5cade8dae9d03d9ed0d90
SHA1	da169b167a77e1d95ff29e633885643566bd1424
SHA256	45c429eed629c6f184601541ca7c3c15643bc40fc0c8f7238b2ba08299316aa8
SHA512	49d90bf570c86026c5a516cc94367d820a93d1286fe0fef70d4c533481d46c598f5461f2596351d315366e0b8190fd5a9adeee5b08ed1856355f1bb4317c37b2

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5	c395d20f9c4174c4f1e2b77e351c61cb
SHA1	8a279ca98e8d8e7de5b9e7b9116b827ee5a24794
SHA256	2ef91dc528e688dde7718e4705080d2179ccad0247e8b3096aa35eac77cbb820
SHA512	2344bf54ff03bbf23b9bf5750f7c559585e177fd3f448abe5959cda1ac0a7e19dd7de961caf6070c52ef3095250e3aa242f3c9a6b75294a6c2d287d3154f461c

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

MD5	89e06b9556d0fc3d1fc8c93f9b1a7ddb
SHA1	25cb1800fafac31b6e0963994c48f26e4e49d5a4
SHA256	da7748c9b32466abe802a6f15c3886c49702865de84a6d2a51148b7d15b55545
SHA512	559c3f7496a79f586f868ac85210a667af3744487beb637cf22c32bd613b217d5900575b2fe6cebf8c6651b19f0fb0039d9a0cc95c66db8307e7302d2eac3102

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5	407f66d8578fc1901643c50e70590466
SHA1	b2c7d51534345a3b64bfafc61e965dace9dcd7d0
SHA256	39e8d84edd7bca4529dac89c947162b7ea88aff08f254608fdcf3d880b5ece9e
SHA512	846991125ae020d21d05da670695b85048a6993367de372006f9a51643eafea8494656d9030a8de8363efe3be9e5c0ddea823e9e465ae14071fa467922c20e8f

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5	4a15acff88b8f99b57eced5c5aa7dfa2
SHA1	08242db67075cbb56e691c3fa8ca94cc38ac8ce4
SHA256	7ba1aee8792c0f10ee79b35a7780976d3ee7bfd3e3dbe8485948acfa22a36096
SHA512	c5cbe4778848ca177c8a34a0238c11661710b0db1159db9d7d43e3a7fa94644c863d3a8dbc73bb4ccf8d519f429ada87469fe36ea958447a450267060980d6ea

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

MD5	19bec29e9949137bf706ca853d0f735d
SHA1	4a0cc837bf89e405dd66cfd43b6f59ccf741dff7
SHA256	57a33b4a84b8489e4123953923c62ddbcf66595f8c93f92ff648b64fb0f6dd2f
SHA512	fc2d759167fce290b413a8f1f1a3d1dcfccd0829568658863f0bd1a6a838a907619e5425cef6d2cf8a9a02a509b317763bc09bb71a34a94f73d0dd75e61f1962

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5	12817628e471ecbd5ad219be396918e6
SHA1	dbfe7c0bd858020107a9061168101c2604ed4b4c
SHA256	91c45ffd0496bb972c36095a0aeac8c3f8509961b02652bfc8c8238d0e239108
SHA512	d4f14269a44ffab4607eb7368e49713c28209ee7fa5e72d7bf55d10b93e79dfae00a7a0407d31153120affaef8cd5394f548420c422bad844c3435173a6b8643

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5	0a457faa1515d4e78d84d286377e0733
SHA1	62b8dcd2ff78d4e28ad33c77080797804c1a54e9
SHA256	4dcaf7fa32122a00dd969316b38d66e3ccf57049be6d5fd509150846d611f39c
SHA512	d668b7ebef98817267a32d2deda91e19f8b0770abdf4409360321088e213127e9efa3246251c81bd7e683f9366419f5dd79ec0c1a5edb20bd03f9715ff85dc1f

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

MD5	5996405ffce02ce4ede2b8d0cd194b88
SHA1	27802b4eba3ebc1eb0d4b7ed1c690b1ba7bab233
SHA256	d07ca5df1a082149c03dea7b22896402bf1727360241a4fd6e61add5358098e1
SHA512	a8200b8da78466e5abecd6c10056c6aa432af288be4fd938d282f8f969037d414ff4361daee6678399acbf8ac921487b012ba1759fea6dcd0e2cca86605ba00e

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\44f0a88f-6362-4a47-9f11-17da47e9fa65.tmp

MD5	796bed6ef36e283328b7f3b4f99642bc
SHA1	0265639728eb353f07099f390c5b92aa3da928ce
SHA256	752b4f147b5f8c72f9c75d77cb427b5a98f24fec6ddd5d5f415a9dc963005edb
SHA512	4202761fc9cb16aedea8f56327582363ca12efc213b9f2c850ac3b2a6e3f4a7f417fd7fa4968bedc5ea73fd1f9cbd0a13eb66341e18b7e301510cd21529fbf06

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5	a9d1c7306e2fdce901d91b9ce5f4bcee
SHA1	74579af9f5ee84693d6a10c774fefa9740d18a68
SHA256	93929a59470a30bd0be0117d37e76afa4ef13f89a03fbe31ad118dd01ca03d51
SHA512	bd3b89daa9fd7eaec00a42483fb3b54a5598ab17fdaeee6a7d8dedc541469fb32c439b937c6c9406e61931ccb5aa9c3b53cee95f8a2d9ce2a019919063cce8b2

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5	fd5669cc73442c53f5c295fae020320f
SHA1	908e65c4434b01e933656518338d60e8c4f222a3
SHA256	dda5884fb130c9a40735c0012edddba8c6124f679ea61ae192fbf3183c7f0551
SHA512	988adf878cd6ad32c5ecfc3264e88cd593a98aa76ac59e08cb7e0ca44bba58a4096d7355ba3eb06ec6a09ef06336bd3dd76bd6f6f381c6fa7595c088bee840de

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5	e863e770590f72ca411c064043d7f45b
SHA1	6161e8821b313b0602c19534f976983d57d93e9c
SHA256	6ad73d3cadca0e74a84c9d851e950f29ccb2591271302d5d1b2faa8879726b17
SHA512	546bf01882bcfc6dd322ed6bfb7274154099596157fc00ef0820af7d0651bb6209e5c07665cced6776fe21ab8a48fe8a76d34cd0f6518d287275a95c592b91e8

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe5caa22.TMP

MD5	a9748843b3951006cd98b83794b32aca
SHA1	4bb615a8bafcc8cd7030600799aa26389f587b89
SHA256	1b1d2b52cf471e2b70a0a361ae38e9f8c2a6bb8429c28d59c4149855342ed41b
SHA512	20a0113b6ec5384a25dd513e9ea2af28575648199454998a460c2cd3a53ce3df8194225ba71d428e5611c024b9e984524d8cd7fdbaf7e330da4dc0da506f363e

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

MD5	cfba309083a731ec8803d2c3a3a9e96c
SHA1	52578ba27d7e0287bbd0e45e4a8c9551e63cff60
SHA256	fe99882923c07d80e5c1ebb06c5401c6c0319b2c6ef4188c0252d4a826f6cd72
SHA512	82f09649d252c56ac7ef5445fc7edfbe639e12f43d3ce47aeadc9aaad7f9bf3b2dda6982d1acec6ad0a7a4af3b765b3f23b084196c6ffa0ff9ce2b9a2a2429b6

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5	9cc403bf91dbe3eee354843e77d60ddf
SHA1	932ffd92ad635f4c935fbf2712870bae248d3640
SHA256	dac4d2a344bef4a29fef69646e8140cfea87687d9edaec5c5905ce1dd925a0fb
SHA512	d0e33ecee372f4fa289c2a34f21e23bf41ed7ef4fd28446912a2fd5ed5cabf888f1173fa844c135d8afdd4b57075a2e586a3a02f06c3b248774445684b55571e

C:\Users\Admin\Downloads\1d9bd899e9470b5e4c4f42d2a337918a5686dcb936a3563e19622483f0bf3027.zip

MD5	8d9ea584c2f8b98d680e1591856eaeac
SHA1	fbffadc8b8e536e82804d3a4dafd27a3325362f4
SHA256	789cf758b123eb1d57a1aed11b9ba2b77fdd173651165990350a803f91feac86
SHA512	7d62bbad6e59c5cb405389e775a3f84c947a0f9083b4fe5ea246a58827fc3b2af6242408b306abbd5ac501c8b4305f8facdea59910ab89eeff4588becc3120ec

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5	19c6160a462fe3afe812924818a341cb
SHA1	5d8cce2ca18a1bb7d802377ea8d4191830c54247
SHA256	ee185e53617c2b6c022a7c26dcca9143bb33a1cd22d853b39b5225e32f4490c7
SHA512	bb1e511abadbb12f86a2ff74e68dab24ceb27b0059cdaeba102a6e8427ac003d53f1e00e9fd5a02137babc4ef5df179ffa617b7e94fcf82d797931c27de2fcb9

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

MD5	cb79c4023995ef31114cdbda686ccc13
SHA1	893f5bf60a9d37dfc02f0178f3d59db680164cd2
SHA256	d84c6b386f4685359ad4f54f9f2a056f077c4986d15544d46a6ad63064c0d9fd
SHA512	f1329914bcc6797255925e6d5e44eb8e56c34e83c5f602c63156aaca2ae6e55c3d089cabe604283f93379125112efc1d5835618160f9aa6eb34857544a15a2d1

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5	28150b15b3cdd4063bc0135890db7f40
SHA1	17e3b3df249ec08e55ee79fb1e98dd754e7f66b3
SHA256	114bbd426e9f43bf7d20c362c8012ba7228956340e5201612a83892594dc1928
SHA512	e48252524c405a15bad1c3394c797dd1d3b4535c6e14afada0e794a30164849ff7c17f49a543d762ed8807a56a0e00e1098e5e6e76ef42c538e33b790a9cbab6

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5	fa9ec446d6fe1d49249021016ba5be78
SHA1	7de6d284560772ce0e3e21627579dc44b4c6cebb
SHA256	153dde1572cfac47d4d5c14fc4361909159c8596a63ca050b8e22cb4028abdda
SHA512	47b073fe9af585fa9bb4d3b5b74f10079e9f0305b2704543464658b47454a905bd1204eb0a2001fc4e9958348df3b2f68d2e39eeddf83d357400fcf34d878c5a

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

MD5	8b8038d49ade8589c0b3e91022fcba7b
SHA1	579a5e2f3136ff0989212cd0dcff3fe2cc3ef7cc
SHA256	daf9eb0135428a2fa3ab576de1103182853c4780a07a452bd464b16958594273
SHA512	ab794cbd043669a611967c8b38a09475bfb65ff3b90b57ee2d1e56eb62e90d9ecf1eac2db401d1e63c8359e4a37ae29ef7c4253d6495a5aa571b7afafbdd6f75

C:\Users\Admin\Downloads\1d9bd899e9470b5e4c4f42d2a337918a5686dcb936a3563e19622483f0bf3027\1d9bd899e9470b5e4c4f42d2a337918a5686dcb936a3563e19622483f0bf3027.exe

MD5	591c4518dfc22c6484a3f0c6cbb9b056
SHA1	db1bac6deb1b76f0837f1f51857ceae4b81889c3
SHA256	1d9bd899e9470b5e4c4f42d2a337918a5686dcb936a3563e19622483f0bf3027
SHA512	c278c01f4ea9d259f6ca535fefac934383ca6b2529945d3beaf182f80c9fbf7fd17fbf9d99f5408dc5d83a8524e8ef15eaba7963287276c06641059de45d5603

memory/224-451-0x0000000000420000-0x00000000005F4000-memory.dmp

C:\notice.txt

MD5	c2d7e35bd00150e2d3d28888df5d10fb
SHA1	f7fdbcc3d6cd02097a037ff163f03f44a8a839b1
SHA256	494ba1d8f3532b2e68857b7f9b603addaeb3f506f36eeb1fd0cdfb506523c87f
SHA512	f5cbd03ad348c94b55eabb11e1bd6fcc09646be103ea96ae190d5fadcf253c6a41894912ebc91bfaf6759df87ed44e9c653305de2b973ebc1d844591107352d0

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

MD5	5c18af72ab972cdc7ee87dbd4d2682a5
SHA1	1eaf3f481cc0c1848c758a3748a8eb1902d56d2f
SHA256	fabdd3c6b69da4ca7a580d2571c8cbe4be320139cb10f8a227c9e5dc4de49f70
SHA512	c2d0bf779b2da72f0ba8b417a50841649419e35f5422fcff28ebf30dc08438fdc2898e0244e402b119948787e679b1dfff100eff8bf301ccf552f6c458780598

C:\Users\Admin\Downloads\1f69810b8fe71e30a8738278adf09dd982f7de0ab9891d296ce7ea61b3fa4f69.zip

MD5	91cc14457fb7680e45510fe4cdcc05c1
SHA1	16b383a176b61d78a4338c6f510872c43dcec452
SHA256	3ca550ea7a57934d6a0eba1184364d2c87a0a7d886311be7a6afb813989caee8
SHA512	71245c73c5650a84849ba715cafe4ab099eeac8c58bb870d104700cd7c5140407ac4e88f828474ec5d1295ead9bfa13ba7028eec987101c5efe343c5ef12bd65

memory/1704-474-0x00000000028F0000-0x00000000028F1000-memory.dmp

memory/1596-475-0x0000017B7A100000-0x0000017B7A200000-memory.dmp

memory/1596-480-0x0000017B7A640000-0x0000017B7A660000-memory.dmp

memory/1596-497-0x0000017B7A7C0000-0x0000017B7A7E0000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5	605041740dea5be27d73c2f904993f91
SHA1	9603c05238423018d913d8ee323d2f41290e3aa8
SHA256	796195cd56c281103488fce72134c6bfc05b009ec3803a663ba453bad33cf678
SHA512	9cf180f0ded02e82c5944971ca9fcf3ca80fb2ae25b920cb453e2e9a6e17ef8d21700517ff638d502909a6dff368cc56582cfb02886e0ad702c96d7f3899498e

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5	d5112cebfcb12f4a68284da7744c422d
SHA1	a93e95bfb40bef2fdec0acf92e0b7e8739265153
SHA256	edd40c0b8c24dce54ca37f1d8300cd579f115a8eae8aecf28b6e540373f98afd
SHA512	512780461d42d2122f227fcab9f754e3d6536dae3f2fce1c9b744509c257712e823183583634d7c698f6833f02d561129105173fb38807ad3e1ca8ba0d6cde32

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

MD5	038bc00a3f3e7e29ef9d29185521d343
SHA1	f2f7092dc9eab6e0d6d81864534624fa12f7d37c
SHA256	cbc567750af9f73c5f12612f27c74eb0a2173e35c7b736ee0c33dd127ffdcc82
SHA512	3c671d4e55cd40e13d9b64c2c803cf298f79e293737743f0bd358234eecca7b968a0c6723a31f40f0a8543b18390cf02ce0770300dd467a806c0716036883013

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\5f7b5f1e01b83767.automaticDestinations-ms

MD5	10cde1d9285557d98ff6514fd7cfd2e9
SHA1	524146098bc4a971de3863b64cc95c796e20a057
SHA256	37fb64144b25963fcf716c6de9dadc190b9ebaf214520f142e28548564f7dfbf
SHA512	94608d2bde48716cfba616ace96c5217e2be5802b57cd544919541127521d188fd026ca2549561d08e86ac61e78a77c77bd667898d266212386ee0dde691045f

C:\Users\Admin\Downloads\2f97d2c4a57016ca28768353e63612e16c8698254bcf588047f2ee75ea10e174.zip

MD5	8ca2a371e004a97df1a6cb1b6db592a1
SHA1	2f61b0882db0a8d939ca817339204ac0a2571220
SHA256	79d455c1cb019f3800b511c14d5c800c195119feaa780904054d157846edd6b5
SHA512	609c566096720cd7cd09203651026f3b985064ae03b1fc4691bb2ca788130f3ec119101974b243e80deb7a0faa2c76ec8a68253421024947f5e03a0bc08cc0a9

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5	bbcf95ddd62cbafeb18514defecc7488
SHA1	60e4ac76174d659a1ee567e42d5353c4da753d89
SHA256	dd07b342eee6afe7f3847769cb6f46f9d6693f7e442c1703955787c53dc0e6cd
SHA512	d62413cbab8fd1f9689b94a50ee8add35e49a7f72e2a60ededea12518d9c7dc4d4aafdecde882e324d8558369cd8d36b83881460b63d63f555bc9cded3e266ee

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5	f94cbb8fc2d3319941c4654d6819b907
SHA1	b6f923f5cbb6712bcea155fabdde6c81c9309297
SHA256	b91a3bee4812b3ab3f650589d22c9ebf3d5a474236f86b3f9767704a152e92c6
SHA512	a046483872da9b55996381885bcc906ca03eda08e38915815aa2bb913cba8c3b5b323103c170986e82777c912abf697953e160229b9cae59c5de3a92c234c5d3

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

MD5	c10dfdbb3b511e6c81f2b7558188426a
SHA1	40bade9d70caf4b2344f3cb37fe8d0e7cdbae8bd
SHA256	17a73f1487d588c7502d57bac942469905ebe11e01e4e83e2c059ab4a889df12
SHA512	e0c2ca37eaf644d777cbdcee4169b0142ab890afffbec24e70af7083299e7695bd7c108e2cd05b069b391cb3d6de25cea4f70ce1ad481e1bb826f77552b4957c

Malware Analysis Report

2024-09-11 06:06

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

Threat Level: Likely malicious

Malicious Activity Summary

MITRE ATT&CK Matrix V13

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Sample ID	240522-t91fashe8t
Target	240522-t14flahc41-behavioral1.pcap
SHA256	9ad9f21ec1538978e896317756689c1b02b84d645a2f7c9c05416a7d2033b3ab
Tags	discovery evasion exploit persistence