agenttesla | hxxps://dosya[.]co/2wc73yr4es21/ErisimEngeli[.]zip[.]html

Analysis

max time kernel
1200s
max time network
1127s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
13/09/2024, 16:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://dosya.co/2wc73yr4es21/ErisimEngeli.zip.html

Score

10^/10

agenttesla discovery execution keylogger persistence spyware stealer trojan

Malware Config

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla payload 1 IoCs

resource	yara_rule
behavioral1/memory/960-529-0x0000000005970000-0x0000000005B82000-memory.dmp	family_agenttesla

Boot or Logon Autostart Execution: Active Setup 2 TTPs 8 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	BTKInternetAgi.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\btk.lnk	BTKInternetAgi.exe

Executes dropped EXE 1 IoCs

pid	Process
1448	Setup.exe

Loads dropped DLL 4 IoCs

pid	Process
1448	Setup.exe
1448	Setup.exe
1448	Setup.exe
1448	Setup.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2228	powershell.exe

Enumerates connected drives 3 TTPs 16 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	explorer.exe
File opened (read-only)	\??\D:	explorer.exe
File opened (read-only)	\??\D:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe
File opened (read-only)	\??\D:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe
File opened (read-only)	\??\D:	explorer.exe
File opened (read-only)	\??\D:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe
File opened (read-only)	\??\D:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe
File opened (read-only)	\??\D:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Crashpad\metadata	setup.exe
File opened for modification	C:\Program Files\Crashpad\settings.dat	setup.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BTKInternetAgi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NDP481-Web.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BTKInternetAgi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Setup.exe

Enumerates system info in registry 2 TTPs 15 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	BTKInternetAgi.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	BTKInternetAgi.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	BTKInternetAgi.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	BTKInternetAgi.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	BTKInternetAgi.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	BTKInternetAgi.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Kills process with taskkill 3 IoCs

evasion

pid	Process
4652	taskkill.exe
4176	taskkill.exe
4436	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 11 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Software\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Software\Microsoft\Internet Explorer\TypedURLs	taskmgr.exe
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Software\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Software\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Software\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Software\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Internet Explorer\GPU	SearchApp.exe

Modifies data under HKEY_USERS 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133707178960585476"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchApp.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1302416131-1437503476-2806442725-1000\{01B720CE-806D-443D-9C77-1D8279B5797E}	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "185"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\windows.search	SearchApp.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\MuiCache	SearchApp.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "185"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search\Total = "23"	SearchApp.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "185"	SearchApp.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "152"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search	SearchApp.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\ApplicationFrame\Microsoft.Windows.PeopleExperienceHo = 6801000088020000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchApp.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1302416131-1437503476-2806442725-1000\{E7D8B036-F9FA-4AF1-8923-A385A6C19507}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\ApplicationFrame\Microsoft.Windows.PeopleExperienceHo = 6801000088020000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "152"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "152"	SearchApp.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search\ = "23"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\ApplicationFrame\Microsoft.Windows.PeopleExperienceHo = 6801000088020000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoft.windows.search	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoft.windows.search	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search\ = "23"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1302416131-1437503476-2806442725-1000\{9ED5C5C8-A20B-464E-9C94-7EC779461D9A}	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search\Total = "23"	SearchApp.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\ApplicationFrame\Microsoft.Windows.PeopleExperienceHo = 6801000088020000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search\Total = "23"	SearchApp.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\MuiCache	SearchApp.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\ApplicationFrame\Microsoft.Windows.PeopleExperienceHo = 6801000088020000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
832	chrome.exe
832	chrome.exe
1448	Setup.exe
1448	Setup.exe
1448	Setup.exe
1448	Setup.exe
1448	Setup.exe
1448	Setup.exe
1448	Setup.exe
1448	Setup.exe
960	BTKInternetAgi.exe
960	BTKInternetAgi.exe
2228	powershell.exe
2228	powershell.exe
3868	taskmgr.exe
3868	taskmgr.exe
3868	taskmgr.exe
3868	taskmgr.exe
3868	taskmgr.exe
3868	taskmgr.exe
3868	taskmgr.exe
3868	taskmgr.exe
3868	taskmgr.exe
3868	taskmgr.exe
4856	BTKInternetAgi.exe
4856	BTKInternetAgi.exe
3868	taskmgr.exe
4856	BTKInternetAgi.exe
4856	BTKInternetAgi.exe
4856	BTKInternetAgi.exe
4856	BTKInternetAgi.exe
4856	BTKInternetAgi.exe
4856	BTKInternetAgi.exe
4856	BTKInternetAgi.exe
4856	BTKInternetAgi.exe
4856	BTKInternetAgi.exe
4856	BTKInternetAgi.exe
4856	BTKInternetAgi.exe
4856	BTKInternetAgi.exe
4856	BTKInternetAgi.exe
4856	BTKInternetAgi.exe
4856	BTKInternetAgi.exe
4856	BTKInternetAgi.exe
4856	BTKInternetAgi.exe
4856	BTKInternetAgi.exe
4856	BTKInternetAgi.exe
4856	BTKInternetAgi.exe
4856	BTKInternetAgi.exe
4856	BTKInternetAgi.exe
4856	BTKInternetAgi.exe
4856	BTKInternetAgi.exe
4856	BTKInternetAgi.exe
4856	BTKInternetAgi.exe
4856	BTKInternetAgi.exe
4856	BTKInternetAgi.exe
4856	BTKInternetAgi.exe
4856	BTKInternetAgi.exe
4856	BTKInternetAgi.exe
4856	BTKInternetAgi.exe
4856	BTKInternetAgi.exe
4856	BTKInternetAgi.exe
4856	BTKInternetAgi.exe
4856	BTKInternetAgi.exe
4856	BTKInternetAgi.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
536	taskmgr.exe

Suspicious behavior: LoadsDriver 64 IoCs

pid	Process
1408	Process not Found
4792	Process not Found
1312	Process not Found
4380	Process not Found
2272	Process not Found
3052	Process not Found
1416	Process not Found
744	Process not Found
4648	Process not Found
3544	Process not Found
4228	Process not Found
1788	Process not Found
2728	Process not Found
460	Process not Found
8	Process not Found
4840	Process not Found
3752	Process not Found
4052	Process not Found
3740	Process not Found
4328	Process not Found
1936	Process not Found
1952	Process not Found
3456	Process not Found
3892	Process not Found
3896	Process not Found
4696	Process not Found
5108	Process not Found
1700	Process not Found
4364	Process not Found
516	Process not Found
2756	Process not Found
4568	Process not Found
408	Process not Found
3312	Process not Found
2064	Process not Found
3340	Process not Found
2624	Process not Found
1080	Process not Found
2104	Process not Found
3148	Process not Found
4348	Process not Found
4736	Process not Found
1152	Process not Found
1568	Process not Found
2440	Process not Found
3556	Process not Found
3504	Process not Found
1648	Process not Found
3424	Process not Found
620	Process not Found
2752	Process not Found
1636	Process not Found
800	Process not Found
848	Process not Found
844	Process not Found
3328	Process not Found
1108	Process not Found
1200	Process not Found
1232	Process not Found
1236	Process not Found
1248	Process not Found
1628	Process not Found
1672	Process not Found
1412	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs

pid	Process
832	chrome.exe
832	chrome.exe
832	chrome.exe
572	chrome.exe
572	chrome.exe
572	chrome.exe
572	chrome.exe
2480	chrome.exe
2480	chrome.exe
2480	chrome.exe
2480	chrome.exe
2480	chrome.exe
2480	chrome.exe
2480	chrome.exe
2480	chrome.exe
2480	chrome.exe
2480	chrome.exe
2480	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	832	chrome.exe
Token: SeCreatePagefilePrivilege	832	chrome.exe
Token: SeShutdownPrivilege	832	chrome.exe
Token: SeCreatePagefilePrivilege	832	chrome.exe
Token: SeShutdownPrivilege	832	chrome.exe
Token: SeCreatePagefilePrivilege	832	chrome.exe
Token: SeShutdownPrivilege	832	chrome.exe
Token: SeCreatePagefilePrivilege	832	chrome.exe
Token: SeShutdownPrivilege	832	chrome.exe
Token: SeCreatePagefilePrivilege	832	chrome.exe
Token: SeShutdownPrivilege	832	chrome.exe
Token: SeCreatePagefilePrivilege	832	chrome.exe
Token: SeShutdownPrivilege	832	chrome.exe
Token: SeCreatePagefilePrivilege	832	chrome.exe
Token: SeShutdownPrivilege	832	chrome.exe
Token: SeCreatePagefilePrivilege	832	chrome.exe
Token: SeShutdownPrivilege	832	chrome.exe
Token: SeCreatePagefilePrivilege	832	chrome.exe
Token: SeShutdownPrivilege	832	chrome.exe
Token: SeCreatePagefilePrivilege	832	chrome.exe
Token: SeShutdownPrivilege	832	chrome.exe
Token: SeCreatePagefilePrivilege	832	chrome.exe
Token: SeDebugPrivilege	960	BTKInternetAgi.exe
Token: SeDebugPrivilege	2228	powershell.exe
Token: SeDebugPrivilege	3868	taskmgr.exe
Token: SeSystemProfilePrivilege	3868	taskmgr.exe
Token: SeCreateGlobalPrivilege	3868	taskmgr.exe
Token: SeDebugPrivilege	4856	BTKInternetAgi.exe
Token: SeShutdownPrivilege	572	chrome.exe
Token: SeCreatePagefilePrivilege	572	chrome.exe
Token: SeShutdownPrivilege	572	chrome.exe
Token: SeCreatePagefilePrivilege	572	chrome.exe
Token: SeShutdownPrivilege	572	chrome.exe
Token: SeCreatePagefilePrivilege	572	chrome.exe
Token: SeShutdownPrivilege	572	chrome.exe
Token: SeCreatePagefilePrivilege	572	chrome.exe
Token: SeShutdownPrivilege	572	chrome.exe
Token: SeCreatePagefilePrivilege	572	chrome.exe
Token: SeShutdownPrivilege	572	chrome.exe
Token: SeCreatePagefilePrivilege	572	chrome.exe
Token: SeShutdownPrivilege	572	chrome.exe
Token: SeCreatePagefilePrivilege	572	chrome.exe
Token: SeShutdownPrivilege	572	chrome.exe
Token: SeCreatePagefilePrivilege	572	chrome.exe
Token: SeShutdownPrivilege	572	chrome.exe
Token: SeCreatePagefilePrivilege	572	chrome.exe
Token: SeShutdownPrivilege	572	chrome.exe
Token: SeCreatePagefilePrivilege	572	chrome.exe
Token: SeShutdownPrivilege	572	chrome.exe
Token: SeCreatePagefilePrivilege	572	chrome.exe
Token: SeShutdownPrivilege	572	chrome.exe
Token: SeCreatePagefilePrivilege	572	chrome.exe
Token: SeShutdownPrivilege	572	chrome.exe
Token: SeCreatePagefilePrivilege	572	chrome.exe
Token: SeShutdownPrivilege	572	chrome.exe
Token: SeCreatePagefilePrivilege	572	chrome.exe
Token: SeShutdownPrivilege	572	chrome.exe
Token: SeCreatePagefilePrivilege	572	chrome.exe
Token: SeShutdownPrivilege	572	chrome.exe
Token: SeCreatePagefilePrivilege	572	chrome.exe
Token: SeShutdownPrivilege	572	chrome.exe
Token: SeCreatePagefilePrivilege	572	chrome.exe
Token: SeShutdownPrivilege	572	chrome.exe
Token: SeCreatePagefilePrivilege	572	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
832	chrome.exe
832	chrome.exe
832	chrome.exe
832	chrome.exe
832	chrome.exe
832	chrome.exe
832	chrome.exe
832	chrome.exe
832	chrome.exe
832	chrome.exe
832	chrome.exe
832	chrome.exe
832	chrome.exe
832	chrome.exe
832	chrome.exe
832	chrome.exe
832	chrome.exe
832	chrome.exe
832	chrome.exe
832	chrome.exe
832	chrome.exe
832	chrome.exe
832	chrome.exe
832	chrome.exe
832	chrome.exe
832	chrome.exe
832	chrome.exe
832	chrome.exe
832	chrome.exe
832	chrome.exe
832	chrome.exe
832	chrome.exe
832	chrome.exe
832	chrome.exe
832	chrome.exe
3868	taskmgr.exe
3868	taskmgr.exe
3868	taskmgr.exe
3868	taskmgr.exe
3868	taskmgr.exe
3868	taskmgr.exe
3868	taskmgr.exe
3868	taskmgr.exe
3868	taskmgr.exe
3868	taskmgr.exe
3868	taskmgr.exe
3868	taskmgr.exe
3868	taskmgr.exe
3868	taskmgr.exe
3868	taskmgr.exe
3868	taskmgr.exe
3868	taskmgr.exe
3868	taskmgr.exe
3868	taskmgr.exe
3868	taskmgr.exe
3868	taskmgr.exe
3868	taskmgr.exe
3868	taskmgr.exe
4856	BTKInternetAgi.exe
4856	BTKInternetAgi.exe
4856	BTKInternetAgi.exe
572	chrome.exe
572	chrome.exe
572	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
832	chrome.exe
832	chrome.exe
832	chrome.exe
832	chrome.exe
832	chrome.exe
832	chrome.exe
832	chrome.exe
832	chrome.exe
832	chrome.exe
832	chrome.exe
832	chrome.exe
832	chrome.exe
832	chrome.exe
832	chrome.exe
832	chrome.exe
832	chrome.exe
832	chrome.exe
832	chrome.exe
832	chrome.exe
832	chrome.exe
832	chrome.exe
832	chrome.exe
832	chrome.exe
832	chrome.exe
3868	taskmgr.exe
3868	taskmgr.exe
3868	taskmgr.exe
3868	taskmgr.exe
3868	taskmgr.exe
3868	taskmgr.exe
3868	taskmgr.exe
3868	taskmgr.exe
3868	taskmgr.exe
3868	taskmgr.exe
3868	taskmgr.exe
3868	taskmgr.exe
3868	taskmgr.exe
3868	taskmgr.exe
3868	taskmgr.exe
3868	taskmgr.exe
3868	taskmgr.exe
3868	taskmgr.exe
3868	taskmgr.exe
3868	taskmgr.exe
3868	taskmgr.exe
3868	taskmgr.exe
3868	taskmgr.exe
4856	BTKInternetAgi.exe
4856	BTKInternetAgi.exe
4856	BTKInternetAgi.exe
572	chrome.exe
572	chrome.exe
572	chrome.exe
572	chrome.exe
572	chrome.exe
572	chrome.exe
572	chrome.exe
572	chrome.exe
572	chrome.exe
572	chrome.exe
572	chrome.exe
572	chrome.exe
572	chrome.exe
572	chrome.exe

Suspicious use of SetWindowsHookEx 15 IoCs

pid	Process
4276	NDP481-Web.exe
3724	StartMenuExperienceHost.exe
556	StartMenuExperienceHost.exe
4988	SearchApp.exe
3984	StartMenuExperienceHost.exe
836	SearchApp.exe
2224	StartMenuExperienceHost.exe
4916	StartMenuExperienceHost.exe
4768	SearchApp.exe
4640	StartMenuExperienceHost.exe
5036	SearchApp.exe
4364	StartMenuExperienceHost.exe
4736	SearchApp.exe
1404	StartMenuExperienceHost.exe
1156	explorer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 832 wrote to memory of 1460	832	chrome.exe	82
PID 832 wrote to memory of 1460	832	chrome.exe	82
PID 832 wrote to memory of 1552	832	chrome.exe	83
PID 832 wrote to memory of 1552	832	chrome.exe	83
PID 832 wrote to memory of 1552	832	chrome.exe	83
PID 832 wrote to memory of 1552	832	chrome.exe	83
PID 832 wrote to memory of 1552	832	chrome.exe	83
PID 832 wrote to memory of 1552	832	chrome.exe	83
PID 832 wrote to memory of 1552	832	chrome.exe	83
PID 832 wrote to memory of 1552	832	chrome.exe	83
PID 832 wrote to memory of 1552	832	chrome.exe	83
PID 832 wrote to memory of 1552	832	chrome.exe	83
PID 832 wrote to memory of 1552	832	chrome.exe	83
PID 832 wrote to memory of 1552	832	chrome.exe	83
PID 832 wrote to memory of 1552	832	chrome.exe	83
PID 832 wrote to memory of 1552	832	chrome.exe	83
PID 832 wrote to memory of 1552	832	chrome.exe	83
PID 832 wrote to memory of 1552	832	chrome.exe	83
PID 832 wrote to memory of 1552	832	chrome.exe	83
PID 832 wrote to memory of 1552	832	chrome.exe	83
PID 832 wrote to memory of 1552	832	chrome.exe	83
PID 832 wrote to memory of 1552	832	chrome.exe	83
PID 832 wrote to memory of 1552	832	chrome.exe	83
PID 832 wrote to memory of 1552	832	chrome.exe	83
PID 832 wrote to memory of 1552	832	chrome.exe	83
PID 832 wrote to memory of 1552	832	chrome.exe	83
PID 832 wrote to memory of 1552	832	chrome.exe	83
PID 832 wrote to memory of 1552	832	chrome.exe	83
PID 832 wrote to memory of 1552	832	chrome.exe	83
PID 832 wrote to memory of 1552	832	chrome.exe	83
PID 832 wrote to memory of 1552	832	chrome.exe	83
PID 832 wrote to memory of 1552	832	chrome.exe	83
PID 832 wrote to memory of 4052	832	chrome.exe	84
PID 832 wrote to memory of 4052	832	chrome.exe	84
PID 832 wrote to memory of 1644	832	chrome.exe	85
PID 832 wrote to memory of 1644	832	chrome.exe	85
PID 832 wrote to memory of 1644	832	chrome.exe	85
PID 832 wrote to memory of 1644	832	chrome.exe	85
PID 832 wrote to memory of 1644	832	chrome.exe	85
PID 832 wrote to memory of 1644	832	chrome.exe	85
PID 832 wrote to memory of 1644	832	chrome.exe	85
PID 832 wrote to memory of 1644	832	chrome.exe	85
PID 832 wrote to memory of 1644	832	chrome.exe	85
PID 832 wrote to memory of 1644	832	chrome.exe	85
PID 832 wrote to memory of 1644	832	chrome.exe	85
PID 832 wrote to memory of 1644	832	chrome.exe	85
PID 832 wrote to memory of 1644	832	chrome.exe	85
PID 832 wrote to memory of 1644	832	chrome.exe	85
PID 832 wrote to memory of 1644	832	chrome.exe	85
PID 832 wrote to memory of 1644	832	chrome.exe	85
PID 832 wrote to memory of 1644	832	chrome.exe	85
PID 832 wrote to memory of 1644	832	chrome.exe	85
PID 832 wrote to memory of 1644	832	chrome.exe	85
PID 832 wrote to memory of 1644	832	chrome.exe	85
PID 832 wrote to memory of 1644	832	chrome.exe	85
PID 832 wrote to memory of 1644	832	chrome.exe	85
PID 832 wrote to memory of 1644	832	chrome.exe	85
PID 832 wrote to memory of 1644	832	chrome.exe	85
PID 832 wrote to memory of 1644	832	chrome.exe	85
PID 832 wrote to memory of 1644	832	chrome.exe	85
PID 832 wrote to memory of 1644	832	chrome.exe	85
PID 832 wrote to memory of 1644	832	chrome.exe	85
PID 832 wrote to memory of 1644	832	chrome.exe	85
PID 832 wrote to memory of 1644	832	chrome.exe	85

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://dosya.co/2wc73yr4es21/ErisimEngeli.zip.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff9111acc40,0x7ff9111acc4c,0x7ff9111acc58
  2⤵
  PID:1460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1840,i,16804432254766755472,15215997096608106359,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=1896 /prefetch:2
  2⤵
  PID:1552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2108,i,16804432254766755472,15215997096608106359,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2124 /prefetch:3
  2⤵
  PID:4052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2184,i,16804432254766755472,15215997096608106359,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2396 /prefetch:8
  2⤵
  PID:1644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3116,i,16804432254766755472,15215997096608106359,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3160 /prefetch:1
  2⤵
  PID:4916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3132,i,16804432254766755472,15215997096608106359,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3192 /prefetch:1
  2⤵
  PID:3392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4532,i,16804432254766755472,15215997096608106359,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4528 /prefetch:1
  2⤵
  PID:4144
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4752,i,16804432254766755472,15215997096608106359,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4764 /prefetch:8
  2⤵
  PID:3108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5080,i,16804432254766755472,15215997096608106359,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5140 /prefetch:8
  2⤵
  PID:2528

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:2452

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3472

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4168

C:\Users\Admin\Desktop\ErisimEngeli\NDP481-Web.exe
"C:\Users\Admin\Desktop\ErisimEngeli\NDP481-Web.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4276
- C:\1a36e26f2c2dcf5ce2ae36\Setup.exe
  C:\1a36e26f2c2dcf5ce2ae36\\Setup.exe /x86 /x64 /web
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  PID:1448

C:\Users\Admin\Desktop\ErisimEngeli\BTKInternetAgi.exe
"C:\Users\Admin\Desktop\ErisimEngeli\BTKInternetAgi.exe"
1⤵
- Drops startup file
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:960
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableRealtimeMonitoring $true
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2228

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3868

C:\Users\Admin\Desktop\ErisimEngeli\BTKInternetAgi.exe
"C:\Users\Admin\Desktop\ErisimEngeli\BTKInternetAgi.exe"
1⤵
- Drops file in Drivers directory
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4856

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:572
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff9111acc40,0x7ff9111acc4c,0x7ff9111acc58
  2⤵
  PID:5072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1796,i,10528768741658903446,4145154414194229927,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=1792 /prefetch:2
  2⤵
  PID:1964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2184,i,10528768741658903446,4145154414194229927,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2256 /prefetch:3
  2⤵
  PID:4712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2264,i,10528768741658903446,4145154414194229927,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2428 /prefetch:8
  2⤵
  PID:4008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3164,i,10528768741658903446,4145154414194229927,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3184 /prefetch:1
  2⤵
  PID:4816
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3192,i,10528768741658903446,4145154414194229927,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:3560
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3724,i,10528768741658903446,4145154414194229927,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4544 /prefetch:1
  2⤵
  PID:3872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4684,i,10528768741658903446,4145154414194229927,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4908 /prefetch:8
  2⤵
  PID:3716
- C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe
  "C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe" --reenable-autoupdates --system-level
  2⤵
  - Drops file in Program Files directory
  PID:4628
- - C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe
    "C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x284,0x288,0x28c,0x260,0x290,0x7ff78eb14698,0x7ff78eb146a4,0x7ff78eb146b0
    3⤵
    - Drops file in Program Files directory
    PID:3084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4772,i,10528768741658903446,4145154414194229927,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4932 /prefetch:8
  2⤵
  PID:2744
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=5012,i,10528768741658903446,4145154414194229927,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5208 /prefetch:1
  2⤵
  PID:412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --restart
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  PID:2480
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff9111acc40,0x7ff9111acc4c,0x7ff9111acc58
    3⤵
    PID:3244
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2072,i,17251165249955434637,5745811819455603792,262144 --variations-seed-version=20240913-050142.817000 --mojo-platform-channel-handle=2064 /prefetch:2
    3⤵
    PID:4284
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=tr --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1820,i,17251165249955434637,5745811819455603792,262144 --variations-seed-version=20240913-050142.817000 --mojo-platform-channel-handle=2136 /prefetch:3
    3⤵
    PID:3548
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=tr --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2284,i,17251165249955434637,5745811819455603792,262144 --variations-seed-version=20240913-050142.817000 --mojo-platform-channel-handle=2456 /prefetch:8
    3⤵
    PID:3424
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=tr --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3732,i,17251165249955434637,5745811819455603792,262144 --variations-seed-version=20240913-050142.817000 --mojo-platform-channel-handle=3752 /prefetch:1
    3⤵
    PID:3096
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=tr --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3600,i,17251165249955434637,5745811819455603792,262144 --variations-seed-version=20240913-050142.817000 --mojo-platform-channel-handle=4056 /prefetch:1
    3⤵
    PID:872
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=tr --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4812,i,17251165249955434637,5745811819455603792,262144 --variations-seed-version=20240913-050142.817000 --mojo-platform-channel-handle=4824 /prefetch:8
    3⤵
    PID:5064
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=tr --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5072,i,17251165249955434637,5745811819455603792,262144 --variations-seed-version=20240913-050142.817000 --mojo-platform-channel-handle=4904 /prefetch:8
    3⤵
    PID:4636
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=tr --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=4784,i,17251165249955434637,5745811819455603792,262144 --variations-seed-version=20240913-050142.817000 --mojo-platform-channel-handle=4696 /prefetch:1
    3⤵
    PID:1640
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=tr --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=4500,i,17251165249955434637,5745811819455603792,262144 --variations-seed-version=20240913-050142.817000 --mojo-platform-channel-handle=4856 /prefetch:1
    3⤵
    PID:2372
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=tr --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=4852,i,17251165249955434637,5745811819455603792,262144 --variations-seed-version=20240913-050142.817000 --mojo-platform-channel-handle=4592 /prefetch:1
    3⤵
    PID:3236
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=tr --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=5196,i,17251165249955434637,5745811819455603792,262144 --variations-seed-version=20240913-050142.817000 --mojo-platform-channel-handle=5316 /prefetch:1
    3⤵
    PID:3572
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=tr --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=4364,i,17251165249955434637,5745811819455603792,262144 --variations-seed-version=20240913-050142.817000 --mojo-platform-channel-handle=4904 /prefetch:1
    3⤵
    PID:4804
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=tr --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=5008,i,17251165249955434637,5745811819455603792,262144 --variations-seed-version=20240913-050142.817000 --mojo-platform-channel-handle=4700 /prefetch:1
    3⤵
    PID:2256
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=tr --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=3448,i,17251165249955434637,5745811819455603792,262144 --variations-seed-version=20240913-050142.817000 --mojo-platform-channel-handle=5448 /prefetch:1
    3⤵
    PID:4312
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=tr --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=4920,i,17251165249955434637,5745811819455603792,262144 --variations-seed-version=20240913-050142.817000 --mojo-platform-channel-handle=5124 /prefetch:1
    3⤵
    PID:4876
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=tr --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=4296,i,17251165249955434637,5745811819455603792,262144 --variations-seed-version=20240913-050142.817000 --mojo-platform-channel-handle=5132 /prefetch:1
    3⤵
    PID:2224

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:1412

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:4496

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
PID:4056

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
1⤵
PID:1632
- C:\Windows\system32\taskkill.exe
  "C:\Windows\system32\taskkill.exe" /F /IM internetagi
  2⤵
  - Kills process with taskkill
  PID:4176
- C:\Windows\system32\taskkill.exe
  "C:\Windows\system32\taskkill.exe" /F /IM btkinternetagi
  2⤵
  - Kills process with taskkill
  PID:4436
- C:\Windows\system32\taskkill.exe
  "C:\Windows\system32\taskkill.exe" /F /IM btkinternetagi.exe
  2⤵
  - Kills process with taskkill
  PID:4652

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
PID:536
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe"
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Enumerates connected drives
  - Checks SCSI registry key(s)
  - Modifies registry class
  PID:3028

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2896
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Enumerates connected drives
  - Checks SCSI registry key(s)
  - Modifies registry class
  PID:3392

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3724

C:\Windows\explorer.exe
explorer.exe
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
PID:3716

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:556

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4988

C:\Windows\explorer.exe
explorer.exe
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
PID:3184

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Suspicious use of SetWindowsHookEx
PID:3984

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:836

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Suspicious use of SetWindowsHookEx
PID:2224

C:\Windows\explorer.exe
explorer.exe
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
PID:4332

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Suspicious use of SetWindowsHookEx
PID:4916

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4768

C:\Windows\explorer.exe
explorer.exe
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
PID:4300

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4640

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5036

C:\Windows\explorer.exe
explorer.exe
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
PID:2312

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4364

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4736

C:\Windows\explorer.exe
explorer.exe
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1156

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Suspicious use of SetWindowsHookEx
PID:1404

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3440

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:4828

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3436

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3572

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:2000

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:4220

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:4200

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:1296

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:1668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\1a36e26f2c2dcf5ce2ae36\1025\LocalizedData.xml

Filesize
81KB

MD5
075961c7e742c66ee4cd8b614a778141

SHA1
a5541fa0487135aaed1c336bba79e8025ac2804c

SHA256
4198a6ae89b0be8bd07ed3c18dea6ca87239a5a47343b73ff612ce0ab47e08dd

SHA512
c6881fc501805d0cb5aa9b42fc14029404a236166699e3845586e0609c26e4536bdd6ca2181e1139f83d5cb78c35d0fa7d158134f522fb9f4736880e330fc8f6

Download Submit
C:\1a36e26f2c2dcf5ce2ae36\1028\LocalizedData.xml

Filesize
70KB

MD5
8b37256ce099957b91ebe1d51ad8f61c

SHA1
6bf4bcf46781126ffdce92e39ad4d1d912e75ac5

SHA256
7d6777e8c9484229c1b8e3f2e354a88f57539503c2c56f2b0ee47679a6ef9cc0

SHA512
6659dec6fae7a7f733a0c9e44a04f178a6732e1b9b785833c63efd8ed6e25adabb58e37b2ec039dacdb071732f8ee42ceb297cb2ec72b67e8d25eb093d5423a5

Download Submit
C:\1a36e26f2c2dcf5ce2ae36\1029\LocalizedData.xml

Filesize
87KB

MD5
aadf97951359a8267f7990cdd2cc950d

SHA1
61f626b44e252e916c9c70a4222efc9c21d951c6

SHA256
e28d2d89fc269d25272956cee4d7150a30706f58ad305e84e3c1c9fe7ac0ee86

SHA512
2d352cf7d8d167b2a9fd4416582328d894619f2eb213fd334e1b15ef1044735a69ffca36fba02d9d1af6355e9d1a55d38c3b7f5339ecacb8c1dfdc4cc50c5342

Download Submit
C:\1a36e26f2c2dcf5ce2ae36\1030\LocalizedData.xml

Filesize
84KB

MD5
e1f2f586d75650df1a751d86bb659df8

SHA1
283097241e6b1acc8f30ca822585df104c918e51

SHA256
615a6380adcfa3a0e7a5db2df9b98dad650678d8c46b1c7c3f2d2854204f079e

SHA512
b7fb3e366a7e5cbaaf99e8e14731653dd14885cd0b3d5462c091113f12800478ff2e5bd351bd403abaeef3041cdd5a7693825e488f27ec48d087686c95daa774

Download Submit
C:\1a36e26f2c2dcf5ce2ae36\1031\LocalizedData.xml

Filesize
89KB

MD5
74d28384c38283518c6490bfd068ebf1

SHA1
c52d2fd41a59691e18871ec64db10c43f241fb6c

SHA256
01afd814b009538f387812f6940c863a9d0cd7dc4159050f34f82e50ecbc33f8

SHA512
e23ae604eafab0c3a0d8aeb07321c0dd629d21c5ba47d37958f48f1b9f27d89de4db880ec3958ad1e5f2165a69bed18d61f73f71fd743a2d7eaafdc0ef8d1cc0

Download Submit
C:\1a36e26f2c2dcf5ce2ae36\1032\LocalizedData.xml

Filesize
91KB

MD5
233d0d1551b17f2284ad80674569de79

SHA1
67cd31126c6e5547e60d7266e61b6835b80b5916

SHA256
7106a1121056a73fed77aab7c7293dddffe0f5aecd7db969799a121ad5d88181

SHA512
c3375081c704fb05c7335929505ef4589fa728c97bb58738932b7ee05dd6e00c19d8ba14bb0a8dfce0d51ac73fa76bffa0ccc00772b73850eea37d39088a0473

Download Submit
C:\1a36e26f2c2dcf5ce2ae36\1033\LocalizedData.xml

Filesize
84KB

MD5
31bff8efc0cc701092ab7fe606271d65

SHA1
844cc4837ebe3eea9563df6613989b4588d6f19c

SHA256
b3048715a23d9bd77e9b3e1ec8577f94cfc8c2dd30b61dbf326871a97aa6e22c

SHA512
472b881df9128c93f9183ab05d2406146aeef8ce9723c9dcfa6e93d093d90b2db75bb4a3f784d26db187436242409f021fa8b7844aa04bf9cb58f48a6c4822d5

Download Submit
C:\1a36e26f2c2dcf5ce2ae36\1035\LocalizedData.xml

Filesize
85KB

MD5
c78dddce3189c67c23f60561dcacd4a8

SHA1
e375a6d1f71709ead1ad4139b1c16476019666d2

SHA256
e9353dedb338ce826b3b990851a955da1b04e484a378cac7c3c17a2de26d14a4

SHA512
a58d995936f5c5310e04f7514c177a071f3451638f0a9692593c4d505c5f48caeca1cee9644b092bf32bd70c52bb956f0b87ac748190aea2040adc3afbbab3b0

Download Submit
C:\1a36e26f2c2dcf5ce2ae36\1036\LocalizedData.xml

Filesize
89KB

MD5
d7e814adae1a18958416b7e29ae7078b

SHA1
857fed2c8766102d1a64d91eccb0661f6de750fd

SHA256
c8c847bf9ddf8998520123ff0a638c6e9843c860b68943275b7f0256f324c4ce

SHA512
73ad8b3d24ace1795c93ef807b3e644512fee2a295eea05a93fea07d131746aa99f895a68075efe44c2c4e305da3881c27a342d2fa13dd6d1f258a9cc669491a

Download Submit
C:\1a36e26f2c2dcf5ce2ae36\1037\LocalizedData.xml

Filesize
79KB

MD5
a258bd1060df46dcefe6257d4af638dc

SHA1
9e989db32e94499a717c93e889ebf47787509a42

SHA256
83120845e156ecbd401a9047365647cf8e9b2ec75d9295237da33c53eda365e4

SHA512
6f69aa98e264e3de3669f52e34140bf3a1bc333e3e3c4e06228eb1a78aabde380c8a444d9086a1f1188c49ead7ca73962db488dfb8e4e13c09ebf539ae53d011

Download Submit
C:\1a36e26f2c2dcf5ce2ae36\1038\LocalizedData.xml

Filesize
88KB

MD5
1b59e64e51b3f9b96e8897d5b9b17c37

SHA1
1fdd8951133add26ae062da306133980e31809b0

SHA256
5dfa759937eb0ee393d94485e0ac74546d344f342fc3d42ad33847ebbd5163e4

SHA512
f1cb4670805ccd1327a7ea31b98caccc7c5bc7cb7ea7817a5749b0e176f4bdae36339d25d1037f9cdb19a47bcaac4e53fc49656c365ee7981473264b55f2a996

Download Submit
C:\1a36e26f2c2dcf5ce2ae36\1040\LocalizedData.xml

Filesize
87KB

MD5
3192c0f7f30df881ec199d77b095b93e

SHA1
dca1cfe248a9de56f2d207d5f1979c92e006831c

SHA256
5dceb300d25c68003d61437e3802f97e1d5503e27032989338f7d260c7b0904e

SHA512
42a5f98103e23d7e8d7a34f8ba08d027ac4317d92109565b5f3fa4fd7057104d3a12b88846bee1914451cff59ed1b46e9146592784c09cd724bf004eb65864c3

Download Submit
C:\1a36e26f2c2dcf5ce2ae36\1041\LocalizedData.xml

Filesize
76KB

MD5
4cfdb16e84869a51119e17a545ace7a2

SHA1
5eb358e13291d65ff8805513254b02ff3b83d7c6

SHA256
1c2587f7c0d7e57494061d24638a83c8f9d33a4eb192cfe6bd65c172fb6a76a4

SHA512
381878c16a98aae9ef688bf4735b13d2d42b2c115d76c1677f5c275db3745b35fac35468f11d80284307a6f5ed93265fa2c378a5199284d848fdf984f2a88daf

Download Submit
C:\1a36e26f2c2dcf5ce2ae36\1042\LocalizedData.xml

Filesize
74KB

MD5
401f386416c7c37f92da9ec1688d750b

SHA1
c6565b80ba557827e3e6b96901f27fdcd1b525c6

SHA256
721cf8956fb2fb01df302713351eb9721cfccff096dc429d02b0f2b150855919

SHA512
f4ac60826287262b87bd407c85091d583ac504645faabd6fe8e116ac50e35908341d85850e8888e5928cb8235101e6b7a1074597946d584550e8aea6a7fba591

Download Submit
C:\1a36e26f2c2dcf5ce2ae36\1043\LocalizedData.xml

Filesize
86KB

MD5
18efd16361a280efe263f261a4faa21e

SHA1
6e5bbbc46b2decdb00cd957d02e27bbbf2a4d880

SHA256
88de82f8c0934f23e0eb16224def959ff55da396610bd34149e4fb9aab24fb03

SHA512
b4bdaf600c5a855c040db974744b780c4860474c38ec453c4bfdc5a11c8beff65437d17c5ab0c3c78b5b861d93b0d41f1c3f4d5d435d233ba3719f78c9058446

Download Submit
C:\1a36e26f2c2dcf5ce2ae36\1044\LocalizedData.xml

Filesize
85KB

MD5
a9998c1f395c44bcd41faa0ae60439e4

SHA1
4a267707c7dd8a24eed4c433b3c41b7e1a6a936b

SHA256
8165d0b468d73347a495f525dc81d847bb84b3391c8af1abc95e2b8f4a51d620

SHA512
9f0fb00c34ee788f9e8058915794b822fcb31f1c35a1d47ce5da2b15bae904cab513d55111ae4cccbf4da2587a4c3e045f0cc2e95654c9b5631a3a4a86632bd3

Download Submit
C:\1a36e26f2c2dcf5ce2ae36\DHTMLHeader.html

Filesize
15KB

MD5
cd131d41791a543cc6f6ed1ea5bd257c

SHA1
f42a2708a0b42a13530d26515274d1fcdbfe8490

SHA256
e139af8858fe90127095ac1c4685bcd849437ef0df7c416033554703f5d864bb

SHA512
a6ee9af8f8c2c7acd58dd3c42b8d70c55202b382ffc5a93772af7bf7d7740c1162bb6d38a4307b1802294a18eb52032d410e128072af7d4f9d54f415be020c9a

Download Submit
C:\1a36e26f2c2dcf5ce2ae36\ParameterInfo.xml

Filesize
1.0MB

MD5
4a0c5e0d81034c74bedc85b7f4759888

SHA1
d2c13fca6d918c7b4d25c8b9290bac053c551694

SHA256
5b872fc7d87f00634137d4051ee6f4cf481f9f7e0163ae7589a6c40a7c828569

SHA512
913425ea56c02ec136ee6eab4ab6a44e6a61f428ee431df241e2c745377d33835a6ecac69a8d02596f2adbbbf602a8afe578a05a1e3d253aa6e60e5666e1214c

Download Submit
C:\1a36e26f2c2dcf5ce2ae36\Setup.exe

Filesize
118KB

MD5
f7a63e2d4217b71d39e4b18b3dadf632

SHA1
c3446cd1a50f6374c3ad3446607864bee97426d9

SHA256
43290269962f9edb13d042d54973a76570f6e4b6a4af33e7362f8284b9083720

SHA512
1703b6c1b1f96febdee8663fa9e8e11939715781810f5feccc6f11b0298fed4f83f6decd975ed1c05dd0e976a12b0738040d0c09db46389a2720462a6624c942

Download Submit
C:\1a36e26f2c2dcf5ce2ae36\SetupEngine.dll

Filesize
899KB

MD5
9964ce1f4874a686910dbc1aeec1a326

SHA1
0b434c566f6722c765245a1228b7600fd10ba1c9

SHA256
3a45fbe9c5e03f67b49808c068eb2ce831e4eebdd1b38e520e4be5a5537a72e4

SHA512
8d123ab8e6b767a80d122b021a77460373e2b0841c92375ba1f56830529a2610bbf3749ce95aa64b67f45591378246409f035518feced582c7ebe1b6609dba99

Download Submit
C:\1a36e26f2c2dcf5ce2ae36\SplashScreen.bmp

Filesize
117KB

MD5
bc32088bfaa1c76ba4b56639a2dec592

SHA1
84b47aa37bda0f4cd196bd5f4bd6926a594c5f82

SHA256
b05141dbc71669a7872a8e735e5e43a7f9713d4363b7a97543e1e05dcd7470a7

SHA512
4708015aa57f1225d928bfac08ed835d31fd7bdf2c0420979fd7d0311779d78c392412e8353a401c1aa1885568174f6b9a1e02b863095fa491b81780d99d0830

Download Submit
C:\1a36e26f2c2dcf5ce2ae36\UiInfo.xml

Filesize
63KB

MD5
c99059acb88a8b651d7ab25e4047a52d

SHA1
45114125699fa472d54bc4c45c881667c117e5d4

SHA256
b879f9bc5b79349fa7b0bdbe63167be399c5278454c96773885bd70fbfe7c81d

SHA512
b23a7051f94d72d5a1a0914107e5c2be46c0ddee7ca510167065b55e2d1cb25f81927467370700b1cc7449348d152e9562566de501f3ea5673a2072248572e3b

Download Submit
C:\1a36e26f2c2dcf5ce2ae36\sqmapi.dll

Filesize
221KB

MD5
6404765deb80c2d8986f60dce505915b

SHA1
e40e18837c7d3e5f379c4faef19733d81367e98f

SHA256
b236253e9ecb1e377643ae5f91c0a429b91c9b30cca1751a7bc4403ea6d94120

SHA512
a5ff302f38020b31525111206d2f5db2d6a9828c70ef0b485f660f122a30ce7028b5a160dd5f5fbcccb5b59698c8df7f2e15fdf19619c82f4dec8d901b7548ba

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

Filesize
40B

MD5
ebd1e0c475994371b3998462615f0d05

SHA1
14e355cb59a4e518018b776164c6d0217aca50e8

SHA256
6982055c717bbdaed4aeec95fd9209e1f933093cf5419bc09194366ee80b0541

SHA512
7aa0bc09e0f291418fe3b6683c2e6e83781a2d96af1d36fd47162a132cfb1fe0051135fe401c6f953c85948974aa79343fb88a0d40ed31be7c60249ae21a3a32

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\1af40130-49ef-4e5a-a35b-e745ff983e59.tmp

Filesize
1B

MD5
5058f1af8388633f609cadb75a75dc9d

SHA1
3a52ce780950d4d969792a2559cd519d7ee8c727

SHA256
cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

SHA512
0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
ae42a6e02604f6a2394775b790fa9779

SHA1
8418349d8cdf44d4284e714fdd91a0631775c577

SHA256
d63e48ac12e14c477f3cb0fe2c34e3c88cdf55f50950212978cbf076e44dc7f2

SHA512
9652cfb4cdaa8a4f39a486f68bda879016f94e4e28cdc1b5309d7eaf818d48e8f31d23edf354d216f914694e2c1b88cc7ebff161c1a3ec7b1d641e3f2855930e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_1

Filesize
264KB

MD5
ac1bd40a7e2c37e7932e2e7f415f5e28

SHA1
855f5eef914b89ae81dff3fad8cd7f0c4ac1ca87

SHA256
dfb63425070371e79756a0440c563c55cee005e6c2a367b3445caa435393fd54

SHA512
ad732d7d07844f859a51b5ae9065cf119cf32cfc95a04eb1745f6e7f809b20231876020d785884c3b85f323c4b91eb669d62d842617791ca412d684998601afb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
288B

MD5
4b75779872ac12d321efb8c2d80f2512

SHA1
e75437ac351f591a7bad2022c6217837c95877c2

SHA256
8d8b05954bd8ad9bf7758e427c8704b2118cbf3355539822d9d6269b3ff14e07

SHA512
ac8e0847c34cebc7b529fa783b3b93ba03681e12aa1ccd7be51c69c80ae60920f4281fb01ed0b0888a57df8aab4fe2b97525d692650214f086962a25660dda5c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
68165e59a51a4b5f6ea1c077c45ecdfc

SHA1
f6db34dd27b2878e4c4cdacc14b3a46007323d80

SHA256
cd3088ced3813a039b4bc0805de18d0cfd1136eabce7e2617b1693c429afcfc3

SHA512
9c9123b5ee1393d438f2c4a31719e019d1c99e86e6522fd17ff5b83bf85f2b2dc7aa362b6eab7f88472c103c3e9c20188fbf3317ce5f64be19db75cf89b5aa16

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
4KB

MD5
a10e0bbda91adb60cc64bf2a49e82031

SHA1
cd9b6e3172e1cf89a3785d1f2ed12468c9ef2333

SHA256
b85f7c232508263b67d9082e5eb51677a69182ba7683cb1f13a6e395be6c9de9

SHA512
83e3c0a435416adcc61cc464cde854475c8ee0424eb49388fad17c850e2c9418d90e15cd0a51f2425aabebac1d73ad6bb3709d078cdeeedccd095b47c661085c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
254b8c24d97fa9e5175fea47085c8c3b

SHA1
53a8050b4c016dc72f896101c50f9bc4cd69063e

SHA256
888e8bcf22db3497407f8a5d997279fbaf4bae7661775cdb6cf2160041cd0942

SHA512
ff9983db9305510f76a4f0b68341de1f7b533fd991fa3d83d5510e8e77131f6b3f2086593dadf7df0ab9d2fa757a22cbf762795916ff676696143e92cfe12e2e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
a77a07a816a112ebc83351dd0cccdfdd

SHA1
3b9b8de471bb98a6d972eb1793be21469c333970

SHA256
ab1b5f1b3876673db1a11739042742a9a1786cfe2c724f4cb02d307a1d1876ac

SHA512
a9b2d142b1210254c0089cfdafb85ee84af0fda00827896df9edbcb2c7704c32b2417108f9fcbec964f697fb4a990bc7cde602f13f65ad168628b9f18da86829

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\d8060410-34de-480c-90ec-27ed2e46f2ec.tmp

Filesize
4KB

MD5
12d655a52ef22be5e11c9855fcc38b21

SHA1
c41d4e978da910ee1a04c66eb3bc49ef6db88536

SHA256
ef6cb9809a3fe7f5ec8e9c2c90bf1b9c1022dcd65b8b946431f3b4e7fa695ba4

SHA512
642b3b5b59308dba17ff5b7b6dec9d8f3f34cdbb161e95cbcff9a5a9665bb40f54ef8a2fe313c4161921ae704fcede1c60153814fc77571bf84d47bd238e1754

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
4419e87098e33171149c10a6ec517efe

SHA1
534aa02cb28b426be5087487e8557fb91f22e0cc

SHA256
2a20d832c361a123dec258f3b5b361a2621ba9ef617e7ed9154cdc998ce874bf

SHA512
3e189f947cb957b78cdf1eae87126e3622d82166df10ab65dc6d99afe33522dc10d0641ccb85f461f77b80cbe72dcdcb3d1fecb41de9a676a075344c26496473

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
058dba3e274e3470e0af878828ce9f1f

SHA1
56385be36b56ddb0ad64f9e9de79410bafaa180b

SHA256
a574a0a71b65dcb51e238b3b5c925454afe47b2fe2a1244da9ccd96e809682aa

SHA512
5946aec050a369df0f0fd4738cb40dd997f990fadc3c5f46bd71c82090dfd9ab28ecf99f89f0e4e5f215c6b98def0cd82f3c8a774448c3a8f3d1493cb1dc4614

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
027654238facdede79a984ab8a743d55

SHA1
c3d67e47108d187c941334de6967f948608b452e

SHA256
e326a56b11f795fe6c729e502add630339732a0bad394ea51c51b7813e8061b2

SHA512
4a0656cca823d26a37d46fefbc7dc0e932fe0190a79ebb6602ddc101d86bbb7f50d64d5a6fb6fa03a2d6203d28519044a329396d9987478dd8e866d7b92e0212

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
6ba3a9b83094c731127127894253f82d

SHA1
5a913b6adff2c62303b933442acb79a6a97e3df5

SHA256
45927129d6a6764c96d24aada8f6e20b4e4db7c9aae1ed695d710f82869f1d86

SHA512
7bc5fb771c107ba09e812ded3d717c6f59567f07ff9cdcbe5af88bce6351c19aed53ef966e8d1c82cd6b1faa0a7a03ede6b305385dc8ed99c00f792c175dc9ad

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
dcbaa5775dd6ac058da91e3678b93c98

SHA1
41a35ccf34f35f7c5f7dac7dd0d77ab7344a9c3a

SHA256
8d2997431d4bf003370a2db00fb20ca1b71143a51094fc4cdd2248ac1022287e

SHA512
16e7a875cd509834abb278765ae3843da7c1aca8ad491eb8e583a473106ecf6af7ee6f14e38be6a5281907af4400f54b0ae10cfa9ec143c6e8fadf3f9af02096

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
f965c81401bc8045e27e7e61c8158187

SHA1
48ee8e6746ad0bed163c9259c8d85569820eb480

SHA256
a95288b5c3082b380e4c402340bfac6234ce3d513b0aae14ad16683612887747

SHA512
2ae14622978749d7e6992d2f7e2ca7d84069a534b30e9f17cb0ff12a3a0a4f07f5a8ad025b98fa24aac3feb09b016c7fc8cd0e7005c53893b0c965b40051106f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
fc1f1c3e5a2a6901f82d90f027bade73

SHA1
53adce99578d7f1332252a5ce88a53be3a607a27

SHA256
48ef1681adc597bc9c235a189b179bbb2a30a3bceda44c19eed893465c1bef4b

SHA512
51f1e33935178dc8e0d19f7289517a33c9a8398bb1263f6dd8eb844beb73e6c94c2d75128109df34950ad63f22c0fa110d799bb329ea147425dbd747a0ebc60e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
70c675deccfd378ba047bfb59aee6e07

SHA1
603f2d499938b06bb708ca96b660a89cddc6472a

SHA256
98b94af0c0d914358dfd5f2a436b969caf7411743bb2c6db9ad257b74edc24c1

SHA512
df37b1fe7a48983081fef9c4dc263e79835f0550974e7fe49be6d069665253b72be408fe9ca8dd73636b50205a7f212be1a04c3125f60db0128e032aef3ec3b3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
f99040f63deb2e41873d837d70ad2016

SHA1
b8f9fc9b73a7a2398c7aca4996c6d39243bcc1e6

SHA256
e5e0a7c490972fcec4b64b505094354c8b297e61de0e598a87363ca53609851d

SHA512
a4b46322b0f2e6e2d08231f11bd4b1e6fc3018623455b3ee3c6bb53a341e4b74d7554db06b646095e9b8c8a60bf34588d6807e8908952f25421a11a5b48470aa

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
c80078a4f921da6f021e595fcf5215ef

SHA1
a264ccafb9f5107db03caf8938513f7f12f6a513

SHA256
21f9a8d381028418da17a7efe50a4a350b22769b5b977315bdd073d26f1890fd

SHA512
0e398b3a1e6b4407f46a40e49e55103f21e7af7dee62d8addd8cdd455b6925ecfbf511fb0121c44855d16763959ba4ae7f4236a0b19f711338d003adbfa4c8ce

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
208KB

MD5
51e11f58bf96773a4982a633f9417638

SHA1
0dd6e1fe784f4c2e72ea1b3302783d554695a6b9

SHA256
cd661d3da48b7ffd96df55f7cde4c6d434ce28930f9bc3b306305d8ba24bca9e

SHA512
ec05370aa3daa02bdca4fbf10d45a3f537fba15c80c5551b268dfbc757aad680f2c24ff6f01f652c497711c190cd74f0e488c2d1305ff5d9040b78c83e1521c9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
208KB

MD5
c81e8987c18b4957662dd01f75c3b9c5

SHA1
79785154d5c28a91d2fded0a084d5411c71f072f

SHA256
b7710e4f7eb29d2fb750c285bde28d1b0fb7fc9fe5c55826dd0119a756dd2330

SHA512
0578f66105e25ac80b0d25e4e0f62c8e0e71f377b45414f2449ef8ca647ae7168445c79b1cfa2d6fd929cf999cff26b08b25d8ca01adb7099bbde808262a6028

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
112KB

MD5
ca44612ed44be94c695358d398c51540

SHA1
b16b218f648fd257df9e274651f6e07bbe8894de

SHA256
5143029408eac90aaffae738fcc60b638bc0dc42622e1738758934a251f01539

SHA512
cdfbf6815295fccf2ee344d99abce38691e0eb6ff64acce9be5c2a958376ab01fec08d41a06888617d31cbcba32981ac265833b0b4d87b94adf8ca7b20753985

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
208KB

MD5
a4e72f0aa5f4b71d1208cd82c62e5f8c

SHA1
d0b9523e42e9e4df328277e0d9c200d3e6d3b65c

SHA256
842d7510df8756fc2975064313fbcc3d6f4a28a81ee1ffb4b91f9a1a044512a2

SHA512
0eb587ea9814e3545d19190b94aa0fad59b5f8e1007a18fcbccd7a6c0344d72bec0823bf4eb7a487c3e9998e926eafb9eae3f05cee573bad9ad9b178419a496b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
208KB

MD5
0f9fcda00aba5f4573e601d696a871f6

SHA1
f4c6aeeec42eb6693a51555dbf4d8e127c28386c

SHA256
03506f079aebf7aa8cee8238ed9452bc62f2753059fa4af48c03d726493f6121

SHA512
e0870b5347544f38740a2f268b363c3b56b775cfbd917e53c48c06dd7b4271b55602e4515b2505759ed37a371387e2f67e99c284ae3ff69aa7460108278050b4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
99KB

MD5
a961cf11eca763042c984a40df5ee278

SHA1
b9959c3db645afe8887f75dddf085560d1ce6f39

SHA256
2f44444da91ab20097fe963b4b3d97c8e61167b9b549e835d260a4b5346f9c3e

SHA512
c3d7c7aed05ff348454a89d337bd0fc6b6c92c6a83cce243e235903b5d484f9ccc39d1a56014e88bb970b777bad3429b0126229124fbab9b927b946fcf79afa3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
112KB

MD5
02af27f52f0cdfa9ebdbf5bc23544341

SHA1
481caa8c19e98691759e0a8921d7cc18ff4a8a2a

SHA256
3d12bd4fd27e8200ea333667d114fe427e6fc87c0de95b0578851e23fda95faa

SHA512
ec107eb5d20b9e06a775dd74947d8d3a647da92b7ed905e852c9cf57d2aebd049192bd6c565c902006403b65512ccf40507237122386ae05b8c9a3692e00b93a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
99KB

MD5
3755c0627a6c660a98e9148bd25ba9df

SHA1
38317f426fdec5a15bd70e98e934e0d3a4e1f977

SHA256
a3c620d8999bd1aa138dd7879f5045b5b7994b2e9a6036c3c73ed6b6c303fcc4

SHA512
e5e8508e13ba1da1af913f783ce1698856f68ea73270e45ac8d01fa7b330ce403650759cc65b37cb8156e164bdd8cd838ab690d148da2fb986a19d9aef90893c

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\MP05IF81\microsoft.windows[1].xml

Filesize
96B

MD5
188f8f76ad695de69c313c1113722ec5

SHA1
acf66cf340e75c0997ab844f745ed139e05b5c1c

SHA256
d926dfadf64142c9d6e871f8e3d4709e78b5e82e237fcde0680740eed9c82b5b

SHA512
00eb7bda00afe8efe5b3f29460e2d92d173911f7deabb097d9995fb9af556371c4cecb473d328c8f9c7c85978fd560b1b9cec723805c44bd167ff59c3cf5bbf3

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_s2juxueh.upj.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\Desktop\AddRename.ppsm

Filesize
729KB

MD5
281527114cae6a5ce2d9d699746d0beb

SHA1
00d50c980535730e8580b8ef16bd28d0e41cb27c

SHA256
ac0e7cc006e2167c2a0016fbd8ad98631f1ea68afbb527bba5a7f72c2d612de1

SHA512
a3f12da079e2463b4ad3a7d0467e20606bc4343061a50f96285412602b6a7157ebda0514d6a0678331997847eb757c57a7e9369424414f9260bdc4f1bbd6b52b

Download Submit
C:\Users\Admin\Desktop\BlockDisconnect.mpeg

Filesize
614KB

MD5
60ff9a7c05e97a902a0ac04858150a25

SHA1
d89da986fdd8580eefeae4fddbff12cfe641cdc1

SHA256
cf5d4e225549501bfada84d3f7f88fbce59c0e1af6cbf8400e65652ddc47f164

SHA512
cad5c7fe66d3fdac162c688b734a7977d95d959dd6f6d170954d8ea9aa309276a9d7dab3f71b40340bbbe264fd03618c5d70a2f54f37e977da0c64f39ff2d504

Download Submit
C:\Users\Admin\Desktop\ClearWatch.kix

Filesize
768KB

MD5
97d66326d4e59e1926ea0c3aee203bc9

SHA1
1461508cbc5ce831aa16793924105b01eca5f6a1

SHA256
e50a47f59c089271fea4b9815636963267f6c80d00fc103083f36c71092924c0

SHA512
349987a45a41ba9f1e4796871da3671598a2c39efaf2879177f1a75dce44bb10d36c4b98e40f05b3fe0390adbff8ce9948535c4069012f02e6734933271e87b8

Download Submit
C:\Users\Admin\Desktop\CloseSelect.3gp

Filesize
652KB

MD5
9c409040eb891da5f2f84922ac9a4f8e

SHA1
1e4b32bd27dba4116498e0c252399ff24218ea89

SHA256
68f23a2c00237c355bebfe420475be93c8ccbf301fe6ddc56332d829d132980e

SHA512
06cbf2303d6a98db84ef4b9df8f1d1123bf1e8a485f7513876ee378276d48028e8c8ce8708991dd9c09689e1a59d950ed0529e8eb55874d60c487f3cdbf8909b

Download Submit
C:\Users\Admin\Desktop\CompressSave.ADTS

Filesize
998KB

MD5
318749165f454cf9d6df491dc2e7c44f

SHA1
3e0ec304e570b6b34a49fb0c010793c29dbdb0c9

SHA256
c3645ebfb1eafc76aca2d239ac733b5f2890109e6c862dc393d1211af9dd7221

SHA512
caf58d358c59d404d7ca89bdf66ab48c1bf2bd5ea1e2cf8984416a164bb0a35dbc6234c2ae4634719e35dcc3fb88083cc6e4dcecd4102a894e27ccc2cfae25ff

Download Submit
C:\Users\Admin\Desktop\ConvertFromRestore.xlsx

Filesize
15KB

MD5
12a972d528eee56e7d7f058072711f11

SHA1
2933239a7bc5ec4bf55feb0db7310f2feac28cad

SHA256
c0febd606dac9358473211fae39852792fa092ed2bb9f456766c01182c75622f

SHA512
32636a4d0d352f79aa0bd4371b013d70193e1efb3b3843f791922116684eed3606f881c6ebf0ae8e5134156c04280e81e1564d4d632089cc831094dea2ff3072

Download Submit
C:\Users\Admin\Desktop\ConvertPublish.mpeg

Filesize
537KB

MD5
5fde677d9f67283cb80bf1ad109cdf92

SHA1
95977358a9bbe0d436eaddfd113a300930e59743

SHA256
e76094213c5d48167129d1a1b4ee088a35f68727a90c9dc518445b02ade620f7

SHA512
afe466276c93b382664b5fb918f5a882f7c421c7e6882e908ed3593d6055f0e17a007afbd6f521f4906f03e527cab35987151adb45c88a603b580d3e08f22377

Download Submit
C:\Users\Admin\Desktop\ConvertToConvert.ods

Filesize
921KB

MD5
c9bced67d0108a70cf125b0c7be8fd8d

SHA1
fad444a17d2182b3cc43476b6e54d9492b95041b

SHA256
b85192252812cd44046c85ebf54dd400f92578978e5d0d1b93a679c8e73e2c63

SHA512
4fc8f0785eed99f41b5821407058a4a08c4b03f5701bad93979af40b3591d2329d9759b3f6607d77d37ae80291e4d82d8f83d1fa2299a0ad4492c7778195e8b5

Download Submit
C:\Users\Admin\Desktop\DebugRepair.mpeg

Filesize
384KB

MD5
386ac746f5bd8edc6a6a8aecf0a7e16e

SHA1
68b6ab5cfd1b8e013f25a7f4152f42214eccd78b

SHA256
34dc37fd6c99ee186ba89fe70dfab70f3b9681ef26dac7931b56a4ca92978ba3

SHA512
dc79fe883495d36496a8a86c9a0f3c355053505504078b20ca80203d296fb3c4c3ca1c9570d570c4673759d2c0330c6bcd17e9beaf3e4ad9e7e42c74535b8c5a

Download Submit
C:\Users\Admin\Desktop\EditLock.vssm

Filesize
883KB

MD5
8eeae483bdf54b032bdb4e82fd23d869

SHA1
85c3935d39feb9d4b0c62890a7a221ded1eb70cd

SHA256
c760528000ce467878444e419015c036bd95e80723f031effe397a9899bdc646

SHA512
eb96d621af733564ebbe2444f0afe752f6dcf2ddbba915ab4204eed0f7800ef3f20a9a511abce35cd3f027b3fbcc305da74c59b27bf750fb7a02d4239314f7f1

Download Submit
C:\Users\Admin\Desktop\ExitConfirm.dll

Filesize
499KB

MD5
c95cdd3a8c34093dfcc651d07bd8ac04

SHA1
94667ef49d6dec6994905c50a9362f5d376f8343

SHA256
6c9c3d12429f23a318f14b89fd4abfc8d0241dd9aa1fab4cad90bd9fa8c3ea68

SHA512
f884fc1bd2b2f94dabe669da250fe644ef915898044fb2c5037d0bbcb653e4b7bc6f8b4c56e0851ecf2d752bed50e5de4c447301f52ebaa058b357410cf9a7f2

Download Submit
C:\Users\Admin\Desktop\ImportClear.docx

Filesize
13KB

MD5
4ee2eb49c4e32e428e0b5463a3ccbd4e

SHA1
4a2bb5dd4440ae998ad6841f477cd2b581634e43

SHA256
b191a04bc3c818e81c302ca3c047b9c17c6925706905aa4521a02f8cc45fcaaf

SHA512
c7ff7390391c909f38ccc653bc791f037a1085cfa08fc09094fb9b11d83e0b901797e53c950fc7a41a0e52ee4801759ca9ac14f04a0e509787f5d86944e7da1b

Download Submit
C:\Users\Admin\Desktop\InitializeImport.3g2

Filesize
1.1MB

MD5
2137b1ffcae30e463fe439284943dce7

SHA1
2b37740612d341d5da9a1468ef237a15e8e1b547

SHA256
34650303697778557a29696d8ac1db8e731e9168ed1d017e0bb83f33b710e8f4

SHA512
cb47df7247039de5e63b8abc21e801eafbc70b0c86681003611d48f8c477478176297914e48534df599496e417ca8bc820722d788f79ed48660557709df1f9b5

Download Submit
C:\Users\Admin\Desktop\InitializeSet.MOD

Filesize
1.5MB

MD5
b91cbc39203f3de1d2e55d881da3717d

SHA1
67d7e7e7afd64f0239f2d08e7cb789e5141812ac

SHA256
6de08de9c0fe6094ff42876797dafc3c42e8482bb32800401561d9419e82e4f3

SHA512
49f64f4a0bf0683bdc48c28dadf86bc9a2f02ed8c118096366c515e938a2ca499b6d055a5dee3c5402cbfcbc1e376fc72539117166958eb62a30cf94469ff3f9

Download Submit
C:\Users\Admin\Desktop\Microsoft Edge.lnk

Filesize
2KB

MD5
16158a41fda7c302e47266966611be42

SHA1
c3c4a97352198a95483e49e734ca675af42a578c

SHA256
c7bb1ee1cc88e053affc65fcbd5c73e4d244a967a0a1f43643962153c7389d8a

SHA512
8997148011486bfcb940c26509a093561fb0f8a6f857d9c8b2a551129e864083da62ea97ba097adfb5c6a8d88b04a100e9c4a2b69c060d27fa2afed12c9ffdc3

Download Submit
C:\Users\Admin\Desktop\MountAssert.docm

Filesize
576KB

MD5
f044912a15afdb86c52d2e6397228d4c

SHA1
f8e2fc5c7b85fe891571013507fa3a193447ce2c

SHA256
ddc487f201f5a0f1e675db7684f8db29afac75bff657e6c7ba021d821221f588

SHA512
02f1ba32d4fdce8d5d0b58a3cc26e8ac474de704a6a0767d309b7f0d08493bbafaaeff1e580d3788bc2722154a692c7b3cfeb72a78fd71b5e54d24e7ecdbdf60

Download Submit
C:\Users\Admin\Desktop\MountExport.html

Filesize
691KB

MD5
0000b842bec8ae94b7ac113cd9825110

SHA1
b4344c4979f8e9ff5b672499ea77b5e052b5bd2d

SHA256
f5cf193e382e202dc85e4ce1c81d59eee8f84df958d7ee0fbedb3d0b983cb0b2

SHA512
d5aca2f6cb4ad053727488e7c3b72383c4948b8e97721847b2704892a799ec13e2f920aaa570ef7d518cd6f69788129b7e7b1bc97f75998617fb26625a1083fe

Download Submit
C:\Users\Admin\Desktop\MountSearch.wmf

Filesize
844KB

MD5
80492310b1b71ff0701b374da3408ffc

SHA1
18350cbae4722d66222032725878e32f94e770b9

SHA256
2a33afdd10f0683b78634c67d1bd8c08a06479027a6ebbec555bea4adf6e985a

SHA512
6567441534733e64e83689c915f00a92b5af7e8f315d138c7c67659657e51a274ac111d2847f17fa1759866e16a81dc6737f2f85087f0ed683e6b7b9d3326add

Download Submit
C:\Users\Admin\Desktop\MoveGet.ps1

Filesize
806KB

MD5
ed315f85e30725675604a1eaad4f6ec5

SHA1
c058db1adb727f2e039eec56bee2af6ea9b6a2fc

SHA256
5ab8894e44a6d1f8bd449d7cd37214d613550b8d80d3d175efd68c08d9d050fa

SHA512
7596437f1a8a466dda677230392f470216c02ff618bb2b5fc569877f5f01831b5418445b4fd8f7c331a11540707852d667c44b07538e6550ffbfb9ff8416d9d9

Download Submit
C:\Users\Admin\Desktop\PopResize.dll

Filesize
1.0MB

MD5
23ce5932d45ba5c5ae15e971bc60633a

SHA1
060b51a06f2a0603cfef39573ef08444316433ae

SHA256
5cbf070c6094c960b0537691b02491fc154d5f6f7783a3f6f99f20e87e1e10ee

SHA512
3b6fd6e935bec5c017a3791d5bde0320ad1bffb1930a8975d1a4a1946c797773c6c30906975a84c3d86cb3f2c9c5e799f64575ccee7395709b993ca865c6f0ce

Download Submit
C:\Users\Admin\Desktop\PublishUnprotect.ps1xml

Filesize
960KB

MD5
41f8cab646e82caab9cab6465ab2d2ee

SHA1
fb73197e812d160deb77e1a5a7ef8836d3682f92

SHA256
329aa1d292740d06f872611697a07c45ea4fb49e837e772a2793a93c20f3e026

SHA512
f93fbc1d730e8928b8d035e860a53007d66b008a36b4c495fb8f60e9caa30813ba976874eeaa84a63d04fc87a15859aaac3d08468aa05f7e87f0a1233ef069c8

Download Submit
C:\Users\Admin\Desktop\PushOut.mp3

Filesize
460KB

MD5
2abc656999475ddc0ac0a105c9f6dd26

SHA1
9fec5a463499fd37db4ea13b2cc45ce619c5f4cb

SHA256
27f946a6febea1825b05da5e326dd0ebb9fad6de48ddd3916895c46b68ddccc7

SHA512
fde8334a54ea58ecff5475e5a87ad3979eabf2360dc84e0499b74d4ff6e8997eeb15b9c31e5cecffd33e2e3e51032a757b2ff8e254f01e7bac98cfcac99fa06e

Download Submit
C:\Users\Admin\Desktop\RemoveJoin.docx

Filesize
12KB

MD5
03205ab97ced76819ddac24bdc3e0eef

SHA1
3fbff3d8e97101a29fe984e875679a17d61660c1

SHA256
6408be05e59788a0cecb95381db8ee07ed2cec28295a02e6e3c35f62cdd8a5a3

SHA512
e8933aee5441397df76adeb613ea14ef0e90ad5293651a4a99778c4455559b5f00ecee422ded34deaace73c825ec82a55ccb486e3cd0980e23fe1f92e477978f

Download Submit
C:\Users\Admin\Desktop\RequestGet.docx

Filesize
13KB

MD5
4c749c30ddf4fcc29bc1af80c3855167

SHA1
1b23ed04cdf1e33ef5dbf62a933dc1c8760dc039

SHA256
1e41196e0b51cd4a2fe66e0185ba67c63fc7cd2ed87c789470169bef6e6ddc1a

SHA512
fe3fc52980f53bae252b68a4cd6cd193326268ea59b98ba8d2efba364f6e63128cc67cc249965d54ed2135971b1fa52e2925d0c5e5aa5fb820c69cd979d66167

Download Submit
C:\Users\Admin\Desktop\ResumeWrite.xlsx

Filesize
13KB

MD5
e2820d028c533ac684fb5c6e9e33606d

SHA1
688cd0daa6895d368989c6ebdfb8802a3e86a572

SHA256
baf0b81a0eaa6488ef7a816eeecb2b61169eb4e98110ce5f4778f232237f2779

SHA512
888e8150e03558df76847656a85219f5a2b589ca1d6112d5350f67182673523df46d874a225825a7830b8da5b8d53b18fbe46f08f62529e0cc1250a66d1b27f2

Download Submit
C:\Users\Admin\Desktop\ShowInitialize.bmp

Filesize
422KB

MD5
996959a3285dfcd6c9ed33d333ae2b9d

SHA1
dc71875e44bfc5b612745c8ba00e86f49b5b9f14

SHA256
83cc2669e9b8b2b950f7288f9003e71b9a16def04106692bac3491242ba74335

SHA512
18471eaedb3c0c39b8bbe049038702815d8eaebd45d17f0ab53ddca979147f3c6f1f096a90dca1192ff10b9304b8c4043da013d4a42abfd45b4ecc3789610bb8

Download Submit
C:\Users\Admin\Downloads\ErisimEngeli.zip.crdownload

Filesize
2.4MB

MD5
9941b21868922cc214ae69b1dbc7452c

SHA1
9a4e7d8d0ced13948423aca12e9cd772d2c62bd4

SHA256
79adb6b9405c73db160ea4be1b036c32197b1890bdcf0b32b082a703efeabf18

SHA512
9e3c74a4a6a293bb7cb9066ebbcdb2b9bc9862b8928b9e73c29109db56e0d8d62b60589089f0b037b3e0744995c5f71c01c9583b078e517c24138f4ff973f665

Download Submit
C:\Users\Public\Desktop\Acrobat Reader DC.lnk

Filesize
2KB

MD5
2beee381eec552fe5127943ef5630ec4

SHA1
4011cf31d159be18d21be562b53e580a2096d1b0

SHA256
8a3f782de8d1e19fa29729c52619ebd4b53754d67caea991271353e1183de0ea

SHA512
34057bb25ae0ec7aefc62a13aab9314231a7026253436f30c3668f11c32abdd0d6c3f02916955ff6cd57eeaf3a9863e0a5877ba247bfa8987b259993558fac31

Download Submit
C:\Users\Public\Desktop\Firefox.lnk

Filesize
1000B

MD5
ca1bdbd69d8d3776b33514b79f17429c

SHA1
8341752364c369e5960240ce4e347c086557513a

SHA256
61841c3cabefe1f8ee352a3f33c14840312b186eaeafc14145bfc4159ccf8166

SHA512
b47360d5deda7b7f600f58d8b19d0eb1483d9a7d50c0b0d57af119bde6b7cc0a10104dec07149c979a6557bbe04c4bc22fa592a180bff3d0c1d5c5a1220865a5

Download Submit
C:\Users\Public\Desktop\Google Chrome.lnk

Filesize
2KB

MD5
3709a355a638aebdb1350ff018f77ae5

SHA1
45442b2d212ee8b0c194777b63086b9d55132a14

SHA256
ddaf07db8706ab30cf4eaa6f0c7b68865ef7aeab3140fb51b14f651e6b81a844

SHA512
8bd3088201a8fae05df5daf7d263f886936ce9957a300b6b178bb1e1d9de46628303dae5771a87f756ecef625ea9fc2a2e402b9af7d5dad669bced955a2b1a94

Download Submit
C:\Users\Public\Desktop\VLC media player.lnk

Filesize
923B

MD5
2a44c89d6fe76c51263f1c6fa9ad8fc4

SHA1
c93e8fe25efcd3a6a6e98998107d4a694eeaa27f

SHA256
f04aa42d077edf1bd96f4594f2d0be7cfb7516e2e4300607b8b94df823708893

SHA512
dd61910a4e1ed38afb481c69c574ef6649967fa24ddfe4bd27017fcc1a82dc00f78c279756988b890ecb37c2df32c422ce2865fe5a8f3435a06a981138b9157f

Download Submit
memory/536-1003-0x0000021C7DD60000-0x0000021C7DD61000-memory.dmp

Filesize
4KB

Download
memory/536-1005-0x0000021C7DD60000-0x0000021C7DD61000-memory.dmp

Filesize
4KB

Download
memory/536-998-0x0000021C7DD60000-0x0000021C7DD61000-memory.dmp

Filesize
4KB

Download
memory/536-997-0x0000021C7DD60000-0x0000021C7DD61000-memory.dmp

Filesize
4KB

Download
memory/536-1006-0x0000021C7DD60000-0x0000021C7DD61000-memory.dmp

Filesize
4KB

Download
memory/536-1004-0x0000021C7DD60000-0x0000021C7DD61000-memory.dmp

Filesize
4KB

Download
memory/536-1002-0x0000021C7DD60000-0x0000021C7DD61000-memory.dmp

Filesize
4KB

Download
memory/536-1001-0x0000021C7DD60000-0x0000021C7DD61000-memory.dmp

Filesize
4KB

Download
memory/536-999-0x0000021C7DD60000-0x0000021C7DD61000-memory.dmp

Filesize
4KB

Download
memory/960-533-0x000000000A470000-0x000000000A48E000-memory.dmp

Filesize
120KB

Download
memory/960-525-0x00000000003E0000-0x00000000004AE000-memory.dmp

Filesize
824KB

Download
memory/960-531-0x000000000A350000-0x000000000A3C6000-memory.dmp

Filesize
472KB

Download
memory/960-529-0x0000000005970000-0x0000000005B82000-memory.dmp

Filesize
2.1MB

Download
memory/960-528-0x0000000004DF0000-0x0000000004DFA000-memory.dmp

Filesize
40KB

Download
memory/960-527-0x0000000004D40000-0x0000000004DD2000-memory.dmp

Filesize
584KB

Download
memory/960-526-0x00000000053C0000-0x0000000005964000-memory.dmp

Filesize
5.6MB

Download
memory/1156-1605-0x0000000004530000-0x0000000004531000-memory.dmp

Filesize
4KB

Download
memory/1632-987-0x0000017078770000-0x0000017078792000-memory.dmp

Filesize
136KB

Download
memory/1632-988-0x0000017078B60000-0x0000017078BA4000-memory.dmp

Filesize
272KB

Download
memory/1632-989-0x0000017078C30000-0x0000017078CA6000-memory.dmp

Filesize
472KB

Download
memory/2228-571-0x0000000007A70000-0x0000000007B06000-memory.dmp

Filesize
600KB

Download
memory/2228-552-0x0000000005ED0000-0x0000000006224000-memory.dmp

Filesize
3.3MB

Download
memory/2228-570-0x0000000007860000-0x000000000786A000-memory.dmp

Filesize
40KB

Download
memory/2228-569-0x00000000077F0000-0x000000000780A000-memory.dmp

Filesize
104KB

Download
memory/2228-568-0x0000000007E30000-0x00000000084AA000-memory.dmp

Filesize
6.5MB

Download
memory/2228-567-0x00000000076C0000-0x0000000007763000-memory.dmp

Filesize
652KB

Download
memory/2228-566-0x0000000007690000-0x00000000076AE000-memory.dmp

Filesize
120KB

Download
memory/2228-556-0x000000006EBD0000-0x000000006EC1C000-memory.dmp

Filesize
304KB

Download
memory/2228-555-0x0000000007650000-0x0000000007682000-memory.dmp

Filesize
200KB

Download
memory/2228-554-0x0000000006520000-0x000000000656C000-memory.dmp

Filesize
304KB

Download
memory/2228-553-0x00000000064E0000-0x00000000064FE000-memory.dmp

Filesize
120KB

Download
memory/2228-573-0x0000000007A20000-0x0000000007A2E000-memory.dmp

Filesize
56KB

Download
memory/2228-538-0x0000000003040000-0x0000000003076000-memory.dmp

Filesize
216KB

Download
memory/2228-547-0x0000000005DA0000-0x0000000005E06000-memory.dmp

Filesize
408KB

Download
memory/2228-541-0x00000000056F0000-0x0000000005756000-memory.dmp

Filesize
408KB

Download
memory/2228-540-0x0000000005650000-0x0000000005672000-memory.dmp

Filesize
136KB

Download
memory/2228-539-0x0000000005770000-0x0000000005D98000-memory.dmp

Filesize
6.2MB

Download
memory/2228-572-0x00000000079F0000-0x0000000007A01000-memory.dmp

Filesize
68KB

Download
memory/2228-574-0x0000000007A30000-0x0000000007A44000-memory.dmp

Filesize
80KB

Download
memory/2228-576-0x0000000007B10000-0x0000000007B18000-memory.dmp

Filesize
32KB

Download
memory/2228-575-0x0000000007B30000-0x0000000007B4A000-memory.dmp

Filesize
104KB

Download
memory/2312-1454-0x0000000002530000-0x0000000002531000-memory.dmp

Filesize
4KB

Download
memory/3716-1013-0x0000000003770000-0x0000000003771000-memory.dmp

Filesize
4KB

Download
memory/3868-581-0x000001FABD3B0000-0x000001FABD3B1000-memory.dmp

Filesize
4KB

Download
memory/3868-587-0x000001FABD3B0000-0x000001FABD3B1000-memory.dmp

Filesize
4KB

Download
memory/3868-588-0x000001FABD3B0000-0x000001FABD3B1000-memory.dmp

Filesize
4KB

Download
memory/3868-589-0x000001FABD3B0000-0x000001FABD3B1000-memory.dmp

Filesize
4KB

Download
memory/3868-590-0x000001FABD3B0000-0x000001FABD3B1000-memory.dmp

Filesize
4KB

Download
memory/3868-591-0x000001FABD3B0000-0x000001FABD3B1000-memory.dmp

Filesize
4KB

Download
memory/3868-586-0x000001FABD3B0000-0x000001FABD3B1000-memory.dmp

Filesize
4KB

Download
memory/3868-585-0x000001FABD3B0000-0x000001FABD3B1000-memory.dmp

Filesize
4KB

Download
memory/3868-579-0x000001FABD3B0000-0x000001FABD3B1000-memory.dmp

Filesize
4KB

Download
memory/3868-580-0x000001FABD3B0000-0x000001FABD3B1000-memory.dmp

Filesize
4KB

Download
memory/4300-1313-0x0000000004A60000-0x0000000004A61000-memory.dmp

Filesize
4KB

Download
memory/4332-1162-0x0000000003240000-0x0000000003241000-memory.dmp

Filesize
4KB

Download
memory/4736-1456-0x00000142BBD00000-0x00000142BBE00000-memory.dmp

Filesize
1024KB

Download
memory/4736-1484-0x00000142BD1E0000-0x00000142BD200000-memory.dmp

Filesize
128KB

Download
memory/4736-1470-0x00000142BCDD0000-0x00000142BCDF0000-memory.dmp

Filesize
128KB

Download
memory/4736-1457-0x00000142BBD00000-0x00000142BBE00000-memory.dmp

Filesize
1024KB

Download
memory/4736-1461-0x00000142BCE10000-0x00000142BCE30000-memory.dmp

Filesize
128KB

Download
memory/4736-1458-0x00000142BBD00000-0x00000142BBE00000-memory.dmp

Filesize
1024KB

Download
memory/4768-1169-0x000002166ECD0000-0x000002166ECF0000-memory.dmp

Filesize
128KB

Download
memory/4768-1190-0x000002166F2A0000-0x000002166F2C0000-memory.dmp

Filesize
128KB

Download
memory/4768-1178-0x000002166EC90000-0x000002166ECB0000-memory.dmp

Filesize
128KB

Download
memory/4768-1164-0x000002166DD70000-0x000002166DE70000-memory.dmp

Filesize
1024KB

Download
memory/4988-1015-0x0000021122C00000-0x0000021122D00000-memory.dmp

Filesize
1024KB

Download
memory/4988-1027-0x0000021123D20000-0x0000021123D40000-memory.dmp

Filesize
128KB

Download
memory/4988-1037-0x0000021124120000-0x0000021124140000-memory.dmp

Filesize
128KB

Download
memory/4988-1020-0x0000021123D60000-0x0000021123D80000-memory.dmp

Filesize
128KB

Download
memory/5036-1337-0x00000162B6800000-0x00000162B6820000-memory.dmp

Filesize
128KB

Download
memory/5036-1325-0x00000162B6400000-0x00000162B6420000-memory.dmp

Filesize
128KB

Download
memory/5036-1320-0x00000162B6440000-0x00000162B6460000-memory.dmp

Filesize
128KB

Download
memory/5036-1316-0x00000162B5300000-0x00000162B5400000-memory.dmp

Filesize
1024KB

Download
memory/5036-1315-0x00000162B5300000-0x00000162B5400000-memory.dmp

Filesize
1024KB

Download