Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe	N/A

Adds Run key to start application

persistence

Description	Indicator	Process	Target
Set value (str)	\REGISTRY\USER\S-1-5-21-952492217-3293592999-1071733403-1000\Software\Microsoft\Windows\CurrentVersion\Run\confuse = "C:\\Users\\Admin\\AppData\\Roaming\\confuse\\chargeable.exe"	C:\Users\Admin\AppData\Local\Temp\1135f4d76cb6ca7605d54bd690b378bd769acdd28172fe55117f53de8f3c7520.exe	N/A
Set value (str)	\REGISTRY\USER\S-1-5-21-952492217-3293592999-1071733403-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysMain = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1135f4d76cb6ca7605d54bd690b378bd769acdd28172fe55117f53de8f3c7520.exe"	C:\Users\Admin\AppData\Local\Temp\1135f4d76cb6ca7605d54bd690b378bd769acdd28172fe55117f53de8f3c7520.exe	N/A

Suspicious use of SetThreadContext

Description	Indicator	Process	Target
PID 3476 set thread context of 2028	N/A	C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe	C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe

Enumerates physical storage devices

Event Triggered Execution: Netsh Helper DLL

persistence privilege_escalation

Description	Indicator	Process	Target
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	C:\Windows\SysWOW64\netsh.exe	N/A
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	C:\Windows\SysWOW64\netsh.exe	N/A
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	C:\Windows\SysWOW64\netsh.exe	N/A

Enumerates system info in registry

Description	Indicator	Process	Target
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A

Modifies data under HKEY_USERS

Description	Indicator	Process	Target
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133632851065609317"	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A

NTFS ADS

Description	Indicator	Process	Target
File opened for modification	C:\Users\Admin\Downloads\BonziBuddy432.exe:Zone.Identifier	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A

Suspicious behavior: EnumeratesProcesses

Description	Indicator	Process	Target
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe	N/A

Suspicious behavior: GetForegroundWindowSpam

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe	N/A

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Description	Indicator	Process	Target
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A

Suspicious use of AdjustPrivilegeToken

Description	Indicator	Process	Target
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe	N/A
Token: 33	N/A	C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe	N/A
Token: SeIncBasePriorityPrivilege	N/A	C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: 33	N/A	C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe	N/A
Token: SeIncBasePriorityPrivilege	N/A	C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A

Suspicious use of FindShellTrayWindow

Description	Indicator	Process	Target
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A

Suspicious use of SendNotifyMessage

Description	Indicator	Process	Target
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A
N/A	N/A	C:\Program Files\Google\Chrome\Application\chrome.exe	N/A

Suspicious use of WriteProcessMemory

Processes

C:\Users\Admin\AppData\Local\Temp\1135f4d76cb6ca7605d54bd690b378bd769acdd28172fe55117f53de8f3c7520.exe

"C:\Users\Admin\AppData\Local\Temp\1135f4d76cb6ca7605d54bd690b378bd769acdd28172fe55117f53de8f3c7520.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff8f4e8ab58,0x7ff8f4e8ab68,0x7ff8f4e8ab78

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1512 --field-trial-handle=1752,i,15263132960423728910,16711251881763057347,131072 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2116 --field-trial-handle=1752,i,15263132960423728910,16711251881763057347,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2176 --field-trial-handle=1752,i,15263132960423728910,16711251881763057347,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3036 --field-trial-handle=1752,i,15263132960423728910,16711251881763057347,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3108 --field-trial-handle=1752,i,15263132960423728910,16711251881763057347,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3820 --field-trial-handle=1752,i,15263132960423728910,16711251881763057347,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4328 --field-trial-handle=1752,i,15263132960423728910,16711251881763057347,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4568 --field-trial-handle=1752,i,15263132960423728910,16711251881763057347,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4608 --field-trial-handle=1752,i,15263132960423728910,16711251881763057347,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4780 --field-trial-handle=1752,i,15263132960423728910,16711251881763057347,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4872 --field-trial-handle=1752,i,15263132960423728910,16711251881763057347,131072 /prefetch:8

C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe

"C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe"

C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe

"C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe" --reenable-autoupdates --system-level

C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe

"C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x254,0x258,0x25c,0x230,0x260,0x7ff7a888ae48,0x7ff7a888ae58,0x7ff7a888ae68

C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe

C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=4924 --field-trial-handle=1752,i,15263132960423728910,16711251881763057347,131072 /prefetch:1

C:\Windows\SysWOW64\netsh.exe

netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe" "chargeable.exe" ENABLE

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=3836 --field-trial-handle=1752,i,15263132960423728910,16711251881763057347,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=4988 --field-trial-handle=1752,i,15263132960423728910,16711251881763057347,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=3244 --field-trial-handle=1752,i,15263132960423728910,16711251881763057347,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5136 --field-trial-handle=1752,i,15263132960423728910,16711251881763057347,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --mojo-platform-channel-handle=5352 --field-trial-handle=1752,i,15263132960423728910,16711251881763057347,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --mojo-platform-channel-handle=5228 --field-trial-handle=1752,i,15263132960423728910,16711251881763057347,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --mojo-platform-channel-handle=5164 --field-trial-handle=1752,i,15263132960423728910,16711251881763057347,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --mojo-platform-channel-handle=5364 --field-trial-handle=1752,i,15263132960423728910,16711251881763057347,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --mojo-platform-channel-handle=1480 --field-trial-handle=1752,i,15263132960423728910,16711251881763057347,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --mojo-platform-channel-handle=1476 --field-trial-handle=1752,i,15263132960423728910,16711251881763057347,131072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5388 --field-trial-handle=1752,i,15263132960423728910,16711251881763057347,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5776 --field-trial-handle=1752,i,15263132960423728910,16711251881763057347,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5820 --field-trial-handle=1752,i,15263132960423728910,16711251881763057347,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2680 --field-trial-handle=1752,i,15263132960423728910,16711251881763057347,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5776 --field-trial-handle=1752,i,15263132960423728910,16711251881763057347,131072 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2656 --field-trial-handle=1752,i,15263132960423728910,16711251881763057347,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5928 --field-trial-handle=1752,i,15263132960423728910,16711251881763057347,131072 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3920 --field-trial-handle=1752,i,15263132960423728910,16711251881763057347,131072 /prefetch:8

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	72.32.126.40.in-addr.arpa	udp
US	8.8.8.8:53	203.107.17.2.in-addr.arpa	udp
US	150.171.28.10:443	tse1.mm.bing.net	tcp
US	150.171.28.10:443	tse1.mm.bing.net	tcp
US	150.171.28.10:443	tse1.mm.bing.net	tcp
US	150.171.28.10:443	tse1.mm.bing.net	tcp
US	150.171.28.10:443	tse1.mm.bing.net	tcp
GB	142.250.187.196:443	www.google.com	udp
GB	142.250.187.196:443	www.google.com	tcp
US	8.8.8.8:53	196.187.250.142.in-addr.arpa	udp
GB	142.250.200.14:443	apis.google.com	udp
US	8.8.8.8:53	195.187.250.142.in-addr.arpa	udp
GB	142.250.187.206:443	clients2.google.com	udp
N/A	224.0.0.251:5353		udp
GB	142.250.187.206:443	clients2.google.com	tcp
GB	172.217.169.46:443	play.google.com	udp
GB	172.217.169.46:443	play.google.com	tcp
MA	41.249.109.189:10000	doddyfire.linkpc.net	tcp
GB	142.250.187.238:443	fundingchoicesmessages.google.com	tcp
GB	142.250.187.202:443	content-autofill.googleapis.com	tcp
FR	151.106.4.82:443	bonzi.link	tcp
FR	151.106.4.82:443	bonzi.link	tcp
FR	151.106.4.82:443	bonzi.link	udp
GB	172.217.169.2:443	googleads.g.doubleclick.net	tcp
GB	142.250.187.238:443	fundingchoicesmessages.google.com	udp
GB	142.250.187.238:443	fundingchoicesmessages.google.com	udp
GB	172.217.169.2:443	googleads.g.doubleclick.net	tcp
GB	172.217.169.2:443	googleads.g.doubleclick.net	tcp
GB	172.217.169.2:443	googleads.g.doubleclick.net	tcp
GB	172.217.169.2:443	googleads.g.doubleclick.net	tcp
GB	172.217.169.2:443	googleads.g.doubleclick.net	tcp
GB	172.217.169.2:443	googleads.g.doubleclick.net	tcp
GB	172.217.16.225:443	tpc.googlesyndication.com	tcp
GB	172.217.16.225:443	tpc.googlesyndication.com	udp
GB	172.217.169.2:443	googleads.g.doubleclick.net	udp
US	8.8.8.8:53	s0.2mdn.net	udp
GB	216.58.204.70:443	s0.2mdn.net	tcp
GB	216.58.204.70:443	s0.2mdn.net	tcp
GB	216.58.204.70:443	s0.2mdn.net	tcp
GB	172.217.16.234:443	ajax.googleapis.com	tcp
GB	216.58.204.70:443	s0.2mdn.net	tcp
IE	54.154.243.133:443	fw.adsafeprotected.com	tcp
US	172.64.151.101:443	dsum-sec.casalemedia.com	tcp
GB	142.250.179.226:443	cm.g.doubleclick.net	tcp
GB	216.58.204.70:443	s0.2mdn.net	udp
GB	142.250.179.226:443	cm.g.doubleclick.net	udp
NL	185.89.210.46:443	ib.adnxs.com	tcp
US	172.64.151.101:443	dsum-sec.casalemedia.com	udp
GB	18.245.253.3:443	static.adsafeprotected.com	tcp
US	8.8.8.8:53	133.243.154.54.in-addr.arpa	udp
US	8.8.8.8:53	dt.adsafeprotected.com	udp
US	8.8.8.8:53	101.151.64.172.in-addr.arpa	udp
US	8.8.8.8:53	226.179.250.142.in-addr.arpa	udp
US	8.8.8.8:53	46.210.89.185.in-addr.arpa	udp
GB	18.245.253.3:443	static.adsafeprotected.com	tcp
US	3.89.13.112:443	dt.adsafeprotected.com	tcp
US	3.89.13.112:443	dt.adsafeprotected.com	tcp
US	3.89.13.112:443	dt.adsafeprotected.com	tcp
GB	172.217.16.226:443	googleads4.g.doubleclick.net	tcp
GB	172.217.16.226:443	googleads4.g.doubleclick.net	tcp
FR	151.106.4.82:80	bonzi.link	tcp
FR	151.106.4.82:80	bonzi.link	tcp
FR	151.106.4.82:80	bonzi.link	tcp
GB	142.250.200.34:443	ade.googlesyndication.com	tcp
FR	151.106.4.82:80	bonzi.link	tcp
FR	151.106.4.82:80	bonzi.link	tcp
GB	142.250.200.34:443	ade.googlesyndication.com	udp
GB	142.250.178.14:443	encrypted-tbn0.gstatic.com	tcp
GB	142.250.178.14:443	encrypted-tbn0.gstatic.com	tcp
GB	142.250.178.14:443	encrypted-tbn0.gstatic.com	tcp
GB	142.250.178.14:443	encrypted-tbn0.gstatic.com	tcp
GB	142.250.178.14:443	encrypted-tbn0.gstatic.com	tcp
GB	142.250.180.22:443	i.ytimg.com	tcp
FR	216.58.215.35:443	beacons.gcp.gvt2.com	tcp
GB	142.250.180.14:443	encrypted-vtbn0.gstatic.com	tcp
GB	142.250.187.196:443	www.google.com	udp
NL	23.62.61.171:443	www.bing.com	tcp
GB	172.217.169.46:443	play.google.com	udp
GB	142.250.180.22:443	i.ytimg.com	udp
GB	142.250.200.34:443	ade.googlesyndication.com	udp
US	207.241.224.2:443	archive.org	tcp
US	207.241.224.2:443	archive.org	tcp
FR	216.58.215.35:443	beacons.gcp.gvt2.com	udp
US	207.241.239.241:443	sentry.archive.org	tcp
US	207.241.239.241:443	sentry.archive.org	tcp
US	207.241.225.195:443	analytics.archive.org	tcp
US	207.241.225.195:443	analytics.archive.org	tcp
US	207.241.225.195:443	analytics.archive.org	tcp
GB	142.250.187.202:443	content-autofill.googleapis.com	udp
US	207.241.225.195:443	analytics.archive.org	tcp
US	207.241.228.85:443	ia801005.us.archive.org	tcp
US	207.241.239.241:443	sentry.archive.org	tcp
US	207.241.224.2:443	archive.org	tcp
FR	216.58.215.35:443	beacons.gcp.gvt2.com	udp
GB	142.250.200.34:443	ade.googlesyndication.com	udp
FR	216.58.214.67:443	beacons.gvt2.com	tcp
IT	34.17.18.17:443	e2c61.gcp.gvt2.com	tcp
FR	216.58.214.67:443	beacons.gvt2.com	udp
GB	142.250.200.34:443	ade.googlesyndication.com	udp
FR	216.58.215.35:443	beacons.gcp.gvt2.com	udp
FR	216.58.214.67:443	beacons.gvt2.com	udp
GB	142.250.187.206:443	clients2.google.com	udp
FR	216.58.215.35:443	beacons.gcp.gvt2.com	udp
US	216.239.32.116:443	beacons4.gvt2.com	tcp
US	216.239.32.116:443	beacons4.gvt2.com	udp
FR	216.58.215.35:443	beacons.gcp.gvt2.com	udp
GB	172.217.169.67:443	beacons.gcp.gvt2.com	udp
GB	172.217.169.67:443	beacons.gcp.gvt2.com	udp

Files

memory/4560-0-0x0000000074F21000-0x0000000074F22000-memory.dmp

memory/4560-1-0x0000000074F20000-0x00000000754D1000-memory.dmp

memory/4560-2-0x0000000074F20000-0x00000000754D1000-memory.dmp

\??\pipe\crashpad_2816_BMLSXENFUSFEAUXI

MD5	d41d8cd98f00b204e9800998ecf8427e
SHA1	da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256	e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512	cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

MD5	d751713988987e9331980363e24189ce
SHA1	97d170e1550eee4afc0af065b78cda302a97674c
SHA256	4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512	b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe

MD5	f888001689a154d11699d5a6392bca60
SHA1	8f971b9df475317c0197200ce09b9896563b7f33
SHA256	d74d0b62b9c2a80ddd1d6755d5daf50207563720eba7a8b857f6bdf38390505e
SHA512	1de0c1c9fb57fb4cdaa5c01f36787a4ace784394dd1772369fbcbabeb1c314e3a9b067292e7a19b1ab7831ef68cfc186ca9688d3a15bbad84510921c988d5c1a

memory/4560-57-0x0000000074F20000-0x00000000754D1000-memory.dmp

memory/3476-56-0x0000000074F20000-0x00000000754D1000-memory.dmp

memory/3476-58-0x0000000074F20000-0x00000000754D1000-memory.dmp

memory/3476-59-0x0000000074F20000-0x00000000754D1000-memory.dmp

memory/2028-65-0x0000000000400000-0x000000000040C000-memory.dmp

memory/3476-69-0x0000000074F20000-0x00000000754D1000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\chargeable.exe.log

MD5	120bfac9d59228edf92ec26d4bbfaf9e
SHA1	bc36d828b7f358671ef0cb934c4ab2fdfb02b447
SHA256	c4c6e7ef90b460bf232e55933594a95ba4a2d156fa5accb06d1c7c2f817fcf35
SHA512	684f086ff7d41d85782b21f5bc7e79584f5866f3c06eabbca2c5a697c1d142aa81e0dc25c78be978ba67e9e6fc014f3b62d1da114dc1bb009c7637491a619137

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5	3ba0e1b67881b39ede78b1fdaf9670f1
SHA1	11ccdeda0b0e8752e73450f295fe44d9d784e7f1
SHA256	b2226f7fcaf9e92163a9ba9f7de01083159caae83d6c7171788169920c8b049f
SHA512	bfe5c8e89d2a81b8d1ff30a53b20df1259b48dbcd8ed529e3767e69c179169bd657a240795a7a50309731c9c6e38f2bf0bfdff1de8703c5d49b3bc8d45e13e68

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5	ecc08f1efe8d535fb0014a4ad57d96ec
SHA1	b695f05ba984ad2b6af7dbaef818b7c06e9f487c
SHA256	4b61d0f96724f36e7be7d40a8f56cc7fed14e61d51996a6efc38ebbb0ea4246e
SHA512	1755de270eaf4043e384d57c8f35709373c257682d1d5ddcb05136f15b2132a32cb7ebd9451e4a6d6b439316f554674656b568de21790f24f85bfe6652bd3099

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5	44038e9981087a7071954468008f7a1e
SHA1	a16122740a5a0261e590bd6ad06c8c90e72a2669
SHA256	80fd113a4dd899d147e47b9ce2144193095cb654dcf1a30b45f3bc8c8355283b
SHA512	8897794d8f0872de779611725f1160f1b72df033cdc7155f540ffb2b30489d489c840f529368e366c9d21137375cab74ed4bbffc59c2df768d3ef18280ae89c5

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

MD5	ed038d4c2b2be688c940ca9c5404e624
SHA1	c6f2055a8dbde84271237aadfb2df94a407dddbe
SHA256	e81812b005b89cca1a75f2d285874604bde368f569e3d9c4a7a9587d72acd0a3
SHA512	f0b5045a08642a245dc509732ecc219d7035553f3c897017d23eaf449512be1913139923ff17a16166658f78ac40c7e5cd792b7d41ce575a1ee5214016417c0b

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5	40af62ecc2d197c140d806852352c616
SHA1	0c73c72187e005bae2cf009b8bde118fce4452f4
SHA256	e12d0ebc810045de543d3676b17b79d2fc73fb9d26d50314c5766337130d31b4
SHA512	b569bbb2ba51c598148e4cd1c1ce04d0708a1cbf6797b77a4922bbebe9bc2bce0f7b8051c82581175c0c2e4d6060d108f70ad0363fead13d1395653ac3551ce7

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5	470e47008d74d4319b80a3899ef64a41
SHA1	92976e65ad6ae041ae4c516a11a1e52fe452d616
SHA256	199cc915a56afb51561002460afad9631a22b4e841eab5d776304d3b40d99878
SHA512	e88a00ec0bab93940f1adca7805feda5836c4733570c02c6de14c5db0f90cb183cc5299a3638253a6d301007cb3d6fe826c38e7146a466a70faca5d554ccc750

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000022

MD5	94f3cd075711c9533d5c34754d748eef
SHA1	6d17b83bacb2d1aea0b3e7995dc7128cf7b88e56
SHA256	26922c1a98440b0c6b8141d2ed4d0f485fdca942fc1bdf304c723ad17224e7ba
SHA512	4996ef6edf0e7616cc778f06fafb3cacaf81de8ab66559b60617d87cbb6c7e8fbc3209aa2455dcc480f9e40bb6e162ed22a7ee25eca5563052530b1830a626e1

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000020

MD5	ce1093c800c0933d7c9674eda75790d8
SHA1	371c2dcde092f51b18852e2617bc6c0c176f5873
SHA256	57781a723db9a2483067bcbc89d1f30f7e2f22ae2d18aab1e45ad894d8cdab89
SHA512	fdbb31c607cc9a4bd75c42cbc552fb40d82e53804d156244ed2daa124c75e1680b908589f7a3ad8888b9b03ebfd1f4b3e83e19f84e3a746cf210d0b8a1678533

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5	165cd25defe3c6ead16777ebc393636c
SHA1	488c98eec28241c1a3b6a647113946dfadb6e138
SHA256	ad307ff739839760252c0a5620c964ef422743d75ca0a49c87f88b1c11c7aa2d
SHA512	6ee1e7a4cb0d58457a48f465c403a0aa3a205397ef0f0052b2316d5232f72586fe64d278758b6d9bf0b0d2e851ff1fe03399b8e73a142dd27a71c0f21edb74c5

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5	f072bf65050a61d27d3b85732cc4ae69
SHA1	8b7baedb574e5b14a2c9f7c3fcd331d2475e808a
SHA256	873bc674af8c4fd6cb25db9e608d913a32ed3852ca0e65ad989f7f9f2c652921
SHA512	47202f3cbd206444d4e89e567aeeafb8df1f5a765e05ee64e888358dd9666efa914cd3987ce113775b9c529c2ab4e820d28f1bcb93605aa6b228a28f31f61219

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

MD5	73a607ffff9556ce616ab1ff640bb057
SHA1	47e6f075dc439000e28344fe23324401a05d69f4
SHA256	a9ded6167400b94c35c74482148d4b7bbc0978ae509922483b664a24f0e5ed75
SHA512	b68461c85a718e2242f1829d424c5cef9ed77a749d9dc83027ce943f09ce07f87087e0d0e81986708d207517befb8d774a816365ca8c9654db759ba445658aa0

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe57e84d.TMP

MD5	00d7bc49d2c9704d1e8b207ba0295623
SHA1	189fe68d1e15fb6a911939f8164d1a7f49bc62a7
SHA256	1e00a42612d274c80fe59fa4f6763f48952204ae76578b41ea42d8634ed2d584
SHA512	aedcaa81c8eea81907936614885ff32d4c26f9a03d8c4de876d0aa6b453a7ee183e4c2ef5d11e0b5178f11f1f38ed2b25bb3fc2129a1832b97a9569b39356031

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5	eb3d081472587ea190ad18ac78b43a3e
SHA1	06653dd80835ce6258eb4178b5e9d84db627faa2
SHA256	8463308dc3e7ce2ac5624a32268fb2a9c9a5be33129ae76a83b8f11e0e616f72
SHA512	3decf50674284a7a4c6b3af1e1b40f594b5699239c8c59d9bf4bc47784b032a48a7e9dbf87627b9eae7dd743921561b7818f150a7eb0f964123d9f39bf9e128b

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

MD5	3f5f4b10a685c416b4aca19773f68f6a
SHA1	bc2b6c09da68c23a742f4b161a90111ec2832966
SHA256	6ea8d2f157b0543e9c61208600506652b0ee18cd62302889a1e1307e5096aad9
SHA512	f31f30ea148b48345ccd7a85362bb4f7069f833d033d650b407179d8e6a5b95c43a5d30f1515057a15fa147e00da49ad78b46828a1b55f8c6e9dea4f3a7fbaed

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5	841da80c4f8452f75297df1c98edd65c
SHA1	0141020438562f329904def5bba45804b3a6d7a8
SHA256	3d8510ab87e71d9741f9ef9d0dc75815fbc40bc01c756900c7454292e85f2671
SHA512	26537539e4a8288554df85bd49fbb2fbc6e9574275df190c9a399a765a3b2210f8a17821b7c60b742fb5682ad83f180f0c7ca6c095b9f9ed9fab7b86678e96af

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5	79638a64e4feda72b27e5c0a4fed6bef
SHA1	097a9bed2a00abc16b62692a139170a1553e6a82
SHA256	b9ad13b341262a0868c1fab2aef2355ba5731e6c5e73b73afe492dc68ddf22f5
SHA512	64d9b5cf4687d666c1d2b5b2a42536c4ad7da03f1e411d28e5b67af1f9aa14b21b0e540bb44a3b486102609fc7d1619a65b3fa85ec90a92c5470a89460755db8

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5	aa48b53c7eebe9fa75793c9b4b66e5ed
SHA1	0234147b478695e301937e4da5c149de5b879e01
SHA256	1021aaf5e5876d63230304409ebd6affea053915e7bf05a4703b79f7004edd1c
SHA512	83f15a3f7ecfc81134ef3fad098b8d146d7725fc37be358faaf97c28423174975a36e32ace5b0841b124a1048e2fc2caef08b6526864e738aa7a035640a7bd3b

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5	4985771b2633a56d42d1d834727eaa99
SHA1	9d1ea3c59c30fb0337bc821c743064f96c2f27fc
SHA256	8da78fba34bde680c5b94c7684138b1f3de5b1db61f25bab7c761361baa683c3
SHA512	1f817e8adf48d7ca610246de0c66fe109e32e0f31720b620ddcda85c3091459611fc5297a06bfde2605d11732081f08f1dca8da263bb93f0fa2352e0435b19b5

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

MD5	972ad86cae04dff28c1481884df36e4e
SHA1	a22f63427e2714636de38d4ec73453b572eb6596
SHA256	a373a73eab501db64de96b9c3fd3ef05b2f42fb86826be4f1472f650e6bea1f1
SHA512	8d86e2d5959a0eae750f21b34cbf7d1151cd4ce7eb5c7dc14261c7a44e6bb7feb50c2376ba2474dceae2c3e50904d60038456bbace115c6fd9e2a79621633742

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5	cc5c773e0dfb69c4fa65e6fa14bc3569
SHA1	fb974871048618ae8a4378420115cfd8716eddb2
SHA256	e98c58909667bc9dc8d5d39554ae66807de37f05d9043f3919d6b1e0e41d8a09
SHA512	ad8fcc9a3a4dd569517d6c67a543f0565e79b44f53abb1234ea5acbce39b693dac77b0407b16be5fe8b241e3c9a499c81aad74dd1d261049720e00cc3347ef7c

C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

MD5	f3b25701fe362ec84616a93a45ce9998
SHA1	d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256	b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA512	98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_archive.org_0.indexeddb.leveldb\MANIFEST-000001

MD5	3fd11ff447c1ee23538dc4d9724427a3
SHA1	1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA256	720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
SHA512	10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_archive.org_0.indexeddb.leveldb\CURRENT

MD5	46295cac801e5d4857d09837238a6394
SHA1	44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA256	0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA512	8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

MD5	64cd37ab37e60848920580c857fb0272
SHA1	b556b5623bcf0696fef9d6a1a5cbfcd54d196735
SHA256	e71f860e1337a08b6bedce931e18b2a0c6869bce2e4f499064385a62f11a6aac
SHA512	f86616c9a5be93c6c280b65d00563704fdf25c41e12bef4a8552b315be673f6a6b1c222322136eb697435958f8a7f9fa7bce2f2c4455655300f69496c5cdce1b

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5	3ddb54dc93fa0250d4f05d197ef93a7a
SHA1	1a07e3ca610818ffa9c0d03bfdb4c051ea2f6535
SHA256	626dbb84c9b8ed63962f776ba1b86d86c3d40a13653869bd768bf3eed9f2da2b
SHA512	8b93d043cbe0b7e4fc2649faa6357ce9eff024c4323d007464c6256f507b73ca815b97cdec309ef98f49a8399afe39f62cdd8a58841f3958c2b950ad0c4fad96

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

MD5	1e41f93e355672abe5e498e32ff9ba47
SHA1	b293a864ff7eb18470eba3a52011ff840738bd63
SHA256	a465f55cd4909ff98df38d9b47ef7f2d97dd13a267904093e843516ad1d01161
SHA512	182c4bbfd92fe683fa50e7bd7ebf652130b6ede372158598b883ee040e36f4269bf9a7c0c02836d615ae2201d0de922201a8b80378da52bfd5ee2486fd96b51b

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5	f409b867bfc57da863b8beaf87f7807e
SHA1	46c2455ef7f163bfb936ef4cd7f570d0d8591ff9
SHA256	7fbe13e6b4f0d993a97b8d4c460b63784f0a41d1c459b66c27cb849fd3601ea0
SHA512	176fe1a2838b145f7d7d67e38dbba15bc30f3cc10b18ed52b9d0bd7ecd747227fe120dfadac71a8461cc0625071aed4c4b17c81fff85b679ed74e92b12767741

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5	6549013425572a6fef969879c4a8953b
SHA1	1b67dfbf6059c33fc3a6c521d9daf556eac880bb
SHA256	7e109ee7915edfcf7f107dd974cb2bcc408ed33922fe9e9dd8801dceeaacf546
SHA512	72e3530cd0346fd18beb7fd91edf8f7a353507ac5dd6cb0097a8d72bee102f67e4e5a3c299ab7c42ca261b9c64f77c6c90a5d8027b0fe09a76ad44525626a32f

C:\Users\Admin\Downloads\BonziBuddy432.exe:Zone.Identifier

MD5	fbccf14d504b7b2dbcb5a5bda75bd93b
SHA1	d59fc84cdd5217c6cf74785703655f78da6b582b
SHA256	eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913
SHA512	aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

C:\Users\Admin\Downloads\BonziBuddy432.exe

MD5	06d87d4c89c76cb1bcb2f5a5fc4097d1
SHA1	657248f78abfa9015b77c431f2fd8797481478fd
SHA256	f1e859d99072e35f20e172d8458e3ea1baf8ba86c8c9e311a0debcd2acd5d0fc
SHA512	12bcc681544bfc0cb5f1a3c2e5e3d475efdf5abb8bf0e18cb18f529a82d551f39e16de2d3f0664c2c2cbfab2bc4702e256b958acadca53424e6d8760b6f457f9

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5	316c321f6c4492b16fa0a2fe5367a84f
SHA1	2a2e7a087df1a41f53e5fa1c387426797ca5db5a
SHA256	bc915844739d1c6bed88efcf433b762265423b85768245926b46016c4ac1d25e
SHA512	b01338decabd0d47d6f88309f5d0a0af171c9b11a4615bf190bb768771b538ea7bb02265aa470bd2297559d4d2eb22e260bde986f0b1696202026055bfee9962

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

MD5	369ec88ebf9cbde6cfdec050fbb5551a
SHA1	ed803f2b08cfab588c0be9df6ae2e6dece0e6358
SHA256	2c9fb379c290244284660716dc35c4bd2fdb5d332ac0563a6a1f0a5003f71940
SHA512	033164aedd1e893f9df2eff9abbd1ebc09af4b7dbd8abaf1b779b9369dfbd30c24893e890f4b4dc8edb539cc934fb5a3cd20864f695275b86f0ef0fcba488f0f

Malware Analysis Report

2024-08-06 19:42

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

Threat Level: Known bad

Malicious Activity Summary

MITRE ATT&CK Matrix V13

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Sample ID	240619-s22gysxekr
Target	1135f4d76cb6ca7605d54bd690b378bd769acdd28172fe55117f53de8f3c7520.exe
SHA256	1135f4d76cb6ca7605d54bd690b378bd769acdd28172fe55117f53de8f3c7520
Tags	njrat neuf evasion persistence privilege_escalation trojan