agenttesla | 16930620b3b9166e0ffbd98f5d5b580c9919fd6ccdcc74fb996f53577f508267

max time kernel
199s
max time network
303s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
13-08-2024 22:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

New Text Document mod.exe
Size

8KB
MD5

69994ff2f00eeca9335ccd502198e05b
SHA1

b13a15a5bea65b711b835ce8eccd2a699a99cead
SHA256

2e2e035ece4accdee838ecaacdc263fa526939597954d18d1320d73c8bf810c2
SHA512

ced53147894ed2dfc980bcb50767d9734ba8021f85842a53bb4bb4c502d51b4e9884f5f74c4dd2b70b53cafbe2441376675f7bd0f19bb20a3becb091a34fb9f3
SSDEEP

96:y7ov9wc1dN1Unh3EHJ40CUJCrQt0LpCBIW12nEtgpH9GIkQYQoBNw9fnmK5iLjTv:yZyTFJfCB20LsBIW12n/eIkQ2BNg5S1

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

Default

127.0.0.1:6606

127.0.0.1:7707

127.0.0.1:8808

127.0.0.1:1604

127.0.0.1:22253

eu-central-7075.packetriot.net:6606

eu-central-7075.packetriot.net:7707

eu-central-7075.packetriot.net:8808

eu-central-7075.packetriot.net:1604

eu-central-7075.packetriot.net:22253

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
3
install
true
install_file
svchost.exe
install_folder
%AppData%

aes.plain

Extracted

Family

amadey

Version

4.41

Botnet

cd33f9

http://193.176.158.185

Attributes

install_dir
fed0c9a4d3
install_file
Hkbsse.exe
strings_key
a2163aef710017f5548e7e730af53cca
url_paths
/B0kf3CbAbR/index.php

rc4.plain

Extracted

Family

redline

185.215.113.9:12617

Extracted

Family

snakekeylogger

Credentials

Protocol: smtp
Host:
mail.blooming.com.my
Port:
587
Username:
[email protected]
Password:
THL191282

Extracted

Family

nanocore

Version

1.2.2.0

blackangel.hopto.org:54984

Mutex

f71cda30-fa3d-4402-acaf-cf2c8c816f12

Attributes

activate_away_mode
true
backup_connection_host
blackangel.hopto.org
backup_dns_server
8.8.4.4
buffer_size
65535
build_time
2024-04-20T19:45:18.703376436Z
bypass_user_account_control
true
bypass_user_account_control_data
clear_access_control
true
clear_zone_identifier
false
connect_delay
4000
connection_port
54984
default_group
Default
enable_debug_mode
true
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
f71cda30-fa3d-4402-acaf-cf2c8c816f12
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
blackangel.hopto.org
primary_dns_server
8.8.8.8
request_elevation
true
restart_delay
5000
run_delay
0
run_on_startup
false
set_critical_process
true
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8000

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
mail.synergyinnovationsgroup.com
Port:
587
Username:
[email protected]
Password:
C@p-Y8BoHc#?
Email To:
[email protected]

Extracted

Family

metasploit

Version

encoder/shikata_ga_nai

Extracted

Family

metasploit

Version

windows/reverse_tcp

193.117.208.148:7800

Extracted

Family

redline

Botnet

kir

147.45.44.73:6282

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit
NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 4 IoCs

resource	yara_rule
behavioral2/files/0x000100000002aa57-483.dat	family_redline
behavioral2/memory/1632-489-0x00000000009D0000-0x0000000000A22000-memory.dmp	family_redline
behavioral2/files/0x000200000002a5c1-1069.dat	family_redline
behavioral2/memory/1852-1074-0x00000000008D0000-0x0000000000922000-memory.dmp	family_redline

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 2 IoCs

resource	yara_rule
behavioral2/files/0x000200000002a5c0-1059.dat	family_sectoprat
behavioral2/memory/1204-1064-0x0000000000C60000-0x0000000000D26000-memory.dmp	family_sectoprat

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 1 IoCs

resource	yara_rule
behavioral2/memory/4108-639-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral2/files/0x000100000002a99c-8.dat	family_asyncrat

Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003

Boot or Logon Autostart Execution: Active Setup 2 TTPs 7 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\ = "Google Chrome"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\StubPath = "\"C:\\Program Files\\Google\\Chrome\\Application\\127.0.6533.120\\Installer\\chrmstp.exe\" --configure-user-settings --verbose-logging --system-level --channel=stable"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\Localized Name = "Google Chrome"	setup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\IsInstalled = "1"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\Version = "43,0,0,0"	setup.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components	setup.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}	setup.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2948	powershell.exe
3348	powershell.exe
6436	powershell.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002
Downloads MZ/PE file

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GoogleUpdate.exe	GoogleUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GoogleUpdate.exe\DisableExceptionChainValidation = "0"	GoogleUpdate.exe

Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002
Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 64 IoCs

pid	Process
1696	stub.exe
4956	Mke%20Fallen.exe
2764	Mke%20Fallen.exe
1676	vmtoolsd.exe
2260	build2.exe
4200	vmtoolsd.exe
1472	svchost.exe
4740	vmtoolsd.exe
3524	vmtoolsd.exe
1888	l2.exe
4296	keylogger.exe
3224	Hkbsse.exe
2400	networks_profile.exe
2100	networks_profile.exe
4504	backdoor.exe
4804	vmtoolsd.exe
3016	vmtoolsd.exe
2116	vmtoolsd.exe
3556	vmtoolsd.exe
3944	Hkbsse.exe
2336	oobeldr.exe
2740	vmtoolsd.exe
2628	carrier.exe
4964	wahost.exe
1496	regasm.exe
2376	vmtoolsd.exe
2172	sihost.exe
3728	winiti.exe
1448	GoogleUpdate.exe
4444	GoogleUpdate.exe
4516	vmtoolsd.exe
2080	sahost.exe
1236	GoogleUpdate.exe
1548	GoogleUpdateComRegisterShell64.exe
4796	GoogleUpdateComRegisterShell64.exe
2860	GoogleUpdateComRegisterShell64.exe
1632	cookie250.exe
1280	GoogleUpdate.exe
2412	GoogleUpdate.exe
3940	GoogleUpdate.exe
3984	out_test_sig.exe
1944	TTF.exe
1948	T9.exe
4588	vmtoolsd.exe
2436	c7.exe
3700	mservice64.exe
1744	T7.exe
1316	wahost.exe
4020	nano.exe
4336	request.exe
1056	vmtoolsd.exe
4108	regasm.exe
5088	1111.exe
2624	sahost.exe
1300	vmtoolsd.exe
3208	microsoft.exe
240	microsoft.exe
780	msvcservice.exe
5192	vmtoolsd.exe
5864	vmtoolsd.exe
5940	vmtoolsd.exe
6108	vmtoolsd.exe
6096	127.0.6533.120_chrome_installer.exe
3852	setup.exe

Loads dropped DLL 64 IoCs

pid	Process
2100	networks_profile.exe
2100	networks_profile.exe
2100	networks_profile.exe
2100	networks_profile.exe
2100	networks_profile.exe
2100	networks_profile.exe
1448	GoogleUpdate.exe
4444	GoogleUpdate.exe
1236	GoogleUpdate.exe
1548	GoogleUpdateComRegisterShell64.exe
1236	GoogleUpdate.exe
4796	GoogleUpdateComRegisterShell64.exe
1236	GoogleUpdate.exe
2860	GoogleUpdateComRegisterShell64.exe
1236	GoogleUpdate.exe
1280	GoogleUpdate.exe
2412	GoogleUpdate.exe
3940	GoogleUpdate.exe
3940	GoogleUpdate.exe
2412	GoogleUpdate.exe
2172	sihost.exe
2172	sihost.exe
2172	sihost.exe
2172	sihost.exe
2172	sihost.exe
2172	sihost.exe
2172	sihost.exe
692	GoogleUpdate.exe
200	GoogleUpdate.exe
200	GoogleUpdate.exe
5676	chrome.exe
568	chrome.exe
5676	chrome.exe
3216	chrome.exe
3216	chrome.exe
3216	chrome.exe
3216	chrome.exe
3216	chrome.exe
3216	chrome.exe
3216	chrome.exe
3216	chrome.exe
1220	chrome.exe
5576	chrome.exe
5576	chrome.exe
1220	chrome.exe
720	chrome.exe
2380	chrome.exe
720	chrome.exe
2380	chrome.exe
3704	chrome.exe
3704	chrome.exe
4752	chrome.exe
4752	chrome.exe
1852	chrome.exe
1852	chrome.exe
1664	chrome.exe
1664	chrome.exe
6156	chrome.exe
6156	chrome.exe
6252	chrome.exe
6252	chrome.exe
6308	chrome.exe
6308	chrome.exe
6628	chrome.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000200000002a5a9-968.dat	upx
behavioral2/memory/5200-996-0x0000000000400000-0x0000000000419000-memory.dmp	upx
behavioral2/files/0x000300000002a5ba-1014.dat	upx
behavioral2/memory/692-1019-0x0000000000400000-0x0000000000419000-memory.dmp	upx
behavioral2/memory/5200-1542-0x0000000000400000-0x0000000000419000-memory.dmp	upx

Accesses Microsoft Outlook profiles 1 TTPs 9 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	regasm.exe
Key opened	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	regasm.exe
Key opened	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	wahost.exe
Key opened	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	wahost.exe
Key opened	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	sahost.exe
Key opened	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	sahost.exe
Key opened	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	wahost.exe
Key opened	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	sahost.exe
Key opened	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	regasm.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SCSI Subsystem = "C:\\Program Files (x86)\\SCSI Subsystem\\scsiss.exe"	microsoft.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000\Software\Microsoft\Windows\CurrentVersion\Run\msvcservice = "C:\\Users\\Admin\\msvcservice.exe"	msvcservice.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000\Software\Microsoft\Windows\CurrentVersion\Run\msvcservice = "C:\\Users\\Admin\\msvcservice.exe"	msvcservice.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000\Software\Microsoft\Windows\CurrentVersion\Run\msvcservice = "C:\\Users\\Admin\\msvcservice.exe"	msvcservice.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000\Software\Microsoft\Windows\CurrentVersion\Run\msvcservice = "C:\\Users\\Admin\\msvcservice.exe"	request.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SCSI Subsystem = "C:\\Program Files (x86)\\SCSI Subsystem\\scsiss.exe"	nano.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	nano.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	microsoft.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
3	raw.githubusercontent.com
5	raw.githubusercontent.com
130	pastebin.com
148	pastebin.com

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	checkip.dyndns.org
55	ip-api.io
70	ip-api.io

Power Settings 1 TTPs 8 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
6948	powercfg.exe
4380	powercfg.exe
4660	powercfg.exe
2368	powercfg.exe
6092	powercfg.exe
3336	powercfg.exe
400	powercfg.exe
2332	powercfg.exe

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	chrome.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\vmtoolsd.exe	Mke%20Fallen.exe
File created	C:\Windows\SysWOW64\Mke%20Fallen.exe	Mke%20Fallen.exe
File opened for modification	C:\Windows\SysWOW64\Mke%20Fallen.exe	Mke%20Fallen.exe
File created	C:\Windows\SysWOW64\vmtoolsd.exe	Mke%20Fallen.exe

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
5820	wab.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2172	sihost.exe
5820	wab.exe

Suspicious use of SetThreadContext 15 IoCs

description	pid	Process	procid_target
PID 1948 set thread context of 4060	1948	T9.exe	196
PID 1944 set thread context of 1240	1944	TTF.exe	200
PID 4964 set thread context of 1316	4964	wahost.exe	202
PID 1744 set thread context of 3920	1744	T7.exe	204
PID 1496 set thread context of 4108	1496	regasm.exe	212
PID 2080 set thread context of 2624	2080	sahost.exe	219
PID 3208 set thread context of 240	3208	microsoft.exe	222
PID 2172 set thread context of 5820	2172	sihost.exe	251
PID 1480 set thread context of 2848	1480	microsoft.exe	327
PID 3456 set thread context of 5492	3456	pimer_bbbcontents7.exe	269
PID 2592 set thread context of 6420	2592	WE.exe	440
PID 1480 set thread context of 6580	1480	U.exe	312
PID 2848 set thread context of 6800	2848	microsoft.exe	328
PID 6872 set thread context of 6528	6872	66b5d9d3adbaa_defaultr.exe	335
PID 5124 set thread context of 4900	5124	66af4e35e761b_doz.exe	345

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Google\Temp\GUMCA02.tmp\GoogleUpdate.exe	winiti.exe
File created	C:\Program Files (x86)\Google\Temp\GUMCA02.tmp\goopdateres_vi.dll	winiti.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.122\goopdateres_de.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.122\goopdateres_uk.dll	GoogleUpdate.exe
File created	C:\Program Files\Google\Chrome\Temp\source3852_866180897\Chrome-bin\127.0.6533.120\vk_swiftshader.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Install\{F8F53ED5-1905-4DA7-9038-CBDD309427EA}\CR_B68B3.tmp\setup.exe	127.0.6533.120_chrome_installer.exe
File created	C:\Program Files (x86)\Google\Temp\GUMCA02.tmp\GoogleUpdateOnDemand.exe	winiti.exe
File created	C:\Program Files\Google\Chrome\Temp\source3852_866180897\Chrome-bin\127.0.6533.120\Locales\id.pak	setup.exe
File created	C:\Program Files (x86)\Google\Temp\GUMCA02.tmp\goopdateres_ca.dll	winiti.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\127.0.6533.120\127.0.6533.120_chrome_installer.exe	GoogleUpdate.exe
File created	C:\Program Files\Google\Chrome\Temp\source3852_866180897\Chrome-bin\127.0.6533.120\resources.pak	setup.exe
File created	C:\Program Files (x86)\Google\Temp\GUMCA02.tmp\goopdateres_zh-CN.dll	winiti.exe
File created	C:\Program Files (x86)\SCSI Subsystem\scsiss.exe	microsoft.exe
File created	C:\Program Files\Google\Chrome\Temp\source3852_866180897\Chrome-bin\127.0.6533.120\127.0.6533.120.manifest	setup.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.122\goopdateres_mr.dll	GoogleUpdate.exe
File created	C:\Program Files\Google\Chrome\Temp\source3852_866180897\Chrome-bin\127.0.6533.120\Locales\nl.pak	setup.exe
File created	C:\Program Files (x86)\Google\Temp\GUMCA02.tmp\psmachine_64.dll	winiti.exe
File created	C:\Program Files (x86)\Google\Temp\GUMCA02.tmp\GoogleUpdateCore.exe	winiti.exe
File created	C:\Program Files (x86)\Google\Temp\GUMCA02.tmp\goopdateres_pl.dll	winiti.exe
File created	C:\Program Files\Google\Chrome\Temp\source3852_866180897\Chrome-bin\127.0.6533.120\icudtl.dat	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source3852_866180897\Chrome-bin\127.0.6533.120\Locales\pt-BR.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source3852_866180897\Chrome-bin\127.0.6533.120\Locales\vi.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source3852_866180897\Chrome-bin\127.0.6533.120\MEIPreload\manifest.json	setup.exe
File created	C:\Program Files (x86)\Google\Temp\GUMCA02.tmp\goopdateres_bn.dll	winiti.exe
File created	C:\Program Files (x86)\Google\Temp\GUMCA02.tmp\goopdateres_de.dll	winiti.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.122\goopdateres_sk.dll	GoogleUpdate.exe
File opened for modification	C:\Program Files (x86)\SCSI Subsystem\scsiss.exe	nano.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.122\goopdateres_sl.dll	GoogleUpdate.exe
File created	C:\Program Files\Google\Chrome\Temp\source3852_866180897\Chrome-bin\127.0.6533.120\Locales\lt.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source3852_866180897\Chrome-bin\127.0.6533.120\Locales\sk.pak	setup.exe
File created	C:\Program Files (x86)\Google\Temp\GUMCA02.tmp\goopdateres_fil.dll	winiti.exe
File created	C:\Program Files (x86)\Google\Temp\GUMCA02.tmp\goopdateres_gu.dll	winiti.exe
File created	C:\Program Files (x86)\Google\Temp\GUMCA02.tmp\goopdateres_tr.dll	winiti.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.122\goopdateres_ar.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.122\goopdateres_hu.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.122\goopdateres_it.dll	GoogleUpdate.exe
File created	C:\Program Files\Google\Chrome\Temp\source3852_866180897\Chrome-bin\127.0.6533.120\Locales\kn.pak	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source3852_866180897\Chrome-bin\chrome_proxy.exe	setup.exe
File created	C:\Program Files\Google\Chrome\Temp\source3852_866180897\Chrome-bin\127.0.6533.120\vulkan-1.dll	setup.exe
File created	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	setup.exe
File created	C:\Program Files (x86)\Google\Temp\GUMCA02.tmp\goopdateres_hu.dll	winiti.exe
File created	C:\Program Files (x86)\Google\Temp\GUMCA02.tmp\goopdateres_ml.dll	winiti.exe
File created	C:\Program Files\Google\Chrome\Temp\source3852_866180897\Chrome-bin\127.0.6533.120\VisualElements\SmallLogoCanary.png	setup.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.122\goopdateres_am.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.122\goopdateres_gu.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.122\goopdateres_ms.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.122\GoogleUpdate.exe	GoogleUpdate.exe
File created	C:\Program Files\Google\Chrome\Temp\source3852_866180897\Chrome-bin\127.0.6533.120\Locales\ko.pak	setup.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.122\goopdateres_sr.dll	GoogleUpdate.exe
File created	C:\Program Files\Google\Chrome\Temp\source3852_866180897\Chrome-bin\127.0.6533.120\Locales\gu.pak	setup.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.122\goopdateres_th.dll	GoogleUpdate.exe
File created	C:\Program Files\Google\Chrome\Temp\source3852_866180897\Chrome-bin\127.0.6533.120\Locales\fr.pak	setup.exe
File created	C:\Program Files (x86)\SCSI Subsystem\scsiss.exe	nano.exe
File created	C:\Program Files\Google\Chrome\Temp\source3852_866180897\Chrome-bin\127.0.6533.120\Locales\el.pak	setup.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.122\goopdateres_tr.dll	GoogleUpdate.exe
File created	C:\Program Files\Google\Chrome\Temp\source3852_866180897\Chrome-bin\127.0.6533.120\libGLESv2.dll	setup.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.122\goopdateres_iw.dll	GoogleUpdate.exe
File created	C:\Program Files (x86)\Google\Temp\GUMCA02.tmp\psmachine.dll	winiti.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.122\GoogleUpdateComRegisterShell64.exe	GoogleUpdate.exe
File created	C:\Program Files\Google\Chrome\Temp\source3852_866180897\Chrome-bin\127.0.6533.120\chrome_200_percent.pak	setup.exe
File created	C:\Program Files (x86)\Google\Temp\GUMCA02.tmp\goopdateres_ko.dll	winiti.exe
File created	C:\Program Files\Google\Chrome\Temp\source3852_866180897\Chrome-bin\127.0.6533.120\Locales\ro.pak	setup.exe
File created	C:\Program Files (x86)\Google\Temp\GUMCA02.tmp\goopdate.dll	winiti.exe
File created	C:\Program Files (x86)\Google\Temp\GUMCA02.tmp\goopdateres_am.dll	winiti.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp\Crashpad\settings.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File created	C:\Windows\Tasks\Hkbsse.job	build2.exe
File opened for modification	C:\Windows\SystemTemp	setup.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\metadata	setup.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\settings.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp	setup.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\metadata	setup.exe

Launches sc.exe 4 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
6432	sc.exe
5148	sc.exe
4072	sc.exe
5480	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
behavioral2/files/0x000100000002a9a6-98.dat	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Program crash 32 IoCs

pid	pid_target	Process	procid_target
3256	2260	WerFault.exe	89
4636	2260	WerFault.exe	89
3864	2260	WerFault.exe	89
2924	2260	WerFault.exe	89
1476	2260	WerFault.exe	89
1744	2260	WerFault.exe	89
4024	2260	WerFault.exe	89
2784	2260	WerFault.exe	89
3196	2260	WerFault.exe	89
1664	2260	WerFault.exe	89
4512	3224	WerFault.exe	125
1408	3224	WerFault.exe	125
3180	3224	WerFault.exe	125
2852	3224	WerFault.exe	125
1448	3224	WerFault.exe	125
1352	3224	WerFault.exe	125
1508	3224	WerFault.exe	125
4588	3224	WerFault.exe	125
3212	3224	WerFault.exe	125
3816	3224	WerFault.exe	125
1116	3224	WerFault.exe	125
4104	3224	WerFault.exe	125
1444	3944	WerFault.exe	150
4204	5368	WerFault.exe	244
6448	5492	WerFault.exe	269
6924	3224	WerFault.exe	125
6604	5756	WerFault.exe	326
5696	6760	WerFault.exe	355
6404	3224	WerFault.exe	125
5132	2096	WerFault.exe	391
1788	3224	WerFault.exe	125
3504	3224	WerFault.exe	125

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	T7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	microsoft.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	keylogger.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winiti.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	out_test_sig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sihost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	microsoft.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Meetings.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GoogleUpdateOnDemand.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GoogleUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wahost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TTF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hkbsse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GoogleUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GoogleUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pimer_bbbcontents7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Trial.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	l2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cookie250.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msvcservice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Teamview.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	stub.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mke%20Fallen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sahost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GoogleUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	U.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GoogleUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wahost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	microsoft.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1sesc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GoogleUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	request.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	microsoft.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	build2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nano.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sahost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	66b5d9d3adbaa_defaultr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Extension.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mailer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mke%20Fallen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Documents.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1280	GoogleUpdate.exe
692	GoogleUpdate.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 1 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
112	netsh.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	1111.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	1111.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	pimer_bbbcontents7.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	pimer_bbbcontents7.exe

Delays execution with timeout.exe 4 IoCs

evasion

pid	Process
1684	timeout.exe
6536	timeout.exe
6824	timeout.exe
4512	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
7112	systeminfo.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133680618914661645"	chrome.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{4EB61BAC-A3B6-4760-9581-655041EF4D69}	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{909489C2-85A6-4322-AA56-D25278649D67}\NumMethods\ = "4"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8A1D4361-2C08-4700-A351-3EAA9CBFF5E4}\LocalizedString = "@C:\\Program Files (x86)\\Google\\Update\\1.3.36.122\\goopdate.dll,-3000"	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{76F7B787-A67C-4C73-82C7-31F5E3AABC5C}\NumMethods	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{909489C2-85A6-4322-AA56-D25278649D67}\ProxyStubClsid32\ = "{0CE63743-3E8B-463F-90D8-0274D20FCEBB}"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GoogleUpdate.PolicyStatusSvc\CurVer\ = "GoogleUpdate.PolicyStatusSvc.1.0"	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8476CE12-AE1F-4198-805C-BA0F9B783F57}\NumMethods	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4DE778FE-F195-4EE3-9DAB-FE446C239221}	GoogleUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{598FE0E5-E02D-465D-9A9D-37974A28FD42}\PROGID	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GoogleUpdate.PolicyStatusMachineFallback.1.0\ = "Google Update Policy Status Class"	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{25461599-633D-42B1-84FB-7CD68D026E53}\LocalServer32	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{05A30352-EB25-45B6-8449-BCA7B0542CE5}\ProxyStubClsid32\ = "{0CE63743-3E8B-463F-90D8-0274D20FCEBB}"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DAB1D343-1B2A-47F9-B445-93DC50704BFE}	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DD42475D-6D46-496A-924E-BD5630B4CBBA}\ProxyStubClsid32	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1C642CED-CA3B-4013-A9DF-CA6CE5FF6503}\NumMethods\ = "9"	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{909489C2-85A6-4322-AA56-D25278649D67}	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GoogleUpdate.OnDemandCOMClassSvc.1.0\ = "Google Update Legacy On Demand"	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4E223325-C16B-4EEB-AEDC-19AA99A237FA}	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DCAB8386-4F03-4DBD-A366-D90BC9F68DE6}\ProxyStubClsid32\ = "{0CE63743-3E8B-463F-90D8-0274D20FCEBB}"	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F63F6F8B-ACD5-413C-A44B-0409136D26CB}	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B3A47570-0A85-4AEA-8270-529D47899603}	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{521FDB42-7130-4806-822A-FC5163FAD983}\ProgID	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9B2340A0-4068-43D6-B404-32E27217859D}\ = "Google Update Core Class"	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1C642CED-CA3B-4013-A9DF-CA6CE5FF6503}\NumMethods\ = "9"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2732F2FE-BCF7-4CE1-8ABD-951329519827}\InprocHandler32\ThreadingModel = "Both"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2D363682-561D-4C3A-81C6-F2F82107562A}\ProxyStubClsid32\ = "{0CE63743-3E8B-463F-90D8-0274D20FCEBB}"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{247954F9-9EDC-4E68-8CC3-150C2B89EADF}	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0CE63743-3E8B-463F-90D8-0274D20FCEBB}	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{34527502-D3DB-4205-A69B-789B27EE0414}	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31AC3F11-E5EA-4A85-8A3D-8E095A39C27B}\ProxyStubClsid32	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0CE63743-3E8B-463F-90D8-0274D20FCEBB}	GoogleUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{534F5323-3569-4F42-919D-1E1CF93E5BF6}	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4DE778FE-F195-4EE3-9DAB-FE446C239221}\ProxyStubClsid32\ = "{0CE63743-3E8B-463F-90D8-0274D20FCEBB}"	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{34527502-D3DB-4205-A69B-789B27EE0414}\ = "IPolicyStatus2"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DD42475D-6D46-496A-924E-BD5630B4CBBA}\ = "IAppBundleWeb"	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{084D78A8-B084-4E14-A629-A2C419B0E3D9}\ = "IApp2"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5B25A8DC-1780-4178-A629-6BE8B8DEFAA2}\ProxyStubClsid32	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FE908CDD-22BB-472A-9870-1A0390E42F36}\ProxyStubClsid32\ = "{0CE63743-3E8B-463F-90D8-0274D20FCEBB}"	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C6271107-A214-4F11-98C0-3F16BC670D28}\InprocServer32\ = "C:\\Program Files (x86)\\Google\\Update\\1.3.36.122\\psmachine_64.dll"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2732F2FE-BCF7-4CE1-8ABD-951329519827}\InprocHandler32	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{463ABECF-410D-407F-8AF5-0DF35A005CC8}\1.0\0\win32\ = "C:\\Program Files\\Google\\Chrome\\Application\\127.0.6533.120\\elevation_service.exe"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GoogleUpdate.PolicyStatusSvc.1.0\ = "Google Update Policy Status Class"	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3D05F64F-71E3-48A5-BF6B-83315BC8AE1F}\NumMethods\ = "12"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F63F6F8B-ACD5-413C-A44B-0409136D26CB}\ProxyStubClsid32\ = "{0CE63743-3E8B-463F-90D8-0274D20FCEBB}"	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DAB1D343-1B2A-47F9-B445-93DC50704BFE}	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{128C2DA6-2BC0-44C0-B3F6-4EC22E647964}	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{128C2DA6-2BC0-44C0-B3F6-4EC22E647964}\ = "IProcessLauncher"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4E223325-C16B-4EEB-AEDC-19AA99A237FA}\ = "IRegistrationUpdateHook"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DAB1D343-1B2A-47F9-B445-93DC50704BFE}\ProxyStubClsid32\ = "{0CE63743-3E8B-463F-90D8-0274D20FCEBB}"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BCDCB538-01C0-46D1-A6A7-52F4D021C272}\ = "IAppVersion"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DAB1D343-1B2A-47F9-B445-93DC50704BFE}\ProxyStubClsid32\ = "{0CE63743-3E8B-463F-90D8-0274D20FCEBB}"	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{19692F10-ADD2-4EFF-BE54-E61C62E40D13}\ = "IJobObserver2"	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0CE63743-3E8B-463F-90D8-0274D20FCEBB}\ = "PSFactoryBuffer"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6DB17455-4E85-46E7-9D23-E555E4B005AF}	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5B25A8DC-1780-4178-A629-6BE8B8DEFAA2}\NumMethods\ = "4"	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BCDCB538-01C0-46D1-A6A7-52F4D021C272}\ProxyStubClsid32	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DAB1D343-1B2A-47F9-B445-93DC50704BFE}\NumMethods	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D106AB5F-A70E-400E-A21B-96208C1D8DBB}\NumMethods	GoogleUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{909489C2-85A6-4322-AA56-D25278649D67}\NumMethods\ = "4"	GoogleUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2732F2FE-BCF7-4CE1-8ABD-951329519827}\InprocHandler32	GoogleUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GoogleUpdate.CoreClass.1\CLSID\ = "{E225E692-4B47-4777-9BED-4FD7FE257F0E}"	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{128C2DA6-2BC0-44C0-B3F6-4EC22E647964}\NumMethods	GoogleUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1C642CED-CA3B-4013-A9DF-CA6CE5FF6503}\NumMethods	GoogleUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8A1D4361-2C08-4700-A351-3EAA9CBFF5E4}\ProgID	GoogleUpdate.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064	cookie250.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064\Blob = 0b000000010000004800000054006900740061006e00690075006d00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790000000200000001000000cc0000001c0000006c00000001000000000000000000000000000000010000007b00340031003700340034004200450034002d0031003100430035002d0034003900340043002d0041003200310033002d004200410030004300450039003400340039003300380045007d00000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e00300000000000030000000100000014000000f1a578c4cb5de79a370893983fd4da8b67b2b06420000000010000000a03000030820306308201eea003020102020867f7beb96a4c2798300d06092a864886f70d01010b0500302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f72697479301e170d3233303331343130333532305a170d3236303631373130333532305a302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a028201010086e4577a5861ce819177d005fa51d5515a936c610ccfcbde5332cd151da647ee881a245c9b02833b02af3d76fe20bd3bfaf7a20973e72ebd9440d09d8c3d2713bdf0d09feb9532acd7a42da2a952daa86a2a88ee427d30959d90bfba05276aa02998a6986fc01306629b79b8405d1f1fa6d9a42f827afc7566340dc2de27012b94bb4a27b3cb1c219a3cb2c14203f34451bd626520edd4dbcc414f593f2acbc48479f7143cbe139cfd129c913e5303dc20f94c44358901b69a848d7ea02e308a311560ac00ae009a29109aeed9713dd8919b97ed598058e17f0726c7a020f710abc06291dfaaf181c6be6a76c89cb68eb0b0ec1cd95f326c7e55588bfd76c5190203010001a328302630130603551d25040c300a06082b06010505070301300f0603551d130101ff040530030101ff300d06092a864886f70d01010b0500038201010070851293d757e982797dc5f7f27da894ef0cdb329f06a6096e0cf604b0e54711560ef40f5282082e210f55a3db41f312548b7611f5f0dacea3c78b13f6fc243c02b106665be69e184088415b273999b877bee353a248cec7eeb5a095c2174bc9526cafe3372c59dbfbe758134ed351e5147273fec68577ae4552a6f99ac80ca8d0ee422af528858c6be81cb0a8031ab0ae83c0eb5564f4e87a5c06295d3903eee2fdf92d62a7f4d4054deaa79bcaebda4e8b1a6efd42aef9d01c7075728cb13aa8557c85a72532b5e2d6c3e55041c9867ca8f562bbd2ab0c3710d83173ec3781d1dcaac5c6e07ee726624dfdc5814cffd336e17932f89beb9cf7fdbee9bebf61	cookie250.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 14 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5960	schtasks.exe
3708	schtasks.exe
1748	schtasks.exe
2976	schtasks.exe
5324	schtasks.exe
768	schtasks.exe
6500	schtasks.exe
5328	schtasks.exe
4656	schtasks.exe
1052	schtasks.exe
3356	schtasks.exe
1044	schtasks.exe
4380	schtasks.exe
1836	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1696	stub.exe
1696	stub.exe
1696	stub.exe
1696	stub.exe
1696	stub.exe
1696	stub.exe
1696	stub.exe
1696	stub.exe
1696	stub.exe
1696	stub.exe
1696	stub.exe
1696	stub.exe
1696	stub.exe
1696	stub.exe
1696	stub.exe
1696	stub.exe
1696	stub.exe
1696	stub.exe
1696	stub.exe
2628	carrier.exe
2628	carrier.exe
2628	carrier.exe
1448	GoogleUpdate.exe
1448	GoogleUpdate.exe
1448	GoogleUpdate.exe
1448	GoogleUpdate.exe
1448	GoogleUpdate.exe
1448	GoogleUpdate.exe
1944	TTF.exe
1944	TTF.exe
1944	TTF.exe
1944	TTF.exe
4964	wahost.exe
4964	wahost.exe
4964	wahost.exe
1316	wahost.exe
1316	wahost.exe
1496	regasm.exe
1496	regasm.exe
1496	regasm.exe
1496	regasm.exe
2080	sahost.exe
2080	sahost.exe
2948	powershell.exe
2948	powershell.exe
1496	regasm.exe
4108	regasm.exe
4108	regasm.exe
2080	sahost.exe
4020	nano.exe
4020	nano.exe
4020	nano.exe
4020	nano.exe
4020	nano.exe
4020	nano.exe
4020	nano.exe
4020	nano.exe
3348	powershell.exe
3348	powershell.exe
2080	sahost.exe
2624	sahost.exe
2624	sahost.exe
240	microsoft.exe
240	microsoft.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
4020	nano.exe
240	microsoft.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2172	sihost.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5676	chrome.exe
5676	chrome.exe
5676	chrome.exe
5676	chrome.exe
5676	chrome.exe

Suspicious behavior: SetClipboardViewer 1 IoCs

pid	Process
240	microsoft.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3792	New Text Document mod.exe
Token: SeIncBasePriorityPrivilege	4956	Mke%20Fallen.exe
Token: SeDebugPrivilege	1696	stub.exe
Token: SeDebugPrivilege	1472	svchost.exe
Token: SeDebugPrivilege	1472	svchost.exe
Token: SeDebugPrivilege	1448	GoogleUpdate.exe
Token: SeDebugPrivilege	1448	GoogleUpdate.exe
Token: SeDebugPrivilege	1448	GoogleUpdate.exe
Token: SeDebugPrivilege	1944	TTF.exe
Token: SeDebugPrivilege	1948	T9.exe
Token: SeDebugPrivilege	1744	T7.exe
Token: SeDebugPrivilege	4964	wahost.exe
Token: SeDebugPrivilege	1316	wahost.exe
Token: SeDebugPrivilege	1496	regasm.exe
Token: SeDebugPrivilege	3700	mservice64.exe
Token: SeBackupPrivilege	3700	mservice64.exe
Token: SeSecurityPrivilege	3700	mservice64.exe
Token: SeSecurityPrivilege	3700	mservice64.exe
Token: SeSecurityPrivilege	3700	mservice64.exe
Token: SeSecurityPrivilege	3700	mservice64.exe
Token: SeDebugPrivilege	1240	RegAsm.exe
Token: SeBackupPrivilege	1240	RegAsm.exe
Token: SeSecurityPrivilege	1240	RegAsm.exe
Token: SeSecurityPrivilege	1240	RegAsm.exe
Token: SeSecurityPrivilege	1240	RegAsm.exe
Token: SeSecurityPrivilege	1240	RegAsm.exe
Token: SeDebugPrivilege	4060	RegAsm.exe
Token: SeBackupPrivilege	4060	RegAsm.exe
Token: SeSecurityPrivilege	4060	RegAsm.exe
Token: SeSecurityPrivilege	4060	RegAsm.exe
Token: SeSecurityPrivilege	4060	RegAsm.exe
Token: SeSecurityPrivilege	4060	RegAsm.exe
Token: SeDebugPrivilege	2080	sahost.exe
Token: SeDebugPrivilege	2948	powershell.exe
Token: SeDebugPrivilege	4108	regasm.exe
Token: SeDebugPrivilege	4020	nano.exe
Token: SeDebugPrivilege	3348	powershell.exe
Token: SeDebugPrivilege	2624	sahost.exe
Token: SeDebugPrivilege	240	microsoft.exe
Token: SeDebugPrivilege	1632	cookie250.exe
Token: 33	6096	127.0.6533.120_chrome_installer.exe
Token: SeIncBasePriorityPrivilege	6096	127.0.6533.120_chrome_installer.exe
Token: SeDebugPrivilege	5820	wab.exe
Token: 33	5412	GoogleCrashHandler64.exe
Token: SeIncBasePriorityPrivilege	5412	GoogleCrashHandler64.exe
Token: 33	652	GoogleCrashHandler.exe
Token: SeIncBasePriorityPrivilege	652	GoogleCrashHandler.exe
Token: SeDebugPrivilege	2412	GoogleUpdate.exe
Token: SeDebugPrivilege	692	GoogleUpdate.exe
Token: SeDebugPrivilege	1448	GoogleUpdate.exe
Token: SeShutdownPrivilege	5676	chrome.exe
Token: SeCreatePagefilePrivilege	5676	chrome.exe
Token: SeShutdownPrivilege	5676	chrome.exe
Token: SeCreatePagefilePrivilege	5676	chrome.exe
Token: SeDebugPrivilege	1204	authenticator.exe
Token: SeDebugPrivilege	1480	U.exe
Token: SeDebugPrivilege	2592	WE.exe
Token: SeShutdownPrivilege	5676	chrome.exe
Token: SeCreatePagefilePrivilege	5676	chrome.exe
Token: SeShutdownPrivilege	5676	chrome.exe
Token: SeCreatePagefilePrivilege	5676	chrome.exe
Token: SeShutdownPrivilege	5676	chrome.exe
Token: SeCreatePagefilePrivilege	5676	chrome.exe
Token: SeShutdownPrivilege	5676	chrome.exe

Suspicious use of FindShellTrayWindow 27 IoCs

pid	Process
2260	build2.exe
5676	chrome.exe
5676	chrome.exe
5676	chrome.exe
5676	chrome.exe
5676	chrome.exe
5676	chrome.exe
5676	chrome.exe
5676	chrome.exe
5676	chrome.exe
5676	chrome.exe
5676	chrome.exe
5676	chrome.exe
5676	chrome.exe
5676	chrome.exe
5676	chrome.exe
5676	chrome.exe
5676	chrome.exe
5676	chrome.exe
5676	chrome.exe
5676	chrome.exe
5676	chrome.exe
5676	chrome.exe
5676	chrome.exe
5676	chrome.exe
5676	chrome.exe
5676	chrome.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
5676	chrome.exe
5676	chrome.exe
5676	chrome.exe
5676	chrome.exe
5676	chrome.exe
5676	chrome.exe
5676	chrome.exe
5676	chrome.exe
5676	chrome.exe
5676	chrome.exe
5676	chrome.exe
5676	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2628	carrier.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3792 wrote to memory of 1696	3792	New Text Document mod.exe	84
PID 3792 wrote to memory of 1696	3792	New Text Document mod.exe	84
PID 3792 wrote to memory of 1696	3792	New Text Document mod.exe	84
PID 3792 wrote to memory of 4956	3792	New Text Document mod.exe	85
PID 3792 wrote to memory of 4956	3792	New Text Document mod.exe	85
PID 3792 wrote to memory of 4956	3792	New Text Document mod.exe	85
PID 4956 wrote to memory of 3412	4956	Mke%20Fallen.exe	87
PID 4956 wrote to memory of 3412	4956	Mke%20Fallen.exe	87
PID 4956 wrote to memory of 3412	4956	Mke%20Fallen.exe	87
PID 2764 wrote to memory of 1676	2764	Mke%20Fallen.exe	88
PID 2764 wrote to memory of 1676	2764	Mke%20Fallen.exe	88
PID 2764 wrote to memory of 1676	2764	Mke%20Fallen.exe	88
PID 3792 wrote to memory of 2260	3792	New Text Document mod.exe	89
PID 3792 wrote to memory of 2260	3792	New Text Document mod.exe	89
PID 3792 wrote to memory of 2260	3792	New Text Document mod.exe	89
PID 1696 wrote to memory of 3152	1696	stub.exe	91
PID 1696 wrote to memory of 3152	1696	stub.exe	91
PID 1696 wrote to memory of 3152	1696	stub.exe	91
PID 1696 wrote to memory of 1952	1696	stub.exe	93
PID 1696 wrote to memory of 1952	1696	stub.exe	93
PID 1696 wrote to memory of 1952	1696	stub.exe	93
PID 3152 wrote to memory of 3356	3152	cmd.exe	95
PID 3152 wrote to memory of 3356	3152	cmd.exe	95
PID 3152 wrote to memory of 3356	3152	cmd.exe	95
PID 1952 wrote to memory of 1684	1952	cmd.exe	96
PID 1952 wrote to memory of 1684	1952	cmd.exe	96
PID 1952 wrote to memory of 1684	1952	cmd.exe	96
PID 2764 wrote to memory of 4200	2764	Mke%20Fallen.exe	97
PID 2764 wrote to memory of 4200	2764	Mke%20Fallen.exe	97
PID 2764 wrote to memory of 4200	2764	Mke%20Fallen.exe	97
PID 1952 wrote to memory of 1472	1952	cmd.exe	98
PID 1952 wrote to memory of 1472	1952	cmd.exe	98
PID 1952 wrote to memory of 1472	1952	cmd.exe	98
PID 2764 wrote to memory of 4740	2764	Mke%20Fallen.exe	99
PID 2764 wrote to memory of 4740	2764	Mke%20Fallen.exe	99
PID 2764 wrote to memory of 4740	2764	Mke%20Fallen.exe	99
PID 2764 wrote to memory of 3524	2764	Mke%20Fallen.exe	100
PID 2764 wrote to memory of 3524	2764	Mke%20Fallen.exe	100
PID 2764 wrote to memory of 3524	2764	Mke%20Fallen.exe	100
PID 3792 wrote to memory of 1888	3792	New Text Document mod.exe	101
PID 3792 wrote to memory of 1888	3792	New Text Document mod.exe	101
PID 3792 wrote to memory of 1888	3792	New Text Document mod.exe	101
PID 3792 wrote to memory of 4296	3792	New Text Document mod.exe	102
PID 3792 wrote to memory of 4296	3792	New Text Document mod.exe	102
PID 3792 wrote to memory of 4296	3792	New Text Document mod.exe	102
PID 1888 wrote to memory of 4656	1888	l2.exe	107
PID 1888 wrote to memory of 4656	1888	l2.exe	107
PID 1888 wrote to memory of 4656	1888	l2.exe	107
PID 2260 wrote to memory of 3224	2260	build2.exe	125
PID 2260 wrote to memory of 3224	2260	build2.exe	125
PID 2260 wrote to memory of 3224	2260	build2.exe	125
PID 3792 wrote to memory of 2400	3792	New Text Document mod.exe	128
PID 3792 wrote to memory of 2400	3792	New Text Document mod.exe	128
PID 2400 wrote to memory of 2100	2400	networks_profile.exe	130
PID 2400 wrote to memory of 2100	2400	networks_profile.exe	130
PID 3792 wrote to memory of 4504	3792	New Text Document mod.exe	131
PID 3792 wrote to memory of 4504	3792	New Text Document mod.exe	131
PID 3792 wrote to memory of 4504	3792	New Text Document mod.exe	131
PID 2764 wrote to memory of 4804	2764	Mke%20Fallen.exe	133
PID 2764 wrote to memory of 4804	2764	Mke%20Fallen.exe	133
PID 2764 wrote to memory of 4804	2764	Mke%20Fallen.exe	133
PID 2100 wrote to memory of 3128	2100	networks_profile.exe	134
PID 2100 wrote to memory of 3128	2100	networks_profile.exe	134
PID 2100 wrote to memory of 112	2100	networks_profile.exe	135

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	regasm.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	regasm.exe

C:\Users\Admin\AppData\Local\Temp\New Text Document mod.exe
"C:\Users\Admin\AppData\Local\Temp\New Text Document mod.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3792
- C:\Users\Admin\AppData\Local\Temp\a\stub.exe
  "C:\Users\Admin\AppData\Local\Temp\a\stub.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1696
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\Admin\AppData\Roaming\svchost.exe"' & exit
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3152
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\Admin\AppData\Roaming\svchost.exe"'
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:3356
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp126A.tmp.bat""
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1952
  - - C:\Windows\SysWOW64\timeout.exe
      timeout 3
      4⤵
      Delays execution with timeout.exe
      PID:1684
  - - C:\Users\Admin\AppData\Roaming\svchost.exe
      "C:\Users\Admin\AppData\Roaming\svchost.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1472
- C:\Users\Admin\AppData\Local\Temp\a\Mke%20Fallen.exe
  "C:\Users\Admin\AppData\Local\Temp\a\Mke%20Fallen.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4956
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\a\MKE%20~1.EXE > nul
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3412
- C:\Users\Admin\AppData\Local\Temp\a\build2.exe
  "C:\Users\Admin\AppData\Local\Temp\a\build2.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2260
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2260 -s 772
    3⤵
    - Program crash
    PID:3256
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2260 -s 820
    3⤵
    - Program crash
    PID:4636
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2260 -s 876
    3⤵
    - Program crash
    PID:3864
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2260 -s 956
    3⤵
    - Program crash
    PID:2924
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2260 -s 960
    3⤵
    - Program crash
    PID:1476
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2260 -s 1000
    3⤵
    - Program crash
    PID:1744
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2260 -s 944
    3⤵
    - Program crash
    PID:4024
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2260 -s 944
    3⤵
    - Program crash
    PID:2784
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2260 -s 1136
    3⤵
    - Program crash
    PID:3196
- - C:\Users\Admin\AppData\Local\Temp\fed0c9a4d3\Hkbsse.exe
    "C:\Users\Admin\AppData\Local\Temp\fed0c9a4d3\Hkbsse.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3224
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3224 -s 584
      4⤵
      Program crash
      PID:4512
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3224 -s 624
      4⤵
      Program crash
      PID:1408
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3224 -s 580
      4⤵
      Program crash
      PID:3180
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3224 -s 752
      4⤵
      Program crash
      PID:2852
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3224 -s 884
      4⤵
      Program crash
      PID:1448
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3224 -s 928
      4⤵
      Program crash
      PID:1352
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3224 -s 948
      4⤵
      Program crash
      PID:1508
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3224 -s 948
      4⤵
      Program crash
      PID:4588
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3224 -s 616
      4⤵
      Program crash
      PID:3212
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3224 -s 1064
      4⤵
      Program crash
      PID:3816
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3224 -s 1176
      4⤵
      Program crash
      PID:1116
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3224 -s 1188
      4⤵
      Program crash
      PID:4104
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3224 -s 888
      4⤵
      Program crash
      PID:6924
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3224 -s 1412
      4⤵
      Program crash
      PID:6404
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3224 -s 1476
      4⤵
      Program crash
      PID:1788
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3224 -s 1452
      4⤵
      Program crash
      PID:3504
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2260 -s 1416
    3⤵
    - Program crash
    PID:1664
- C:\Users\Admin\AppData\Local\Temp\a\l2.exe
  "C:\Users\Admin\AppData\Local\Temp\a\l2.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1888
- - C:\Windows\SysWOW64\schtasks.exe
    /C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4656
- C:\Users\Admin\AppData\Local\Temp\a\keylogger.exe
  "C:\Users\Admin\AppData\Local\Temp\a\keylogger.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4296
- C:\Users\Admin\AppData\Local\Temp\a\networks_profile.exe
  "C:\Users\Admin\AppData\Local\Temp\a\networks_profile.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2400
- - C:\Users\Admin\AppData\Local\Temp\a\networks_profile.exe
    "C:\Users\Admin\AppData\Local\Temp\a\networks_profile.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2100
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "ver"
      4⤵
      PID:3128
  - - C:\Windows\SYSTEM32\netsh.exe
      netsh wlan show profiles
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:112
- C:\Users\Admin\AppData\Local\Temp\a\backdoor.exe
  "C:\Users\Admin\AppData\Local\Temp\a\backdoor.exe"
  2⤵
  - Executes dropped EXE
  PID:4504
- C:\Users\Admin\AppData\Local\Temp\a\carrier.exe
  "C:\Users\Admin\AppData\Local\Temp\a\carrier.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:2628
- C:\Users\Admin\AppData\Local\Temp\a\wahost.exe
  "C:\Users\Admin\AppData\Local\Temp\a\wahost.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4964
- - C:\Users\Admin\AppData\Local\Temp\a\wahost.exe
    "C:\Users\Admin\AppData\Local\Temp\a\wahost.exe"
    3⤵
    - Executes dropped EXE
    - Accesses Microsoft Outlook profiles
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1316
- C:\Users\Admin\AppData\Local\Temp\a\regasm.exe
  "C:\Users\Admin\AppData\Local\Temp\a\regasm.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1496
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\eVoVlc.exe"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2948
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\eVoVlc" /XML "C:\Users\Admin\AppData\Local\Temp\tmpFC9B.tmp"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1836
- - C:\Users\Admin\AppData\Local\Temp\a\regasm.exe
    "C:\Users\Admin\AppData\Local\Temp\a\regasm.exe"
    3⤵
    - Executes dropped EXE
    - Accesses Microsoft Outlook profiles
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - outlook_office_path
    - outlook_win_path
    PID:4108
- C:\Users\Admin\AppData\Local\Temp\a\sihost.exe
  "C:\Users\Admin\AppData\Local\Temp\a\sihost.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: MapViewOfSection
  PID:2172
- - C:\Program Files (x86)\windows mail\wab.exe
    "C:\Users\Admin\AppData\Local\Temp\a\sihost.exe"
    3⤵
    - Suspicious use of NtCreateThreadExHideFromDebugger
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5820
- C:\Users\Admin\AppData\Local\Temp\a\winiti.exe
  "C:\Users\Admin\AppData\Local\Temp\a\winiti.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:3728
- - C:\Program Files (x86)\Google\Temp\GUMCA02.tmp\GoogleUpdate.exe
    "C:\Program Files (x86)\Google\Temp\GUMCA02.tmp\GoogleUpdate.exe" /installsource taggedmi /install "appguid={8A69D345-D564-463C-AFF1-A69D9E530F96}&iid={4611E087-CB70-244B-9202-F605357A02F4}&lang=en&browser=5&usagestats=1&appname=Google%20Chrome&needsadmin=prefers&ap=x64-stable-statsdef_1&brand=CHBF&installdataindex=empty"
    3⤵
    - Event Triggered Execution: Image File Execution Options Injection
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1448
  - - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
      "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /regsvc
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Modifies registry class
      PID:4444
  - - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
      "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /regserver
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Modifies registry class
      PID:1236
    - - C:\Program Files (x86)\Google\Update\1.3.36.122\GoogleUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Google\Update\1.3.36.122\GoogleUpdateComRegisterShell64.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:1548
    - - C:\Program Files (x86)\Google\Update\1.3.36.122\GoogleUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Google\Update\1.3.36.122\GoogleUpdateComRegisterShell64.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:4796
    - - C:\Program Files (x86)\Google\Update\1.3.36.122\GoogleUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Google\Update\1.3.36.122\GoogleUpdateComRegisterShell64.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:2860
  - - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
      "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zNi4xMjIiIHNoZWxsX3ZlcnNpb249IjEuMy4zNi4xMjEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QjE1MkE2M0UtMDUzOC00MEY0LTlDOTMtODIxODEwQ0ZGQTE4fSIgdXNlcmlkPSJ7NjI2MUY0MkEtQTYwNi00Mzg0LTlBNzYtNUNFRjQxQjJDMzNBfSIgaW5zdGFsbHNvdXJjZT0idGFnZ2VkbWkiIHJlcXVlc3RpZD0ie0VFM0UzRjkwLUQ3QUYtNEY2NC04RkYwLTQ5NjI3QjE3RTAxQ30iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgcGh5c21lbW9yeT0iOCIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4yMjAwMC40OTMiIHNwPSIiIGFyY2g9Ing2NCIvPjxhcHAgYXBwaWQ9Ins0MzBGRDREMC1CNzI5LTRGNjEtQUEzNC05MTUyNjQ4MTc5OUR9IiB2ZXJzaW9uPSIxLjMuMzYuMzcxIiBuZXh0dmVyc2lvbj0iMS4zLjM2LjEyMiIgbGFuZz0iZW4iIGJyYW5kPSJDSEJGIiBjbGllbnQ9IiIgaWlkPSJ7NDYxMUUwODctQ0I3MC0yNDRCLTkyMDItRjYwNTM1N0EwMkY0fSI-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgaW5zdGFsbF90aW1lX21zPSIyMDYzIi8-PC9hcHA-PC9yZXF1ZXN0Pg
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      PID:1280
  - - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
      "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /handoff "appguid={8A69D345-D564-463C-AFF1-A69D9E530F96}&iid={4611E087-CB70-244B-9202-F605357A02F4}&lang=en&browser=5&usagestats=1&appname=Google%20Chrome&needsadmin=prefers&ap=x64-stable-statsdef_1&brand=CHBF&installdataindex=empty" /installsource taggedmi /sessionid "{B152A63E-0538-40F4-9C93-821810CFFA18}"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2412
- C:\Users\Admin\AppData\Local\Temp\a\sahost.exe
  "C:\Users\Admin\AppData\Local\Temp\a\sahost.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2080
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\OkNQYfjSk.exe"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3348
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\OkNQYfjSk" /XML "C:\Users\Admin\AppData\Local\Temp\tmp2A6.tmp"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1044
- - C:\Users\Admin\AppData\Local\Temp\a\sahost.exe
    "C:\Users\Admin\AppData\Local\Temp\a\sahost.exe"
    3⤵
    - Executes dropped EXE
    - Accesses Microsoft Outlook profiles
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2624
- C:\Users\Admin\AppData\Local\Temp\a\cookie250.exe
  "C:\Users\Admin\AppData\Local\Temp\a\cookie250.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies system certificate store
  - Suspicious use of AdjustPrivilegeToken
  PID:1632
- C:\Users\Admin\AppData\Local\Temp\a\out_test_sig.exe
  "C:\Users\Admin\AppData\Local\Temp\a\out_test_sig.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3984
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Microsoft\Windows\hyper-v.exe"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:6436
- - C:\Windows\SysWOW64\systeminfo.exe
    systeminfo
    3⤵
    - Gathers system information
    PID:7112
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-CimInstance -Class Win32_ComputerSystem
    3⤵
    PID:6456
- C:\Users\Admin\AppData\Local\Temp\a\TTF.exe
  "C:\Users\Admin\AppData\Local\Temp\a\TTF.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1944
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:4400
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:3152
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1240
- C:\Users\Admin\AppData\Local\Temp\a\T9.exe
  "C:\Users\Admin\AppData\Local\Temp\a\T9.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of AdjustPrivilegeToken
  PID:1948
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4060
- C:\Users\Admin\AppData\Local\Temp\a\c7.exe
  "C:\Users\Admin\AppData\Local\Temp\a\c7.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2436
- C:\Users\Admin\AppData\Local\Temp\a\mservice64.exe
  "C:\Users\Admin\AppData\Local\Temp\a\mservice64.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:3700
- C:\Users\Admin\AppData\Local\Temp\a\T7.exe
  "C:\Users\Admin\AppData\Local\Temp\a\T7.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:1744
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe"
    3⤵
    PID:3920
- C:\Users\Admin\AppData\Local\Temp\a\nano.exe
  "C:\Users\Admin\AppData\Local\Temp\a\nano.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  PID:4020
- C:\Users\Admin\AppData\Local\Temp\a\request.exe
  "C:\Users\Admin\AppData\Local\Temp\a\request.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:4336
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\System32\schtasks.exe /Create /SC MINUTE /MO 1 /TN msvcservice /TR "C:\Users\Admin\msvcservice.exe" /F
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1052
- - C:\Users\Admin\msvcservice.exe
    "C:\Users\Admin\msvcservice.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    PID:780
  - - C:\Windows\SysWOW64\schtasks.exe
      C:\Windows\System32\schtasks.exe /Create /SC MINUTE /MO 1 /TN msvcservice /TR "C:\Users\Admin\msvcservice.exe" /F
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:4380
- C:\Users\Admin\AppData\Local\Temp\a\1111.exe
  "C:\Users\Admin\AppData\Local\Temp\a\1111.exe"
  2⤵
  - Executes dropped EXE
  - Checks processor information in registry
  PID:5088
- C:\Users\Admin\AppData\Local\Temp\a\microsoft.exe
  "C:\Users\Admin\AppData\Local\Temp\a\microsoft.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  PID:3208
- - C:\Users\Admin\AppData\Local\Temp\a\microsoft.exe
    "C:\Users\Admin\AppData\Local\Temp\a\microsoft.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Checks whether UAC is enabled
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious behavior: SetClipboardViewer
    - Suspicious use of AdjustPrivilegeToken
    PID:240
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /C mkdir "C:\Users\Admin\AppData\Roaming\microsoft"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1832
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /C schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\microsoft\microsoft.exe'" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4716
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\microsoft\microsoft.exe'" /f
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:5324
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /C copy "C:\Users\Admin\AppData\Local\Temp\a\microsoft.exe" "C:\Users\Admin\AppData\Roaming\microsoft\microsoft.exe"
    3⤵
    PID:5644
- C:\Users\Admin\AppData\Local\Temp\a\Identifications.exe
  "C:\Users\Admin\AppData\Local\Temp\a\Identifications.exe"
  2⤵
  PID:5008
- C:\Users\Admin\AppData\Local\Temp\a\pimer_bbbcontents7.exe
  "C:\Users\Admin\AppData\Local\Temp\a\pimer_bbbcontents7.exe"
  2⤵
  - Suspicious use of SetThreadContext
  PID:3456
- - C:\Users\Admin\AppData\Local\Temp\a\pimer_bbbcontents7.exe
    "C:\Users\Admin\AppData\Local\Temp\a\pimer_bbbcontents7.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    PID:5492
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5492 -s 1320
      4⤵
      Program crash
      PID:6448
- C:\Users\Admin\AppData\Local\Temp\a\Documents.exe
  "C:\Users\Admin\AppData\Local\Temp\a\Documents.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2868
- C:\Users\Admin\AppData\Local\Temp\a\tc10.exe
  "C:\Users\Admin\AppData\Local\Temp\a\tc10.exe"
  2⤵
  PID:4424
- C:\Users\Admin\AppData\Local\Temp\a\Meetings.exe
  "C:\Users\Admin\AppData\Local\Temp\a\Meetings.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3160
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\1sesc.exe
    "C:\Users\Admin\AppData\Local\Temp\RarSFX0\1sesc.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5320
- C:\Users\Admin\AppData\Local\Temp\a\Trial.exe
  "C:\Users\Admin\AppData\Local\Temp\a\Trial.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5200
- C:\Users\Admin\AppData\Local\Temp\a\Extension.exe
  "C:\Users\Admin\AppData\Local\Temp\a\Extension.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5556
- C:\Users\Admin\AppData\Local\Temp\a\Mailer.exe
  "C:\Users\Admin\AppData\Local\Temp\a\Mailer.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:692
- C:\Users\Admin\AppData\Local\Temp\a\Setup.exe
  "C:\Users\Admin\AppData\Local\Temp\a\Setup.exe"
  2⤵
  PID:6008
- C:\Users\Admin\AppData\Local\Temp\a\Teamview.exe
  "C:\Users\Admin\AppData\Local\Temp\a\Teamview.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3204
- C:\Users\Admin\AppData\Local\Temp\a\authenticator.exe
  "C:\Users\Admin\AppData\Local\Temp\a\authenticator.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1204
- C:\Users\Admin\AppData\Local\Temp\a\exec.exe
  "C:\Users\Admin\AppData\Local\Temp\a\exec.exe"
  2⤵
  PID:1852
- C:\Users\Admin\AppData\Local\Temp\a\U.exe
  "C:\Users\Admin\AppData\Local\Temp\a\U.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:1480
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6580
- C:\Users\Admin\AppData\Local\Temp\a\WE.exe
  "C:\Users\Admin\AppData\Local\Temp\a\WE.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of AdjustPrivilegeToken
  PID:2592
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6420
- C:\Users\Admin\AppData\Local\Temp\a\66b5d9d3adbaa_defaultr.exe
  "C:\Users\Admin\AppData\Local\Temp\a\66b5d9d3adbaa_defaultr.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  PID:6872
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    PID:3500
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    PID:6528
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\KFHJJJKKFHID" & exit
      4⤵
      PID:6220
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 10
        5⤵
        Delays execution with timeout.exe
        
        PID:6536
- C:\Users\Admin\AppData\Local\Temp\a\66af4e35e761b_doz.exe
  "C:\Users\Admin\AppData\Local\Temp\a\66af4e35e761b_doz.exe"
  2⤵
  - Suspicious use of SetThreadContext
  PID:5124
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    PID:4900
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" & rd /s /q "C:\ProgramData\JJEGIJEGDBFH" & exit
      4⤵
      PID:6952
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 10
        5⤵
        Delays execution with timeout.exe
        
        PID:6824
- C:\Users\Admin\AppData\Local\Temp\a\66b5b75106ac6_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\a\66b5b75106ac6_stealc.exe"
  2⤵
  PID:7060
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    PID:768
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    PID:5848
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    PID:5440
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    PID:6760
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 6760 -s 1284
      4⤵
      Program crash
      PID:5696
- C:\Users\Admin\AppData\Local\Temp\a\66b0ee142cf8f_PhotosExifEditor.exe
  "C:\Users\Admin\AppData\Local\Temp\a\66b0ee142cf8f_PhotosExifEditor.exe"
  2⤵
  PID:6884
- C:\Users\Admin\AppData\Local\Temp\a\66b331646d2cd_123p.exe
  "C:\Users\Admin\AppData\Local\Temp\a\66b331646d2cd_123p.exe"
  2⤵
  PID:396
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
    3⤵
    - Power Settings
    PID:6092
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
    3⤵
    - Power Settings
    PID:3336
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
    3⤵
    - Power Settings
    PID:400
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
    3⤵
    - Power Settings
    PID:2332
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe delete "VIFLJRPW"
    3⤵
    - Launches sc.exe
    PID:5480
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe create "VIFLJRPW" binpath= "C:\ProgramData\xprfjygruytr\etzpikspwykg.exe" start= "auto"
    3⤵
    - Launches sc.exe
    PID:6432
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop eventlog
    3⤵
    - Launches sc.exe
    PID:5148
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe start "VIFLJRPW"
    3⤵
    - Launches sc.exe
    PID:4072
- C:\Users\Admin\AppData\Local\Temp\a\66b837290469c_vidar.exe
  "C:\Users\Admin\AppData\Local\Temp\a\66b837290469c_vidar.exe"
  2⤵
  PID:4696
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    PID:3868
- C:\Users\Admin\AppData\Local\Temp\a\66af531b832ee_main.exe
  "C:\Users\Admin\AppData\Local\Temp\a\66af531b832ee_main.exe"
  2⤵
  PID:6784
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    PID:6556
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" & rd /s /q "C:\ProgramData\GDAEBKJDHDAF" & exit
      4⤵
      PID:6664
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 10
        5⤵
        Delays execution with timeout.exe
        
        PID:4512
- C:\Users\Admin\AppData\Local\Temp\a\66b4af430a0a1_files.exe
  "C:\Users\Admin\AppData\Local\Temp\a\66b4af430a0a1_files.exe"
  2⤵
  PID:6508
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    PID:3420
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    PID:5456
- C:\Users\Admin\AppData\Local\Temp\a\66b85f47d1f63_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\a\66b85f47d1f63_stealc.exe"
  2⤵
  PID:5568
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    PID:3484

C:\Windows\SysWOW64\Mke%20Fallen.exe
C:\Windows\SysWOW64\Mke%20Fallen.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2764
- C:\Windows\SysWOW64\vmtoolsd.exe
  "C:\Windows\system32\vmtoolsd.exe"
  2⤵
  - Executes dropped EXE
  PID:1676
- C:\Windows\SysWOW64\vmtoolsd.exe
  "C:\Windows\system32\vmtoolsd.exe"
  2⤵
  - Executes dropped EXE
  PID:4200
- C:\Windows\SysWOW64\vmtoolsd.exe
  "C:\Windows\system32\vmtoolsd.exe"
  2⤵
  - Executes dropped EXE
  PID:4740
- C:\Windows\SysWOW64\vmtoolsd.exe
  "C:\Windows\system32\vmtoolsd.exe"
  2⤵
  - Executes dropped EXE
  PID:3524
- C:\Windows\SysWOW64\vmtoolsd.exe
  "C:\Windows\system32\vmtoolsd.exe"
  2⤵
  - Executes dropped EXE
  PID:4804
- C:\Windows\SysWOW64\vmtoolsd.exe
  "C:\Windows\system32\vmtoolsd.exe"
  2⤵
  - Executes dropped EXE
  PID:3016
- C:\Windows\SysWOW64\vmtoolsd.exe
  "C:\Windows\system32\vmtoolsd.exe"
  2⤵
  - Executes dropped EXE
  PID:2116
- C:\Windows\SysWOW64\vmtoolsd.exe
  "C:\Windows\system32\vmtoolsd.exe"
  2⤵
  - Executes dropped EXE
  PID:3556
- C:\Windows\SysWOW64\vmtoolsd.exe
  "C:\Windows\system32\vmtoolsd.exe"
  2⤵
  - Executes dropped EXE
  PID:2740
- C:\Windows\SysWOW64\vmtoolsd.exe
  "C:\Windows\system32\vmtoolsd.exe"
  2⤵
  - Executes dropped EXE
  PID:2376
- C:\Windows\SysWOW64\vmtoolsd.exe
  "C:\Windows\system32\vmtoolsd.exe"
  2⤵
  - Executes dropped EXE
  PID:4516
- C:\Windows\SysWOW64\vmtoolsd.exe
  "C:\Windows\system32\vmtoolsd.exe"
  2⤵
  - Executes dropped EXE
  PID:4588
- C:\Windows\SysWOW64\vmtoolsd.exe
  "C:\Windows\system32\vmtoolsd.exe"
  2⤵
  - Executes dropped EXE
  PID:1056
- C:\Windows\SysWOW64\vmtoolsd.exe
  "C:\Windows\system32\vmtoolsd.exe"
  2⤵
  - Executes dropped EXE
  PID:1300
- C:\Windows\SysWOW64\vmtoolsd.exe
  "C:\Windows\system32\vmtoolsd.exe"
  2⤵
  - Executes dropped EXE
  PID:5192
- C:\Windows\SysWOW64\vmtoolsd.exe
  "C:\Windows\system32\vmtoolsd.exe"
  2⤵
  - Executes dropped EXE
  PID:5864
- C:\Windows\SysWOW64\vmtoolsd.exe
  "C:\Windows\system32\vmtoolsd.exe"
  2⤵
  - Executes dropped EXE
  PID:5940
- C:\Windows\SysWOW64\vmtoolsd.exe
  "C:\Windows\system32\vmtoolsd.exe"
  2⤵
  - Executes dropped EXE
  PID:6108
- C:\Windows\SysWOW64\vmtoolsd.exe
  "C:\Windows\system32\vmtoolsd.exe"
  2⤵
  PID:4580
- C:\Windows\SysWOW64\vmtoolsd.exe
  "C:\Windows\system32\vmtoolsd.exe"
  2⤵
  PID:5608
- C:\Windows\SysWOW64\vmtoolsd.exe
  "C:\Windows\system32\vmtoolsd.exe"
  2⤵
  PID:5800
- C:\Windows\SysWOW64\vmtoolsd.exe
  "C:\Windows\system32\vmtoolsd.exe"
  2⤵
  PID:5952
- C:\Windows\SysWOW64\vmtoolsd.exe
  "C:\Windows\system32\vmtoolsd.exe"
  2⤵
  PID:3744
- C:\Windows\SysWOW64\vmtoolsd.exe
  "C:\Windows\system32\vmtoolsd.exe"
  2⤵
  PID:6116
- C:\Windows\SysWOW64\vmtoolsd.exe
  "C:\Windows\system32\vmtoolsd.exe"
  2⤵
  PID:4396
- C:\Windows\SysWOW64\vmtoolsd.exe
  "C:\Windows\system32\vmtoolsd.exe"
  2⤵
  PID:6764
- C:\Windows\SysWOW64\vmtoolsd.exe
  "C:\Windows\system32\vmtoolsd.exe"
  2⤵
  PID:6912
- C:\Windows\SysWOW64\vmtoolsd.exe
  "C:\Windows\system32\vmtoolsd.exe"
  2⤵
  PID:7048
- C:\Windows\SysWOW64\vmtoolsd.exe
  "C:\Windows\system32\vmtoolsd.exe"
  2⤵
  PID:5840
- C:\Windows\SysWOW64\vmtoolsd.exe
  "C:\Windows\system32\vmtoolsd.exe"
  2⤵
  PID:6592
- C:\Windows\SysWOW64\vmtoolsd.exe
  "C:\Windows\system32\vmtoolsd.exe"
  2⤵
  PID:4620
- C:\Windows\SysWOW64\vmtoolsd.exe
  "C:\Windows\system32\vmtoolsd.exe"
  2⤵
  PID:1468
- C:\Windows\SysWOW64\vmtoolsd.exe
  "C:\Windows\system32\vmtoolsd.exe"
  2⤵
  PID:6944
- C:\Windows\SysWOW64\vmtoolsd.exe
  "C:\Windows\system32\vmtoolsd.exe"
  2⤵
  PID:6776
- C:\Windows\SysWOW64\vmtoolsd.exe
  "C:\Windows\system32\vmtoolsd.exe"
  2⤵
  PID:5972
- C:\Windows\SysWOW64\vmtoolsd.exe
  "C:\Windows\system32\vmtoolsd.exe"
  2⤵
  PID:6632
- C:\Windows\SysWOW64\vmtoolsd.exe
  "C:\Windows\system32\vmtoolsd.exe"
  2⤵
  PID:6708
- C:\Windows\SysWOW64\vmtoolsd.exe
  "C:\Windows\system32\vmtoolsd.exe"
  2⤵
  PID:6004
- C:\Windows\SysWOW64\vmtoolsd.exe
  "C:\Windows\system32\vmtoolsd.exe"
  2⤵
  PID:580
- C:\Windows\SysWOW64\vmtoolsd.exe
  "C:\Windows\system32\vmtoolsd.exe"
  2⤵
  PID:1636
- C:\Windows\SysWOW64\vmtoolsd.exe
  "C:\Windows\system32\vmtoolsd.exe"
  2⤵
  PID:6604
- C:\Windows\SysWOW64\vmtoolsd.exe
  "C:\Windows\system32\vmtoolsd.exe"
  2⤵
  PID:4940
- C:\Windows\SysWOW64\vmtoolsd.exe
  "C:\Windows\system32\vmtoolsd.exe"
  2⤵
  PID:4744
- C:\Windows\SysWOW64\vmtoolsd.exe
  "C:\Windows\system32\vmtoolsd.exe"
  2⤵
  PID:6772
- C:\Windows\SysWOW64\vmtoolsd.exe
  "C:\Windows\system32\vmtoolsd.exe"
  2⤵
  PID:6760
- C:\Windows\SysWOW64\vmtoolsd.exe
  "C:\Windows\system32\vmtoolsd.exe"
  2⤵
  PID:5476
- C:\Windows\SysWOW64\vmtoolsd.exe
  "C:\Windows\system32\vmtoolsd.exe"
  2⤵
  PID:6676
- C:\Windows\SysWOW64\vmtoolsd.exe
  "C:\Windows\system32\vmtoolsd.exe"
  2⤵
  PID:6436
- C:\Windows\SysWOW64\vmtoolsd.exe
  "C:\Windows\system32\vmtoolsd.exe"
  2⤵
  PID:6620
- C:\Windows\SysWOW64\vmtoolsd.exe
  "C:\Windows\system32\vmtoolsd.exe"
  2⤵
  PID:5592
- C:\Windows\SysWOW64\vmtoolsd.exe
  "C:\Windows\system32\vmtoolsd.exe"
  2⤵
  PID:5464
- C:\Windows\SysWOW64\vmtoolsd.exe
  "C:\Windows\system32\vmtoolsd.exe"
  2⤵
  PID:1744

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2260 -ip 2260
1⤵
PID:396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2260 -ip 2260
1⤵
PID:4648

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2260 -ip 2260
1⤵
PID:1188

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 2260 -ip 2260
1⤵
PID:4840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 2260 -ip 2260
1⤵
PID:2948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 2260 -ip 2260
1⤵
PID:3368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2260 -ip 2260
1⤵
PID:2436

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 2260 -ip 2260
1⤵
PID:4612

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 2260 -ip 2260
1⤵
PID:1072

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 2260 -ip 2260
1⤵
PID:964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 3224 -ip 3224
1⤵
PID:4068

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3224 -ip 3224
1⤵
PID:2232

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 3224 -ip 3224
1⤵
PID:396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 3224 -ip 3224
1⤵
PID:3228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 3224 -ip 3224
1⤵
PID:3392

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 3224 -ip 3224
1⤵
PID:2148

C:\Users\Admin\AppData\Local\Temp\fed0c9a4d3\Hkbsse.exe
C:\Users\Admin\AppData\Local\Temp\fed0c9a4d3\Hkbsse.exe
1⤵
- Executes dropped EXE
PID:3944
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3944 -s 404
  2⤵
  - Program crash
  PID:1444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 352 -p 3224 -ip 3224
1⤵
PID:4208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3224 -ip 3224
1⤵
PID:3368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3224 -ip 3224
1⤵
PID:2612

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 3224 -ip 3224
1⤵
PID:4612

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 3224 -ip 3224
1⤵
PID:4744

C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
1⤵
- Executes dropped EXE
PID:2336
- C:\Windows\SysWOW64\schtasks.exe
  /C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2976

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3224 -ip 3224
1⤵
PID:2508

C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /svc
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3940
- C:\Program Files (x86)\Google\Update\Install\{F8F53ED5-1905-4DA7-9038-CBDD309427EA}\127.0.6533.120_chrome_installer.exe
  "C:\Program Files (x86)\Google\Update\Install\{F8F53ED5-1905-4DA7-9038-CBDD309427EA}\127.0.6533.120_chrome_installer.exe" --verbose-logging --do-not-launch-chrome --channel=stable --system-level /installerdata="C:\Windows\TEMP\gui6289.tmp"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious use of AdjustPrivilegeToken
  PID:6096
- - C:\Program Files (x86)\Google\Update\Install\{F8F53ED5-1905-4DA7-9038-CBDD309427EA}\CR_B68B3.tmp\setup.exe
    "C:\Program Files (x86)\Google\Update\Install\{F8F53ED5-1905-4DA7-9038-CBDD309427EA}\CR_B68B3.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Google\Update\Install\{F8F53ED5-1905-4DA7-9038-CBDD309427EA}\CR_B68B3.tmp\CHROME.PACKED.7Z" --verbose-logging --do-not-launch-chrome --channel=stable --system-level /installerdata="C:\Windows\TEMP\gui6289.tmp"
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Executes dropped EXE
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Modifies registry class
    PID:3852
  - - C:\Program Files (x86)\Google\Update\Install\{F8F53ED5-1905-4DA7-9038-CBDD309427EA}\CR_B68B3.tmp\setup.exe
      "C:\Program Files (x86)\Google\Update\Install\{F8F53ED5-1905-4DA7-9038-CBDD309427EA}\CR_B68B3.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=127.0.6533.120 --initial-client-data=0x248,0x24c,0x250,0x224,0x254,0x7ff73ec241f8,0x7ff73ec24204,0x7ff73ec24210
      4⤵
      Drops file in Windows directory
      PID:1780
  - - C:\Program Files (x86)\Google\Update\Install\{F8F53ED5-1905-4DA7-9038-CBDD309427EA}\CR_B68B3.tmp\setup.exe
      "C:\Program Files (x86)\Google\Update\Install\{F8F53ED5-1905-4DA7-9038-CBDD309427EA}\CR_B68B3.tmp\setup.exe" --channel=stable --system-level --verbose-logging --create-shortcuts=2 --install-level=1
      4⤵
      Drops file in Windows directory
      PID:5164
    - - C:\Program Files (x86)\Google\Update\Install\{F8F53ED5-1905-4DA7-9038-CBDD309427EA}\CR_B68B3.tmp\setup.exe
        
        "C:\Program Files (x86)\Google\Update\Install\{F8F53ED5-1905-4DA7-9038-CBDD309427EA}\CR_B68B3.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=127.0.6533.120 --initial-client-data=0x244,0x248,0x24c,0x220,0x250,0x7ff73ec241f8,0x7ff73ec24204,0x7ff73ec24210
        5⤵
        Drops file in Windows directory
        
        PID:5212
- C:\Program Files (x86)\Google\Update\1.3.36.122\GoogleCrashHandler.exe
  "C:\Program Files (x86)\Google\Update\1.3.36.122\GoogleCrashHandler.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:652
- C:\Program Files (x86)\Google\Update\1.3.36.122\GoogleCrashHandler64.exe
  "C:\Program Files (x86)\Google\Update\1.3.36.122\GoogleCrashHandler64.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5412
- C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
  "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zNi4xMjIiIHNoZWxsX3ZlcnNpb249IjEuMy4zNi4xMjEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QjE1MkE2M0UtMDUzOC00MEY0LTlDOTMtODIxODEwQ0ZGQTE4fSIgdXNlcmlkPSJ7NjI2MUY0MkEtQTYwNi00Mzg0LTlBNzYtNUNFRjQxQjJDMzNBfSIgaW5zdGFsbHNvdXJjZT0idGFnZ2VkbWkiIHJlcXVlc3RpZD0ie0FDRTAxOUVFLUU4QzctNDYzMC1CQzZFLUYzQTRBNzU5OEEwM30iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgcGh5c21lbW9yeT0iOCIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4yMjAwMC40OTMiIHNwPSIiIGFyY2g9Ing2NCIvPjxhcHAgYXBwaWQ9Ins4QTY5RDM0NS1ENTY0LTQ2M0MtQUZGMS1BNjlEOUU1MzBGOTZ9IiB2ZXJzaW9uPSIiIG5leHR2ZXJzaW9uPSIxMjcuMC42NTMzLjEyMCIgYXA9Ing2NC1zdGFibGUtc3RhdHNkZWZfMSIgbGFuZz0iZW4iIGJyYW5kPSJDSEJGIiBjbGllbnQ9IiIgaW5zdGFsbGFnZT0iMTEiIGlpZD0iezQ2MTFFMDg3LUNCNzAtMjQ0Qi05MjAyLUY2MDUzNTdBMDJGNH0iIGNvaG9ydD0iMTpndS9pMTk6IiBjb2hvcnRuYW1lPSJTdGFibGUgSW5zdGFsbHMgJmFtcDsgVmVyc2lvbiBQaW5zIj48ZXZlbnQgZXZlbnR0eXBlPSI5IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iNSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIvPjxldmVudCBldmVudHR5cGU9IjEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIGRvd25sb2FkZXI9ImJpdHMiIHVybD0iaHR0cDovL2VkZ2VkbC5tZS5ndnQxLmNvbS9lZGdlZGwvcmVsZWFzZTIvY2hyb21lL2FjbmNkenpnaTMyZXAyZHRiM2Y2YXlxaHppNnFfMTI3LjAuNjUzMy4xMjAvMTI3LjAuNjUzMy4xMjBfY2hyb21lX2luc3RhbGxlci5leGUiIGRvd25sb2FkZWQ9IjEwNjczNzAxNiIgdG90YWw9IjEwNjczNzAxNiIgZG93bmxvYWRfdGltZV9tcz0iMTYxMjUiLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iNiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIvPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjE5NjcwNyIgc291cmNlX3VybF9pbmRleD0iMCIgdXBkYXRlX2NoZWNrX3RpbWVfbXM9Ijk2OSIgZG93bmxvYWRfdGltZV9tcz0iMTczOTEiIGRvd25sb2FkZWQ9IjEwNjczNzAxNiIgdG90YWw9IjEwNjczNzAxNiIgaW5zdGFsbF90aW1lX21zPSIzMzY1NiIvPjwvYXBwPjwvcmVxdWVzdD4
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3944 -ip 3944
1⤵
PID:2340

C:\Users\Admin\msvcservice.exe
C:\Users\Admin\msvcservice.exe
1⤵
- Adds Run key to start application
PID:5272
- C:\Windows\SysWOW64\schtasks.exe
  C:\Windows\System32\schtasks.exe /Create /SC MINUTE /MO 1 /TN msvcservice /TR "C:\Users\Admin\msvcservice.exe" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1748

C:\Users\Admin\AppData\Local\Temp\fed0c9a4d3\Hkbsse.exe
C:\Users\Admin\AppData\Local\Temp\fed0c9a4d3\Hkbsse.exe
1⤵
PID:5368
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5368 -s 472
  2⤵
  - Program crash
  PID:4204

C:\Users\Admin\AppData\Roaming\microsoft\microsoft.exe
C:\Users\Admin\AppData\Roaming\microsoft\microsoft.exe
1⤵
- Suspicious use of SetThreadContext
PID:1480
- C:\Users\Admin\AppData\Roaming\microsoft\microsoft.exe
  "C:\Users\Admin\AppData\Roaming\microsoft\microsoft.exe"
  2⤵
  PID:2848
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C mkdir "C:\Users\Admin\AppData\Roaming\microsoft"
  2⤵
  PID:5216
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\microsoft\microsoft.exe'" /f
  2⤵
  PID:1420
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\microsoft\microsoft.exe'" /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5960
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C copy "C:\Users\Admin\AppData\Roaming\microsoft\microsoft.exe" "C:\Users\Admin\AppData\Roaming\microsoft\microsoft.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 5368 -ip 5368
1⤵
PID:6040

C:\Program Files (x86)\Google\Update\1.3.36.122\GoogleUpdateOnDemand.exe
"C:\Program Files (x86)\Google\Update\1.3.36.122\GoogleUpdateOnDemand.exe" -Embedding
1⤵
- System Location Discovery: System Language Discovery
PID:3416
- C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
  "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ondemand
  2⤵
  - Loads dropped DLL
  PID:200
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --from-installer
    3⤵
    - Loads dropped DLL
    - Checks system information in the registry
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:5676
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=127.0.6533.120 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff980c8e790,0x7ff980c8e79c,0x7ff980c8e7a8
      4⤵
      Loads dropped DLL
      PID:568
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1840,i,5428729288148169184,10229268637634553365,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=1836 /prefetch:2
      4⤵
      Loads dropped DLL
      PID:3216
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --field-trial-handle=1400,i,5428729288148169184,10229268637634553365,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=1960 /prefetch:11
      4⤵
      Loads dropped DLL
      PID:1220
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --field-trial-handle=2192,i,5428729288148169184,10229268637634553365,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=2496 /prefetch:13
      4⤵
      Loads dropped DLL
      PID:5576
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3052,i,5428729288148169184,10229268637634553365,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=3136 /prefetch:1
      4⤵
      Loads dropped DLL
      PID:2380
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3060,i,5428729288148169184,10229268637634553365,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=3332 /prefetch:1
      4⤵
      Loads dropped DLL
      PID:720
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4280,i,5428729288148169184,10229268637634553365,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=4304 /prefetch:1
      4⤵
      Loads dropped DLL
      PID:4752
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4548,i,5428729288148169184,10229268637634553365,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=4512 /prefetch:1
      4⤵
      Loads dropped DLL
      PID:3704
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=4780,i,5428729288148169184,10229268637634553365,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=4768 /prefetch:14
      4⤵
      Loads dropped DLL
      PID:1852
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --field-trial-handle=4460,i,5428729288148169184,10229268637634553365,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=4816 /prefetch:14
      4⤵
      Loads dropped DLL
      PID:1664
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=5000,i,5428729288148169184,10229268637634553365,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=5012 /prefetch:14
      4⤵
      Loads dropped DLL
      PID:6156
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=4772,i,5428729288148169184,10229268637634553365,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=4896 /prefetch:14
      4⤵
      Loads dropped DLL
      PID:6252
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=4572,i,5428729288148169184,10229268637634553365,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=5348 /prefetch:14
      4⤵
      Loads dropped DLL
      PID:6308
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=5336,i,5428729288148169184,10229268637634553365,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=4964 /prefetch:14
      4⤵
      Loads dropped DLL
      PID:6628
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=5380,i,5428729288148169184,10229268637634553365,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=5348 /prefetch:9
      4⤵
      PID:6156
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --field-trial-handle=216,i,5428729288148169184,10229268637634553365,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=5488 /prefetch:14
      4⤵
      PID:1236
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --field-trial-handle=5496,i,5428729288148169184,10229268637634553365,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=5392 /prefetch:14
      4⤵
      PID:2528
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --field-trial-handle=3616,i,5428729288148169184,10229268637634553365,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=4448 /prefetch:11
      4⤵
      PID:3708
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=4872,i,5428729288148169184,10229268637634553365,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=5684 /prefetch:14
      4⤵
      PID:6600
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=5684,i,5428729288148169184,10229268637634553365,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=4856 /prefetch:14
      4⤵
      PID:6572

C:\Program Files\Google\Chrome\Application\127.0.6533.120\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\127.0.6533.120\elevation_service.exe"
1⤵
PID:2948

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:6168

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 5492 -ip 5492
1⤵
PID:6464

C:\Users\Admin\msvcservice.exe
C:\Users\Admin\msvcservice.exe
1⤵
- Adds Run key to start application
PID:6752
- C:\Windows\SysWOW64\schtasks.exe
  C:\Windows\System32\schtasks.exe /Create /SC MINUTE /MO 1 /TN msvcservice /TR "C:\Users\Admin\msvcservice.exe" /F
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:768

C:\Users\Admin\AppData\Local\Temp\fed0c9a4d3\Hkbsse.exe
C:\Users\Admin\AppData\Local\Temp\fed0c9a4d3\Hkbsse.exe
1⤵
PID:5756
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5756 -s 476
  2⤵
  - Program crash
  PID:6604

C:\Users\Admin\AppData\Roaming\microsoft\microsoft.exe
C:\Users\Admin\AppData\Roaming\microsoft\microsoft.exe
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2848
- C:\Users\Admin\AppData\Roaming\microsoft\microsoft.exe
  "C:\Users\Admin\AppData\Roaming\microsoft\microsoft.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6800
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C mkdir "C:\Users\Admin\AppData\Roaming\microsoft"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6816
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\microsoft\microsoft.exe'" /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6512
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\microsoft\microsoft.exe'" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3708
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C copy "C:\Users\Admin\AppData\Roaming\microsoft\microsoft.exe" "C:\Users\Admin\AppData\Roaming\microsoft\microsoft.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6380

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3224 -ip 3224
1⤵
PID:6884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 380 -p 5756 -ip 5756
1⤵
PID:6656

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 380 -p 6760 -ip 6760
1⤵
PID:4664

C:\Users\Admin\AppData\Roaming\microsoft\microsoft.exe
C:\Users\Admin\AppData\Roaming\microsoft\microsoft.exe
1⤵
PID:6680
- C:\Users\Admin\AppData\Roaming\microsoft\microsoft.exe
  "C:\Users\Admin\AppData\Roaming\microsoft\microsoft.exe"
  2⤵
  PID:6492
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C mkdir "C:\Users\Admin\AppData\Roaming\microsoft"
  2⤵
  PID:3476
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\microsoft\microsoft.exe'" /f
  2⤵
  PID:6620
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\microsoft\microsoft.exe'" /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6500
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C copy "C:\Users\Admin\AppData\Roaming\microsoft\microsoft.exe" "C:\Users\Admin\AppData\Roaming\microsoft\microsoft.exe"
  2⤵
  PID:2368
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4380

C:\Users\Admin\msvcservice.exe
C:\Users\Admin\msvcservice.exe
1⤵
PID:2520
- C:\Windows\SysWOW64\schtasks.exe
  C:\Windows\System32\schtasks.exe /Create /SC MINUTE /MO 1 /TN msvcservice /TR "C:\Users\Admin\msvcservice.exe" /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5328
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1220

C:\Users\Admin\AppData\Local\Temp\fed0c9a4d3\Hkbsse.exe
C:\Users\Admin\AppData\Local\Temp\fed0c9a4d3\Hkbsse.exe
1⤵
PID:2096
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2096 -s 480
  2⤵
  - Program crash
  PID:5132

C:\ProgramData\xprfjygruytr\etzpikspwykg.exe
C:\ProgramData\xprfjygruytr\etzpikspwykg.exe
1⤵
PID:4540
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
  2⤵
  - Power Settings
  PID:2368
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
  2⤵
  - Power Settings
  PID:4660
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
  2⤵
  - Power Settings
  PID:4380
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
  2⤵
  - Power Settings
  PID:6948
- C:\Windows\system32\conhost.exe
  C:\Windows\system32\conhost.exe
  2⤵
  PID:6844
- C:\Windows\system32\svchost.exe
  svchost.exe
  2⤵
  PID:484

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3224 -ip 3224
1⤵
PID:6596

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 2096 -ip 2096
1⤵
PID:4480

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3224 -ip 3224
1⤵
PID:6288

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3224 -ip 3224
1⤵
PID:6420

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Netsh Helper DLL

T1546.007

Power Settings

T1653

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Web Service

T1102

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Google\Temp\GUMCA02.tmp\GoogleUpdate.exe

Filesize
152KB

MD5
e4bf1e4d8477fbf8411e274f95a0d528

SHA1
a3ff668cbc56d22fb3b258fabff26bac74a27e21

SHA256
62f622b022d4d8a52baf02bcf0c163f6fd046265cc4553d2a8b267f8eded4b76

SHA512
429d99fc7578d07c02b69e6daf7d020cff9baa0098fbd15f05539cb3b78c3ac4a368dee500c4d14b804d383767a7d5e8154e61d4ab002d610abed4d647e14c70

Download Submit
C:\Program Files (x86)\Google\Temp\GUMCA02.tmp\goopdate.dll

Filesize
1.9MB

MD5
b235a510d74783594b5a50f60d6a841a

SHA1
101395a59c156139786554153e29a72e445776f7

SHA256
6a478176c0e2257485b517c5b549d6a4b9b93264b8ae67f134c8e87571db50ba

SHA512
78adc152a2b11a750e398f19fc611e27b6a53c6dd0aec959f49d3ac0bc6121901c58a32fca065cc9bbe41fbbc034d4807c8d26d7c9719dcb133073a05687d292

Download Submit
C:\Program Files (x86)\Google\Temp\GUMCA02.tmp\goopdateres_en.dll

Filesize
47KB

MD5
b6fea8f291da55bb35d408040f354250

SHA1
19ed99a4f169467055474454f2b35204f2cd6568

SHA256
6dcbd0c88d81ffa42a926787cbdecf8042685cc44f0484ef87307f89ec220bcc

SHA512
1b47352ddc03bb1b6a171e7cf58bfd1e1214a4f9cc04cf8ad58326e17a33b4c639cf23b4f7372b1010021ce3816129ca270d06a2c55ba3a3b001e1587c5ab75a

Download Submit
C:\Program Files\Google\Chrome\Application\127.0.6533.120\Installer\setup.exe

Filesize
3.9MB

MD5
5aa8ebc484fabcfaba8d10170d0b4b59

SHA1
522c14c36b2a515426b0a97c97d9a11b20605fcb

SHA256
fcdf6ee87d81342d7949eb27d5716de504b0b0c7feb9ade2e24a4f83f2fc4165

SHA512
fd6f029b11908bf19532b4991cdd02a398d1be1bdbcc4b59adba2ae72a3cf3430b52a94be0b6487844b8b74b094aa91d1f514116ea14ae585ca65382f95c702d

Download Submit
C:\ProgramData\CBGCGDBKEGHI\GIJJKF

Filesize
160KB

MD5
f310cf1ff562ae14449e0167a3e1fe46

SHA1
85c58afa9049467031c6c2b17f5c12ca73bb2788

SHA256
e187946249cd390a3c1cf5d4e3b0d8f554f9acdc416bf4e7111fff217bb08855

SHA512
1196371de08c964268c44103ccaed530bda6a145df98e0f480d8ee5ad58cb6fb33ca4c9195a52181fe864726dcf52e6a7a466d693af0cda43400a3a7ef125fad

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
5e21faad58d8d3b0c2039d38eca609f1

SHA1
faa588a96bc2547dcf7d7ee7fe9cabbc7b21ffbc

SHA256
697f6eef31b4c62045093734e5693b7c2621c77086f3430950f5174df40c3cc3

SHA512
50d67f17a524fe1bd6fda55e24755c8970421105f955a6481aa1ceb844d430ea9dd8836e9f12718b69156d5466f99656a4906ec311b77bf9c7bd48131354c8b4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json

Filesize
593B

MD5
91f5bc87fd478a007ec68c4e8adf11ac

SHA1
d07dd49e4ef3b36dad7d038b7e999ae850c5bef6

SHA256
92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9

SHA512
fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Google Profile.ico

Filesize
192KB

MD5
505a174e740b3c0e7065c45a78b5cf42

SHA1
38911944f14a8b5717245c8e6bd1d48e58c7df12

SHA256
024ae694ba44ccd2e0914c5e8ee140e6cc7d25b3428d6380102ba09254b0857d

SHA512
7891e12c5ec14b16979f94da0c27ac4629bae45e31d9d1f58be300c4b2bbaee6c77585e534be531367f16826ecbaf8ec70fc13a02beaf36473c448248e4eb911

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
356B

MD5
90a68fbbf99108f70d33b0f8232b3dd0

SHA1
bd9942e0a7dda02c2f57c58fb78675fea9051c00

SHA256
605bfb84ca7e1a0b27c44c50500e5fac5e3a5ff747d2d10b7e95d363c2b3314e

SHA512
2ed0558c04286c4e2337ed8c078907f44d9804c5bdd24777c7a1a8949f8d7d7a68c04ab1af2601a52b58206f23692eec2b41f401dba8bab928d1e2e756aecf8c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
a4fa7f8412f5b73ee8db584fb39c4a99

SHA1
2ebd5fe2adb1bc4daa64025182f721b96fcf2e33

SHA256
60261698babf3826e4c3e3df12d2eec5c6ac186c8fa1898a9b52fc6d39e47c67

SHA512
c3f3e50fe7a89e951be94901af2ca7aaf83e0cebb13ee4761446f8ece5307a8df1111932bb006843122343018829305049511efd8dddf689f8e1d60941730370

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
3aced57b415278ad75a2de726195b772

SHA1
8401f298c5d3ef4b9a40d161150c26ed842492f1

SHA256
6633e90d11350b63efe4d1e762f2c77d6c41588fb74c1bbc70acb0b72fe30719

SHA512
a77bdf37ff1b414aa32b442d866f2018dfc3f076e7d91e807c142f0700f9f8bb57c0541e3ae10240613e0995f4e85a25d4c8145f013b0bec2cc5bbf1ba8b5e0d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index

Filesize
48B

MD5
56c80798ec695bd0dd93b705bfd937a3

SHA1
a1236df1b371c4fd47e252761332f35c9ff6d04d

SHA256
a049ef25702b9e53cef50863819abeedf5ac7c225bdbec8bcec528c06ed54c43

SHA512
3bb7747688987988b1e67dfc007e3c6eed8b353b0b159ff5308bf846b07b5dcd87044f27ddc4695d28f953e9c9cf7115f3fdd63cc0cbb75d8a0d7faa84d912f7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
5d2c0540de551a45acabb22274e45ec1

SHA1
f149809ab97b4a68381160ce6f744eaa78a84739

SHA256
aea84502fad7811c5c7c9d2d25dfe42f7eaa7837c9c74917b086bda94fa707a5

SHA512
a792e82cc679e4eecf1f4058d02d8aab91d948c88a9ac9cabb5a6f8823568f5bbad51852e385129fc71afb3a22cd3ddace8e11136204cacf649c2cc7ec94191c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnGraphiteCache\data_0

Filesize
8KB

MD5
cf89d16bb9107c631daabf0c0ee58efb

SHA1
3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b

SHA256
d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e

SHA512
8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnGraphiteCache\data_1

Filesize
264KB

MD5
d0d388f3865d0523e451d6ba0be34cc4

SHA1
8571c6a52aacc2747c048e3419e5657b74612995

SHA256
902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b

SHA512
376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnGraphiteCache\data_2

Filesize
8KB

MD5
0962291d6d367570bee5454721c17e11

SHA1
59d10a893ef321a706a9255176761366115bedcb

SHA256
ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

SHA512
f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnGraphiteCache\data_3

Filesize
8KB

MD5
41876349cb12d6db992f1309f22df3f0

SHA1
5cf26b3420fc0302cd0a71e8d029739b8765be27

SHA256
e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

SHA512
e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Session Storage\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Session Storage\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\trusted_vault.pb

Filesize
38B

MD5
3433ccf3e03fc35b634cd0627833b0ad

SHA1
789a43382e88905d6eb739ada3a8ba8c479ede02

SHA256
f7d5893372edaa08377cb270a99842a9c758b447b7b57c52a7b1158c0c202e6d

SHA512
21a29f0ef89fec310701dcad191ea4ab670edc0fc161496f7542f707b5b9ce619eb8b709a52073052b0f705d657e03a45be7560c80909e92ae7d5939ce688e9c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
183KB

MD5
21ea7ef027d0afd8d2a0182e16483152

SHA1
a9049bcb1ae851d3f183adc9b83b177257c4d5a4

SHA256
bd875a2666875d8390c350a8d8b4cbe6b7668d51dfddf761d9110b9c343c0c21

SHA512
467e176d09e638b20e0b20dffd10418a5b2613873a84fca6f3ada4322a44c84f2a9a958c88aa30980d18360bf48d7958ad7263e8382aa1914936a31d22d76e96

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
101KB

MD5
aba4b742c62993effe29bcac9aa59797

SHA1
3b22e3542838f7531f0b207d8dc5a4ccd4b7e76c

SHA256
4a26104f8b91e3b505ad993a866a0709833f351e2ec94371f424689cce00b6fb

SHA512
022b26cbd1e98c16cfe8281e8f6efd3bc372af719bd9313cb8f6cf57efcdbc2119a08530e96c0ce3b86805b26786a37c9b28fecfaa189fce75e86a704a946160

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
183KB

MD5
4f29886dacc6978a838b8f100eca5075

SHA1
4a6c809bad57dce56dd6c42978fa78c3ed61c285

SHA256
94b6f3ca88a09760d425eb50ac628d479517252a3282b1a6900d83b331c5e372

SHA512
b1b918f52ddfa65182761885e1be8e7ef0ef1d89b9cc019b2f757bf9c54c8ad7e365276fcda8c55aaa4e49008d9c8f38172af5498935b7990df0bfa070339f98

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
100KB

MD5
03bd99725323cb234d772827cf616dc3

SHA1
66838951a62e0ee34e8b4b30ed39e0596460e90a

SHA256
5f8488033d4f6517cc55920960a155c1f872cca4b19a52623e50231572bdd246

SHA512
4a7b9ffdf047e23a181f1a7223f49588bd8a39f5298d379dea6cc80896511da502593d5755a0f7d17b382bc076d2630feccda4d6ea568155b97f821abbb901f4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
186KB

MD5
2d58a272618855d43e32e7674fd1fc31

SHA1
1c49d0a732f71075659c3e3a6926018c375afa6b

SHA256
b5de31b5159929956cf3708bad1042aa685e47b4ed035921cbccd64bb43681c2

SHA512
3e1ce0858b618dec62edde89ecc385655324be9b3e24c02883c20a8a9e3b4be41ee94e4bbbc3d12d7ab4bd5d47b4f56795423e2e834f467dc14c787ce2487f43

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Subresource Filter\Unindexed Rules\9.49.1\Filtering Rules

Filesize
68KB

MD5
6274a7426421914c19502cbe0fe28ca0

SHA1
e4d1c702ca1b5497a3abcdd9495a5d0758f19ffc

SHA256
ae2fd01d2908591e0f39343a5b4a78baa8e7d6cac9d78ba79c502fe0a15ce3ee

SHA512
bf1287f502013308cdd906f6e42998c422ef1e272b348e66122dc4a4e471d01333b418f48d1bb2198c72845bdc950612597e179e612aaa1ba6cf8d48fb8f0cf5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\U.exe.log

Filesize
847B

MD5
ef375f28c91db0202bf7db29c0cbc2ce

SHA1
5a3f5d4ec75a468b908c2eb2b9e6f4b1e76c1017

SHA256
f4d1c038db378dec10e7e2fc81ccc2e2d4b8132ef0d66905e3625a0b0cbbde5f

SHA512
f18141e352fcd253e02cb25fa0cff29ab06dec62bafd5aa80ca48c959d1dba97deae830d01bf521f851a8143b9416747eb170d0cedafa32b59155027c02f244d

Download Submit
C:\Users\Admin\AppData\Local\Temp\761892313337

Filesize
59KB

MD5
8d69a5c97cec4667f5dd1870b52e1cd6

SHA1
dc454320e0b963383b096d84b369454c0cb00c1e

SHA256
67c153bb214283e9c6ad115eb6cc4c6a8734dba9f3bccc6df0ac8295a59f500b

SHA512
d5cd231444a140fa62824e711867f2b43d7e216b0c7f68a0ef751f707a71a4207257db78cb1bb2da638ca6134fb89ad5c468a1e4b635767b2c880071256eead8

Download Submit
C:\Users\Admin\AppData\Local\Temp\761892313337

Filesize
66KB

MD5
1e56a08b625307e32ec052fe910b1d36

SHA1
0d0931b8228249216f123ae6f54fa051c6c2d18b

SHA256
4f421997ea611a4c5bb5d7b32fe3f30cc5029d03660c9dcbd19ed7909bb5a403

SHA512
7c39a0bd7c2ea50255e7ac51b597111ae4c7f6a331a2d29e75f2d6a91e72d437393b7aa104bfa975e727288c185c5499afd5eec4d8b5fdfb62a54039ccb70bbb

Download Submit
C:\Users\Admin\AppData\Local\Temp\9a76e035

Filesize
2.4MB

MD5
a189bfea1dacd415afd90cb8fd9be766

SHA1
d305e3fe68c676b911b30721c6ba4bfcd92949a9

SHA256
a9fcdf722e2f08c5a554a70d1e40c9c815788862d479bc20556d2f1df184c646

SHA512
a92c2b91c8123d47eba33beb247467234b261292c625356f823652b05e6b685723b289f638a05117a67992983ab128262478b7b80ca13d1400fdec3e01615661

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\1sesc.exe

Filesize
72KB

MD5
c4f4156638ac479952f64a7e95f2f90b

SHA1
895d46fdd02604e99841a1b1daa6c989ccd4d55e

SHA256
f850edcfc0a41c0296474dc465bfb53d7299f9ebb56737fbb4e6a970cd2e5f13

SHA512
109c90d97ddd50c3c5663b0ef87161aeb4b13dc1999851298c70673529b05e05936b124be7046e0637263d8f13f905248ea2b4b08c4271745ded0d796a501ad9

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpD7DD.tmp

Filesize
2KB

MD5
1420d30f964eac2c85b2ccfe968eebce

SHA1
bdf9a6876578a3e38079c4f8cf5d6c79687ad750

SHA256
f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9

SHA512
6fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI24002\VCRUNTIME140.dll

Filesize
94KB

MD5
18049f6811fc0f94547189a9e104f5d2

SHA1
dc127fa1ff0aab71abd76b89fc4b849ad3cf43a6

SHA256
c865c3366a98431ec3a5959cb5ac3966081a43b82dfcd8bfefafe0146b1508db

SHA512
38fa01debdb8c5369b3be45b1384434acb09a6afe75a50a31b3f0babb7bc0550261a5376dd7e5beac74234ec1722967a33fc55335b1809c0b64db42f7e56cdf7

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI24002\_ctypes.pyd

Filesize
124KB

MD5
7322f8245b5c8551d67c337c0dc247c9

SHA1
5f4cb918133daa86631211ae7fa65f26c23fcc98

SHA256
4fcf4c9c98b75a07a7779c52e1f7dff715ae8a2f8a34574e9dac66243fb86763

SHA512
52748b59ce5d488d2a4438548963eb0f2808447c563916e2917d08e5f4aab275e4769c02b63012b3d2606fdb5a8baa9eb5942ba5c5e11b7678f5f4187b82b0c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI24002\_socket.pyd

Filesize
78KB

MD5
478abd499eefeba3e50cfc4ff50ec49d

SHA1
fe1aae16b411a9c349b0ac1e490236d4d55b95b2

SHA256
fdb14859efee35e105f21a64f7afdf50c399ffa0fa8b7fcc76dae4b345d946cb

SHA512
475b8d533599991b4b8bfd27464b379d78e51c41f497e81698b4e7e871f82b5f6b2bfec70ec2c0a1a8842611c8c2591133eaef3f7fc4bc7625e18fc4189c914e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI24002\base_library.zip

Filesize
763KB

MD5
c6b38adf85add9f9a7ea0b67eea508b4

SHA1
23a398ffdae6047d9777919f7b6200dd2a132887

SHA256
77479f65578cf9710981255a3ad5495d45f8367b2f43c2f0680fce0fed0e90fb

SHA512
d6abc793a7b6cc6138b50305a8c1cad10fa1628ca01a2284d82222db9bd1569959b05bdf4581d433ff227438131e43eec98bf265e746b17e76b1c9e9e21d447d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI24002\libffi-7.dll

Filesize
32KB

MD5
eef7981412be8ea459064d3090f4b3aa

SHA1
c60da4830ce27afc234b3c3014c583f7f0a5a925

SHA256
f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081

SHA512
dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI24002\python39.dll

Filesize
4.3MB

MD5
1d5e4c20a20740f38f061bdf48aaca4f

SHA1
de1b64ab5219aa6fef95cd2b0ccead1c925fd0d0

SHA256
f8172151d11bcf934f2a7518cd0d834e3f079bd980391e9da147ce4cff72c366

SHA512
9df64c97e4e993e815fdaf7e8ecbc3ce32aa8d979f8f4f7a732b2efa636cfeb9a145fe2c2dcdf2e5e9247ee376625e1fdc62f9657e8007bb504336ac8d05a397

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI24002\select.pyd

Filesize
28KB

MD5
fed3dae56f7c9ea35d2e896fede29581

SHA1
ae5b2ef114138c4d8a6479d6441967c170c5aa23

SHA256
d56542143775d02c70ad713ac36f295d473329ef3ad7a2999811d12151512931

SHA512
3128c57724b0609cfcaca430568d79b0e6abd13e5bba25295493191532dba24af062d4e0340d0ed68a885c24fbbf36b7a3d650add2f47f7c2364eab6a0b5faff

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rffeacjh.kzx.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\a\1111.exe

Filesize
2.5MB

MD5
67846d1862f63942b00eb61e47be2652

SHA1
a018b557975a35fa8c001a43a55d08cef7d426f2

SHA256
b8df70d0227e4277fa8e1e2efe6f86c4c087f60a68744aa89df83d1cdd15253f

SHA512
5dc36ebb7b3148c23f0e248971d04519587f7da0ff9320a85f64ddf1e9b10e907aa7d88feec725b385e514816c829d375b01f91d4c64d3c0ae6664a9d5906150

Download Submit
C:\Users\Admin\AppData\Local\Temp\a\66af4e35e761b_doz.exe

Filesize
4.5MB

MD5
c7904602501fb4a18a2ceb29d1c7748b

SHA1
cf51727aab14549d8748ab60876b3915532b08be

SHA256
0843b763880a4e1b559d29140afff5cd867bcada20eda6db2524d4e5045af114

SHA512
70512f5498fb5f813bfcfb3383807f3beee8dfceb24156cfa9dab122baf2aa15681b0b9dbcd0e29537d07383656e08a6dd2d2b8328ec2c80488839ba66d08a13

Download Submit
C:\Users\Admin\AppData\Local\Temp\a\66af531b832ee_main.exe

Filesize
4.4MB

MD5
46bb5bf831f8b516b87078f35286a4d6

SHA1
4a6637b3ace0542d5629dfef7ad3b0b5e73e9c01

SHA256
521d404952876e51d0cf3a4d0d69e30566406a3a129343d5e53d5d7274f4d3dc

SHA512
9b8abf0478563a402edff57282c1be0475742f403c07d9b99ca5ff36a5fb7831d2af76bbef046dc9b2b1b084ea287b20040610c44e0ccb7251b9d6e9fb2fda19

Download Submit
C:\Users\Admin\AppData\Local\Temp\a\66b0ee142cf8f_PhotosExifEditor.exe

Filesize
7.9MB

MD5
677ad736788d93b76ca77717706a8176

SHA1
e5ceecfa05f98c11f58b8844cba4e52850e11009

SHA256
8ef1d24500ab75ee2ebde59ea01df3a168b41d9d7e987ae843c1188ec7dac49f

SHA512
df2b84b37380ef2776d5f4d5179006e5ef0f318928fd040bea7ba4a88808bdf62220cddc3ce7406f30aac1e7ea019d1a994eda2c7fd23038ca0748e078db6700

Download Submit
C:\Users\Admin\AppData\Local\Temp\a\66b331646d2cd_123p.exe

Filesize
10.3MB

MD5
27b14ad026da76c1111174c6b4ba6aba

SHA1
e55a0aa823a6c91ec602d4e6f283b23858965a08

SHA256
bef765aff3d916d8be504b604c0dc37afe3fd76260fe158508b778b5e4b85ddf

SHA512
a4f682d6e047c5e3bafc5431d6ddc2a3d6decf47c14ef14ae3a9581cf669db5314bb19b7f9437b9236a28338472e94407dad7745465afb691ffce3548503624f

Download Submit
C:\Users\Admin\AppData\Local\Temp\a\66b4af430a0a1_files.exe

Filesize
6.2MB

MD5
f3d8c82810e55bc012bdeb2557ff13b9

SHA1
f899ab6b698678aedc8b24a6d7599114479216fe

SHA256
c4af46f2a357b68ce8e5830d9639e0c9212c61ae5d0fd1bb283812217a14ab72

SHA512
3e93f06c4fcbe06a904144bb08ec876587b58626c80d9774c0282f67530d3cf0668a9da795899cdc618e6ace6e513b9cd82b7dafa4c09d4fdb0e9b2160dd4f7f

Download Submit
C:\Users\Admin\AppData\Local\Temp\a\66b5b75106ac6_stealc.exe

Filesize
6.0MB

MD5
67d39f0cbbab44b99fffaf3a408b2088

SHA1
ab84d55834c956a7904db0061a9fe145a6e9c783

SHA256
e7ad5000fcab4b69737e7b206f7ea0fbeeb7f68443e983e924e2710b54c7e5d4

SHA512
b5ef2c31e80527bf5715db45cb859d79b16ae4361657298173dd666290d14ce3f04e366ef203f00663964c815fa101ef4a42036669412c67ac4daa020f4faab4

Download Submit
C:\Users\Admin\AppData\Local\Temp\a\66b5d9d3adbaa_defaultr.exe

Filesize
11.1MB

MD5
45c0d8bedd6bff145cbe1c3064f2cf56

SHA1
5a68f160bde8531f0b38ed8f9c6b19b7e615a905

SHA256
b8a5ef9ea9fa588907a197db55c743559460190aa58b227db10d6be75d8bfe39

SHA512
3963adecb4ee013b54c926328fe0d6576d291dcae0ead3f675c38ddb51b2747e0469179fa4903e3237fe2beea7079f67da377f3787b3bd4ddba8694102af0703

Download Submit
C:\Users\Admin\AppData\Local\Temp\a\66b837290469c_vidar.exe

Filesize
9.3MB

MD5
dd9a8bbd0b8038552cb57b07a56f0ae2

SHA1
0f4a5f36b7f29f9012f73595594c564b574df9ee

SHA256
e603e36cae3f0fa9badbeaeff8fb0becb1ed444776892db76cd8d219e2ba92bd

SHA512
1d215eae3e854b04e8fe4d2f3119c9308882f5c2f4125183ca21e034c7be6da0a6549aacb0880900e667cb2ee3b1a29aabef24a17bdec83e1a415038664b2b64

Download Submit
C:\Users\Admin\AppData\Local\Temp\a\66b85f47d1f63_stealc.exe

Filesize
7.0MB

MD5
f90545447cc1a034b5808ed7fdf73091

SHA1
9bb93d17ff2aa79cd39ba9307f2f2dc907f854f9

SHA256
4ff955e39fc6b4f0c0a715c3b87b95c47d61df9145e0071061a5070a5c87c855

SHA512
c3c8670afb7b4bb4b9a2e787577a9dc3bf8564d0795fdb978090ecc97ec00db633303773a1843dceb4cd89a281c96a39cb5a7c231d87382989dff07536a95807

Download Submit
C:\Users\Admin\AppData\Local\Temp\a\Documents.exe

Filesize
72KB

MD5
cb6b3683ff1df73bda3d32c03ddc8700

SHA1
d28d4af8387aeaefb4e8d5815ae8c82dfb50fbf9

SHA256
ec76d4d641e6bcfea1c76a81727fe9c525121d782346ee3ec88d87de69f45eae

SHA512
6c8234a0836af05f75179746336a730524f5ed74b215d28456e1e8931eb5c619734b7e025a4c3007645e84d8daef9bcd159a68b9587cfcd911f20a29001e448d

Download Submit
C:\Users\Admin\AppData\Local\Temp\a\Extension.exe

Filesize
72KB

MD5
42710df7d572082524e742e5e4f3cab0

SHA1
21abbff0c148012f3863bfcd1dae294c8bc7ec34

SHA256
3c7765451ee006387b6367e75c7a53c2b4e2ad5639ae27ef80755b11a4123fac

SHA512
2eed026168142055d30fbbe5c7c8bcfa43522f82b8b6e8bf795659d3e91c4634ccb557a0a6524256d307e74abc2e3ac4d474dc1f618450d6a71a37d8a2118779

Download Submit
C:\Users\Admin\AppData\Local\Temp\a\Identifications.exe

Filesize
9.2MB

MD5
5f283d0e9d35b9c56fb2b3514a5c4f86

SHA1
5869ef600ba564ae7bc7db52b9c70375607d51aa

SHA256
41657910cd010c7e5ebbbfc11a2636fa1868a9bffe78d98b8faa7bd0e9c5c3b8

SHA512
b5b78975c6328feb5e1986698174a85ddf722a639234eb6fe80cfccabaa7d0c09678c9465fd6a9586a0a412f2586d9e9d38eb5243626a2b44a8c8512322415b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\a\Mailer.exe

Filesize
47KB

MD5
07924a75dd7d92d04c18063bea0d0b61

SHA1
12f1fc566c29f2db6548fcbba77daae1ff59fae3

SHA256
c5bd778d6cb31d3e6970e4df3d5d058bd9f95db7faae9fa55c5854d53b78898b

SHA512
c016ff36438146653d3579e994013529d945211f0c9dd2219fb38633bd590be5a1f5065ee125bc7e658086afc3a8b57304a0627dbef969e666dc07cef6ecbd22

Download Submit
C:\Users\Admin\AppData\Local\Temp\a\Meetings.exe

Filesize
346KB

MD5
209ae4a712ada48aa2d5fba027ed58b6

SHA1
68d7a9260aba3859f6a5e59c2283635272ae8d09

SHA256
811326123c9b90d8932c4679c574afd2097496d883edc7ce6b0800afe90abe72

SHA512
e2a5726e08ce49caa1a90b8c3596ee1f4cd7e85def75dbf8318b74f062de6bc75a69c9139db0010f3082a48a3f7889aaab289cc2de189ac40acef40e4fb29863

Download Submit
C:\Users\Admin\AppData\Local\Temp\a\Mke%20Fallen.exe

Filesize
192KB

MD5
eaeb33cc12fd71532fb6156938f46854

SHA1
a9e8a3ce071a58ce801bc4a7d2afe0615b7d3f88

SHA256
055f7b2e38401cb201d4b594e7fe205484681495fb2393185910eb80dfaaec20

SHA512
459501464c6ae917443ef94cb99d0ac40c3d320ad5d2007a3956c48f64d5cc5ece0c00be9124d0922a256e42d70ad0adc73c3b508bba4b9e2480a97b0e5e8f64

Download Submit
C:\Users\Admin\AppData\Local\Temp\a\Setup.exe

Filesize
72KB

MD5
55222d629eb6d7d189fa5a28991c7c97

SHA1
7b37a93bf57a9bfb92158bf6b2d4dfe617bc28f0

SHA256
554b6beb5ba502b5028c26576265738a4f212db2063d938ba90c89f78daf5481

SHA512
c40d3185d4a8f671d448564c3d70063601ded69e20b5ccba62a0b1de33be9e7e5bb8f74e8c5625bdf6b2f37def20feccb94be85166bd25c0df9d0c3912eb8eac

Download Submit
C:\Users\Admin\AppData\Local\Temp\a\T7.exe

Filesize
13KB

MD5
106317cd019b63fde3dc44b2e365d0e6

SHA1
cf8158e8e6433a5ddd81f68558632bbad3d33db6

SHA256
a288d0d898c7729037ab07a8ab05713862a3b74aba2c5fc55ec2cd590d547a7b

SHA512
b1eff4c179096157252ae383860862fc53394094d76459d18568b669290c150291f671f8d80f7e741c436466e66cb0db197f79d9a9a9282961b3baa101f9d5a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\a\T9.exe

Filesize
13KB

MD5
762e2c938ec4a35e6b67fafb977fd05c

SHA1
2082b2a1b33adcc4aae73cbc072eaac50f72ab7e

SHA256
8b2951ff344d2fcaeb0045269c93e0ced5402ff53efe685cde78fba2293e6283

SHA512
c688320e12ca1536217282a42c02dd4d19b97d2dc96ea206b1327866fd496f277c21426fe9cb3e894fdf3bd59d0da6f4ab787bfa4e53d010d038e1d3156f9dfc

Download Submit
C:\Users\Admin\AppData\Local\Temp\a\TTF.exe

Filesize
13KB

MD5
b5fe23cf43111d7500a18d432d1a9307

SHA1
e3b7dc412ce069a4262522b7c8e791278fc130dc

SHA256
2d187bb4a0d2a51dbe68e4085815167c952803f310c323bfe6f39b2cfc9f6532

SHA512
54ee18272c9d3e700452a69a7a0d56cd9ab32196878f059e3ab3fbce0558183c5fbc06eae7b7b0def3636ec6747867a138b1350cd8a9a2ec046e704453f4db26

Download Submit
C:\Users\Admin\AppData\Local\Temp\a\Teamview.exe

Filesize
72KB

MD5
b45260f399b77d44c118288df45afc6e

SHA1
0a4d4cd555ac4043a768218261ec04aee44d6eb4

SHA256
f326ddac0f73b4addca3cab4ab77ee95777cee572b0eafe1fceb4017f083bd3f

SHA512
ec3b223dc08859a4b74f4c7ff5c1bb2c36563327df93bdc5147c838ae43ea1609370aa81f609acc62586701d70876b243b71a22006372c1dc7c98d6098c9d5b4

Download Submit
C:\Users\Admin\AppData\Local\Temp\a\Trial.exe

Filesize
47KB

MD5
8c85fdc958d3299c7cb1fc0a82be0a28

SHA1
4a26a14a230e1285ee3b4e622fe7922292e8cff5

SHA256
5276b39a55cb85f30195a5150dbb2b6407a596adbd3482cb0dc099049bba4224

SHA512
5c1e96d4873e8f16e8dd5f7d7e6911ed3410986d55914a453835a0124eb2b3a617890b67b78d2a9de27ebe49e37c01cb16838cdbb178e78af51fd05223a4a1b1

Download Submit
C:\Users\Admin\AppData\Local\Temp\a\U.exe

Filesize
13KB

MD5
50ab74c3916f51cd30d6d588211148a3

SHA1
cca87dbd37fc9df0e007c3a98ac7d214eee703a7

SHA256
05609085a166cd35855e70c9b9e89372f15e35a21dcf6e0da8a30648b4950f93

SHA512
094eb17919dfc550238fa202080136cb3d8298ee518618935c54ee4cab6b0c4e3bb863b9e53b1580d1bbe42b307dc72f0b6f4c47740bbf79de20ded3e4741320

Download Submit
C:\Users\Admin\AppData\Local\Temp\a\WE.exe

Filesize
13KB

MD5
c3810dc34fb0dd806c01d2a15617e343

SHA1
7e7a1635fff8401c6342ad3c68472b6ef1ed1d1f

SHA256
afc9edae65579141465dd988495aa73366f942287ac85773f0c630b5bb3e2420

SHA512
b8d1bf4fb186bd45faecdd11af29c2d30d97916d6d8ae94f55ca6f6d2d3dd771b6da09b3e56d0517da25232e8e3a72d1a3f4ef0b6dab7be48f020bf327e61893

Download Submit
C:\Users\Admin\AppData\Local\Temp\a\authenticator.exe

Filesize
768KB

MD5
1560d6506f8e57432427df2bc4263f12

SHA1
70f83580e72e75f4a1b215abf55d9e07beb683f0

SHA256
0bb9e107a5f5f9ad838173ebf222107d37cc1f378fa10f46ad5b2914f19f8e72

SHA512
e5b0eff2054b6b24efeb9f8df23cd22e307d5fac1669e86b798d8caee2e3c4ea3e4c6213abe868ba44b37b689e5b52d4d3a40fd0167a476c06bc32dded69a202

Download Submit
C:\Users\Admin\AppData\Local\Temp\a\backdoor.exe

Filesize
68KB

MD5
698f5896ec35c84909344dc08b7cae67

SHA1
4c3eb447125f74f2eef63e14a5d97a823fa8d4e9

SHA256
9cc2e2d5feeb360b2ea9a650809468f08e13c0e997ebadf5baa69ae3c27a958e

SHA512
2230abef3f2ac7fff21f2af8a1df79a0ab3f7b1153ce696745ff5cef7f677bfe562dc820eb36be8e4819210ffa565d52e3b940f0cad5427d30a3aa05a4bcde2b

Download Submit
C:\Users\Admin\AppData\Local\Temp\a\build2.exe

Filesize
481KB

MD5
f9a4f6684d1bf48406a42921aebc1596

SHA1
c9186ff53de4724ede20c6485136b4b2072bb6a6

SHA256
e0a051f93d4c1e81cc142181d14249e246be4c169645d667267134b664e75042

SHA512
67294a47dfef6aba404939497c403f93318841e9c5ee28b706f7506b5dff2630381e28e86f6dcbfdff2427092a515db1dc0a04e334e7f8de8b0b682269ff88fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\a\c7.exe

Filesize
316KB

MD5
819ea2d1b7f70aa3fab1a5eefd8928fd

SHA1
c13b663ec677b95631a845d2627e12d71ca96fdd

SHA256
e00f4b1980537b569386c1e5d37410b11aa74a4f771311cec06d60130d7aa1c5

SHA512
3e8261f470ddc9a06077ad352fd5d34f3c999f168e7e53b9d5c8c2d4ab9691af89ab208c09767b27519bcf9cd6fdf4e4df949ec219bca4fda1165b178efad113

Download Submit
C:\Users\Admin\AppData\Local\Temp\a\carrier.exe

Filesize
13.7MB

MD5
3686d869af7276fa2b6d55d04bd69d0d

SHA1
d830c559d05cd9684d94046f4475e802ce287463

SHA256
29197842e2d3209ac504f9d79c8839884bd2b85d8d31748e6878eb15c704cf72

SHA512
438e87d837f0f000eaa8074c64865b8fb70c7bf2dc7046436092c73ce6ff4d867c014cb390414ff1acbdcc8c30458e1fdd855458538d6683a76b50d0cf5afb2a

Download Submit
C:\Users\Admin\AppData\Local\Temp\a\cookie250.exe

Filesize
304KB

MD5
1b099f749669dfe00b4177988018fc40

SHA1
c007e18cbe95b286b146531a01dde05127ebd747

SHA256
f7b57a665ac90377683c434a04b8b6894c369d34fdb03273778a8c9f8fdbb262

SHA512
87dc26b28cb2c43c788d9ae9ef384b69be52b27500bc23cdc6acc8567e51705d99ef942cdc0b23fa6a7c84d4ddaaa8f05865a8e7bb4ad943ba5deabf7a4105fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\a\exec.exe

Filesize
304KB

MD5
7f437ba23ac06e9f17bf831fe4610b7c

SHA1
0131f155fa2aee4a8d3c77cd795988f466eff6d3

SHA256
69e4ee0c49e80e9aed263df6c7a62b6896a80972002b3e71b68d7623843c01d3

SHA512
802ed8bcc7bb2651794cbbd0a0391b931b6f776551457496d9f461f7dea5d9b189bcf388151544934f72164c75d3e91680a053313e0e2f293bef120b8ccb837c

Download Submit
C:\Users\Admin\AppData\Local\Temp\a\keylogger.exe

Filesize
51KB

MD5
fbbc99e0b5c7a5f4b76886520f5a4f63

SHA1
361b841c52643792c26868f90e0330ba2ab131ae

SHA256
6054e52edc7112fcecaaf39f37c6bdaa35f98bfaff45d4e01802b9a8bedd2eef

SHA512
5de0b99a9d3f7cdee1d9ed8122c62f096b59cca93c9ad4c4eb15da6bb08d5ea07c09f2864e8a841dcc4095e890e47dd595f51c535ab37713f807a151de52cb11

Download Submit
C:\Users\Admin\AppData\Local\Temp\a\l2.exe

Filesize
4.4MB

MD5
af6e384dfabdad52d43cf8429ad8779c

SHA1
c78e8cd8c74ad9d598f591de5e49f73ce3373791

SHA256
f327c2b5ab1d98f0382a35cd78f694d487c74a7290f1ff7be53f42e23021e599

SHA512
b55ba87b275a475e751e13ec9bac2e7f1a3484057844e210168e2256d73d9b6a7c7c7592845d4a3bf8163cf0d479315418a9f3cb8f2f4832af88a06867e3df93

Download Submit
C:\Users\Admin\AppData\Local\Temp\a\microsoft.exe

Filesize
384KB

MD5
27aa8ad8930fa0d076510cfb6573ce74

SHA1
26da6ec9efcd8b95c2d744373532afd12d26bf8f

SHA256
91dc640360851a1e69261fe72d9fa570a73e6d9465c8ebf971dbe840493b890d

SHA512
bb1af7c9caf9d05e6bf2ebf3ff8fbada74c0e4fbac04759428da3766110b66a8966081b22c0ffc4dc3a141a0914e552a6fc0a766c037c438546e8d4124f5922f

Download Submit
C:\Users\Admin\AppData\Local\Temp\a\mservice64.exe

Filesize
668KB

MD5
c1915f095d3e7b2ad07b5aadc21be2e3

SHA1
9643864f45e15e14e95545cfae9462c977933ba4

SHA256
b0d8f20c0bb09ab90c44281d372e98520c94cecaba6a374be64dc4fdd45f1c89

SHA512
e1dbd8501409dab0537b9afdb8961c3031280e0968f0dc0bc3339e14af3e1f009bdfa0c5425f62590f1db6c8c33fc65b95da65cacdc83338128a7887676bee13

Download Submit
C:\Users\Admin\AppData\Local\Temp\a\nano.exe

Filesize
552KB

MD5
1873f27a43f63c02800d6c80014c0235

SHA1
3441bba24453db09fb56e02a9d56cdf775886f07

SHA256
4bfcba248d79dfd6c2cba52d7c9ee18842f007bfa0e3ba99ababacb4794e8c6e

SHA512
9f2b663afc1cc3dbc8eba3278f61ffb41c19e42f94ee4c8a60eff83c8846b81d34e4ff869b643434a8ad5657c46bd06a712f0598062b62802ba6f0ee6f4fb8f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\a\networks_profile.exe

Filesize
6.6MB

MD5
7306abcf62c8ee10a1692a6a85af9297

SHA1
69900ccc2400e685b981b3654af57c062ffb44e2

SHA256
37c9a26faec0bb21171b3968d2e4254f6ae10ff7ae0d0b1493226685bc5d3b4b

SHA512
cd00a60387e06fcc6f14242adb97a54575a49cf1e9b22c74aa5d8bb7617e571fc194049691e4ee0fcff8bdd659b04de62f46d07e2f3330c18ac7035134e183d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\a\out_test_sig.exe

Filesize
5.0MB

MD5
47f2701f1d1f6645baccced737e8e20c

SHA1
56e90cc7888e2cc74916ce10148a10c9261fdf2f

SHA256
3d37b55464bded5c54903c5328e695d9b08b483e65cf6bdadd4ecf93954dfc9e

SHA512
1b3f47fa75b041e8a2e144d3e98d103e90ed119b530ab7f7ac61ada3c4cad9abfac93a480b2236f1f6c9093f2ea9529acace77ac15f851450f5e16015735b045

Download Submit
C:\Users\Admin\AppData\Local\Temp\a\pimer_bbbcontents7.exe

Filesize
5.8MB

MD5
abb5797dd47bf453358359acf2453551

SHA1
cbce075e182eb636b6935296d80fb185a48a07a3

SHA256
f7bbd59299cad16b2cb4916738ad1475f61e129763cae617f1f9184f20db1d99

SHA512
a6885bd39a574c75587476328968d0fb1206ada1b33f575551433b70341d259a3db3fc7b19ef0d6e30c4411c38073e09aa0ad92ebeb1fca9889f37f734d3f9ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\a\regasm.exe

Filesize
593KB

MD5
f74f2df998219d602185c46107329e82

SHA1
a0f8eeb2e5c712e690923fdaf3b7cefc64f3d63e

SHA256
5f569c72db9c31528daf2e907938b9bb711ea3a050efe5bf5d514dc962c5415c

SHA512
b28e1eafefaf4f71666bf6c216c8672eb615a5e369bd913b85d99b2774df76ffaa489f145722a93f80f2afcb76eef40e62dcf246793bcf867d696487e9343a9f

Download Submit
C:\Users\Admin\AppData\Local\Temp\a\request.exe

Filesize
307KB

MD5
ef8320eace6f753231666c61104bdd49

SHA1
0166aceb79a7d6b4a041fd7595fc1d75404a4419

SHA256
8e2fa428fa5e7092d117dadf10529a35f415a0b8fa27cd17607e23dd913ffcdc

SHA512
354676c97fe1666920a75fdbffecfd0ac802613572b9e7d0dbc9a1ac24b3c771ca8fa3c1f3375f0a1c90364a07fa22469d2e7eb822196c0a2a1893931b62efe9

Download Submit
C:\Users\Admin\AppData\Local\Temp\a\sahost.exe

Filesize
922KB

MD5
d996f588469a7a1af5ababce991b42f5

SHA1
2086f187e1bb96da2fff9b7233bfda8eafc9ae05

SHA256
9238f0f88af5a6f80f79c66f502b73ca920522f58128428bc556054963ea6d1c

SHA512
5a55a0e83c514a7f98a933eb658d72ce3d4fbc371cdaf737b80fa1db75cb77f1a6dc429bd0b852f7ab3985bdba497b475979de67bc43675d4857d235d9baf96b

Download Submit
C:\Users\Admin\AppData\Local\Temp\a\sihost.exe

Filesize
649KB

MD5
6fe36f5cd0c522ca1241658ec2553db3

SHA1
f197615adff4daace92fd2f0c4f266a6170aa464

SHA256
e7e5fbeb7606fdcdb246a9df4efaf2896a82cd335babded9231dd990a110628f

SHA512
2b288eab811c12a818d089d419b8e51ee0b3692274010303f968fae82dde99a82c8601621860222c3b365f64fcc6508310e51cf3a954414054822d293d39196b

Download Submit
C:\Users\Admin\AppData\Local\Temp\a\stub.exe

Filesize
48KB

MD5
a7ed4ba445aa61c4632dd6579c212bf5

SHA1
a81d766d12a6dd8c3cec537387a089650b34e103

SHA256
91fb355fdc173c40fa77f8a252031d6bc32fab91c5e5573da28044494691c820

SHA512
2a0e0afdecf803657f2d67433399dc3119a3b4221334a9c8d7cb3e3e741457aaa26d2edd32377a102f1c539a4ef065cb5296d4cdfe7657993223e675e3fd4bae

Download Submit
C:\Users\Admin\AppData\Local\Temp\a\tc10.exe

Filesize
72KB

MD5
dac7ffcb0844646ba715b3df810c70e2

SHA1
68f04f0730c7043d18d1d0d5a85f92f827c7e2af

SHA256
62f2c3c1f11c2ac66e9c755dec3ab49a5cf2d732e22a71d44db5a00b564ff913

SHA512
931dfcdcced518338f02852c56e83977e8c2ac75660612206daa6ed88a4bee060926e621d5bc6a73ccb785fe1bc1809bf16713baa9f344f7b8a925a8676daa58

Download Submit
C:\Users\Admin\AppData\Local\Temp\a\wahost.exe

Filesize
712KB

MD5
14b98daca4a9912ad416eb7c0231cc21

SHA1
58328f022b71c8b3001449e87f91fbad4ac973ea

SHA256
850752cfce58c44ce5d48735f4d53ccc1f8d12b7e1ae00d367d9c42103d9ad99

SHA512
1169760e0245b4b1f2676271e0e56b62db0157a08ada4098d7dfacbf5c1e2d6cac29275c04a2d59471d7a9d9420425c07387c63fd3bc9bc4f91a9b3d5addcb0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\a\winiti.exe

Filesize
1.3MB

MD5
ebf39794ba6132055e6114d47bc18941

SHA1
214dead1bd716c58709c39a8180551b737048785

SHA256
8af777d0f92cef2d9040a634527c3753669235589c23129f09855ad0ebe10c6f

SHA512
01e7521af569050acc473fd13c8dd9a781370bd7cefcbc7e953e66ab930f407e9791c9fdb2ab4f368579f16bebb7368bebd2a475351a42d9e2092da0835bffbb

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsmE0D8.tmp\LangDLL.dll

Filesize
5KB

MD5
68b287f4067ba013e34a1339afdb1ea8

SHA1
45ad585b3cc8e5a6af7b68f5d8269c97992130b3

SHA256
18e8b40ba22c7a1687bd16e8d585380bc2773fff5002d7d67e9485fcc0c51026

SHA512
06c38bbb07fb55256f3cdc24e77b3c8f3214f25bfd140b521a39d167113bf307a7e8d24e445d510bc5e4e41d33c9173bb14e3f2a38bc29a0e3d08c1f0dca4bdb

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsmE0D8.tmp\System.dll

Filesize
12KB

MD5
cff85c549d536f651d4fb8387f1976f2

SHA1
d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e

SHA256
8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8

SHA512
531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir5676_1476480644\CRX_INSTALL\_locales\en\messages.json

Filesize
450B

MD5
dbedf86fa9afb3a23dbb126674f166d2

SHA1
5628affbcf6f897b9d7fd9c17deb9aa75036f1cc

SHA256
c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe

SHA512
931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir5676_1476480644\b4cc9d67-e82a-45a3-9225-d465672a63bd.tmp

Filesize
242KB

MD5
541f52e24fe1ef9f8e12377a6ccae0c0

SHA1
189898bb2dcae7d5a6057bc2d98b8b450afaebb6

SHA256
81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82

SHA512
d779d78a15c5efca51ebd6b96a7ccb6d718741bdf7d9a37f53b2eb4b98aa1a78bc4cfa57d6e763aab97276c8f9088940ac0476690d4d46023ff4bf52f3326c88

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp126A.tmp.bat

Filesize
151B

MD5
fe9aaf4b3e5aa5efd154a8fda4baf071

SHA1
15fe844645d513b1f632569a5738b30c09c0cd2e

SHA256
5bd43c673fc09423f84e66ddcfb2dfde611e4d1e5287f4a7f2351ee99ee45826

SHA512
d5181c3771d469a4b265f295425a81cdeead94c501e676ba487018470e0b737a3c74dbe2a4dd0ef3cdfba1c178fad5839304c5d0957a6ea5a9e4d2b8053819d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpBAE0.tmp

Filesize
40KB

MD5
a182561a527f929489bf4b8f74f65cd7

SHA1
8cd6866594759711ea1836e86a5b7ca64ee8911f

SHA256
42aad7886965428a941508b776a666a4450eb658cb90e80fae1e7457fc71f914

SHA512
9bc3bf5a82f6f057e873adebd5b7a4c64adef966537ab9c565fe7c4bb3582e2e485ff993d5ab8a6002363231958fabd0933b48811371b8c155eaa74592b66558

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpBB7F.tmp

Filesize
128KB

MD5
ebca298cb3fd0e8139f96992051e9f1d

SHA1
3d4eb6c5c63b53830aea4bbb8894e090b36f37a9

SHA256
912c24cb6c2e2ddbe77ccac50804a40d10283eb755ce2ec111e5ddeb91881ea8

SHA512
7d2a35154ef95772e7dd823c75c13b62c6c4254b32cf27a74871e597b798f420f92818f33a23f6bc5bffd9827002162004c6308baf8f2c63ffe05005d3dbbb6c

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5676_1373748449\manifest.json

Filesize
114B

MD5
4c30f6704085b87b66dce75a22809259

SHA1
8953ee0f49416c23caa82cdd0acdacc750d1d713

SHA256
0152e17e94788e5c3ff124f2906d1d95dc6f8b894cc27ec114b0e73bf6da54f9

SHA512
51e2101bcad1cb1820c98b93a0fb860e4c46172ca2f4e6627520eb066692b3957c0d979894e6e0190877b8ae3c97cb041782bf5d8d0bb0bf2814d8c9bb7c37f3

Download Submit
memory/240-721-0x0000000006630000-0x000000000663C000-memory.dmp

Filesize
48KB

Download
memory/240-725-0x0000000006690000-0x000000000669E000-memory.dmp

Filesize
56KB

Download
memory/240-716-0x00000000065F0000-0x000000000660A000-memory.dmp

Filesize
104KB

Download
memory/240-696-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/240-699-0x00000000050D0000-0x00000000050DA000-memory.dmp

Filesize
40KB

Download
memory/240-700-0x00000000050E0000-0x00000000050FE000-memory.dmp

Filesize
120KB

Download
memory/240-701-0x0000000005340000-0x000000000534A000-memory.dmp

Filesize
40KB

Download
memory/240-715-0x0000000005AC0000-0x0000000005AD2000-memory.dmp

Filesize
72KB

Download
memory/240-719-0x0000000006610000-0x000000000661E000-memory.dmp

Filesize
56KB

Download
memory/240-720-0x0000000006620000-0x000000000662E000-memory.dmp

Filesize
56KB

Download
memory/240-722-0x0000000006640000-0x0000000006654000-memory.dmp

Filesize
80KB

Download
memory/240-723-0x0000000006650000-0x0000000006660000-memory.dmp

Filesize
64KB

Download
memory/240-727-0x00000000066D0000-0x00000000066E4000-memory.dmp

Filesize
80KB

Download
memory/240-726-0x00000000066A0000-0x00000000066CE000-memory.dmp

Filesize
184KB

Download
memory/240-724-0x0000000006660000-0x0000000006674000-memory.dmp

Filesize
80KB

Download
memory/692-1019-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/1204-1064-0x0000000000C60000-0x0000000000D26000-memory.dmp

Filesize
792KB

Download
memory/1316-596-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/1480-1084-0x00000000003B0000-0x00000000003BA000-memory.dmp

Filesize
40KB

Download
memory/1496-225-0x0000000000A20000-0x0000000000ABA000-memory.dmp

Filesize
616KB

Download
memory/1496-226-0x00000000059F0000-0x0000000005A02000-memory.dmp

Filesize
72KB

Download
memory/1496-593-0x0000000006800000-0x0000000006868000-memory.dmp

Filesize
416KB

Download
memory/1632-521-0x00000000069D0000-0x00000000069E2000-memory.dmp

Filesize
72KB

Download
memory/1632-522-0x0000000006A30000-0x0000000006A6C000-memory.dmp

Filesize
240KB

Download
memory/1632-523-0x0000000006BA0000-0x0000000006BEC000-memory.dmp

Filesize
304KB

Download
memory/1632-628-0x0000000007660000-0x00000000076B0000-memory.dmp

Filesize
320KB

Download
memory/1632-489-0x00000000009D0000-0x0000000000A22000-memory.dmp

Filesize
328KB

Download
memory/1632-514-0x0000000005900000-0x0000000005976000-memory.dmp

Filesize
472KB

Download
memory/1632-515-0x0000000006900000-0x000000000691E000-memory.dmp

Filesize
120KB

Download
memory/1632-518-0x0000000006F40000-0x0000000007558000-memory.dmp

Filesize
6.1MB

Download
memory/1632-520-0x0000000006A90000-0x0000000006B9A000-memory.dmp

Filesize
1.0MB

Download
memory/1696-43-0x0000000005420000-0x00000000054BC000-memory.dmp

Filesize
624KB

Download
memory/1696-15-0x000000007523E000-0x000000007523F000-memory.dmp

Filesize
4KB

Download
memory/1696-16-0x0000000000530000-0x0000000000542000-memory.dmp

Filesize
72KB

Download
memory/1696-42-0x0000000004FF0000-0x0000000005056000-memory.dmp

Filesize
408KB

Download
memory/1744-589-0x0000000000300000-0x000000000030A000-memory.dmp

Filesize
40KB

Download
memory/1852-1111-0x0000000006AA0000-0x0000000006AEC000-memory.dmp

Filesize
304KB

Download
memory/1852-1074-0x00000000008D0000-0x0000000000922000-memory.dmp

Filesize
328KB

Download
memory/1888-67-0x0000000000400000-0x0000000000BD9000-memory.dmp

Filesize
7.8MB

Download
memory/1888-78-0x0000000000400000-0x0000000000BD9000-memory.dmp

Filesize
7.8MB

Download
memory/1888-77-0x0000000000400000-0x0000000000BD9000-memory.dmp

Filesize
7.8MB

Download
memory/1888-82-0x0000000000400000-0x0000000000BD9000-memory.dmp

Filesize
7.8MB

Download
memory/1944-560-0x00000000002D0000-0x00000000002DA000-memory.dmp

Filesize
40KB

Download
memory/1948-561-0x0000000000E10000-0x0000000000E1A000-memory.dmp

Filesize
40KB

Download
memory/2080-627-0x0000000004B30000-0x0000000004BBC000-memory.dmp

Filesize
560KB

Download
memory/2080-487-0x0000000005790000-0x00000000057AE000-memory.dmp

Filesize
120KB

Download
memory/2080-477-0x00000000007B0000-0x000000000089C000-memory.dmp

Filesize
944KB

Download
memory/2080-625-0x0000000006470000-0x0000000006486000-memory.dmp

Filesize
88KB

Download
memory/2260-93-0x0000000000400000-0x0000000002860000-memory.dmp

Filesize
36.4MB

Download
memory/2336-228-0x0000000000400000-0x0000000000BD9000-memory.dmp

Filesize
7.8MB

Download
memory/2336-172-0x0000000000400000-0x0000000000BD9000-memory.dmp

Filesize
7.8MB

Download
memory/2592-1094-0x0000000000340000-0x000000000034A000-memory.dmp

Filesize
40KB

Download
memory/2624-665-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/2628-196-0x00007FF9A5E80000-0x00007FF9A6089000-memory.dmp

Filesize
2.0MB

Download
memory/2628-193-0x00000000709A0000-0x0000000070A75000-memory.dmp

Filesize
852KB

Download
memory/2628-187-0x0000000000400000-0x00000000011C3000-memory.dmp

Filesize
13.8MB

Download
memory/2948-770-0x00000000076D0000-0x00000000076D8000-memory.dmp

Filesize
32KB

Download
memory/2948-757-0x00000000075D0000-0x00000000075DE000-memory.dmp

Filesize
56KB

Download
memory/2948-741-0x0000000007390000-0x00000000073AA000-memory.dmp

Filesize
104KB

Download
memory/2948-738-0x0000000007010000-0x000000000702E000-memory.dmp

Filesize
120KB

Download
memory/2948-635-0x00000000052A0000-0x00000000058CA000-memory.dmp

Filesize
6.2MB

Download
memory/2948-634-0x0000000002820000-0x0000000002856000-memory.dmp

Filesize
216KB

Download
memory/2948-742-0x0000000007410000-0x000000000741A000-memory.dmp

Filesize
40KB

Download
memory/2948-650-0x0000000005A70000-0x0000000005AD6000-memory.dmp

Filesize
408KB

Download
memory/2948-729-0x000000006C640000-0x000000006C68C000-memory.dmp

Filesize
304KB

Download
memory/2948-743-0x0000000007620000-0x00000000076B6000-memory.dmp

Filesize
600KB

Download
memory/2948-756-0x00000000075A0000-0x00000000075B1000-memory.dmp

Filesize
68KB

Download
memory/2948-761-0x00000000075E0000-0x00000000075F5000-memory.dmp

Filesize
84KB

Download
memory/2948-763-0x00000000076E0000-0x00000000076FA000-memory.dmp

Filesize
104KB

Download
memory/2948-649-0x00000000059D0000-0x00000000059F2000-memory.dmp

Filesize
136KB

Download
memory/2948-703-0x0000000006020000-0x000000000603E000-memory.dmp

Filesize
120KB

Download
memory/2948-651-0x0000000005B50000-0x0000000005EA7000-memory.dmp

Filesize
3.3MB

Download
memory/2948-739-0x0000000007040000-0x00000000070E4000-memory.dmp

Filesize
656KB

Download
memory/2948-728-0x0000000006FD0000-0x0000000007004000-memory.dmp

Filesize
208KB

Download
memory/2948-740-0x00000000079B0000-0x000000000802A000-memory.dmp

Filesize
6.5MB

Download
memory/3208-695-0x0000000000FE0000-0x0000000001046000-memory.dmp

Filesize
408KB

Download
memory/3224-708-0x0000000000400000-0x0000000002860000-memory.dmp

Filesize
36.4MB

Download
memory/3224-252-0x0000000000400000-0x0000000002860000-memory.dmp

Filesize
36.4MB

Download
memory/3224-174-0x0000000000400000-0x0000000002860000-memory.dmp

Filesize
36.4MB

Download
memory/3348-744-0x000000006C640000-0x000000006C68C000-memory.dmp

Filesize
304KB

Download
memory/3456-890-0x0000000005950000-0x0000000005AD6000-memory.dmp

Filesize
1.5MB

Download
memory/3456-889-0x00000000008B0000-0x0000000000E82000-memory.dmp

Filesize
5.8MB

Download
memory/3456-891-0x0000000005720000-0x0000000005742000-memory.dmp

Filesize
136KB

Download
memory/3700-717-0x000000000A520000-0x000000000A6E2000-memory.dmp

Filesize
1.8MB

Download
memory/3700-718-0x000000000AC20000-0x000000000B14C000-memory.dmp

Filesize
5.2MB

Download
memory/3792-1-0x0000000000DB0000-0x0000000000DB8000-memory.dmp

Filesize
32KB

Download
memory/3792-2-0x00007FF985030000-0x00007FF985AF2000-memory.dmp

Filesize
10.8MB

Download
memory/3792-3-0x00007FF985030000-0x00007FF985AF2000-memory.dmp

Filesize
10.8MB

Download
memory/3792-0-0x00007FF985033000-0x00007FF985035000-memory.dmp

Filesize
8KB

Download
memory/3920-611-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/3920-612-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/3944-709-0x0000000000400000-0x0000000002860000-memory.dmp

Filesize
36.4MB

Download
memory/3984-777-0x00000000009C0000-0x0000000000A39000-memory.dmp

Filesize
484KB

Download
memory/4060-590-0x0000000000400000-0x00000000004AE000-memory.dmp

Filesize
696KB

Download
memory/4108-639-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/4964-592-0x00000000063B0000-0x000000000643C000-memory.dmp

Filesize
560KB

Download
memory/4964-582-0x00000000056B0000-0x00000000056BE000-memory.dmp

Filesize
56KB

Download
memory/4964-222-0x0000000005680000-0x0000000005696000-memory.dmp

Filesize
88KB

Download
memory/4964-212-0x00000000051D0000-0x00000000051DA000-memory.dmp

Filesize
40KB

Download
memory/4964-211-0x00000000051F0000-0x0000000005282000-memory.dmp

Filesize
584KB

Download
memory/4964-210-0x00000000056C0000-0x0000000005C66000-memory.dmp

Filesize
5.6MB

Download
memory/4964-209-0x0000000000790000-0x0000000000844000-memory.dmp

Filesize
720KB

Download
memory/5008-845-0x0000000140000000-0x000000014025B000-memory.dmp

Filesize
2.4MB

Download
memory/5008-849-0x0000000140000000-0x000000014025B000-memory.dmp

Filesize
2.4MB

Download
memory/5008-848-0x0000000140000000-0x000000014025B000-memory.dmp

Filesize
2.4MB

Download
memory/5008-847-0x0000000140000000-0x000000014025B000-memory.dmp

Filesize
2.4MB

Download
memory/5008-846-0x0000000140000000-0x000000014025B000-memory.dmp

Filesize
2.4MB

Download
memory/5008-844-0x0000000140000000-0x000000014025B000-memory.dmp

Filesize
2.4MB

Download
memory/5008-838-0x0000000140000000-0x000000014025B000-memory.dmp

Filesize
2.4MB

Download
memory/5008-843-0x0000000140000000-0x000000014025B000-memory.dmp

Filesize
2.4MB

Download
memory/5008-851-0x0000000140000000-0x000000014025B000-memory.dmp

Filesize
2.4MB

Download
memory/5008-850-0x0000000140000000-0x000000014025B000-memory.dmp

Filesize
2.4MB

Download
memory/5088-805-0x0000000000400000-0x0000000000C2D000-memory.dmp

Filesize
8.2MB

Download
memory/5088-775-0x0000000000400000-0x0000000000C2D000-memory.dmp

Filesize
8.2MB

Download
memory/5088-806-0x0000000000400000-0x0000000000C2D000-memory.dmp

Filesize
8.2MB

Download
memory/5124-1672-0x0000000000120000-0x00000000005AE000-memory.dmp

Filesize
4.6MB

Download
memory/5124-1673-0x0000000005070000-0x000000000518A000-memory.dmp

Filesize
1.1MB

Download
memory/5200-996-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/5200-1542-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/5820-864-0x00000000005E0000-0x00000000018F7000-memory.dmp

Filesize
19.1MB

Download
memory/5820-865-0x00000000005E0000-0x0000000000620000-memory.dmp

Filesize
256KB

Download
memory/6436-1527-0x00000000056F0000-0x0000000005A47000-memory.dmp

Filesize
3.3MB

Download
memory/6872-1576-0x0000000003590000-0x00000000035AC000-memory.dmp

Filesize
112KB

Download
memory/6872-1575-0x0000000008820000-0x0000000008E54000-memory.dmp

Filesize
6.2MB

Download
memory/6872-1574-0x0000000006F50000-0x00000000075CA000-memory.dmp

Filesize
6.5MB

Download
memory/6872-1573-0x0000000000800000-0x0000000001324000-memory.dmp

Filesize
11.1MB

Download
memory/7060-1760-0x0000000000A30000-0x0000000001040000-memory.dmp

Filesize
6.1MB

Download
memory/7060-1761-0x0000000005B90000-0x0000000005D06000-memory.dmp

Filesize
1.5MB

Download