ebbcb489171abfcfce56554dbaeacd22a15838391cbc7c756db02995129def5a

max time kernel
1800s
max time network
1798s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
02/11/2024, 08:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Bootstrapper.exe
Size

800KB
MD5

2a4dcf20b82896be94eb538260c5fb93
SHA1

21f232c2fd8132f8677e53258562ad98b455e679
SHA256

ebbcb489171abfcfce56554dbaeacd22a15838391cbc7c756db02995129def5a
SHA512

4f1164b2312fb94b7030d6eb6aa9f3502912ffa33505f156443570fc964bfd3bb21ded3cf84092054e07346d2dce83a0907ba33f4ba39ad3fe7a78e836efe288
SSDEEP

12288:t0zVvgDNMoWjTmFzAzBocaKjyWtiR1pptHxQ0z:O5vgHWjTwAlocaKjyyItHDz

Score

10^/10

credential_access defense_evasion discovery evasion motw persistence phishing privilege_escalation spyware stealer trojan

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\userinit = "C:\\Windows\\system32\\userinit.exe,"	WRSA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe"	WRSA.exe

Modifies firewall policy service 3 TTPs 6 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\DisableNotifications = "0"	WRSA.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile	WRSA.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\DisableNotifications = "0"	WRSA.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	WRSA.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0"	WRSA.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile	WRSA.exe

Suspicious use of NtCreateProcessExOtherParentProcess 6 IoCs

description	pid	Process	procid_target
PID 3732 created 2560	3732	taskmgr.exe	199
PID 3732 created 2560	3732	taskmgr.exe	199
PID 3732 created 2560	3732	taskmgr.exe	199
PID 3732 created 2560	3732	taskmgr.exe	199
PID 3732 created 2560	3732	taskmgr.exe	199
PID 3732 created 2560	3732	taskmgr.exe	199

Windows security bypass 2 TTPs 12 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "0"	WRSA.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "0"	WRSA.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntivirusOverride = "0"	WRSA.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "0"	WRSA.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\FirewallDisableNotify = "0"	WRSA.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\FirewallOverride = "0"	WRSA.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\AntivirusOverride = "0"	WRSA.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\UacDisableNotify = "0"	WRSA.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\UpdatesDisableNotify = "0"	WRSA.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "0"	WRSA.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\AntiVirusDisableNotify = "0"	WRSA.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "0"	WRSA.exe

Disables RegEdit via registry modification 2 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "0"	WRSA.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "0"	WRSA.exe

Disables Task Manager via registry modification
evasion

Disables cmd.exe use via registry modification 2 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "0"	WRSA.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "0"	WRSA.exe

Downloads MZ/PE file

Drops file in Drivers directory 12 IoCs

description	ioc	Process
File created	C:\Windows\system32\drivers\pYkwqpOQ.sys	WRSA.exe
File opened for modification	C:\Windows\system32\drivers\WRBoot.sys	WRSA.exe
File created	C:\Windows\system32\drivers\WRCore.x64.sys	MSIB91F.tmp
File created	C:\Windows\system32\drivers\WRCore.x64.sys	MSI2E3.tmp
File created	C:\Windows\system32\drivers\WRCore.x64.sys	MSIFA58.tmp
File opened for modification	C:\Windows\system32\drivers\WRCore.x64.sys	MSIFA58.tmp
File created	C:\Windows\system32\drivers\oicYHMyV.sys	WRSA.exe
File opened for modification	C:\Windows\system32\drivers\WRBoot.sys	wsainstall.exe
File created	C:\Windows\system32\drivers\WRkrn.sys	WRSA.exe
File opened for modification	C:\Windows\system32\drivers\WRCore.x64.sys	MSIB91F.tmp
File opened for modification	C:\Windows\system32\drivers\WRCore.x64.sys	MSI2E3.tmp
File created	C:\Windows\system32\drivers\jGwAAcsC.sys	WRSA.exe

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 12 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WRSkyClient.x64.exe	MSIFD86.tmp
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WRSkyClient.x64.exe\MitigationAuditOptions = 00000000200000000000000000000000	MSI2E3.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WRSkyClient.x64.exe	MSIFA58.tmp
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WRSkyClient.x64.exe\MitigationAuditOptions = 00000000200000000000000000000000	MSIFA58.tmp
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WRSkyClient.x64.exe	MSIBD18.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WRSkyClient.x64.exe	MSI2E3.tmp
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WRSkyClient.x64.exe\MitigationOptions = 00000000100000000000000000000000	MSI2E3.tmp
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WRSkyClient.x64.exe	MSI43C.tmp
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WRSkyClient.x64.exe\MitigationOptions = 00000000100000000000000000000000	MSIFA58.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WRSkyClient.x64.exe	MSIB91F.tmp
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WRSkyClient.x64.exe\MitigationOptions = 00000000100000000000000000000000	MSIB91F.tmp
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WRSkyClient.x64.exe\MitigationAuditOptions = 00000000200000000000000000000000	MSIB91F.tmp

Looks for Xen service registry key. 1 TTPs 5 IoCs

evasion

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\xensvc	WRSA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\xensvc	WRSA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\xensvc	WRSA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\xensvc	WRSA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\xensvc	WRSA.exe

Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs

persistence

Terminal Services DLL

T1505.005

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\BITS\Parameters\ServiceDll = "%SystemRoot%\\System32\\qmgr.dll"	WRSA.exe

Sets service image path in registry 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WRkrn\ImagePath = "System32\\drivers\\WRkrn.sys"	WRSA.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WRBoot\ImagePath = "System32\\drivers\\WRBoot.sys"	WRSA.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Schedule\ImagePath = "%SystemRoot%\\System32\\svchost.exe -k netsvcs"	WRSA.exe

Uses Session Manager for persistence 2 TTPs 1 IoCs

Creates Session Manager registry key to run executable early in system boot.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Session Manager\BootExecute = 6100750074006f0063006800650063006b0020006100750074006f00630068006b0020002a0000000000	WRSA.exe

Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
credential_access stealer

Windows Credential Manager
T1555.004

Deletes itself 1 IoCs

pid	Process
5392	WRSA.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 20 IoCs

pid	Process
2408	Solara.exe
2640	wsainstall.exe
2560	WRSA.exe
5392	WRSA.exe
5892	MSIB91F.tmp
5088	MSIB91F.tmp
4796	MSIBD18.tmp
1200	MSIBD18.tmp
8844	WRSA.exe
9016	WRSA.exe
5852	WRSA.exe
7536	WRSA.exe
4468	MSI2E3.tmp
6628	MSI2E3.tmp
5900	MSI43C.tmp
2920	MSI43C.tmp
5352	MSIFA58.tmp
5784	MSIFA58.tmp
5560	MSIFD86.tmp
5136	MSIFD86.tmp

Loads dropped DLL 24 IoCs

pid	Process
4796	MsiExec.exe
4796	MsiExec.exe
4832	MsiExec.exe
4832	MsiExec.exe
4832	MsiExec.exe
4832	MsiExec.exe
4832	MsiExec.exe
2724	MsiExec.exe
2724	MsiExec.exe
2724	MsiExec.exe
4796	MsiExec.exe
2540	Process not Found
5392	WRSA.exe
4868	MsiExec.exe
8628	rundll32.exe
3336	Explorer.EXE
5392	WRSA.exe
2560	WRSA.exe
2560	WRSA.exe
8844	WRSA.exe
9016	WRSA.exe
5852	WRSA.exe
6048	MsiExec.exe
900	MsiExec.exe

Modifies system executable filetype association 2 TTPs 12 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"%1\" %*"	WRSA.exe
Key created	\REGISTRY\MACHINE\Software\Classes\comfile\shell\open\command	WRSA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"%1\" %*"	WRSA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"%1\" %*"	WRSA.exe
Key created	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\exefile\shell	WRSA.exe
Key created	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\exefile\shell\open	WRSA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*"	WRSA.exe
Key created	\REGISTRY\MACHINE\Software\Classes\batfile\shell\open\command	WRSA.exe
Key created	\REGISTRY\MACHINE\Software\Classes\piffile\shell\open\command	WRSA.exe
Key created	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\exefile\shell\open\command	WRSA.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\exefile\shell\open\command\ = "\"%1\" %*"	WRSA.exe
Key created	\REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command	WRSA.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Unexpected DNS network traffic destination 64 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1

Windows security modification 2 TTPs 25 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Security Center\Monitoring\SymantecAntiVirus	WRSA.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Monitoring\SymantecAntiVirus\DisableMonitoring = "0"	WRSA.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\AntiVirusDisableNotify = "0"	WRSA.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\FirewallOverride = "0"	WRSA.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntivirusOverride = "0"	WRSA.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "0"	WRSA.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\AutoUpdateDisableNotify = "0"	WRSA.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Monitoring\DisableMonitoring = "0"	WRSA.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\FirewallDisableNotify = "0"	WRSA.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "0"	WRSA.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\AntivirusOverride = "0"	WRSA.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\UacDisableNotify = "0"	WRSA.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\AntiSpywareDisableNotify = "0"	WRSA.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\InternetSettingsDisableNotify = "0"	WRSA.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "0"	WRSA.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Security Center\Svc	WRSA.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "0"	WRSA.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Monitoring\SymantecFirewall\DisableMonitoring = "0"	WRSA.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Security Center\Monitoring\SymantecFirewall	WRSA.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiSpywareDisableNotify = "0"	WRSA.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AutoUpdateDisableNotify = "0"	WRSA.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\InternetSettingsDisableNotify = "0"	WRSA.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "0"	WRSA.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\UpdatesDisableNotify = "0"	WRSA.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Security Center\Monitoring	WRSA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WRSVC = "\"C:\\Program Files\\Webroot\\WRSA.exe\" -ul"	WRSA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\pvcnh0	WRSA.exe

Blocklisted process makes network request 4 IoCs

flow	pid	Process
10	912	msiexec.exe
11	912	msiexec.exe
12	912	msiexec.exe
1117	4868	MsiExec.exe

Checks for any installed AV software in registry 1 TTPs 1 IoCs

Security Software Discovery

T1518.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\a2AntiMalware	Explorer.EXE

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	WRSA.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\E:	WRSA.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	WRSA.exe
File opened (read-only)	\??\F:	WRSA.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\L:	WRSA.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\S:	WRSA.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe

Indicator Removal: Clear Persistence 1 TTPs 51 IoCs

remove IFEO.

defense_evasion

Clear Persistence

T1070.009

description	ioc	Process
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe\debugger	WRSA.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msosrec.exe\debugger	WRSA.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\onenote.exe\debugger	WRSA.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\runtimebroker.exe\debugger	WRSA.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WRSkyClient.x64.exe	MSIBD18.tmp
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroRd32.exe\debugger	WRSA.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\graph.exe\debugger	WRSA.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mshta.exe\debugger	WRSA.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RdrServicesUpdater.exe\debugger	WRSA.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msoadfsb.exe\debugger	WRSA.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msosync.exe\debugger	WRSA.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe\debugger	WRSA.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powerpnt.exe\debugger	WRSA.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SystemSettings.exe\debugger	WRSA.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\clview.exe\debugger	WRSA.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GoogleUpdate.exe\debugger	WRSA.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ie4uinit.exe\debugger	WRSA.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winword.exe\debugger	WRSA.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iexplore.exe\debugger	WRSA.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ngentask.exe\debugger	WRSA.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PrintIsolationHost.exe\debugger	WRSA.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\orgchart.exe\debugger	WRSA.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sdxhelper.exe\debugger	WRSA.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\setlang.exe\debugger	WRSA.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\excel.exe\debugger	WRSA.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\excelcnv.exe\debugger	WRSA.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msqry32.exe\debugger	WRSA.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mscorsvw.exe\debugger	WRSA.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msohtmed.exe\debugger	WRSA.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msoxmled.exe\debugger	WRSA.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ngen.exe\debugger	WRSA.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PrintDialog.exe\debugger	WRSA.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroRd32Info.exe\debugger	WRSA.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ielowutil.exe\debugger	WRSA.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MRT.exe\debugger	WRSA.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svchost.exe\debugger	WRSA.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\debugger	WRSA.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wordconv.exe\debugger	WRSA.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WRSkyClient.x64.exe	MSI43C.tmp
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WRSkyClient.x64.exe	MSIFD86.tmp
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ExtExport.exe\debugger	WRSA.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msoasb.exe\debugger	WRSA.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PresentationHost.exe\debugger	WRSA.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\onenotem.exe\debugger	WRSA.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RdrCEF.exe\debugger	WRSA.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\selfcert.exe\debugger	WRSA.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\splwow64.exe\debugger	WRSA.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spoolsv.exe\debugger	WRSA.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ieinstal.exe\debugger	WRSA.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ieUnatt.exe\debugger	WRSA.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msfeedssync.exe\debugger	WRSA.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs

Web Service

T1102

flow	ioc
13	yandex.com
29	yandex.com
32	yandex.com
40	pastebin.com
51	pastebin.com

Maps connected drives based on registry 3 TTPs 6 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	WRSA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	WRSA.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	WRSA.exe
Key value enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	WRSA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	WRSA.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	WRSA.exe

Mark of the Web detected: This indicates that the page was originally saved or cloned. 1 IoCs

phishing motw

flow	ioc
635	https://storage.googleapis.com/script.aniview.com/ssync/62f53b2c7850d0786f227f64/ssync.html

Modifies WinLogon 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SfcQuota = "4294967295"	WRSA.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "0"	WRSA.exe

Boot or Logon Autostart Execution: Authentication Package 1 TTPs 2 IoCs

Suspicious Windows Authentication Registry Modification.

persistence privilege_escalation

Authentication Package

T1547.002

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Lsa\Authentication Packages = 6d007300760031005f00300000000000	WRSA.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Lsa\Notification Packages = 73006300650063006c00690000000000	WRSA.exe

Drops autorun.inf file 1 TTPs 3 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\autorun.inf	WRSA.exe
File opened for modification	F:\autorun.inf	WRSA.exe
File opened for modification	C:\Windows\autorun.inf	WRSA.exe

Drops file in System32 directory 37 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\206742EA5671D0AFB286434AEACBAD29	MsiExec.exe
File created	C:\Windows\SysWOW64\WRusr.dll.new	WRSA.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	WRSA.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	WRSA.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B4D2AF6F530C54A75160B3511A502C76	WRSA.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B4D2AF6F530C54A75160B3511A502C76	MsiExec.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B4D2AF6F530C54A75160B3511A502C76	MsiExec.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\206742EA5671D0AFB286434AEACBAD29	MsiExec.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8E98E754284A422CC3ACAABE73E0D55B	WRSA.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F9C57C8B55E84B295CBBD8CF3D95BF44	WRSA.exe
File created	C:\Windows\SysWOW64\WRDll.x86.dll	msiexec.exe
File created	C:\Windows\system32\qq0pbq.exe	WRSA.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B4D2AF6F530C54A75160B3511A502C76	WRSA.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\206742EA5671D0AFB286434AEACBAD29	WRSA.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F2E248BEDDBB2D85122423C41028BFD4	WRSA.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	WRSA.exe
File created	C:\Windows\SysWOW64\WRDll.x86.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\59194E40068A745EF528E8E18DD529F2	WRSA.exe
File created	C:\Windows\system32\WRDll.x64.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\206742EA5671D0AFB286434AEACBAD29	WRSA.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B749ED954EEEE8F51A69CEDBC94BC76	WRSA.exe
File created	C:\windows\system32\hMBHTwuz_WR_.tmp	WRSA.exe
File opened for modification	C:\Windows\SysWOW64\WRusr.dll	WRSA.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	WRSA.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C56C4404C4DEF0DC88E5FCD9F09CB2F1	WRSA.exe
File opened for modification	C:\Windows\system32\qq0pbq.exe.vir	WRSA.exe
File created	C:\Windows\SysWOW64\WRusr.dll	WRSA.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F2E248BEDDBB2D85122423C41028BFD4	WRSA.exe
File opened for modification	C:\Windows\SysWOW64\WRusr.dll.new	WRSA.exe
File created	C:\Windows\system32\WRDll.x64.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C56C4404C4DEF0DC88E5FCD9F09CB2F1	WRSA.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F9C57C8B55E84B295CBBD8CF3D95BF44	WRSA.exe
File opened for modification	C:\Windows\system32\qq0pbq.exe	WRSA.exe
File created	C:\Windows\system32\WRusr.dll	WRSA.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8E98E754284A422CC3ACAABE73E0D55B	WRSA.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B749ED954EEEE8F51A69CEDBC94BC76	WRSA.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\59194E40068A745EF528E8E18DD529F2	WRSA.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\tar\lib\unpack.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\sigstore\dist\tlog\types\index.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\minipass-sized\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\clone\clone.iml	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\sigstore\dist\ca\index.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\lib\utils\did-you-mean.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\docs\content\commands\npm.md	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\qrcode-terminal\example\basic.png	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\string_decoder\lib\string_decoder.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\cacache\lib\get.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\lib\commands\owner.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\sigstore\dist\ca\verify\sct.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\cli-table3\index.d.ts	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\iconv-lite\lib\index.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\sigstore\dist\identity\provider.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\rimraf\node_modules\minimatch\minimatch.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\emoji-regex\es2015\text.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\corepack\shims\nodewin\yarnpkg.cmd	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\man\man1\npm-install-test.1	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\abort-controller\browser.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\man\man1\npm-ci.1	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\clean-stack\license	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\node_modules\cacache\lib\content\path.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\columnify\Makefile	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\lib\utils\read-user-info.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\gyp\CODE_OF_CONDUCT.md	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\events\tests\prepend.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\docs\output\commands\npm-update.html	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\promise-inflight\inflight.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\just-diff\LICENSE	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\delegates\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\lib\utils\tar.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\sigstore\dist\types\sigstore\serialized.d.ts	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\docs\output\commands\npm-search.html	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\glob\node_modules\minimatch\LICENSE	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\string-width\index.d.ts	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\iconv-lite\encodings\internal.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\cli-columns\color.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\gyp\pylib\gyp\MSVSUtil.py	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\lib\utils\web-auth.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\docs\output\commands\npm-shrinkwrap.html	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\rimraf\node_modules\glob\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\events\tests\special-event-names.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\is-core-module\LICENSE	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\once\once.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\docs\output\commands\npm-ping.html	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\tuf-js\dist\utils\oid.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\node_modules\cacache\lib\content\rm.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\agentkeepalive\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\spdx-expression-parse\AUTHORS	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\node_modules\readable-stream\CONTRIBUTING.md	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\ip\lib\ip.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\docs\content\commands\npx.md	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\man\man1\npm-root.1	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\corepack\shims\nodewin\corepack	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\hosted-git-info\lib\from-url.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\gyp\pylib\gyp\MSVSVersion.py	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\infer-owner\index.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\postcss-selector-parser\dist\selectors\constructors.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\pacote\lib\util\add-git-sha.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\node_modules\gauge\lib\base-theme.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\corepack\shims\yarnpkg	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\are-we-there-yet\lib\tracker-group.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\minipass-collect\node_modules\minipass\package.json	msiexec.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSIB8DF.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF56A3700EA666E4FB.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF9F8.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e5eb554.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB66D.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF50D10D186C57A225.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF079EB800F6CDDDFD.TMP	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBD18.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF8BAD8B6A00BE5E4D.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\e670050.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2E2.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e670056.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF10723FFC8FB0F32B.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF07CC945C3731BF63.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF822ED502C34805C1.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIACBD.tmp	msiexec.exe
File created	C:\Windows\Installer\{EFA235B5-C6A1-42E6-9BC9-02A8D56F1CDC}\NodeIcon	msiexec.exe
File created	C:\Windows\SystemTemp\~DF91AEF6461790ADB2.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFDFB10BAB5A74DA1F.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF583.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF663F21505B6820E7.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFD86.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{EFA235B5-C6A1-42E6-9BC9-02A8D56F1CDC}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC9DC.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{EFA235B5-C6A1-42E6-9BC9-02A8D56F1CDC}\NodeIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\SystemTemp\~DF7599B409557C21F3.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2C2.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DFCA6F3C387DF219F7.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI966F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAC7D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB91F.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF39B4029906E55700.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI10C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2E3.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF6D23507374BD8F9D.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF926FBC72288B289B.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC95E.tmp	msiexec.exe
File opened for modification	C:\Windows\ELAMBKUP\WRBoot.sys	wsainstall.exe
File opened for modification	C:\Windows\Installer\MSIA5C5.tmp	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\e67005a.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF160E8EB4A1698C0C.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFA47.tmp	msiexec.exe
File created	C:\Windows\Installer\e5891bc.msi	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\SystemTemp\~DF8D8C64A6825F9379.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFD1D216D4A9ED6584.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF19440BDEB65665E3.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF3BBD42D8EDA55DA0.TMP	msiexec.exe
File created	C:\Windows\Installer\e5891c0.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{2B71100E-79C7-4B1E-B06F-578429739047}	msiexec.exe
File created	C:\Windows\Installer\e670050.msi	msiexec.exe
File created	C:\Windows\Installer\e670054.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF10989A1277F6B91C.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF3F69D2EEA19CC3B6.TMP	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\Installer\MSIA5F4.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICCFB.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DFE999BBFF942D8EDA.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF604F642D41A519DF.TMP	msiexec.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\wsainstall.exe:Zone.Identifier	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wsainstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WRSA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WRSA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WRSA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wevtutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WRSA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WRSA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WRSA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe

Checks SCSI registry key(s) 3 TTPs 56 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	WRSA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM	WRSA.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM	WRSA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Device Parameters\Storport	WRSA.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A	WRSA.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Device Parameters	WRSA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties	WRSA.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM	WRSA.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Device Parameters\Storport	WRSA.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Device Parameters	WRSA.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	WRSA.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	WRSA.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	WRSA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties	WRSA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A	WRSA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties	WRSA.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Device Parameters	WRSA.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Device Parameters	WRSA.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Device Parameters\Storport	WRSA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Device Parameters	WRSA.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Device Parameters	WRSA.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Device Parameters	WRSA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	WRSA.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	WRSA.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	WRSA.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	WRSA.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	WRSA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	WRSA.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	WRSA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM	WRSA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	WRSA.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	WRSA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	WRSA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	WRSA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Device Parameters	WRSA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	WRSA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Device Parameters\Storport	WRSA.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	WRSA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Storport	WRSA.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM	WRSA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Device Parameters\Storport	WRSA.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM	WRSA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	WRSA.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	WRSA.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Storport	WRSA.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Device Parameters	WRSA.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Device Parameters\Storport	WRSA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties	WRSA.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A	WRSA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	WRSA.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1820	ipconfig.exe

Modifies Internet Explorer Phishing Filter 1 TTPs 3 IoCs

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000\Software\Microsoft\Internet Explorer\PhishingFilter\EnabledV8 = "1"	WRSA.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000\Software\Microsoft\Internet Explorer\PhishingFilter\EnabledV9 = "1"	WRSA.exe
Key created	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000\Software\Microsoft\Internet Explorer\PhishingFilter	WRSA.exe

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key deleted	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\TYPEDURLS	WRSA.exe
Key created	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000\Software\Microsoft\Internet Explorer\TypedUrls\	WRSA.exe
Key created	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	WRSA.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	WRSA.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Main	WRSA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Display Inline Images = "yes"	WRSA.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	WRSA.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E	MsiExec.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "0"	WRSA.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Policies\System\NoDispSettingsPage = "0"	WRSA.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL\CheckedValue = "1"	WRSA.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	MsiExec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2A\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2D\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2	WRSA.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Security Center\UpdatesDisableNotify = "0"	WRSA.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSetFolders = "0"	WRSA.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoEncryptOnMove = "0"	WRSA.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDesktop = "0"	WRSA.exe
Key created	\REGISTRY\USER\.DEFAULT\System\CurrentControlSet	WRSA.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	WRSA.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	MsiExec.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Security Center\Svc\FirewallOverride = "0"	WRSA.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2e\52C64B7E\@%SystemRoot%\System32\fveui.dll,-844 = "BitLocker Data Recovery Agent"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	MsiExec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	WRSA.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\system32\NgcRecovery.dll,-100 = "Windows Hello Recovery Key Encryption"	MsiExec.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Security Center\Svc\UacDisableNotify = "0"	WRSA.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	WRSA.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSaveSettings = "0"	WRSA.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop\NoAddingComponents = "0"	WRSA.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Classes\.exe	WRSA.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	WRSA.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\1406 = "1"	WRSA.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSetTaskbar = "0"	WRSA.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "0"	WRSA.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr = "0"	WRSA.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2C	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\30	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\1609 = "1"	WRSA.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\1609 = "1"	WRSA.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoWindowsUpdate = "0"	WRSA.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop\NoChangingWallpaper = "0"	WRSA.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL\CheckedValue = "1"	WRSA.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	MsiExec.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Security Center\Monitoring\DisableMonitoring = "0"	WRSA.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\ForceActiveDesktopOn = "0"	WRSA.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop	WRSA.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b\52C64B7E\@%SystemRoot%\System32\ci.dll,-100 = "Isolated User Mode (IUM)"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2c	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\1609 = "1"	WRSA.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop	WRSA.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\Windows\WindowsUpdate	WRSA.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b\52C64B7E\@%SystemRoot%\system32\NgcRecovery.dll,-100 = "Windows Hello Recovery Key Encryption"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	WRSA.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	MsiExec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDrives = "0"	WRSA.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop\NoHTMLWallpaper = "0"	WRSA.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\System\NoDispSettingsPage = "0"	WRSA.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\System\CurrentControlSet\Services\Ndisuio\Start = "3"	WRSA.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3	WRSA.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\Local Settings	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoChangeStartMenu = "0"	WRSA.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.reg	WRSA.exe
Key created	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\Software\Microsoft\Security Center\Monitoring\SymantecFirewall	WRSA.exe
Key created	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden	WRSA.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\E00117B27C97E1B40BF6754892370974	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InprocServer32	WRSA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.exe\ = "exefile"	WRSA.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "0"	WRSA.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\file\shell\open\command	WRSA.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\1609 = "1"	WRSA.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSetFolders = "0"	WRSA.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop\NoChangingWallpaper = "0"	WRSA.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\inifile	WRSA.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	chrome.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E00117B27C97E1B40BF6754892370974\Assignment = "1"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E00117B27C97E1B40BF6754892370974\SourceList\Media	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E00117B27C97E1B40BF6754892370974\SourceList	msiexec.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify\IconStreams = 140000000700000001000100060000001400000050003a005c00430065006200740065006e007a002000530076007900720066005c004a0072006f0065006200620067005c004a00450046004e002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000e8070b004a0072006f00650062006200670020004600720070006800650072004e0061006c006a0075007200650072002000690039002e0030002e00330038002e003300390020002d002000460070006e00610061007600610074002e002e002e000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000008b5b416c12218d418e602ec33614256b00000000000000000000000081c08f9c062ddb0174d99b0e072ddb010000000000000d20feb04a0072006f00650062006200670020005600610070002e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000050003a005c00480066007200650066005c004e0071007a00760061005c004e006300630051006e0067006e005c005900620070006e0079005c005a00760070006500620066006200730067005c00420061007200510065007600690072005c00420061007200510065007600690072002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f50100000000000000000000e8070a00420061007200510065007600690072000a004100620067002000660076007400610072007100200076006100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000fb779b30b018db0100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000e8070a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff75ae2078e323294282c1e41cb67d5b9c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000e8070a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff81ae2078e323294282c1e41cb67d5b9c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000e8070a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff82ae2078e323294282c1e41cb67d5b9c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000e8070a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff83ae2078e323294282c1e41cb67d5b9c00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1	WRSA.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDeletePrinter = "0"	WRSA.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0 = 3a002e803accbfb42cdb4c42b0297fe99a87c641260001002600efbe11000000a97e8dd7af18db01bc673d8a052ddb01bc673d8a052ddb0114000000	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDevMgrUpdate = "0"	WRSA.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\shellscrap	WRSA.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1}	WRSA.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	WRSA.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSaveSettings = "0"	WRSA.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\WRShellExt	WRSA.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\D11D5B053397BDB418D4B00F823E5195	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E00117B27C97E1B40BF6754892370974\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}	WRSA.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\LogicalViewMode = "3"	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{69D72956-317C-44bd-B369-8E44D4EF9802}\InProcServer32\ThreadingModel = "Apartment"	WRSA.exe
Key created	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer	WRSA.exe
Key created	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced	WRSA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.msi\ = "Msi.Package"	WRSA.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E00117B27C97E1B40BF6754892370974\Version = "17301530"	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL\CheckedValue = "1"	WRSA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.shs\ = "shellscrap"	WRSA.exe
Key created	\REGISTRY\MACHINE\Software\Classes\file\shell\open\command	WRSA.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E00117B27C97E1B40BF6754892370974\Language = "1033"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\Software\Microsoft\Windows	WRSA.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E00117B27C97E1B40BF6754892370974\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E00117B27C97E1B40BF6754892370974\SourceList\Media\1 = ";"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E00117B27C97E1B40BF6754892370974	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\Software\Microsoft\Security Center\InternetSettingsDisableNotify = "0"	WRSA.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSetTaskbar = "0"	WRSA.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell	WRSA.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5B532AFE1A6C6E24B99C208A5DF6C1CD\DeploymentFlags = "3"	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop\NoHTMLWallpaper = "0"	WRSA.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Policies\System\NoDispBackgroundPage = "0"	WRSA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\shellscrap\shell\open\command\ = "rundll32 %SystemRoot%\\system32\\shscrap.dll,OpenScrap_RunDLL %1"	WRSA.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\Software\Microsoft\Internet Explorer\PhishingFilter\EnabledV9 = "1"	WRSA.exe
Key created	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\Software\Microsoft\Windows\CurrentVersion	WRSA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.JSE\ = "jsefile"	WRSA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VBEFile\Shell\Open\Command\ = "\"%SystemRoot%\\System32\\WScript.exe\" \"%1\" %*"	WRSA.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoLogoff = "0"	WRSA.exe

Modifies system certificate store 2 TTPs 3 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4	WRSA.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 0f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703080b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac89988140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f1d0000000100000010000000a86dc6a233eb339610f3ed414927c559030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e42000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e	WRSA.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 190000000100000010000000ffac207997bb2cfe865570179ee037b9030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e41d0000000100000010000000a86dc6a233eb339610f3ed414927c559140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac899880b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e19962000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e	WRSA.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\wsainstall.exe:Zone.Identifier	chrome.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1208	Bootstrapper.exe
1208	Bootstrapper.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1160	chrome.exe
1160	chrome.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
912	msiexec.exe

Suspicious behavior: GetForegroundWindowSpam 4 IoCs

pid	Process
1432	taskmgr.exe
3336	Explorer.EXE
3732	taskmgr.exe
5852	WRSA.exe

Suspicious behavior: LoadsDriver 7 IoCs

pid	Process
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 64 IoCs

pid	Process
1160	chrome.exe
1160	chrome.exe
1160	chrome.exe
1160	chrome.exe
1160	chrome.exe
1160	chrome.exe
1160	chrome.exe
1160	chrome.exe
1160	chrome.exe
1160	chrome.exe
1160	chrome.exe
1160	chrome.exe
1160	chrome.exe
1160	chrome.exe
1160	chrome.exe
1160	chrome.exe
1160	chrome.exe
1160	chrome.exe
1160	chrome.exe
1160	chrome.exe
1160	chrome.exe
1160	chrome.exe
1160	chrome.exe
1160	chrome.exe
1160	chrome.exe
1160	chrome.exe
1160	chrome.exe
1160	chrome.exe
1160	chrome.exe
1160	chrome.exe
1160	chrome.exe
1160	chrome.exe
1160	chrome.exe
1160	chrome.exe
1160	chrome.exe
1160	chrome.exe
1160	chrome.exe
1160	chrome.exe
1160	chrome.exe
1160	chrome.exe
1160	chrome.exe
1160	chrome.exe
1160	chrome.exe
1160	chrome.exe
1160	chrome.exe
1160	chrome.exe
1160	chrome.exe
1160	chrome.exe
1160	chrome.exe
1160	chrome.exe
1160	chrome.exe
1160	chrome.exe
1160	chrome.exe
1160	chrome.exe
1160	chrome.exe
1160	chrome.exe
1160	chrome.exe
1160	chrome.exe
1160	chrome.exe
1160	chrome.exe
1160	chrome.exe
1160	chrome.exe
1160	chrome.exe
1160	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1432	taskmgr.exe
Token: SeSystemProfilePrivilege	1432	taskmgr.exe
Token: SeCreateGlobalPrivilege	1432	taskmgr.exe
Token: SeIncreaseQuotaPrivilege	3256	WMIC.exe
Token: SeSecurityPrivilege	3256	WMIC.exe
Token: SeTakeOwnershipPrivilege	3256	WMIC.exe
Token: SeLoadDriverPrivilege	3256	WMIC.exe
Token: SeSystemProfilePrivilege	3256	WMIC.exe
Token: SeSystemtimePrivilege	3256	WMIC.exe
Token: SeProfSingleProcessPrivilege	3256	WMIC.exe
Token: SeIncBasePriorityPrivilege	3256	WMIC.exe
Token: SeCreatePagefilePrivilege	3256	WMIC.exe
Token: SeBackupPrivilege	3256	WMIC.exe
Token: SeRestorePrivilege	3256	WMIC.exe
Token: SeShutdownPrivilege	3256	WMIC.exe
Token: SeDebugPrivilege	3256	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3256	WMIC.exe
Token: SeRemoteShutdownPrivilege	3256	WMIC.exe
Token: SeUndockPrivilege	3256	WMIC.exe
Token: SeManageVolumePrivilege	3256	WMIC.exe
Token: 33	3256	WMIC.exe
Token: 34	3256	WMIC.exe
Token: 35	3256	WMIC.exe
Token: 36	3256	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3256	WMIC.exe
Token: SeSecurityPrivilege	3256	WMIC.exe
Token: SeTakeOwnershipPrivilege	3256	WMIC.exe
Token: SeLoadDriverPrivilege	3256	WMIC.exe
Token: SeSystemProfilePrivilege	3256	WMIC.exe
Token: SeSystemtimePrivilege	3256	WMIC.exe
Token: SeProfSingleProcessPrivilege	3256	WMIC.exe
Token: SeIncBasePriorityPrivilege	3256	WMIC.exe
Token: SeCreatePagefilePrivilege	3256	WMIC.exe
Token: SeBackupPrivilege	3256	WMIC.exe
Token: SeRestorePrivilege	3256	WMIC.exe
Token: SeShutdownPrivilege	3256	WMIC.exe
Token: SeDebugPrivilege	3256	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3256	WMIC.exe
Token: SeRemoteShutdownPrivilege	3256	WMIC.exe
Token: SeUndockPrivilege	3256	WMIC.exe
Token: SeManageVolumePrivilege	3256	WMIC.exe
Token: 33	3256	WMIC.exe
Token: 34	3256	WMIC.exe
Token: 35	3256	WMIC.exe
Token: 36	3256	WMIC.exe
Token: SeDebugPrivilege	1208	Bootstrapper.exe
Token: SeShutdownPrivilege	1764	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1764	msiexec.exe
Token: SeSecurityPrivilege	912	msiexec.exe
Token: SeCreateTokenPrivilege	1764	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1764	msiexec.exe
Token: SeLockMemoryPrivilege	1764	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1764	msiexec.exe
Token: SeMachineAccountPrivilege	1764	msiexec.exe
Token: SeTcbPrivilege	1764	msiexec.exe
Token: SeSecurityPrivilege	1764	msiexec.exe
Token: SeTakeOwnershipPrivilege	1764	msiexec.exe
Token: SeLoadDriverPrivilege	1764	msiexec.exe
Token: SeSystemProfilePrivilege	1764	msiexec.exe
Token: SeSystemtimePrivilege	1764	msiexec.exe
Token: SeProfSingleProcessPrivilege	1764	msiexec.exe
Token: SeIncBasePriorityPrivilege	1764	msiexec.exe
Token: SeCreatePagefilePrivilege	1764	msiexec.exe
Token: SeCreatePermanentPrivilege	1764	msiexec.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe

Suspicious use of SetWindowsHookEx 42 IoCs

pid	Process
2248	chrome.exe
2560	WRSA.exe
2560	WRSA.exe
2560	WRSA.exe
2560	WRSA.exe
2560	WRSA.exe
2560	WRSA.exe
2560	WRSA.exe
2560	WRSA.exe
2560	WRSA.exe
2560	WRSA.exe
3336	Explorer.EXE
2560	WRSA.exe
3336	Explorer.EXE
3336	Explorer.EXE
5608	MiniSearchHost.exe
5852	WRSA.exe
3336	Explorer.EXE
5852	WRSA.exe
5852	WRSA.exe
5852	WRSA.exe
5852	WRSA.exe
5852	WRSA.exe
5852	WRSA.exe
5852	WRSA.exe
5852	WRSA.exe
5852	WRSA.exe
5852	WRSA.exe
5852	WRSA.exe
5852	WRSA.exe
5852	WRSA.exe
5852	WRSA.exe
5852	WRSA.exe
5852	WRSA.exe
5852	WRSA.exe
5852	WRSA.exe
3336	Explorer.EXE
5852	WRSA.exe
3336	Explorer.EXE
3336	Explorer.EXE
5852	WRSA.exe
5852	WRSA.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1208 wrote to memory of 3068	1208	Bootstrapper.exe	81
PID 1208 wrote to memory of 3068	1208	Bootstrapper.exe	81
PID 3068 wrote to memory of 1820	3068	cmd.exe	83
PID 3068 wrote to memory of 1820	3068	cmd.exe	83
PID 1208 wrote to memory of 2072	1208	Bootstrapper.exe	88
PID 1208 wrote to memory of 2072	1208	Bootstrapper.exe	88
PID 2072 wrote to memory of 3256	2072	cmd.exe	90
PID 2072 wrote to memory of 3256	2072	cmd.exe	90
PID 1208 wrote to memory of 1764	1208	Bootstrapper.exe	92
PID 1208 wrote to memory of 1764	1208	Bootstrapper.exe	92
PID 912 wrote to memory of 4796	912	msiexec.exe	96
PID 912 wrote to memory of 4796	912	msiexec.exe	96
PID 912 wrote to memory of 4832	912	msiexec.exe	97
PID 912 wrote to memory of 4832	912	msiexec.exe	97
PID 912 wrote to memory of 4832	912	msiexec.exe	97
PID 1160 wrote to memory of 1440	1160	chrome.exe	99
PID 1160 wrote to memory of 1440	1160	chrome.exe	99
PID 1160 wrote to memory of 4692	1160	chrome.exe	100
PID 1160 wrote to memory of 4692	1160	chrome.exe	100
PID 1160 wrote to memory of 4692	1160	chrome.exe	100
PID 1160 wrote to memory of 4692	1160	chrome.exe	100
PID 1160 wrote to memory of 4692	1160	chrome.exe	100
PID 1160 wrote to memory of 4692	1160	chrome.exe	100
PID 1160 wrote to memory of 4692	1160	chrome.exe	100
PID 1160 wrote to memory of 4692	1160	chrome.exe	100
PID 1160 wrote to memory of 4692	1160	chrome.exe	100
PID 1160 wrote to memory of 4692	1160	chrome.exe	100
PID 1160 wrote to memory of 4692	1160	chrome.exe	100
PID 1160 wrote to memory of 4692	1160	chrome.exe	100
PID 1160 wrote to memory of 4692	1160	chrome.exe	100
PID 1160 wrote to memory of 4692	1160	chrome.exe	100
PID 1160 wrote to memory of 4692	1160	chrome.exe	100
PID 1160 wrote to memory of 4692	1160	chrome.exe	100
PID 1160 wrote to memory of 4692	1160	chrome.exe	100
PID 1160 wrote to memory of 4692	1160	chrome.exe	100
PID 1160 wrote to memory of 4692	1160	chrome.exe	100
PID 1160 wrote to memory of 4692	1160	chrome.exe	100
PID 1160 wrote to memory of 4692	1160	chrome.exe	100
PID 1160 wrote to memory of 4692	1160	chrome.exe	100
PID 1160 wrote to memory of 4692	1160	chrome.exe	100
PID 1160 wrote to memory of 4692	1160	chrome.exe	100
PID 1160 wrote to memory of 4692	1160	chrome.exe	100
PID 1160 wrote to memory of 4692	1160	chrome.exe	100
PID 1160 wrote to memory of 4692	1160	chrome.exe	100
PID 1160 wrote to memory of 4692	1160	chrome.exe	100
PID 1160 wrote to memory of 4692	1160	chrome.exe	100
PID 1160 wrote to memory of 4692	1160	chrome.exe	100
PID 1160 wrote to memory of 4876	1160	chrome.exe	101
PID 1160 wrote to memory of 4876	1160	chrome.exe	101
PID 1160 wrote to memory of 2656	1160	chrome.exe	102
PID 1160 wrote to memory of 2656	1160	chrome.exe	102
PID 1160 wrote to memory of 2656	1160	chrome.exe	102
PID 1160 wrote to memory of 2656	1160	chrome.exe	102
PID 1160 wrote to memory of 2656	1160	chrome.exe	102
PID 1160 wrote to memory of 2656	1160	chrome.exe	102
PID 1160 wrote to memory of 2656	1160	chrome.exe	102
PID 1160 wrote to memory of 2656	1160	chrome.exe	102
PID 1160 wrote to memory of 2656	1160	chrome.exe	102
PID 1160 wrote to memory of 2656	1160	chrome.exe	102
PID 1160 wrote to memory of 2656	1160	chrome.exe	102
PID 1160 wrote to memory of 2656	1160	chrome.exe	102
PID 1160 wrote to memory of 2656	1160	chrome.exe	102
PID 1160 wrote to memory of 2656	1160	chrome.exe	102
PID 1160 wrote to memory of 2656	1160	chrome.exe	102

System policy modification 1 TTPs 52 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisableLocalMachineRunOnce = "0"	WRSA.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoShellSearchButton = "0"	WRSA.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFile = "0"	WRSA.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDeletePrinter = "0"	WRSA.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoResolveTrack = "0"	WRSA.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDesktop = "0"	WRSA.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop\NoEditingComponents = "0"	WRSA.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\NoDispBackgroundPage = "0"	WRSA.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDevMgrUpdate = "0"	WRSA.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoChangeStartMenu = "0"	WRSA.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoHardwareTab = "0"	WRSA.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoControlPanel = "0"	WRSA.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisableCurrentUserRunOnce = "0"	WRSA.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoClose = "0"	WRSA.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSetTaskbar = "0"	WRSA.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\StartMenuLogoff = "0"	WRSA.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoResolveSearch = "0"	WRSA.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoActiveDesktopChanges = "0"	WRSA.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	WRSA.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop\NoHTMLWallpaper = "0"	WRSA.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	WRSA.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDrives = "0"	WRSA.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "0"	WRSA.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoTrayContextMenu = "0"	WRSA.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoTrayItemsDisplay = "0"	WRSA.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoLogoff = "0"	WRSA.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "0"	WRSA.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "0"	WRSA.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoViewOnDrive = "0"	WRSA.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoRun = "0"	WRSA.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSetFolders = "0"	WRSA.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoEncryptOnMove = "0"	WRSA.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSaveSettings = "0"	WRSA.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr = "0"	WRSA.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop\NoComponents = "0"	WRSA.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop\NoChangingWallpaper = "0"	WRSA.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\NoDispAppearancePage = "0"	WRSA.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisableCurrentUserRun = "0"	WRSA.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFind = "0"	WRSA.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoStartMenuSubFolders = "0"	WRSA.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "0"	WRSA.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\ForceActiveDesktopOn = "0"	WRSA.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop\NoDeletingComponents = "0"	WRSA.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisableLocalMachineRun = "0"	WRSA.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoViewContextMenu = "0"	WRSA.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HideClock = "0"	WRSA.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoWindowsUpdate = "0"	WRSA.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDFSTab = "0"	WRSA.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoRunasInstallPrompt = "0"	WRSA.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop	WRSA.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop\NoAddingComponents = "0"	WRSA.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\NoDispSettingsPage = "0"	WRSA.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Loads dropped DLL
- Checks for any installed AV software in registry
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3336
- C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe
  "C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1208
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c ipconfig /all
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3068
  - - C:\Windows\system32\ipconfig.exe
      ipconfig /all
      4⤵
      Gathers network information
      PID:1820
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c wmic nicconfig where (IPEnabled=TRUE) call SetDNSServerSearchOrder ("1.1.1.1", "1.0.0.1")
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2072
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic nicconfig where (IPEnabled=TRUE) call SetDNSServerSearchOrder ("1.1.1.1", "1.0.0.1")
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3256
- - C:\Windows\System32\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\node-v18.16.0-x64.msi" /qn
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1764
- - C:\ProgramData\Solara\Solara.exe
    "C:\ProgramData\Solara\Solara.exe"
    3⤵
    - Executes dropped EXE
    PID:2408
- C:\Windows\system32\taskmgr.exe
  "C:\Windows\system32\taskmgr.exe" /0
  2⤵
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:1432
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:1160
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb574acc40,0x7ffb574acc4c,0x7ffb574acc58
    3⤵
    PID:1440
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1756,i,5738911593151293776,16941197030836867006,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1752 /prefetch:2
    3⤵
    PID:4692
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2092,i,5738911593151293776,16941197030836867006,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2116 /prefetch:3
    3⤵
    PID:4876
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2200,i,5738911593151293776,16941197030836867006,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2208 /prefetch:8
    3⤵
    PID:2656
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3080,i,5738911593151293776,16941197030836867006,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3188 /prefetch:1
    3⤵
    PID:3388
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3108,i,5738911593151293776,16941197030836867006,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3240 /prefetch:1
    3⤵
    PID:1060
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3520,i,5738911593151293776,16941197030836867006,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3552 /prefetch:1
    3⤵
    PID:4284
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4440,i,5738911593151293776,16941197030836867006,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4596 /prefetch:8
    3⤵
    PID:1236
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4604,i,5738911593151293776,16941197030836867006,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4724 /prefetch:8
    3⤵
    PID:4916
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=3544,i,5738911593151293776,16941197030836867006,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4696 /prefetch:8
    3⤵
    PID:3744
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4360,i,5738911593151293776,16941197030836867006,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4560 /prefetch:8
    3⤵
    PID:696
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=4972,i,5738911593151293776,16941197030836867006,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4560 /prefetch:1
    3⤵
    PID:3060
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=3212,i,5738911593151293776,16941197030836867006,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4460 /prefetch:1
    3⤵
    PID:2016
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=3868,i,5738911593151293776,16941197030836867006,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5144 /prefetch:1
    3⤵
    PID:4764
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=4508,i,5738911593151293776,16941197030836867006,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3436 /prefetch:1
    3⤵
    PID:2148
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=4348,i,5738911593151293776,16941197030836867006,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4964 /prefetch:1
    3⤵
    PID:2392
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=3464,i,5738911593151293776,16941197030836867006,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3308 /prefetch:1
    3⤵
    PID:8
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=5284,i,5738911593151293776,16941197030836867006,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3236 /prefetch:1
    3⤵
    PID:4696
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --field-trial-handle=3752,i,5738911593151293776,16941197030836867006,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5292 /prefetch:1
    3⤵
    PID:1012
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --field-trial-handle=3424,i,5738911593151293776,16941197030836867006,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4312 /prefetch:1
    3⤵
    PID:3040
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --field-trial-handle=5680,i,5738911593151293776,16941197030836867006,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5664 /prefetch:1
    3⤵
    PID:1568
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --field-trial-handle=5636,i,5738911593151293776,16941197030836867006,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5804 /prefetch:1
    3⤵
    PID:1356
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --field-trial-handle=5956,i,5738911593151293776,16941197030836867006,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5972 /prefetch:1
    3⤵
    PID:3288
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --field-trial-handle=5924,i,5738911593151293776,16941197030836867006,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=6152 /prefetch:1
    3⤵
    PID:4008
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --field-trial-handle=6300,i,5738911593151293776,16941197030836867006,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=6324 /prefetch:1
    3⤵
    PID:3376
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --no-appcompat-clear --field-trial-handle=6444,i,5738911593151293776,16941197030836867006,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=6280 /prefetch:8
    3⤵
    PID:1624
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --field-trial-handle=3552,i,5738911593151293776,16941197030836867006,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5116 /prefetch:1
    3⤵
    PID:1648
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --field-trial-handle=5904,i,5738911593151293776,16941197030836867006,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5544 /prefetch:1
    3⤵
    PID:3420
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --field-trial-handle=3540,i,5738911593151293776,16941197030836867006,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4808 /prefetch:1
    3⤵
    PID:2072
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --field-trial-handle=4712,i,5738911593151293776,16941197030836867006,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3496 /prefetch:1
    3⤵
    PID:4776
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --field-trial-handle=5972,i,5738911593151293776,16941197030836867006,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=6188 /prefetch:1
    3⤵
    PID:4868
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --field-trial-handle=6108,i,5738911593151293776,16941197030836867006,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5440 /prefetch:1
    3⤵
    PID:2964
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --field-trial-handle=4968,i,5738911593151293776,16941197030836867006,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5444 /prefetch:1
    3⤵
    PID:4288
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --field-trial-handle=6004,i,5738911593151293776,16941197030836867006,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3316 /prefetch:1
    3⤵
    PID:4320
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --field-trial-handle=3220,i,5738911593151293776,16941197030836867006,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5460 /prefetch:1
    3⤵
    PID:1684
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4372,i,5738911593151293776,16941197030836867006,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4376 /prefetch:8
    3⤵
    PID:832
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --field-trial-handle=5104,i,5738911593151293776,16941197030836867006,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5452 /prefetch:1
    3⤵
    PID:1592
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4472,i,5738911593151293776,16941197030836867006,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3176 /prefetch:8
    3⤵
    PID:5044
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --field-trial-handle=5160,i,5738911593151293776,16941197030836867006,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5192 /prefetch:1
    3⤵
    PID:4836
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=3364,i,5738911593151293776,16941197030836867006,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3308 /prefetch:8
    3⤵
    PID:3048
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --field-trial-handle=5260,i,5738911593151293776,16941197030836867006,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3384 /prefetch:1
    3⤵
    PID:3564
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --field-trial-handle=5588,i,5738911593151293776,16941197030836867006,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5596 /prefetch:1
    3⤵
    PID:3256
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --field-trial-handle=3140,i,5738911593151293776,16941197030836867006,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5592 /prefetch:1
    3⤵
    PID:4172
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --field-trial-handle=5264,i,5738911593151293776,16941197030836867006,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5996 /prefetch:1
    3⤵
    PID:4504
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --field-trial-handle=5344,i,5738911593151293776,16941197030836867006,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5332 /prefetch:1
    3⤵
    PID:4508
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --field-trial-handle=6152,i,5738911593151293776,16941197030836867006,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=6624 /prefetch:1
    3⤵
    PID:3560
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --field-trial-handle=6764,i,5738911593151293776,16941197030836867006,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=6576 /prefetch:1
    3⤵
    PID:1104
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --field-trial-handle=6872,i,5738911593151293776,16941197030836867006,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=6900 /prefetch:1
    3⤵
    PID:4936
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --field-trial-handle=7056,i,5738911593151293776,16941197030836867006,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=6736 /prefetch:1
    3⤵
    PID:1860
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --field-trial-handle=7196,i,5738911593151293776,16941197030836867006,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=7164 /prefetch:1
    3⤵
    PID:2016
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --field-trial-handle=7344,i,5738911593151293776,16941197030836867006,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=7216 /prefetch:1
    3⤵
    PID:484
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --field-trial-handle=7340,i,5738911593151293776,16941197030836867006,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=6716 /prefetch:1
    3⤵
    PID:5164
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --field-trial-handle=5644,i,5738911593151293776,16941197030836867006,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=7484 /prefetch:1
    3⤵
    PID:5172
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --field-trial-handle=7520,i,5738911593151293776,16941197030836867006,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=7528 /prefetch:1
    3⤵
    PID:5180
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --field-trial-handle=6720,i,5738911593151293776,16941197030836867006,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=7804 /prefetch:1
    3⤵
    PID:5280
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --field-trial-handle=7772,i,5738911593151293776,16941197030836867006,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=7932 /prefetch:1
    3⤵
    PID:5292
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --field-trial-handle=8092,i,5738911593151293776,16941197030836867006,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=8108 /prefetch:1
    3⤵
    PID:5348
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --field-trial-handle=8080,i,5738911593151293776,16941197030836867006,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=8236 /prefetch:1
    3⤵
    PID:5404
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --field-trial-handle=7928,i,5738911593151293776,16941197030836867006,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=7948 /prefetch:1
    3⤵
    PID:5636
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --field-trial-handle=8084,i,5738911593151293776,16941197030836867006,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4448 /prefetch:1
    3⤵
    PID:3236
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --field-trial-handle=8432,i,5738911593151293776,16941197030836867006,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4452 /prefetch:1
    3⤵
    PID:5972
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --field-trial-handle=7668,i,5738911593151293776,16941197030836867006,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=8460 /prefetch:1
    3⤵
    PID:5128
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --field-trial-handle=4740,i,5738911593151293776,16941197030836867006,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5196 /prefetch:1
    3⤵
    PID:5024
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --field-trial-handle=7684,i,5738911593151293776,16941197030836867006,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=8344 /prefetch:1
    3⤵
    PID:5564
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5608,i,5738911593151293776,16941197030836867006,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=6140 /prefetch:8
    3⤵
    PID:2816
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=7768,i,5738911593151293776,16941197030836867006,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=8048 /prefetch:8
    3⤵
    PID:5584
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --field-trial-handle=5828,i,5738911593151293776,16941197030836867006,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=8048 /prefetch:1
    3⤵
    PID:5700
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --field-trial-handle=8008,i,5738911593151293776,16941197030836867006,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=8016 /prefetch:1
    3⤵
    PID:5728
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --field-trial-handle=6288,i,5738911593151293776,16941197030836867006,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5808 /prefetch:1
    3⤵
    PID:5876
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --field-trial-handle=6320,i,5738911593151293776,16941197030836867006,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=6376 /prefetch:1
    3⤵
    PID:4040
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --field-trial-handle=7932,i,5738911593151293776,16941197030836867006,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=8604 /prefetch:1
    3⤵
    PID:5368
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --field-trial-handle=8504,i,5738911593151293776,16941197030836867006,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=8224 /prefetch:1
    3⤵
    PID:2956
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=73 --field-trial-handle=8408,i,5738911593151293776,16941197030836867006,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=8340 /prefetch:1
    3⤵
    PID:5788
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=74 --field-trial-handle=3360,i,5738911593151293776,16941197030836867006,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=8384 /prefetch:1
    3⤵
    PID:5632
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=75 --field-trial-handle=7760,i,5738911593151293776,16941197030836867006,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=8892 /prefetch:1
    3⤵
    PID:2408
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5756,i,5738911593151293776,16941197030836867006,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=7700 /prefetch:8
    3⤵
    - Modifies registry class
    - Suspicious use of SetWindowsHookEx
    PID:2248
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=77 --field-trial-handle=8708,i,5738911593151293776,16941197030836867006,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=8652 /prefetch:1
    3⤵
    PID:6128
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=78 --field-trial-handle=5564,i,5738911593151293776,16941197030836867006,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=8940 /prefetch:1
    3⤵
    PID:3148
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=79 --field-trial-handle=8048,i,5738911593151293776,16941197030836867006,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=8884 /prefetch:1
    3⤵
    PID:5560
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=9268,i,5738911593151293776,16941197030836867006,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=9300 /prefetch:8
    3⤵
    PID:5572
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=9296,i,5738911593151293776,16941197030836867006,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=9448 /prefetch:8
    3⤵
    PID:5024
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=8904,i,5738911593151293776,16941197030836867006,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=9160 /prefetch:8
    3⤵
    - Subvert Trust Controls: Mark-of-the-Web Bypass
    - NTFS ADS
    PID:2248
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=83 --field-trial-handle=9384,i,5738911593151293776,16941197030836867006,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=9380 /prefetch:1
    3⤵
    PID:4908
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=84 --field-trial-handle=8624,i,5738911593151293776,16941197030836867006,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4452 /prefetch:1
    3⤵
    PID:5944
- - C:\Users\Admin\Downloads\wsainstall.exe
    "C:\Users\Admin\Downloads\wsainstall.exe"
    3⤵
    - Drops file in Drivers directory
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:2640
  - - C:\Program Files\Webroot\WRSA.exe
      "C:\Program Files\Webroot\WRSA.exe" -pi /key=5002WTFT2AF69C634E5D /installing
      4⤵
      Looks for Xen service registry key.
      Executes dropped EXE
      Loads dropped DLL
      Checks whether UAC is enabled
      Maps connected drives based on registry
      System Location Discovery: System Language Discovery
      Checks SCSI registry key(s)
      Suspicious use of SetWindowsHookEx
      PID:2560
- C:\Windows\system32\taskmgr.exe
  "C:\Windows\system32\taskmgr.exe" /0
  2⤵
  - Suspicious use of NtCreateProcessExOtherParentProcess
  - Checks SCSI registry key(s)
  - Suspicious behavior: GetForegroundWindowSpam
  PID:3732
- C:\Program Files\Webroot\WRSA.exe
  "C:\Program Files\Webroot\WRSA.exe" -showgui
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:7536

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4292

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:912
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding B52088726509C5EDD53A537EE6E95203
  2⤵
  - Loads dropped DLL
  PID:4796
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 2C3B2281383C6A9A5452B449E92366F1
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4832
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 9E71DDF51CF225BBBB3E2250C02D7B22 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2724
- - C:\Windows\SysWOW64\wevtutil.exe
    "wevtutil.exe" im "C:\Program Files\nodejs\node_etw_provider.man"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1756
  - - C:\Windows\System32\wevtutil.exe
      "wevtutil.exe" im "C:\Program Files\nodejs\node_etw_provider.man" /fromwow64
      4⤵
      PID:1996

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:1204

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2352

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x0000000000000500 0x000000000000048C
1⤵
PID:3972

C:\Program Files\Webroot\WRSA.exe
"C:\Program Files\Webroot\WRSA.exe" -service
1⤵
- Modifies WinLogon for persistence
- Modifies firewall policy service
- Windows security bypass
- Disables RegEdit via registry modification
- Disables cmd.exe use via registry modification
- Drops file in Drivers directory
- Looks for Xen service registry key.
- Server Software Component: Terminal Services DLL
- Sets service image path in registry
- Uses Session Manager for persistence
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Modifies system executable filetype association
- Windows security modification
- Adds Run key to start application
- Enumerates connected drives
- Indicator Removal: Clear Persistence
- Maps connected drives based on registry
- Modifies WinLogon
- Boot or Logon Autostart Execution: Authentication Package
- Drops autorun.inf file
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer Phishing Filter
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Modifies system certificate store
- System policy modification
PID:5392
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\system32\msiexec.exe" /i "C:\Program Files\Webroot\Components\wrcore.x64_1.8.0.26.msi" /L*V "C:\ProgramData\WRData\ComponentInstall.log" /qn
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5656
- C:\Windows\system32\rundll32.exe
  "C:\Windows\Sysnative\rundll32.exe" "C:\Windows\system32\WRusr.dll",SynProc 3336
  2⤵
  - Loads dropped DLL
  PID:8628
- C:\Program Files\Webroot\WRSA.exe
  "C:\Program Files\Webroot\WRSA.exe"
  2⤵
  - Looks for Xen service registry key.
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:8844
- C:\Program Files\Webroot\WRSA.exe
  "C:\Program Files\Webroot\WRSA.exe"
  2⤵
  - Looks for Xen service registry key.
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:9016
- C:\Program Files\Webroot\WRSA.exe
  "C:\Program Files\Webroot\WRSA.exe"
  2⤵
  - Looks for Xen service registry key.
  - Executes dropped EXE
  - Loads dropped DLL
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:5852
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://detail.webrootcloudav.com/p4inbound.asp?CMD=P40MIDENT&AGENTPROFILE=RFTCWHF&InstanceMID=z57xprz93x745n0n6880z79r41q7zx4x34p3r483r2zp8px5p64rp6qp0q7n7znz&LIC=6773JGNG3ZN40R482P6Q&LANG=pa&VER=078180&DeviceMID=X94NP51N8X333685N57696317863Z4Q41PZ69594&HN=QQSKUUPD&AUTH=784pDtPQD+Srf6a7wenl/wkx5adEYwmiL4OHcKAi6VNDY7wotOvifBJn4LcMbY94LBI27HJ0Oxv7js58zwpPoDBSg2Zk4GMn9qX93lDmeBedplkehNxVFGyDop2Lmd2XtSk3HyN1hhOpZ/DNJo0rTzitBcAUeofmMXgxkyQ5Fo3LP=&[email protected]
    3⤵
    - Enumerates system info in registry
    PID:6048
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffb5e903cb8,0x7ffb5e903cc8,0x7ffb5e903cd8
      4⤵
      PID:5976
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1880,13272542108886511259,13961134983017075399,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1892 /prefetch:2
      4⤵
      PID:1828
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1880,13272542108886511259,13961134983017075399,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2364 /prefetch:3
      4⤵
      PID:4172
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1880,13272542108886511259,13961134983017075399,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2600 /prefetch:8
      4⤵
      PID:6984
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,13272542108886511259,13961134983017075399,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
      4⤵
      PID:3568
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,13272542108886511259,13961134983017075399,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
      4⤵
      PID:7032
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,13272542108886511259,13961134983017075399,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4940 /prefetch:1
      4⤵
      PID:2352
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,13272542108886511259,13961134983017075399,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5252 /prefetch:1
      4⤵
      PID:2308
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,13272542108886511259,13961134983017075399,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5392 /prefetch:1
      4⤵
      PID:6060
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\system32\msiexec.exe" /i "C:\Program Files\Webroot\Components\wrcore.x64_1.8.0.26.msi" /L*V "C:\ProgramData\WRData\ComponentInstall.log" /qn
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6092
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\system32\msiexec.exe" /i "C:\Program Files\Webroot\Components\wrcore.x64_1.8.0.26.msi" /L*V "C:\ProgramData\WRData\ComponentInstall.log" /qn
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4996

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
PID:6688
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 8460CFE4B8B8BF27217D7E71F59EB264 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Blocklisted process makes network request
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  PID:4868
- C:\Windows\Installer\MSIB91F.tmp
  "C:\Windows\Installer\MSIB91F.tmp" /basedir "C:\Program Files\Webroot\Core\\" /install
  2⤵
  - Executes dropped EXE
  PID:5892
- C:\Windows\Installer\MSIBD18.tmp
  "C:\Windows\Installer\MSIBD18.tmp" /basedir "C:\Program Files\Webroot\Core\\" /rollback
  2⤵
  - Executes dropped EXE
  PID:4796

C:\Windows\Installer\MSIB91F.tmp
"C:\Windows\Installer\MSIB91F.tmp" --service /pipe WRMsiLogHost_oxorhnmopv /basedir "C:\Program Files\Webroot\Core\\" /install
1⤵
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
PID:5088

C:\Windows\Installer\MSIBD18.tmp
"C:\Windows\Installer\MSIBD18.tmp" --service /pipe WRMsiLogHost_oxorhnmopv /basedir "C:\Program Files\Webroot\Core\\" /rollback
1⤵
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Indicator Removal: Clear Persistence
PID:1200

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Suspicious use of SetWindowsHookEx
PID:5608

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.13
1⤵
PID:7452

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
PID:2500
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding C84AE1CC17F5657AB31582CB6A11ACE5 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Modifies data under HKEY_USERS
  PID:6048
- C:\Windows\Installer\MSI2E3.tmp
  "C:\Windows\Installer\MSI2E3.tmp" /basedir "C:\Program Files\Webroot\Core\\" /install
  2⤵
  - Executes dropped EXE
  PID:4468
- C:\Windows\Installer\MSI43C.tmp
  "C:\Windows\Installer\MSI43C.tmp" /basedir "C:\Program Files\Webroot\Core\\" /rollback
  2⤵
  - Executes dropped EXE
  PID:5900
- C:\Windows\Installer\MSIFA58.tmp
  "C:\Windows\Installer\MSIFA58.tmp" /basedir "C:\Program Files\Webroot\Core\\" /install
  2⤵
  - Executes dropped EXE
  PID:5352
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 7F28903A514FA765ABE7175A7DBD8B2B E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Modifies data under HKEY_USERS
  PID:900
- C:\Windows\Installer\MSIFD86.tmp
  "C:\Windows\Installer\MSIFD86.tmp" /basedir "C:\Program Files\Webroot\Core\\" /rollback
  2⤵
  - Executes dropped EXE
  PID:5560

C:\Windows\Installer\MSI2E3.tmp
"C:\Windows\Installer\MSI2E3.tmp" --service /pipe WRMsiLogHost_adieyrqivu /basedir "C:\Program Files\Webroot\Core\\" /install
1⤵
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
PID:6628

C:\Windows\Installer\MSI43C.tmp
"C:\Windows\Installer\MSI43C.tmp" --service /pipe WRMsiLogHost_adieyrqivu /basedir "C:\Program Files\Webroot\Core\\" /rollback
1⤵
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Indicator Removal: Clear Persistence
PID:2920

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3484

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:6476

C:\Windows\Installer\MSIFA58.tmp
"C:\Windows\Installer\MSIFA58.tmp" --service /pipe WRMsiLogHost_adieyrqivu /basedir "C:\Program Files\Webroot\Core\\" /install
1⤵
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
PID:5784

C:\Windows\Installer\MSIFD86.tmp
"C:\Windows\Installer\MSIFD86.tmp" --service /pipe WRMsiLogHost_adieyrqivu /basedir "C:\Program Files\Webroot\Core\\" /rollback
1⤵
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Indicator Removal: Clear Persistence
PID:5136

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Command and Scripting Interpreter

T1059

Persistence

Boot or Logon Autostart Execution

T1547

Authentication Package

T1547.002

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Change Default File Association

T1546.001

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Server Software Component

T1505

Terminal Services DLL

T1505.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Authentication Package

T1547.002

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Change Default File Association

T1546.001

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

SIP and Trust Provider Hijacking

T1553.003

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Windows Credential Manager

T1555.004

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

Software Discovery

T1518

Security Software Discovery

T1518.001

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e5891bf.rbs

Filesize
1.0MB

MD5
c9b0c9ab23f41dc27c83c49c70458cf1

SHA1
f16d7eb7b4563f00c760b2c0cb046069e266f712

SHA256
5c5c98855a22748b219ef2bc32cfcbfff248817b708cdad203efee888923cb3f

SHA512
8006b80b4823b3d680681a628348125b62e2f6808e83cc500fe0708608280558e12faafbc98dd7888d8bc2e55aff81dc6514c9281c28e6407603be13df056947

Download Submit
C:\Program Files\Mozilla Firefox\distribution\policies.json

Filesize
184B

MD5
66b1b4a0fb3f860355b57cb1505c00c6

SHA1
a9d0af51311d6bc1e2a29ddef9bbf3e1ab290fbc

SHA256
10be76d4fb9865c6f7d0b49ea665a3d7a32cb705b7716899d19e9b9869d9b06c

SHA512
dab5b9c90a2066aa6eb8d49d8e7d37b49d557e0f549c1f8002346d3a1746d37160c3243c735ca611140fa83441cf3f5c5bc9d75c0d833a16c50ddd3a3b09d7cb

Download Submit
C:\Program Files\Webroot\Components\wrcore.x64_1.8.0.26.msi

Filesize
6.2MB

MD5
66995fe3942ce63368cba9d9667e7f23

SHA1
a6fa6dc515eb75984eeefc531d4923a6b01614c4

SHA256
8cb093366ed1c877ded0e1271c5409ca0b79362228dbf656b3767a840b53ef8d

SHA512
52ad3ff5029fb155ccb3d911dcf9bf9d9912dce1639400ffb8fe835b67240fb63a960b34a49c61fa94b1070c4cef1509489466107bafe47c88c7625b4d1500cd

Download Submit
C:\Program Files\Webroot\Core\WRCore.x64.sys

Filesize
272KB

MD5
998670216d3541be4ac4de49eda2a34e

SHA1
95d980fc4311eb170a864dd1ef576e0ee2f5af61

SHA256
77353c45af6b7e3e4ac2e72c7673eb76578d304fa519bea9033d373c4e01b302

SHA512
89cfd347fc37f85054d0858b8723a6b9765a72df2e245ab0c66c5b78e4aac1e5530c88375211ffd64c50ef5853e62891dc87daf6faf6525f7127af21fe37d8ab

Download Submit
C:\Program Files\nodejs\node_etw_provider.man

Filesize
10KB

MD5
1d51e18a7247f47245b0751f16119498

SHA1
78f5d95dd07c0fcee43c6d4feab12d802d194d95

SHA256
1975aa34c1050b8364491394cebf6e668e2337c3107712e3eeca311262c7c46f

SHA512
1eccbe4ddae3d941b36616a202e5bd1b21d8e181810430a1c390513060ae9e3f12cd23f5b66ae0630fd6496b3139e2cc313381b5506465040e5a7a3543444e76

Download Submit
C:\Program Files\nodejs\node_etw_provider.man

Filesize
8KB

MD5
d3bc164e23e694c644e0b1ce3e3f9910

SHA1
1849f8b1326111b5d4d93febc2bafb3856e601bb

SHA256
1185aaa5af804c6bc6925f5202e68bb2254016509847cd382a015907440d86b4

SHA512
91ebff613f4c35c625bb9b450726167fb77b035666ed635acf75ca992c4846d952655a2513b4ecb8ca6f19640d57555f2a4af3538b676c3bd2ea1094c4992854

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\arborist\LICENSE.md

Filesize
818B

MD5
2916d8b51a5cc0a350d64389bc07aef6

SHA1
c9d5ac416c1dd7945651bee712dbed4d158d09e1

SHA256
733dcbf5b1c95dc765b76db969b998ce0cbb26f01be2e55e7bccd6c7af29cb04

SHA512
508c5d1842968c478e6b42b94e04e0b53a342dfaf52d55882fdcfe02c98186e9701983ab5e9726259fba8336282e20126c70d04fc57964027586a40e96c56b74

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\aggregate-error\license

Filesize
1KB

MD5
5ad87d95c13094fa67f25442ff521efd

SHA1
01f1438a98e1b796e05a74131e6bb9d66c9e8542

SHA256
67292c32894c8ac99db06ffa1cb8e9a5171ef988120723ebe673bf76712260ec

SHA512
7187720ccd335a10c9698f8493d6caa2d404e7b21731009de5f0da51ad5b9604645fbf4bc640aa94513b9eb372aa6a31df2467198989234bc2afbce87f76fbc3

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\bin-links\LICENSE

Filesize
754B

MD5
d2cf52aa43e18fdc87562d4c1303f46a

SHA1
58fb4a65fffb438630351e7cafd322579817e5e1

SHA256
45e433413760dc3ae8169be5ed9c2c77adc31ad4d1bc5a28939576df240f29a0

SHA512
54e33d7998b5e9ba76b2c852b4d0493ebb1b1ee3db777c97e6606655325ff66124a0c0857ca4d62de96350dbaee8d20604ec22b0edc17b472086da4babbbcb16

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\libnpmhook\LICENSE.md

Filesize
771B

MD5
e9dc66f98e5f7ff720bf603fff36ebc5

SHA1
f2b428eead844c4bf39ca0d0cf61f6b10aeeb93b

SHA256
b49c8d25a8b57fa92b2902d09c4b8a809157ee32fc10d17b7dbb43c4a8038f79

SHA512
8027d65e1556511c884cb80d3c1b846fc9d321f3f83002664ad3805c4dee8e6b0eaf1db81c459153977bdbde9e760b0184ba6572f68d78c37bff617646bcfc3b

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\libnpmorg\LICENSE

Filesize
730B

MD5
072ac9ab0c4667f8f876becedfe10ee0

SHA1
0227492dcdc7fb8de1d14f9d3421c333230cf8fe

SHA256
2ef361317adeda98117f14c5110182c28eae233af1f7050c83d4396961d14013

SHA512
f38fd6506bd9795bb27d31f1ce38b08c9e6f1689c34fca90e9e1d5194fa064d1f34a9c51d15941506ebbbcd6d4193055e9664892521b7e39ebcd61c3b6f25013

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\minipass-pipeline\node_modules\minipass\package.json

Filesize
1KB

MD5
d116a360376e31950428ed26eae9ffd4

SHA1
192b8e06fb4e1f97e5c5c7bf62a9bff7704c198b

SHA256
c3052bd85910be313e38ad355528d527b565e70ef15a784db3279649eee2ded5

SHA512
5221c7648f4299234a4637c47d3f1eb5e147014704913bc6fdad91b9b6a6ccc109bced63376b82b046bb5cad708464c76fb452365b76dbf53161914acf8fb11a

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\minizlib\node_modules\minipass\LICENSE

Filesize
802B

MD5
d7c8fab641cd22d2cd30d2999cc77040

SHA1
d293601583b1454ad5415260e4378217d569538e

SHA256
04400db77d925de5b0264f6db5b44fe6f8b94f9419ad3473caaa8065c525c0be

SHA512
278ff929904be0c19ee5fb836f205e3e5b3e7cec3d26dd42bbf1e7e0ca891bf9c42d2b28fce3741ae92e4a924baf7490c7c6c59284127081015a82e2653e0764

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\minizlib\node_modules\minipass\index.js

Filesize
16KB

MD5
bc0c0eeede037aa152345ab1f9774e92

SHA1
56e0f71900f0ef8294e46757ec14c0c11ed31d4e

SHA256
7a395802fbe01bb3dc8d09586e0864f255874bf897378e546444fbaec29f54c5

SHA512
5f31251825554bf9ed99eda282fa1973fcec4a078796a10757f4fb5592f2783c4ebdd00bdf0d7ed30f82f54a7668446a372039e9d4589db52a75060ca82186b3

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\nopt\LICENSE

Filesize
780B

MD5
b020de8f88eacc104c21d6e6cacc636d

SHA1
20b35e641e3a5ea25f012e13d69fab37e3d68d6b

SHA256
3f24d692d165989cd9a00fe35ca15a2bc6859e3361fa42aa20babd435f2e4706

SHA512
4220617e29dd755ad592295bc074d6bc14d44a1feeed5101129669f3ecf0e34eaa4c7c96bbc83da7352631fa262baab45d4a370dad7dabec52b66f1720c28e38

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\promise-all-reject-late\LICENSE

Filesize
763B

MD5
7428aa9f83c500c4a434f8848ee23851

SHA1
166b3e1c1b7d7cb7b070108876492529f546219f

SHA256
1fccd0ad2e7e0e31ddfadeaf0660d7318947b425324645aa85afd7227cab52d7

SHA512
c7f01de85f0660560206784cdf159b2bdc5f1bc87131f5a8edf384eba47a113005491520b0a25d3cc425985b5def7b189e18ff76d7d562c434dc5d8c82e90cce

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\tar\node_modules\fs-minipass\node_modules\minipass\index.d.ts

Filesize
4KB

MD5
f0bd53316e08991d94586331f9c11d97

SHA1
f5a7a6dc0da46c3e077764cfb3e928c4a75d383e

SHA256
dd3eda3596af30eda88b4c6c2156d3af6e7fa221f39c46e492c5e9fb697e2fef

SHA512
fd6affbaed67d09cf45478f38e92b8ca6c27650a232cbbeaff36e4f7554fb731ae44cf732378641312e98221539e3d8fabe80a7814e4f425026202de44eb5839

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\treeverse\LICENSE

Filesize
771B

MD5
1d7c74bcd1904d125f6aff37749dc069

SHA1
21e6dfe0fffc2f3ec97594aa261929a3ea9cf2ab

SHA256
24b8d53712087b867030d18f2bd6d1a72c78f9fb4dee0ce025374da25e4443b9

SHA512
b5ac03addd29ba82fc05eea8d8d09e0f2fa9814d0dd619c2f7b209a67d95b538c3c2ff70408641ef3704f6a14e710e56f4bf57c2bb3f8957ba164f28ee591778

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Node.js\Node.js documentation.url

Filesize
168B

MD5
db7dbbc86e432573e54dedbcc02cb4a1

SHA1
cff9cfb98cff2d86b35dc680b405e8036bbbda47

SHA256
7cf8a9c96f9016132be81fd89f9573566b7dc70244a28eb59d573c2fdba1def9

SHA512
8f35f2e7dac250c66b209acecab836d3ecf244857b81bacebc214f0956ec108585990f23ff3f741678e371b0bee78dd50029d0af257a3bb6ab3b43df1e39f2ec

Download Submit
C:\ProgramData\Solara\Newtonsoft.Json.dll

Filesize
695KB

MD5
195ffb7167db3219b217c4fd439eedd6

SHA1
1e76e6099570ede620b76ed47cf8d03a936d49f8

SHA256
e1e27af7b07eeedf5ce71a9255f0422816a6fc5849a483c6714e1b472044fa9d

SHA512
56eb7f070929b239642dab729537dde2c2287bdb852ad9e80b5358c74b14bc2b2dded910d0e3b6304ea27eb587e5f19db0a92e1cbae6a70fb20b4ef05057e4ac

Download Submit
C:\ProgramData\Solara\Solara.exe

Filesize
133KB

MD5
c6f770cbb24248537558c1f06f7ff855

SHA1
fdc2aaae292c32a58ea4d9974a31ece26628fdd7

SHA256
d1e4a542fa75f6a6fb636b5de6f7616e2827a79556d3d9a4afc3ecb47f0beb2b

SHA512
cac56c58bd01341ec3ff102fe04fdb66625baad1d3dd7127907cd8453d2c6e2226ad41033e16ba20413a509fc7c826e4fdc0c0d553175eb6f164c2fc0906614a

Download Submit
C:\ProgramData\Solara\Wpf.Ui.dll

Filesize
5.2MB

MD5
aead90ab96e2853f59be27c4ec1e4853

SHA1
43cdedde26488d3209e17efff9a51e1f944eb35f

SHA256
46cfbe804b29c500ebc0b39372e64c4c8b4f7a8e9b220b5f26a9adf42fcb2aed

SHA512
f5044f2ee63906287460b9adabfcf3c93c60b51c86549e33474c4d7f81c4f86cd03cd611df94de31804c53006977874b8deb67c4bf9ea1c2b70c459b3a44b38d

Download Submit
C:\ProgramData\WRData\Lso.db.bak

Filesize
109B

MD5
d15db33bac5b593c6c3087974db38fff

SHA1
77f67b6b5f2cf91386aa640546f51ad59aeb61e1

SHA256
7596786c8423827ce293ac1de6b685e8db913ef46323b6738f8c783fa0bc392e

SHA512
1b0669938ecb6fea580a7c5905ae1eed77b56189f2dfed17fe7787493e70b454139a181b1aea4a9b816bb5619809f1162c5a2ee78f14183760757b342f63a7c4

Download Submit
C:\ProgramData\WRData\Ovr.db.bak

Filesize
133B

MD5
c3dd4a132b23c6710c2ca7089cb8e63f

SHA1
681723a43b10742d4bf2e4ebf55c1bf2f528752f

SHA256
8fd4c44080921d7bd91eddf2d8d040b20d4937f444b7ce11e9f25d54cc6db163

SHA512
abb1fc3349849618b6987de8a1577269c3e90fc7b42312904763dc6b3b8dec707d56f2c1fd6ce2101a59d2e5a614610c60e7f671132da5845d63453b07a6fe8f

Download Submit
C:\ProgramData\WRData\PKG\wrUrl.dll

Filesize
957KB

MD5
38a317fce4c4c24ab99f034101582242

SHA1
2b45e46d99d70ee0ab2604837ab2579dc0b58b69

SHA256
017288de532942a6e9a48363bc4eaefbd72b8f3bad2b75b2ef18206f294496dd

SHA512
50a9d488041ef627e50fb6ab746aaa6df25424d7246e545454da2a57f6fd469bec7bdb4d3cb1549c7942f11d2ea9eae6070064063fbaba747da7d92b9ee35cd1

Download Submit
C:\ProgramData\WRData\SystemOptimizer.log

Filesize
5KB

MD5
97a425ded5b9b86ceb9ffeddbbad8519

SHA1
a8f07d40e95aef31555bfb07f1ca257adc3ac0a3

SHA256
e74650dbe4f74160213f3d6eada47c1d0810e4b8e30fb7e45107ae57d62baef1

SHA512
d6d4d54cee441b151c1658fad3b76e2c86de84518881da4c3f1602b75f787c6a25093bcb29bf331ea26b251ebd6ae76ffdc06eec6623855582b5c67fb53872c3

Download Submit
C:\ProgramData\WRData\dbk.db

Filesize
1KB

MD5
a01482f8e23149e5c0bdec26c11befbe

SHA1
1c518663995ba7ab4baa262b72e3b67112b66dde

SHA256
a571e5bc2648e4322383d01258c0311d2a39146dfee4dd3d8a728aa9564c8899

SHA512
724cd0d5c3bac68f79027ede95ec11b3e250f279058798c3ed34a866f6a77638a2e4bbdcf4d850e7027cc429a9a0210a96b01f9ad968acebc5f38ace10afedf1

Download Submit
C:\ProgramData\WRData\dbk.db

Filesize
3KB

MD5
bc6194ea5b38378e7161051c35103c9d

SHA1
c05a68d25f23712bf0e3100fdefeed973a1c43ed

SHA256
0389e923e262c15752c5510d613ec6c8dffa2a52dc673ecd0ca117175d923825

SHA512
4d7bd4482e89132d4571d8c01dbcad2580bbf6b1bca231d4ce08304767d105fc997ed4e6a2fdc8b7ea9df6c7212485cc0a241ec5ce12e192763b11bb90cf6ca2

Download Submit
C:\ProgramData\WRData\dbk.db

Filesize
4KB

MD5
f8fe744fddea24a09f3f0720c15d3ba9

SHA1
a8ab592aa5fd39ca22589aa405845f7211d981ff

SHA256
35c3ec09480c460608de0be788bfb20cef39b3e985c8de8444726390f5a9e349

SHA512
aafa33f97c7468014cab65fc9582745eb31698b70f0aa6caa3534b38f3ec34f15e6c071afae07e2b27d10d3f5124f7e63ee5daf0bfb53eef5544e5e52ab3d823

Download Submit
C:\ProgramData\WRData\qrnexl\qexl-1607664863.dat

Filesize
800KB

MD5
5823a5820d1438f67de30958fc51478b

SHA1
b9154ee159af7caf2520324293edf1fe1a3282f5

SHA256
3b88310eaac97777e7b275eb082c8ea676d38183def1a3302cf0684c8b5c756f

SHA512
d52c694e429d4462d300291e7084f980d6f2b332d4af8fc679873539891d675abd24c4bfc16366efb0f7b00a9d975e92803545a701b5e3d5ae6bbfd1296b5256

Download Submit
C:\ProgramData\WRData\qrnexl\qexl-2584110952.dat

Filesize
7.2MB

MD5
f6d8913637f1d5d2dc846de70ce02dc5

SHA1
5fc9c6ab334db1f875fbc59a03f5506c478c6c3e

SHA256
4e72ca1baee2c7c0f50a42614d101159a9c653a8d6f7498f7bf9d7026c24c187

SHA512
21217a0a0eca58fc6058101aa69cf30d5dbe419c21fa7a160f44d8ebbcf5f4011203542c8f400a9bb8ee3826706417f2939c402f605817df597b7ff812b43036

Download Submit
C:\ProgramData\WRData\res1.db

Filesize
908KB

MD5
e32fa7d5bc1db53db9d7160592aa3823

SHA1
713b7812e85391b6ce4ca522dbca11ce7ad4c5e9

SHA256
34bd7d25a83242fad973d3b999ce491fb7bd83253a5241f11cbe83e664924392

SHA512
864c8f957629e8a1c3d370bd35998308f6effff8931d5c67ead92addd5ba949fa3cc32552f6e0506f6879fd830d62a4c99693c1293e483c191bee444d5d3f412

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx

Filesize
64KB

MD5
b5ad5caaaee00cb8cf445427975ae66c

SHA1
dcde6527290a326e048f9c3a85280d3fa71e1e22

SHA256
b6409b9d55ce242ff022f7a2d86ae8eff873daabf3a0506031712b8baa6197b8

SHA512
92f7fbbcbbea769b1af6dd7e75577be3eb8bb4a4a6f8a9288d6da4014e1ea309ee649a7b089be09ba27866e175ab6f6a912413256d7e13eaf60f6f30e492ce7f

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock

Filesize
4B

MD5
f49655f856acb8884cc0ace29216f511

SHA1
cb0f1f87ec0455ec349aaa950c600475ac7b7b6b

SHA256
7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba

SHA512
599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val

Filesize
1008B

MD5
d222b77a61527f2c177b0869e7babc24

SHA1
3f23acb984307a4aeba41ebbb70439c97ad1f268

SHA256
80dc3ffa698e4ff2e916f97983b5eae79470203e91cb684c5ccd4ff1a465d747

SHA512
d17d836ea77aeaff4cd01f9c7523345167a4a6bc62528aac74acde12679f48079d75d159e9cea2e614da50e83c2dcd92c374c899ea6c4fe8e5513d9bf06c01ff

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\322237bf-e419-48f5-8ab6-a2754d1b7051.tmp

Filesize
13KB

MD5
fe622428c8623c223c40de559c0a4cca

SHA1
10376df996790c10ec059c9c0de314b791e04172

SHA256
d33975a11ecd572af85c6bdd28bb1c8b9a423b04fa96ecdd4e943996d5eff69e

SHA512
8d6f9626926923525037f5f4e1e98a4b3975b81d1451e3356075f403d89394e1b7c04193de81f0ecd3cac928c4aeac192b734b3fafb7daab6b7b746c065b2a8e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
f3735dc0a6be6f828fd06fff59fdd3ab

SHA1
2bd984f61cd608ece5e8692c56ed2abcf82d9d88

SHA256
faa4991670b034baa1e26bc83bd53c3517278e6daa604ee5b448953934479241

SHA512
0f56afcd2034e1618bfce5dd1aeb5139eb83ad7e5847fb9f252d14536fa3f2f2db5fb3c1c60ee455d33dd78c5fd34ebf3188a3ca5de6fc547878817fdd308260

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000056

Filesize
42KB

MD5
baa154adeb470ea23fb78cbb543e31ec

SHA1
f325e3ee7904f1ec18159afc54937ccfebbfa5cf

SHA256
714f2bafc6f0e0423df55ba82f0c1893e90a8b92a533ef135af83f4a185f8394

SHA512
1e7d34107168a74a1612ebe313fc89822df6e3639e99da884c7048d5d4cbe724a624ac3bf1f55ae923cee908d6eb0bd17b378c17dd4cebe833b3234e87a0babb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000057

Filesize
16KB

MD5
453639adc634ad57215c510f7ae3eaa5

SHA1
c60fc7b5ae62f2637485b53a2cd123b35adb5c7e

SHA256
048294f0f99ffb65941a3a06a6c84c3232148b851f437dafae3f9c67772e0068

SHA512
79847caf9209e7438f3e7571b389c3362dc9982e4ae84692279bb16c2e2dd107599c6791c0de365ecb9ec7efe8e1edfda28996fac52d8332efa0c0dabbcb2921

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000058

Filesize
29KB

MD5
6dbec7b4e518958353337d8d21b5fda3

SHA1
e9f54533f95314c6e30d659fc970051eb15451f5

SHA256
03878c0bca35ec2a9f240eb0bcad7596f9d4549bc4efc5e18436ea4fb14acad3

SHA512
ff4ad1707032e9e07d7637898937cbe52c365c4242b380dbfbf02bfe79ba75e803dee941d5fbc8043a15e2d553aeaccd28cc47c252e7b8451ae42dbdb7b9e865

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000059

Filesize
23KB

MD5
3035e2a02940ee3c5dc9839419e0bce2

SHA1
80dbc3c4b3481873283bed088d5c35fa7f0eb4ec

SHA256
8186c075828dcbcb36bd940bf9cd681eba6872e49a3c23fd7ea6a03d24cc3942

SHA512
e20e6ac8a0a74c161348bef5b69c93ced4892ebe5cd35173a057fc7eb7f7e958290fcaf22e10413c4d6b442d33679eb82f26cb5ca4f252984ecc6f0c4b179095

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00005a

Filesize
124KB

MD5
700a7f7d96ca680b66db601b7eb75509

SHA1
ef8518fa6f9200a4ab9b77b0fb8f2b2df7e002a3

SHA256
8846715864d2ca3d03e354e8e79a23c3ac2ecc9b831c9dd114470312aa68cd2b

SHA512
a9229850e5164bb4dae9f577c1631ea9ab6c9719652db3d4d995e3cb8433b64f103360455878c779367e0d83cc1c055290b900b4d8761601bdcc1189baa8c49e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00005b

Filesize
47KB

MD5
8e433c0592f77beb6dc527d7b90be120

SHA1
d7402416753ae1bb4cbd4b10d33a0c10517838bd

SHA256
f052ee44c3728dfd23aba8a4567150bc314d23903026fbb6ad089422c2df56af

SHA512
5e90f48b923bb95aeb49691d03dade8825c119b2fa28977ea170c41548900f4e0165e2869f97c7a9380d7ff8ff331a1da855500e5f7b0dfd2b9abd77a386bbf3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00005c

Filesize
142KB

MD5
6fbb67170c01ee5567f61c7d48869f44

SHA1
b788fab8cb8a25b8948b6d1205caa2f1968af965

SHA256
0e7850b9fd73499f1e3a9257950e2e9d2cce112967ba86c975acf712e423ae3c

SHA512
b1b0754d749a5c574913fe19a662e2508141571a4fdf8a3723b5b6c7da8305ca7345b06d268b7314f93c5e1acd745d61230fc0fe68c084a5f98606ec8f8706b2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00005f

Filesize
70KB

MD5
caa45f9867ed0962bef14d7769af7383

SHA1
d3035a3ac2ad2917c59c438272b2c9a4df1e5bcf

SHA256
ff0be70f96c8949520f088434d4dafcc7e243b63692b3576b8f6816906c29e0e

SHA512
221cfd5e18a0df3b87ae1508f280aa8358237e5d38096c8676217544f4c446918d617811eeea5e5f2949cbcba3c08bf869bcdb8aabb9bd227e53deee40d3e1d0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000062

Filesize
111KB

MD5
b86779553269fcf166a0e5119945bf21

SHA1
557479a902103bffb007bc50ce8b8bd42d0d3a0b

SHA256
366b985614d56fba24451cf58aad1ad50e79b20a34392292880fdd9d7928a93f

SHA512
06cf36a17cf946f832f1b348e8d47ef1da2523f32016e464212f4199b771f7f5ca05c16be04cf1286b9c97c2e690806cfaa977e952fe0fbd4a2377d3790ebf97

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000064

Filesize
38KB

MD5
6c12629373c1e44048e12d640a047f73

SHA1
7b97fad27fb3715a24231b6c641efa132004ad28

SHA256
ee1ad82ac860eeabb406a43503a7cb695aa395ed967fe7e6aaa91840c648910c

SHA512
0c6fb5614b008e149a0abecc0d9569bae9e6eb09e05bcef683f2a8ed2a802b014b16d9d5581afefad78b27eb700a1d47ed7aada7bd8a409eade376ced902aa94

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000069

Filesize
19KB

MD5
7756143bf523d274d12923301cf1ab2a

SHA1
dc4cf185f563fcb6c96e11da40f95b8dae5ebdfe

SHA256
6199b6a55bb44cedc24d0f0f44b32bf6f04cc8a1ea5d7e672ca00467479634a5

SHA512
e130cdf25042a1b356e16423f3be88b662d26b5ea54d2e36098e231242073983387e502050b44336907d0db03d8e3d43742234c6c2d9f031399c9b398668828d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00006c

Filesize
126KB

MD5
68a5c11c9ce496c795dbb5f3a400e6ce

SHA1
9b092e7d397199f4988e26fab3383e0c0f981e66

SHA256
36274412b4494a4f710a0edad830d3f3f83ff217928bc83012efab8c33730e10

SHA512
02126405b126563590ef16093c0040ef0e6054d3e679cf7c67a23f84066c7a0902530f16a09aa5d4cb856f9ba011b2564605ef0cc380d7b7f7b407e85e3cc11b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00006d

Filesize
26KB

MD5
bdbca6cd39a21b94af5e37a7d95cd7b1

SHA1
3bbd7a9c40294b9f26a7fda297a07cf68f4274a8

SHA256
fa016fd584f843b1373b82746add6f4ecc0bd88711e9e85546dd9270e77cac50

SHA512
930121da974124d737bfd6971014a2127dd1e5c383eeb643d7eabc822c867068c261f7d978a2c86f2237a98053ae3dd26a00624d8f0233ed04b4d2c0f8ead102

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00006e

Filesize
81KB

MD5
5a18a6b863bcecf86bcb06a3b9493b52

SHA1
a26866ec845b7d7f5c6965f325b77bfa9a2a007f

SHA256
5892867db3109021fe82dd495aa3462825ee43dcf51f357d328f1f1cdea700b6

SHA512
de4fe0f44f8957c2daa82be275956071eedb43c08c8eb1d5c6b1eda35dbefced0e8faf6c886a4b26d133f6e0330bb34d0cdcbe76cb00d488ad1ce7687693cb83

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00006f

Filesize
99KB

MD5
2519820e03cc052d7b508cd106ac6d73

SHA1
49f79249fd2ed3ae6cd5a9dc413e95cdb405c790

SHA256
731132a1a0d368d305ebac899d5dbf24103e8a1bfd592ee3c20864b43fed05fb

SHA512
32c04bfa4d6ad9a5c468091079c5afeabb8d68b96de88b262c7350973b295af18d473320652365686593ba9b95cddedd7e72f8c940b65db778af0d7330b24d23

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000070

Filesize
60KB

MD5
3b3b2070f3ffc260a4048dbb083824c7

SHA1
70f6bea8721ce7369166177e21d1d4fcef6e9552

SHA256
06bf6e1534eac827eb4b0f5bc3053ab4fdb64a49b8748289e2396b49458975d2

SHA512
ffc474a1a2bf23c47d55f3e32060a792562ed7cfe49a23c2596e08679c07769a0e952cfd00d0ba01c30abc5bb7d9de750aaaeab3ff2d8afb28719cc2d9bb2276

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00007b

Filesize
27KB

MD5
4ceebc85d91b8f5a0fc65e6118c670e3

SHA1
a68d78a3641795cbcd7bd4103ccda83da7b2a426

SHA256
459a191ba2f6dd1ee06cc357cdd73f5d44da981404f020dd0613bf642b90d055

SHA512
3f94a6cf33881be4ba49dd36d629ef6ad0a83b8c98f45bbac3c8c9a24a3f854ebf65a88082e0fc566d7a7945749c86c73f70324214d2f8417f952b5c55a98c26

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000083

Filesize
23KB

MD5
717b89853f2d9ec416d442beaefaa6c6

SHA1
dd1d970c6bd032323872bf40220d5635fb955666

SHA256
1faa4e282cd64ff286ee0d3ef59f3b26bbe581250ef3487d5813da228eea774c

SHA512
20baa653fed4fe26493412e7de8895edbb4040d0d2a782c98d42d915583aed44795067674e936196f21ebacf5ba722402de183903e7f321cfd4aa736f5f16b19

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_0000a2

Filesize
68KB

MD5
dee46781c0389eada0ac9faa177539b6

SHA1
d7641e3d25ac7ac66c2ea72ac7df77b242c909d3

SHA256
35f13cf2aef17a352007ab69222724397e0ec093871ff4bd162645f466425642

SHA512
049b3d8dcfb64510745c2d5f9e8046747337b1c19d4b2714835cc200dc4ba61acaa994fec7c3cd122ba99d688be6e08f97eb642745561d75b410a5589c304d7d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_0000ca

Filesize
27KB

MD5
98c7167d84957848ed3a1dfe03ea09e3

SHA1
a37c286814666b38eadadee4718c8c30d718438c

SHA256
57c371b964f91a13f7608c562be80c3d534d323962555337d3b99a0a1185134c

SHA512
c631c27abef78761af72f56f4800f5dceb10710b6db9567bd58e34d497ad12c1b36510250700bee13617dd021608753ca6c3eeaa69920fb76b99f68c1c07cf8c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\0697abdb2e6b937f_0

Filesize
140KB

MD5
90ac06becaf1dca34318b0e2d4e9b49a

SHA1
9264294ad8b8d719cdf602986c0be5e264afc83b

SHA256
1072fb70a2bbe78775537ba3e8be324315d64993ab520d7fb951d753b08c6687

SHA512
4946fb6bc134db2e05bda9d195d9f21df0392953c6281ca4603041f7b7485ae8fe413fda9634d4c14194fe97ab2a88bb7ab0f930ce5e0d7b56c0e4cbe7ff410a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\0e4198c2927b0bbb_0

Filesize
273B

MD5
aeae1f2cfe74a16fdd0f1d3513ed2c80

SHA1
3b0b682f27ff7b9222b2853804de49ae4d496836

SHA256
9deb5913cdfa9fd392a73eda118677fa643b8b466ac06736b448c040370b0a3e

SHA512
67c9c5894df11bd6e5b33dc90cebd6b1432125b51d451d0fecf3253ab6f0ec40fd6397804fc657c6d15ea13d07b58cc68ce46079269e9f99b80b570deabc2e33

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\15ceb96f51ab460a_0

Filesize
750KB

MD5
a4beaa2d977e04cca10dbd7a58ead863

SHA1
28d8d84664414fc0547f63d4e691fd1fd37b8562

SHA256
65034901fbba2233e624cfac06debe22de19b0630974f8cbdf7b80ba778b602b

SHA512
45062a370952792d93843d3d232f75231ba8665017868f71746e928cf64a8a5062732872a831056d6e41a0272c16c5614dc9368a0786c7d50839d6d0b663e384

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\2a6c304677119dd8_0

Filesize
260B

MD5
843d4184351233debe28d989b9ac2e16

SHA1
2c8890c1c170ad03d12d17419b60a7b964b6b97b

SHA256
ed7acc8b724470bfee77415123e7a62db49ec0acafb7504510ac2f196f19e119

SHA512
deecef27c5dd864b5fda0e9d2e439e3166189f4123ad612bce6bf03cbcb6ecbd3b69046e617d27e14d60ec500ef1cf1e2aacfc708a995abf850215d96f148d69

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\2cb8f998d20bdbbf_0

Filesize
301B

MD5
4526752dd06a841b4bc7b42ab251cd8d

SHA1
7c169ec026eaa32e549725ae0651629dfe86a429

SHA256
d92e7780a0d1e1435ded3fbdf0dbac7a5972d0b36c9958fee34dd658e3074223

SHA512
d60f47cdbd30ce4ac175daf18dc49ed7677314c5169da5cc10a5abefa2ae79cd464498439e5b5438e961c98019e8c3475d968cf9e0939f2b69e512bca9f1c10d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\46bb8e75ba51cee5_0

Filesize
26KB

MD5
7abc4938a0f5468a9dbd25fbc245a978

SHA1
a41c00055db1fe05caf29a221dd86cb42a2d3ca5

SHA256
a7d9067ae5e3d4c25425fa22605756cb8c4563b555cebb9c837be0ae16f7fa63

SHA512
e5d6d043ef97a11911630ef8b0cba5231df5f1b53a5fe8767298050ca40cc2af576ab0ca9977e94863a55af85006bc30a76cffbcb623aa5187dbe07a07b93945

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\4b63af3999561c21_0

Filesize
57KB

MD5
6414eca542dc5d9d5f9f13a659a03a19

SHA1
c142532fa322f83c6a4af6ff6d524ca51f50685f

SHA256
ab35f25dab35beb0957f88d7e3e8c31e81301ad6a460ed81c67c201b18e194fd

SHA512
c57b1664e63fc9f824e967ead3eb079db7beeedbc5bd0016a35ad9390b43ba3326a80942a47282cd083a87a7a16b8c9399d3b92bb3df4de276a8cefb99e25953

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\57dbc5904c0a4418_0

Filesize
248B

MD5
2d16823d78911fdff9fdf16291efddab

SHA1
9c54d46159d69ca87b93d7ea65223c6371597a20

SHA256
2f0de58a3b5c5d6db574fa718c12cc49bcc5fd737d779951b7f0c6e9d32dec70

SHA512
bbdc9811c77507ea9b10ba5d1f1edc1ad0ac09f992e21a8ced43d87947eada3240228a86791310abe45fccb96035146eaf84ae8db6b19e2fc704fe5748251fd0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\62c59565a6c9b9a7_0

Filesize
221KB

MD5
4c99d334c90aedfe03dc4e1475d3d6e3

SHA1
16f887d4ceddfe9e6cbf6665419721870bb54e39

SHA256
298da015a82aa3d81750cc99c8de85e8b062d126d80c1479242293c8122a4ec3

SHA512
39783b0d9bc60cda336fa33e0a8b1380a49b112c420c0a6bcff1c655c141ced85be016276933bdd57a8638412c9799dabc3241c9b75368a9043b31679e14c9eb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\7f518de1a903ba97_0

Filesize
40KB

MD5
621d1df32e6e5fa7c26267c0ef328994

SHA1
2abc01bea57f5ef1847bc33f35092af1a7baf4e5

SHA256
d97d85c4613fac2411105bc0790360b99e4725d78bd04080e332b6bfc218d378

SHA512
b6f1a9cb73d9f70ea4370032f7fff42d276df70cc47d2db8ba53b81996485f811379220096960cdacc61c0af07b56ae35b662055f3e158779ea6658ab862974b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\80d7ea73b668052c_0

Filesize
252B

MD5
ca5291ea81fe817c5d70a040a0ad2b3c

SHA1
9c3d4f3e1abf78c6cdae8944ac53d652a8c646d4

SHA256
7e44c9b177688def70f328ecc069e275f50e7210ff0af2f0506f8ede283e202f

SHA512
a694346a1c2b1885edf7968b6396caa54122b4cdda59cd4237ff9245fba6800f45e88f870c7fe85b5a64a8028fcd5bcfbae797a6068ef7fb65d8ef7bbe8fcf33

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\8b4bb90b2dcc8774_0

Filesize
279B

MD5
18df25e4c9a63d1c539d8be0a1463bee

SHA1
82ba5720aea443815af7834c45bfb4be92495b0a

SHA256
68054f9b9fc54e746eb468d0cfb7098fd1d8a107474ac5e2bf95d23e99d8509a

SHA512
36c4952edd2bc8ab7afac4c5016f86940740d4e04285bf8f91e045b2711dd3319ba22801eb8e3d6b5c6aa23ec9a263a8e77b00c5f9c5c56e8a4f5415d7222978

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\8deebd014ee6a408_0

Filesize
3KB

MD5
16a68b8dc4eb98f24cba3ce87ea726ec

SHA1
8d1563e4bdb53a461451eef9d1e26f3b5ecdf01c

SHA256
701915f2e120850693252af228711925e17ed2b672fb3e879206fc3fdd079d7e

SHA512
d5eb1af9e01cebe0926f7548a5eb723c3d922aca0fbbc5959d77c0a7ad404a99459ed97baa19a28f0f3a0a406dc483a3b4ca41e912f5bee0b1721f11549a198f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\8e424cdc84e3807c_0

Filesize
256B

MD5
0a886573bf33c25640782be7b80201f8

SHA1
48873901eb265fd3874e522102eba6e2ff585b40

SHA256
eea85817c837e1f479ea6f90a6368dd038f0b0ea9700f45109486688e467cd11

SHA512
c8f09d10930b8d0934d5a7a29ac54b4319fd92f1a044e513833ccb14151894a51862c3bbd00cf1ec5bedc20fd2d4da7403a0cf0966a39027018fe70ceb602a43

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\b442abc8b3dbb1ac_0

Filesize
259B

MD5
cb8b87256a509efaa08c5b4f74d5cb53

SHA1
a00e7c8ee74f6a4559396173b28c6e56584e3e36

SHA256
0b6a0d0276b10f9d4143be0b1baac449fc5df34185e18317da2cda9024c7b77c

SHA512
40bda6ac7c760ff34ac404fef2b4f9d98cebaded198a212bc31ff1f3225669f4e05bd9b16232b0c0477d3f9ea99e74d788a89fef8fbec74633ad0f14bb3b0847

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\bcdff90ca946fca5_0

Filesize
260B

MD5
98360a7c01044492b259b1304ad7adad

SHA1
60ad63e13ba951040a6ae809e8321b4ab7c34660

SHA256
b497fda109675b306524132a16199d2fd744a42c5017f8b55dc7089ad807a498

SHA512
6962fa869337dfa974c91b07f0340faab4cbd98514bb86a9d65ae452ff029353a88affc72bdf02f1afcef099c22539a3255756ec1207dc2530d93e2701d3ee1a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\e5433fd5ebca2c62_0

Filesize
596KB

MD5
11350df188769b3dd565a8efb2bf5076

SHA1
6a1b59a81fa2f603b1ac077df36cf400e3d07126

SHA256
d17fc70ab3f1a546edd38389039fe81ee8730cca45f9ff2a11577d61d82f0b3c

SHA512
74117e4d6eccdee7111fe28e2a88b11440eafd12f8d6e8e22edb7b8104618061fe407beb605d2df7d41df507fa8f013060c3ff5c1fcc9e88cc93e682f2436e10

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\f453b8cd4059e03c_0

Filesize
26KB

MD5
8a77b1af7fa6f1eebdd7db9392e8123f

SHA1
302d22c5c6976070d6c5433b64ad21b32fb57a1c

SHA256
34f8afa560fe4f3056b05b09e3156f17a65b7c089d8b9b6c7dff9672e8737dd0

SHA512
c97f0e26335f68706e51b87064a20379b4ec6adb5b2d8303edb3c9a0f37fffb7768fc5338451e3847d2119d900fa6b492176b6d840ea0f76f2320d531458d692

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
7KB

MD5
16c659c8b4ad70546661ba7b39723807

SHA1
0540dca7de6b36b998f7ac02874cd80329018dbd

SHA256
4ed0918f24d2d24d9dea9dddbe1af6e7397b81c3fad1106079dc2ec00c51d2af

SHA512
7a75ea9867cea0706fdb8cd4e555acf9889384b9bdb5de4c8afcdf8177a400aef657e8cbe8f1aa2faa62a92527f6372eec31c4a99305244b64cae787524e678f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
7KB

MD5
5d9be275e156d04d313068849d519eb7

SHA1
c6a59e571f4879c0ae1fb3e167dcf228b94d48f6

SHA256
543547762f4a0abb512c32deceaf4a05546dfc648d4e6420990c542977a267c9

SHA512
a3be14401e632262d7838f09cf58384e6433ed82cc8d0eb98a05191b3559501cd773eb4dc3e02e1cdedcf038465ee389d9fae87406c4308d10d6c1dd341fb76e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
7KB

MD5
17c8ce2c52ce62dc92eaa5c5dcdd6dc4

SHA1
77e99610a0a41d47d3d74639ca952a51a83a184c

SHA256
4f9fd957bee47406f0b9262eab774b6d07fea58552e15c4862be1f4e92e030df

SHA512
4ee513262e81cf556522e9be97c00b8332f345cd0c33f774943f0e4b806a797a07dda228f49b91f03e90137e1de0295e6f01dc36e1bdc216f2ec27bc5a44b6fe

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
7KB

MD5
3bf7e8e4b4d00a56dbb11fd4b1ded6bd

SHA1
436a1d854e7c4ed24afed8dbed3db686fc093d8e

SHA256
925cafe25d4073241e68afa5544584597bdb9a368bdb06725d25e853928c128b

SHA512
5170a0e33809242c05f9426e908c7514ed322a9ae76393dcfe497e3e9c4586a596590e42ccabd129184beed1d65dbe92183025c751348072638e9f150390d019

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnCache\data_1

Filesize
264KB

MD5
ec07b56d0b27963ac7ae73f16ff03def

SHA1
654f7dfbcd8d2e6caede9d72e383d75ef018bf97

SHA256
245459e5de5dce74f434363cc33fd6e3e8c44a2683a8bb6aede01c6bfe89edcb

SHA512
f1f17d9a43b066846c8b1fdbb7bab6e9fe385d44c52193ceea6c1f7e08322466da3694ad07854698711e97d2ed7ab1bf158a1e7460260dc84149f712dfdaead7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\File System\000\t\Paths\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\File System\001\t\Paths\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
47KB

MD5
80722781ce81616e5dc6399e9b403ff1

SHA1
5527c926810e9ecad0ad1ecac5bf0bd6ff8060a3

SHA256
8f8db9a1eb84ff445b28b42adb83113a385cc765c816f6387765c5dac6914077

SHA512
6da74b2aa35db2bc95a38f77183aca3fe725749f70e305eb08bc5c6324047d37a16c2da33ac433c11a1ff000c5c953ab3ee9d351ec1770521f4f5f908b074348

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
45KB

MD5
77136d544283cdfcc4c06b517fe95bc5

SHA1
188bd2305f66b0aed5101b26e5c4598faff0293b

SHA256
4ed55e11080d49a38e9830171aecf85438ba7803adc93d44bea4e69c95213a68

SHA512
d95a91f206392d85765db3ed31f9e0b982693b179330bb5f820ad7fcb20def8b5fbd57b8ef7548fbfec96e452a488ac07274804d3a7f9e08a164527d34fc0ece

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
21KB

MD5
ef3dc859c0e1e32dd0dae30aca2738f0

SHA1
632e502b69ac7ae3f3359f886ef442298df5507e

SHA256
b63781fd382519aa9df40f500a8d15e6cd300d3b192f7c1ef94d3781257bd922

SHA512
9a4ccf16f8c686ec8e36429388c25bc5b088174f6bffe5bac235c807a89672b2758f61fd6574bf6c1aa0f2206933f0850dd52cd30ed69132323e8d1170e050d6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
33KB

MD5
a9183899ee921097f60fb7ea9ff67eaf

SHA1
8551219bfe534c4680a0e8b1369665bb24d13b33

SHA256
8c5d4438cef749b172461d0db96b9b0d07287628da60c093a4635af57f357ed1

SHA512
22ff18cb0ee60ce4bfd61a9428c78eca31d4c1f8255466bd4c8b047b6465a8037e161f3e7fdc03989ecdee6d9d15c743a735cdd43bddfc68f6f54d963fabe647

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
40KB

MD5
bcb1c836a8a5be3a5925d87745ae33e4

SHA1
4e59817e3535607628c71101d21e7d87ae48b0b4

SHA256
7c1512dd3e321013f28fb27eedfcdb3f107b3f789c4d4cf24c45a3eecce9f793

SHA512
7399117cc32895301b658d1470001f0d8876796e435878f287eb6ec21384f2beca7c8065ccea9204a7f20d1907fac0fb962a31560ed5bb92255bd5b32dffa316

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
10KB

MD5
e0073728d7d5333753917f954a082b9b

SHA1
200fac4b643d4cf59a44b5d619aa9f028b81a596

SHA256
9fcadc6769068b3e77152acefda01f9b07a592afdead6b96820adeb448b6ec33

SHA512
18088ba3d4b0baee154ffe0370ce6c349362d87fa0d2d2a9ee25b42f584f5e6706681bd8382559c212110926f55c3712ca0d66bdb4b93009986ea5fd763ad43b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
10KB

MD5
66db82c43126875dd85915370999ac84

SHA1
f3051dc0f44ad1f583f120ec43b1944f570ad449

SHA256
38470e39b8c52cec5212ce6919ca97d0e3678d3b2b7a140dd6ea4fe66ee7eaaa

SHA512
4860890b479ff18d88f5fb03c9bb9f973422073ca2f82eb01deb424ea2419541218a368e3da2da22cf8ca0eae1a78eae25b0376290e00db1287cbaa6606d8a95

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
5KB

MD5
65081f973c61ffcb2b78653b97dbcd76

SHA1
3dd303df6eac349217d3715710db91462baef7cd

SHA256
770a3058853b2657827c35873224f42b9d4dea46f155eda80fc9fa10fba105a9

SHA512
e337733813d904cf409431c11eb444d2e4443572b4e1942001ac0b3136cba986c6ba3573b157dce14f901d84acd7667b2404965e72a96ec68d381737a86d1388

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
7KB

MD5
815cf8465cc8660a2c187a31434aab82

SHA1
87b2f6135288597697d046c845cecf2289b5fffa

SHA256
045f0d1f65d4f3ead29387b46207f5fc9664eb331485328c15551a4913b822cd

SHA512
b827477382ababfe12182d805b82c24cba0e0cdd050e1022b47f7170435b3673d516f148953cd50d044a063d2493d634f441d8d750add6235bfa1675ce76e148

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
11KB

MD5
a335c71dbfcc2bb7147f58f7d64fbd03

SHA1
ad5faecff05ceddd19d1567cab2be0586aa33cf9

SHA256
f7b20707055eeda2e8dd082be1d3f0b1b72fa7288f962f72ee026afe1a179604

SHA512
87d95d02b9900c842b137dc3506c53a9ed7b2c3209641257a8ea5822b0f8abacd8ebfdce606991589b0c04b973341c23415338cdbec5ffdb0c24ac5fd47852d8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
5f3aea21884da4e3a36513d90842df4e

SHA1
b1fff71b6e52c7138739b88ce8707f36df36c588

SHA256
ee43d62228ec657c547d96c793cbfd54e2694917039984d08447b6822a9caf7f

SHA512
cbcd6f0ed2633799c7b675d42bbeb451670218ee5eb6f745b2adb3e9242a6fdd7bf2dc45be874b5ef627c39babc8bfeb2df6dfd4505e39bc46d8446e01ca982a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
7KB

MD5
d6fca2a3a953859949e251c5d9191149

SHA1
c5ef4fd8131f41a44f64645202f227de01959b13

SHA256
deda36ee93e200f54367c1329e2a4e943de991e5fb8ac89e96385aa11f1998bc

SHA512
194356451031f7cdc783e7310a26b9c9c8ad8e25b23cdcc8b5b5e303271096ae81b827f882fd25f5ca9fe625e69353799b67c88e2547fc51eb36275b7ad53867

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
7KB

MD5
827ab5790d01cee4da4de5fd4e24c084

SHA1
6fe4b4a97a20d0bfaf56183d208ff71efdb80510

SHA256
802830a8b7f63c99e34bfd514b59a8cf1fc50b7ed4cfd5d802bac339ffa1b231

SHA512
ea108381d822076ab7ce0f885f0ee27e2e63bcc5ac48e1d5d3bba2f10bcc9a3fb888769e2697281bf1839ff24c384d200ee36090548f4bfeae32138c7991e7be

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
10KB

MD5
19bf03eedbaba7bb86eb7bf801848c9d

SHA1
7f53878075e0ee6fa3da16bc79041bd86739d385

SHA256
68b4f8cd73bc2513b5e4ff15dca32a366ef6055372cc6e357f4d7b545b0b431c

SHA512
6f475fac99252f0490a35d222c4e055db335ec6a1fc35b2b321f67d23fe4a3c9c1e4c2c7044f299672ade11f564faf5f4a8982f7a59052007b55e2116f99ac74

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
356B

MD5
574cf4480821870203bb45c2ae96b594

SHA1
a51f197eb29c96de5e853f2ad9ffb23bac2cc998

SHA256
aabce78adbbc2630f11f8e4994973860dfd579b396adade0e262150d51808daa

SHA512
e3c456a207a9fabad88eaa7c41c2eaa661e0eb4ad70aa55b74300074e0aa7e5d580391138dfc7f6ab5ae7b01f274461c23e4b08902125d3c48841ddd304a5852

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
10KB

MD5
f6c79bc3db73c97b9f16991523e888be

SHA1
d06b997ec7a5d46fa8f856cd79af571ed3105f91

SHA256
cc450b94fc279c4f3488ce0c3f144efcd2622ea75475d3747d4cb967ee0e9c10

SHA512
0d3439b7e1bffe7648e8e45763b41b06e0bc6d1f98c9fb18ef1a2c7ea147d6e503af84a6611d5687b308846f1ae70f24361bb49b1ca548f97c27dcd7ebd4c20d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
7KB

MD5
72878477603f938787fd7a8912e17096

SHA1
71cd4cecf9fa3c2e2e2c1e665d6f416b70bcda59

SHA256
866c20a623b65387b66d3cf1f062cc3a0293d335368ec57c7093a164576c0261

SHA512
2e3300a6d9225a659d0933a3a9217a760f54aee12b20a09832c07392cc11de034e3bf4d98ee2a42f3cfd68bdc96f484a59b28f4e25793829641de872e3fbbacf

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
11KB

MD5
f1fec5ec0695a0592f2956144a954c2d

SHA1
7b3f6adc0b5e46bcd40ed912a7cb96af95e1d040

SHA256
e969e0c2493702812330af5f70f590119c2107e2637d39bd2cc2e01c8e1c8fa7

SHA512
4ccad6fe5646a581180af74ef73ebb530421d1bf3b8fbdeda503ec9c01b94512fef10c2cf1c54ee435ccbaa518e82774e0dda1f22f140747a3653cd3549180e5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
10KB

MD5
b4e2b1833c203c97e677f43149001476

SHA1
855bb6c3088d2a1b798e4b59badf5aafd9e46dbf

SHA256
524de194ca350ab2dfa9c51e1453067a30237c7d0ae3c043a7b95e92674d2ffb

SHA512
3597c3fbd657f7549deee14d63e2820c723ca6ca82af3d25b1ac32a688a6ace0436cb37efec918f1851a73057adcaab9a0bf99b8507c99a1c210094724dbfff1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
4KB

MD5
a5aa94c2a4a21fe9fba86fe0160537ff

SHA1
3b36ac9772e2a56a7782b14c185e315f5dbba634

SHA256
f394cfbf0762d3bbb296e73fd2bb36dabb5a6d21d453e1574d1e585cb14dc183

SHA512
37b8d38fe8b1aea9aad65ab8deecbd0774d400209aa2f4482fdf2eaaae4e77f30a41d95ac07ebd6cde0e8be79b2d68b7d5d3a6da8fa367c9500a09e84fc5f4b1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
7KB

MD5
17720c919bd5d931b42227a962832ee1

SHA1
dfcbd1908d91778dd7b59da57d3f246e785e5dcd

SHA256
3c2789dff93413bd5bd966cb83fe95934149bcdeab1d11b29e8fe7291ebad583

SHA512
c3f7ff9806d81914453bac966370f54bcfe8e8095de6f7e56391f1e161491cc136e0a074ea58e86220071bcf7340679418bd482204f382176b674ce014522302

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
a1dd662d8fc0a3d01ec5658176a99b1e

SHA1
879b1abbc248d0af8f3e6dcb89829f36f571e6a8

SHA256
f6082ebbbedb952a1172ac499e51844fc0731ddb6c7dda9f05fc65bb9111dbef

SHA512
c33dd1e0719eaf4e41acda09c89971e46a5007fdf2cc6eb57151cdf9473ebfb58cb2a3112986c885607c1d2a283a71c991104d8159e659f0caa82957b88c3e43

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
13KB

MD5
868601d5547acb552dabd1d72cbbe13a

SHA1
951f99d51fbad9d4db6e082ac3cba532db4b6630

SHA256
d903f3bb971aaf8014c84abea6e44a351009397aa7600df6015dc1153aa6b173

SHA512
f8c12dabfcc647338f263a3ee6b29748e463a95b71b4e2e485e8fe3edfa001fafc1f6eb39a15b8acdf5fa9a712972ad0d3c16b89bcdec9c22c092a82549a3e04

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
13KB

MD5
1327129e6969cae813ca650ee9522119

SHA1
ad6290237f5320a040d8f06448a60857d1f7bb97

SHA256
e70609261a9fb9328916d272ee772ade38a3317d856acfa6dbf6be07f89c4d94

SHA512
019eeedfc0509674cebaad9897a93502da84aedb712c879e1fb57bcb044d7e58e8cff1582bbc5105de7036dfa3b81f5515e2290d0eb4ccb24e0943445e76ce5d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
13KB

MD5
309eee95510def711a5ff4072935e05f

SHA1
a24fc2b4560a9da3d0d7e278229079f008d6209e

SHA256
25b96aec3e885ec11116d2503c120660aefda0d2d7c216ea38fcfc15d482a6d9

SHA512
56e04c67377b88dbc0765abb329814861d9ed36b7451dc0b5d0202cc51e054b2d91ed6fa4e13a37b7b7d1e6ad93dfe4efecc4bb0d787d915f43d64e972660163

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
13KB

MD5
bffa3f5951a4140511e76df3386e728f

SHA1
84cc6281cc54abaac27fac40420331076864246f

SHA256
e41e9ec477eb04cad426118535ed0a28a4583f237888e5cbf34fd21c98a1eb72

SHA512
75987551d29d708b9398be2397fb0da69582f47cea433c15e7bd028c99c6e587b2d1b07092283a6e828004242d5d2872134d6400ae73a7f5b0c57c9e4cbb2f94

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
13KB

MD5
3711a53c8e63b39d72b04f4efb845920

SHA1
09a277cefb75f841dee41e64816aeeb91969fe75

SHA256
08d52cdfc0f0923fc610fcc100a0064664460d23af9ebd139041eced5592039a

SHA512
853e7ca191b7f99a251b5496fd3ae3b48f8f75ec04b9853260cc1d0a6f617dc23f872128734ab45aad066e26c3c92547149f9811c8760968e19a47860cd2d524

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
072c714eb1b49687cc667770cdb41015

SHA1
7af50198ee585722ee9b04c942606f5689df6efb

SHA256
052450417fc23c7158a13d38c141a64194d40c2414423906eec83db7bb6e92de

SHA512
08530c1088ded9967c0e05594ecbba8e08a360dbc60f0f528746e0deed842628b4acbb82a34740c42071f8e20ac51319b599f2bff4d9e62b2bb59b02fd26c275

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
7b5f841d2d99851bdea8496001097f91

SHA1
32b3d65ef867307d9fddf2b5cbe1618dc076e429

SHA256
3555a8e044fc0a2d6128fd67147f584468a797ce157c248044bfc6ab22b6a0b3

SHA512
9571b07c8b2ed29037690418711b5860b6e191f67cab73b33d868a7f723334cc67a00dd6fa67316abee8852c837b0ac5846fca5e2d9d18bcead734a184bd3dfb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
bdf6b12e026f5cc98e20f6aa3b400dad

SHA1
ea08bcee8d0f37e079f0a29edc955b092eb93d91

SHA256
082305d82b764a346563ccd4254db04933c6928402a905bde665611204cdfe50

SHA512
e73ca9a6d6473a1ae7ef18fc5595b4d034ec986206fddceeaf4efe3428c78895f95ab1cbf588b9361738c7f413fd71810300a033ec7b65385e21e772053c2454

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
12KB

MD5
d37e49c488368fc37e6b4a86d7b13854

SHA1
2352ee06abb74bfbda13e4b2210d89214bd7822d

SHA256
39155c24bf830c7550da7faf248b9563c8a1a59af28de532d8b190ac5e6560da

SHA512
80d3085c4b50c0e72b64abd3f1c2bda54f6929dc5b06333b7109d69d855f6015d77229e5aaa6d8eebdf4c91e2d331b67f2509ce551349442f590486f641f4141

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
13KB

MD5
6d8bea8697d70388783bffcbf050a37e

SHA1
85556a5ff82bfe1c6c8cb1230b71476d5f65a66a

SHA256
a415e8d5aa45f70b4f4b4dcc7c37671cd27d1c509869e2a3ec4a4e70b9d34209

SHA512
016931cf7bd550ad5ec2ea91c08c148d99fba00100953ae9558056880a829bdde5e42d7492e539a765c93a838557f8a714169f6984aabc0836fa0026a174a6ec

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
12KB

MD5
3d1a93bd25c3d42af8081aaec3ee4d70

SHA1
a2dcdc927b589966421640055e25a6b353ab3577

SHA256
1b185f5d3a13c68f19ee8f88ab1af62702b59b10ce086aed0e0ea7eefd541b12

SHA512
6d4d7715534ea85388a346581dfc7d4d4ee958cb7d2fd707e738b8606c901ebfb895eec1c865b15d1bc01fbcd0e49378183ed0b44dd7762ee0ef5b6e5446d6d2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
3fa2fbdbca7832bb4ca22f4e48911808

SHA1
6d283feb40001b9ba7973023964a42b6a7d95def

SHA256
0effc3ea122b01a1fe04f3b044e3052b40a0e70bea285f3f30571b6010e5baff

SHA512
757c3c7aa6dba42fd4daea4cfe9c2d1a7a8c92eabcce1fc33ef6df80b5924f5ab320aabb28f697e8161b424b41b03691b5e6a554a5efb4172477e3ab2686f626

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
05cf8c9b20d8a460b19bc8b4b3254035

SHA1
84625de88d83640525c6dbc23980608b8a09ba9a

SHA256
be264026800259261267653195a587d7d972a794724c0b59cf7bf00d359d0333

SHA512
a2897388e3c140ec9153db78df8a0d1b1aa9253bf610ddb28203ba76cece62785178798168067d722840090eea3b057ebe9f65fa9a22f7554249476402869392

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
02ce2eca7f4766064bec6d4fca9fa906

SHA1
d2fe2449742cf516177db0c29fbc39e6e71dd850

SHA256
ecf4b8d5c15cc399922b29a17336809445e42463439762bf5ce00751e010b8cb

SHA512
817a459cfca80d1a03f29f79fc2b56b4ff9ab5eff6a46a504735e0ddb8b540f4867da9d42d82b58b351f6a8b17d78c3cb756882ac2e2e33f73c0ec9bba3781b2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
12KB

MD5
9377e00ff975efa7ef542ed203747c83

SHA1
30d0eb74b1b3d13667e35403ddede0b3da595819

SHA256
93253980378ce35ca107b43a0079f0142e6db7c3dacff106c2b6fdf60a543f1f

SHA512
0e8d9bf80266256771977ad99e2e3a90565618226acd2a5d8c12ee57703a0493f56abc10d15ffc893a7d40ef5bc00aa3cb2eb3b33d6a1ff586150f2a4a669a93

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
13KB

MD5
72e678431788734b2ff738f1fa939e04

SHA1
e9f43e6ec85241152b4059353d6575bb0beeeaed

SHA256
496daa0bf4fb4c1efb053ff15db4c246b4531fe20a2b846f83e35f33bab2c3a7

SHA512
6f41f388f691064d1755201f47e02dac2e4417b1ee0fce8f28d1f0293f0eb2b866ef14bfdc4dcc665db1c4db783af1ef20bfed93542845fafd33c53cc5cde788

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
13KB

MD5
b235b20ee78cc85d0522e9e0add85b16

SHA1
e8416cb1b626b457e5bcec0898acda31cb75ba6a

SHA256
9574b14bec1e55ca5072e9b87fc405836449e004f6063de4e9b030b0cc119165

SHA512
59df211c0ef98197734deae62f05b4b40e352d38d3bef25d09109d381f6c8b27f1ae9f1dec73ee44c7d52b5098af4fbdcdc8b225cbb46aee718bdedba95fb9d2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
13KB

MD5
73852611eb7970bf7e502e59b329ffae

SHA1
7c4d3f8ccf1b8d5f61d3edd52745c138c6d47fb1

SHA256
48df0055c3da355c87a876b159e8f629eb0069c4757b9543e565b7e636551fbe

SHA512
b3f875af0e6f7a83c3703c777ebfe4506ef342d604974349c7688771544fce26815f45de3505eac1cf0e821f03490328c98cc2d1e7919e460597dc32b0bd7918

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
13KB

MD5
abd4c12a2dbac5b8e5dc137c9809b58d

SHA1
8f6fe2391b27486adab956e116c96f7354ca388e

SHA256
e848e8a3594f1bc7bfc24b31f65ac6b8de78d7de86d952b11091b7f8334713bd

SHA512
0b962927d1a64832dcd0a200919352de5eb30d52cbb1a35a36e04dd5a6c19acad24b3e5c5f4d32c1ef6e48f28f77212ed2a7566a3518f900438d78094307e97a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
fe9b38ae65c8ee8b6b36b202c46b5d7d

SHA1
6889dd4d7c41fe7fcf4cf910290527aaf0837b66

SHA256
6b5c9e7f9c324333e615a8ec4bda3e99455c8082683e04a61597aba59b68cada

SHA512
567aeabe421a08452fbddcd3fdb03b0bf4791fcbd0047a4ea6c7b409c2960e6dfe21d93684b1a84adde843f5b4519c96f3896fffd8a2d0d85871900e3991a970

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
13KB

MD5
ce2dca24afd6d5aec01a35088ea48c2b

SHA1
7ddc34cd4ac45196b44d0057210719ad089588d2

SHA256
71fe37432b2bcddff2af07194163091582734918ae6195ae6b04ee11679c4d5e

SHA512
8a036f144af8b675525a97b87a5ab0cf2864c4f8d41a027c76bca78e1f21f5906e3b8a460460a0fdde284c8a17f011d5f5d1a6a0a230fbddd4031df98e3a6625

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
12KB

MD5
5ec8e4f3dc7ee3268465abf38334f2ea

SHA1
e1d48c02aeb01ea6f4067fecdc86f7650f823a9f

SHA256
56a4b3714e4acabe0213bdbaee0e0d43067f477be2d052dfa10ecba1da0d2b09

SHA512
5a2502064d66e8f67afa2f77511b550c694efd9fcd1340ff62db07d0ca6b89cffee3d86c3cf9d069c19d84139f31d58fe7433f743bdf3418f850af40390dae5e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
13KB

MD5
1de0b4e21c50717ec2138503bf1fea1b

SHA1
fe9cea595f4e387cc210d45fb3fcfe25ef9f3197

SHA256
4550198eff68ba4827477ec8f3cf3107861ac96b90ab7f3ee0859dba260a656a

SHA512
3948bf80c507f72fc52dbaf7566770ad09bad561ac06fcc3468724300dbaa4607bb3246e33b42af652c821e18ef67d441de173637848e1db33637672e33f711b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
31700d98f06bce50769bbe20bff7c903

SHA1
be032d5763b1a9c2caba2fbd098800d88a4bcef9

SHA256
f4e8424f9d2428ea177f8b22b86b86d561ae8f3a11b2af62584a4bb590b5572a

SHA512
9e09de0b5870b2b815b1caebb66f9a3fe32119aa085e896cf9d0ad853f6d7426df9f0ef66e28b2312171aa32a7db8c40dcb3a60f695ea3ccd1dda94efcb6cabd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
27c78e18e3e5a9ec19b37e180fc25c66

SHA1
4539b567cfc4946547787ae4d040b543efe5e42a

SHA256
03f4bbf9a0b69b7a94d3ca68c763bd69334bb7ceb7732e29238c879651bbcce6

SHA512
f869fa0ee066fce2381ce641caea8b350966c9d693cc3e32579a9ff8e59e5e3a09d0368dab95aa6bc1107f68e8503413d904131e354686d5c3ff72ed572216aa

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\99f165cb2044a72beb74125231569e99f93e0a79\40ce1310-5c89-4112-8b23-cdf21458c7a6\4759ee1a464f53de_0

Filesize
20KB

MD5
ac8c7f99608d069e77c490144eef6ca3

SHA1
41d201c361169622b0016aa29f387ef6badfd9eb

SHA256
5b3a4644c31b32aed1e98d9d54a6df3061c32095550270d931857c9c745543c8

SHA512
9b576cd8935d039c33cf6335dd8838a61b0d6e9f7f92dde137908c20639eb1ad0430084f53b2a2f84a9d7d110d42a8790f76b43504f79c0244eb1711799eac9e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\99f165cb2044a72beb74125231569e99f93e0a79\40ce1310-5c89-4112-8b23-cdf21458c7a6\6ac8aadbde7ed6c3_0

Filesize
1KB

MD5
022f8c33f707c3663158fb00dd5651fe

SHA1
fa7c5f1f80556c9693adc57ca95269675bf4ab5f

SHA256
a2e973a88f87ee872cc0b8f40ef377ecb1ce723381f17b316b356489b5eb657b

SHA512
2042cdb04cfede8fa082aafdba45e5f7023b9b0c3ef890f080a1cf565ea998c1d9b550a9cd3c4795a1e30398101c5f7b1ef3e272150cb5b87f624d26b1e2e51a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\99f165cb2044a72beb74125231569e99f93e0a79\40ce1310-5c89-4112-8b23-cdf21458c7a6\9106f3d992c247e3_0

Filesize
6KB

MD5
6dbf1ccd09e08c4f6480430ec9ddedb2

SHA1
8191d1fc231605ded42e71ef7221b3fc3bb117d6

SHA256
6f75c1bf9fae881c77647b7d35e703919f55eddff38795dafc98864675f9248e

SHA512
d5a53694df27dc96c077e0d378caafaddee5eac7a8124f32e1cc91ffaef9ddaf07988b8f73623462cf00d17bb7888da8de78f10a37d9718a34eb8542fe6b4a43

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\99f165cb2044a72beb74125231569e99f93e0a79\40ce1310-5c89-4112-8b23-cdf21458c7a6\94f17951ab6dc425_0

Filesize
2KB

MD5
48a877d60e2334ef6d3cbc0dce010335

SHA1
cef244c961ac36bd08ecce2b90448717dbf81db3

SHA256
fbd51e724b2a6de7b9794043c6b88d3ab1363b4155e7fea5fe1ab984f55eccbd

SHA512
0d8bf5a2d6294a75ac7ae7a4f481e0ddbcb9ad7c10368c4f2f2af227a0205f1344cab849685539f4d5a60172db6c754012fd4c8bd1cc4743db546ca7e8214e61

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\99f165cb2044a72beb74125231569e99f93e0a79\40ce1310-5c89-4112-8b23-cdf21458c7a6\index

Filesize
24B

MD5
54cb446f628b2ea4a5bce5769910512e

SHA1
c27ca848427fe87f5cf4d0e0e3cd57151b0d820d

SHA256
fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d

SHA512
8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\99f165cb2044a72beb74125231569e99f93e0a79\40ce1310-5c89-4112-8b23-cdf21458c7a6\index-dir\the-real-index

Filesize
48B

MD5
d10de790617f87fd37594be7749f01b3

SHA1
3a61bf0592884c75f5571740f93ccd133f7af8d4

SHA256
510ee03abd08f8d5a81a99313d3f2dd36624729fb3edc39fbe40d7216a16149f

SHA512
d17a3244993e37654acf1b709fea68746d7fca6e518a56207402933e07599ba26c53c9130c164ed6776bfbfa0909f1ec977d0a9ea706ef5af05fd1a6330dd78c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\99f165cb2044a72beb74125231569e99f93e0a79\40ce1310-5c89-4112-8b23-cdf21458c7a6\index-dir\the-real-index

Filesize
144B

MD5
0fa8c62bc248fb4c8e94765a94e8cfb4

SHA1
4a312bdb6e042aa5330cb4bebd2f25ec0f8e935a

SHA256
3bc2d083c45da705878dfb59792d28874e15f889234d433b8fac593d0ed49cd4

SHA512
889fe324bf7070cb6ad6c27eb5b89bb8b870fbe18fe2e7f846adfa60b9680c0d763665ed151836ee92c3f06b3a3260332aea0135a29281c40debebf767a07f04

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\99f165cb2044a72beb74125231569e99f93e0a79\index.txt

Filesize
118B

MD5
563fc8537c3c787e9b60f3f31f7cbd31

SHA1
9fa858185225a77c774e5b92d04bf95197e38911

SHA256
50b50bd0aa626532768c3b714c184a17289136079bb1caf9a2e97d7bc33fb271

SHA512
e36790aa3ecc703fbb2e4eff54504bbc304a97f7cfa69d9f8a70b56539667f3147821771d91b5f3bb0001ad6ac75762f69787844d73663a5667c2eddd31b875d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\99f165cb2044a72beb74125231569e99f93e0a79\index.txt~RFe59e19c.TMP

Filesize
123B

MD5
e57740ba64a56cf9a10fb8b75e858c87

SHA1
7ff0a8bf363137f2f28b33f6d714ccf17101ed88

SHA256
f1eaaba846035c8d6e15d3cea0f027626274f1a97c8534a4e3c49173182b2dc5

SHA512
c199c2f407089f754c28037293921ffa7e527039c631349d42b7cceea89cacbcce401872874fb9e24ca7886d4f13072627ece1f2ef4d36778af856089d2b331e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\ba23d8ecda68de77_0

Filesize
12KB

MD5
9c6654e7d08468683334927277c3c4f9

SHA1
715e523c808a732aa067ac324f744ab5cb6c3006

SHA256
dcfd0cf25b4478a6af3871cd1db4b1ba564435f7a524b3139bd7e52d58930839

SHA512
7948e096c2d69cf57b0d1182d9c62a559b3529960644fbc88cea0e4d3e67449ec2b0ff960dadf886facfa09588a7055ddf88d62493dde0eea42f6dea01022244

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\ba23d8ecda68de77_1

Filesize
23KB

MD5
32d0dd6fc5e203711a3bc749e6bc3b49

SHA1
5f953aff717ee18496606e932cab4e26d489f390

SHA256
b692aa77eaf613fad41218c1483132334fef82827446832df6422b1690e6362b

SHA512
276d3703929796064558e577e48c6c4d9d60abfaceb8606b80a1248d2673bd5c34bc0411e8943baa3f8758e09b95e7b9858f0edaaeddbb9617c11ae27b6cb290

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
120B

MD5
dbeb7ddecb382631f0afbe4ca10a092d

SHA1
4dfce702f290cbd618b33cb2bd8200e73939703e

SHA256
031827d9b0ee04e7dc78bc9eca2e92c0929c6dff251ed6140c1ef8dd718fc9da

SHA512
c9c8d19934a056b8c04b71ca45a0461aeff2cdc08a8aa88e6d594ddfdc55cea52c275be06b79ecdbdd6bb8770e759511489ffc4d0b5b43bf720c4c2aba3e476d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
229KB

MD5
c0147597a368624a908e482b221b31c1

SHA1
0eabbfd26d81e15b1be0b774189735e41a28508d

SHA256
74eac18d827328c98642bbab42fa97f6f6aab4e5588c443389f49abe5103edea

SHA512
854b6605239ddee44a3e775abfa49ece0478ee80d3b02ca924fdab5f885fbdc1926fc41610888719ea45acfec5f69afec9d1073961f2c0c19f8d3821e4c146a9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
229KB

MD5
5826870db5455fc5999ed8ee533845c3

SHA1
5a4df3b3f202645a9528028b6c81d97066f8d84d

SHA256
b38351b1936075199e77b71b4f5804d44b3202bdea2bc52733728afb43a1a6d9

SHA512
3f76b4b217535f26f09066f2017cc26d75ca7fb8d8eca0e6447bbadb3e8f7147b85a84080913dd9549342e60fce0417ce58e0024ab416ec4725a4ce66ea5d438

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
229KB

MD5
513db71163994d24b26ebf0286d42325

SHA1
7884be0180ecd8868a814a4abbc451239b4da60a

SHA256
3f6ac5b384e47e5d47b62db0a1150ced383c0ec37104b5ec1de11b2ff51a3e04

SHA512
346c1dda32950e0ff56cb2567a288290b74879ca133090c3b8f4b135117bb6cd38f76af5b151fa00ed9985051d679e15fd773677c6ab6a8927d59510ee48000b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
229KB

MD5
b478be6747ab200b911f32b3bc618c00

SHA1
d111dad1f8979dc1695b1e54ca8481fe75c734d4

SHA256
e6303a87922869b0ce4ce78c3bfc661785037ffe68c2a1397788da6c8fa15e88

SHA512
f62c74b15b77ee77e379161b32319ee31b45d0ad7747b596d17027e622af767c424e7a370499a6f006b4a79b0b5606450167015a6b8a9a24eac5f861e572248a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
229KB

MD5
414b7f36e95e4c4c01de82d7ccf55eeb

SHA1
b8f41b7e7269f8f12d6cbe6ada58189570b83903

SHA256
f7053d844f9113b8ed289bdfdb7eac35bd91210a9e64fabccfecbf7cc5c670b8

SHA512
39baf2162ef5d9e9f51ec73abdf0fc1179ee2cbda27d8b8fff648b77743a12b0dd459c81d0aacc1cb7d36d6ef168f92ea2563bc38bd7bc6334b3cc3db2a37bad

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
229KB

MD5
c7996fc3db5e6c0851219ae04bbcf20f

SHA1
65a0609eff0b290123ab43baffccd5b92d678667

SHA256
f270772f3908dec3192b966294cba06abad8ba7f91231acc38f0b0990de4d49c

SHA512
52bd9f84a4be5086c4dd0496fbe3c8aaf8b17f231c0db9dcbe6a0187534d2dab66c8068a7c5a54a988b7b9d231e30d34524e4dac10dc58c78b08ec5f392f1033

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
229KB

MD5
05d44eb8f6513409621ce5bc72ddd9ff

SHA1
5aa813c392892178a3f143af58ab53ea4ee132ec

SHA256
1b5a5db42f66026152ecc574d1582e595b3fd43910149f822aeac24389764ede

SHA512
af2d8b2760401ab3e40718b229cd57b3a04854c158721c86d84e6ae99d95cda0c736bad5f75c84e93b1c680e3e592c073924aa7cfeeaa1a067c0f0bd9dc7202c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a28bb0d36049e72d00393056dce10a26

SHA1
c753387b64cc15c0efc80084da393acdb4fc01d0

SHA256
684d797e28b7fd86af84bfb217d190e4f5e03d92092d988a6091b2c7bbbd67c1

SHA512
20940fee33aa2194c36a3db92d4fd314ce7eacc2aa745abec62aa031c2a53ba4ff89f2568626e7bd2536090175f8d045c3bb52c5faa5ecc8da8410ab5fc519f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
554d6d27186fa7d6762d95dde7a17584

SHA1
93ea7b20b8fae384cf0be0d65e4295097112fdca

SHA256
2fa6145571e1f1ece9850a1ac94661213d3e0d82f1cef7ac1286ff6b2c2017cb

SHA512
57d9008ccabc315bd0e829b19fe91e24bab6ef20bcfab651b937b0f38eec840b58d0aed092a3bbedd2d6a95d5c150372a1e51087572de55672172adc1fc468a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
408B

MD5
5bb116390342c9ad3b3a01cd965ded38

SHA1
80c46b6a8252814afbc7ed308cdb54919071f765

SHA256
11336c8d4b0f5fdcc2c3e64fbc08ef08c853f2ccd330b370e2b8eb5b6af80ad2

SHA512
cd45676d6345ccc00ec64693938603556112ecc7bebd2422da8a734e3e7087886bd74c02fccf467f06c58552ec3a58fcd58ea471fbc2e472b9881a82863d4ffc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
1efc6190a77e7bf11ff162663c84874b

SHA1
a41c7a53766b22863358e0a89ae0b571c8637c9f

SHA256
cd07474b6da2a128314f83f92c042a45597bcde3a3c20f71c38c951a805263de

SHA512
befeefb0aaba0947ceb178e632f7d4d273119fa548fdfc2505e4d6a2163c099650016bf25c94a5bef847cd7ae64d1945b645cd8c94decd3fa1bd77616b13fb69

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ab7ac5329840a3410e314421f8298387

SHA1
799d56440d9b8aaf29f7cb3542153696b95735cc

SHA256
6352d5c27d77ea28b5808714954dff0cd20863907e02305a8ecca68eeb7f531c

SHA512
95cc5c8efcfbfaa187f1a470e8816de27e3af7795c6ce62b05bc2f2275093903954f059130047482c4bbfbf0c256e727940eadc799689e2af7f567ed6a67e3da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
07475ba3e72b20a74f7d26a89f27f2e1

SHA1
d5b337a191ec98ea2d0a80ad2ad8eb33084515fe

SHA256
fd0c82deeb6abc7f339940716fae72e55c92a9d934b56e4d2c8823728f59767e

SHA512
e57fc9915ab3c3748caac0d8d37c121d7d1be5efa19722216e3d531ff8d765de3591da1ffcfd9e1c844f2a3c4d8cb41ef1acc0d8626236cc17939092bc8d5c20

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\6d5a893c66ed0115dcafe1edcbf6a757ccc1e2c5\index.txt

Filesize
94B

MD5
65f46f410fe26535ba676c7c5acd27fb

SHA1
950c23a29f96532d3622b0a32a656091d41757e8

SHA256
669b72bbed5bda497d05190baf15f90751663d8975492b76c987abf0b148b5b1

SHA512
0c2261f110a340c4e28029468dee28e29df303accdfa291199acef6368b00d45c5c446bafd54d933455f2bc602656988eeb16405505387610c7c1b5c5671d7ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
02d20e78a2939a273d14938c9c431179

SHA1
38568df9460f59a06353664815fa43516d88a9e7

SHA256
426b313b80146c151a9921670680aace1f827ba5cf47993362ae18a7a23a8a51

SHA512
9391c33450fea9440fd3a76f2d1b8f978de1806d8b27c90a781986920a3536bff9b33a9394c857a481f3386505e00746e1c82cd959f680b62896309c8d42ca36

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe67b5b6.TMP

Filesize
48B

MD5
82128c8130fb91d859dbb7f5ce454981

SHA1
3e2f832384766f160c08bee6baf0b6436a8b0d86

SHA256
ed751bdaaef8b73f3bb05780be9e7c4579fd389c90b14cd306a3a537f98f2153

SHA512
3d4435707ca063ccd5bef1e7ba1093de029b46d1155871ae9a0bc2dacabda4e881454a1e9cf105d517bbbb7b8aea3417d968c76d79b231518018c2f6edb9139e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
2274490380c4efaa5220516b36d161fd

SHA1
ad3f97d65418ae998a2065869f515219b23ac009

SHA256
3314e92612a787b927e85920e5ce61c023e25cb81f3816133448360171c0cc3b

SHA512
918e4a5c7758d72ebc068421f91ee03761d65eec053b48a4dda5f20375389fc0f88e9108eea78a40f646cbbb2f93b976cd70da4acd6ff88c23feebc167ca22b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db

Filesize
28KB

MD5
5a5fafbd269614330b897bc3b8f9a92a

SHA1
b45f48aebd39871859dc25d55700a5e6ab59db76

SHA256
d3945e50720993f2755382e0ee2963466d482b41495daee039346f31767b4b98

SHA512
aa2687309e07d761784c6ba36b8ba4697003f2461a84927d5c5eeb7b909b7e8b0721eb747ca30b4e7b2afbbe1eac2aeab9083bb7b578fd8ca3ad3a955a3aa9f9

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\BackgroundTransferApi\727c20d0-792c-4a1b-b2e2-5d272588a33d.down_data

Filesize
555KB

MD5
5683c0028832cae4ef93ca39c8ac5029

SHA1
248755e4e1db552e0b6f8651b04ca6d1b31a86fb

SHA256
855abd360d8a8d6974eba92b70cbd09ce519bc8773439993f9ab37cb6847309e

SHA512
aba434bd29be191c823b02ea9b639beb10647bbe7759bbffdaa790dfb1ec2c58d74c525ef11aacda209e4effe322d1d3a07b115446c8914b07a3bce4d8a0e2c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\node-v18.16.0-x64.msi

Filesize
30.1MB

MD5
0e4e9aa41d24221b29b19ba96c1a64d0

SHA1
231ade3d5a586c0eb4441c8dbfe9007dc26b2872

SHA256
5bfb6f3ab89e198539408f7e0e8ec0b0bd5efe8898573ec05b381228efb45a5d

SHA512
e6f27aecead72dffecbeaad46ebdf4b1fd3dbcddd1f6076ba183b654e4e32d30f7af1236bf2e04459186e993356fe2041840671be73612c8afed985c2c608913

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Windows\ELAMBKUP\WRBoot.sys

Filesize
18KB

MD5
cb90163ef8ed2751f90bf3f6c0396aa7

SHA1
083b844a0ab23304f9bc25983dcd2e3d7a186b7c

SHA256
9750e9bf964fbbf097f5b22bc1613862ed688cc01ddde631cd315986d5d68e3f

SHA512
08da7d97b8a6cfe529e37d83ad0fb1c00240b17413cf18f2eb87b85fdad294cab2e13efc02f5e986d7981796a96c9c634cceab3f0f6e753af422a912279b7c5b

Download Submit
C:\Windows\Installer\MSI2E3.tmp

Filesize
718KB

MD5
8e611bd782c4285454b49d38199c7ba5

SHA1
e24939569c77821b07ab8e6c4b87c4b9aa0571e3

SHA256
dc9f747cda5fbd08bd3e347eb25bbe08f7c3612d6b9381b42bdd5b9706ea3516

SHA512
2a710b802fc50a722e82e533d78e8c2f8e921c9e3723b0cbd6c90be1a2488d7ce627e7218103cff3caa019acab42706f248bd66fd7d40a39f909e1f9cf5bf4c4

Download Submit
C:\Windows\Installer\MSI966F.tmp

Filesize
122KB

MD5
9fe9b0ecaea0324ad99036a91db03ebb

SHA1
144068c64ec06fc08eadfcca0a014a44b95bb908

SHA256
e2cce64916e405976a1d0c522b44527d12b1cba19de25da62121cf5f41d184c9

SHA512
906641a73d69a841218ae90b83714a05af3537eec8ad1d761f58ac365cf005bdd74ad88f71c4437aaa126ac74fa46bcad424d17c746ab197eec2caa1bd838176

Download Submit
C:\Windows\Installer\MSI96EE.tmp

Filesize
211KB

MD5
a3ae5d86ecf38db9427359ea37a5f646

SHA1
eb4cb5ff520717038adadcc5e1ef8f7c24b27a90

SHA256
c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74

SHA512
96ecb3bc00848eeb2836e289ef7b7b2607d30790ffd1ae0e0acfc2e14f26a991c6e728b8dc67280426e478c70231f9e13f514e52c8ce7d956c1fad0e322d98e0

Download Submit
C:\Windows\Installer\MSIA5C5.tmp

Filesize
297KB

MD5
7a86ce1a899262dd3c1df656bff3fb2c

SHA1
33dcbe66c0dc0a16bab852ed0a6ef71c2d9e0541

SHA256
b8f2d0909d7c2934285a8be010d37c0609c7854a36562cbfcbce547f4f4c7b0c

SHA512
421e8195c47381de4b3125ab6719eec9be7acd2c97ce9247f4b70a309d32377917c9686b245864e914448fe53df2694d5ee5f327838d029989ba7acafda302ec

Download Submit
C:\Windows\Installer\MSIFA47.tmp

Filesize
394KB

MD5
afbef36596e1a64a6962303d7551b33c

SHA1
72e8c438423ebf1bf4aed7ad2f4475c03c3d6157

SHA256
ad219c647d1c4b06552f6c4f692500024b1cd71c57c903d0fcc88dea5ec46cc6

SHA512
026cdaa42c574ba4abf0c7d3be5103f38a86cfd76f9992a2c78508bec315b9b1b067b9506d6e9691b3f3842ec7c099fa17072d8acfdb53ccf5379cac93d8d0a2

Download Submit
C:\Windows\SysWOW64\WRusr.dll.new

Filesize
292KB

MD5
a2c1fc9dcc35c1a90db239de96fa93fc

SHA1
75b427e1202caad51b896b73fbab7ba3f319748b

SHA256
7aff8071e60c13113a8edc35f4d52e483d26ec8613858da470018d6e1dec9394

SHA512
34bfe57a6e02a0fde7c31c89a81022e1e26575be0df9ae290f8dfbf4db01dde4aba2cb035ec4d64ca0104cc99b6af689e3063992f6c3d27c370df6594d32675d

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8E98E754284A422CC3ACAABE73E0D55B

Filesize
1KB

MD5
af749a216c00c7d25c249fca0d7fd471

SHA1
580a6f4cc4e4b669b9ebdc1b2b3e087b80d0678d

SHA256
e8e95f0733a55e8bad7be0a1413ee23c51fcea64b3c8fa6a786935fddcc71961

SHA512
a30b1e92b99b839d0076808e38f1c65fb42b1a9608778a0596f5350b3ef80dd15f2e226e1624298ff44135e736717d27642225adfe8a9d10e24b5fa22d912c18

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8E98E754284A422CC3ACAABE73E0D55B

Filesize
256B

MD5
aaad8e97c7c897d8a78a6de5a28b8189

SHA1
9e3094705def3d47f44730f6959263ad1dcf3620

SHA256
13e4258f14839f18672da13e74bf5c93c4957671854cb75ebc656b4f353ed388

SHA512
d5aee9703353b30eb663de8346ffd84051435ab1f5c4fe9d7683104769328edccb6f35fe79f6cca38136ea8d5634a792b979ef29d639b869328dbf7c406337f3

Download Submit
C:\Windows\System32\WRusr.dll

Filesize
255KB

MD5
391e6e4c7ee1cb3ecb618757811b4cef

SHA1
98d9b135c67474fea55375bebfd37bca6a00a9d4

SHA256
2da68a3c21dcf0ea912e7d17e24cdfc63d9f37cf53f93924effbb505809fdc9d

SHA512
262e9646d64c7bf300b343c6717753d708a1dc26ee65a225edbb59b660c594199d80343899301badea614b3ce9cfc6320d6dfaca28805644b2e4d1a057a66c33

Download Submit
C:\Windows\System32\drivers\WRkrn.sys

Filesize
137KB

MD5
06b401646b1e302eb08067534f287584

SHA1
17a27485f48892a8b1ceaf98d8d01b0cb53ab68b

SHA256
360279e9e5acb05c6f1dae511f1940c58843a95eb22abd5933718b4ec5483e55

SHA512
cddc2df10ef3cc2a83e5263a2e0a6e3c9a312b6c306c43f6538302ea8cbdfd8cbce37af30ad9248d955d7cc8527a93de7f8f0c8a094fd5767f41fbaddc8ddaf2

Download Submit
C:\Windows\Temp\FXSTIFFDebugLogFile.txt

Filesize
14B

MD5
6d433fcc14dd8addbbd702de138cf0cf

SHA1
9db94aec44f29e3ca5bd52fda11966fbedc52f0d

SHA256
d19fae4f5d3889885a27b06ef26e4ce625b4a5cd160d7aa6f385d40426307e0b

SHA512
346ff3f47f5dc29ad503b3f2f207255cc41e3e7a45d6ec108dc938bcdd4f45e466ad77871a13855933f05053aeb897c9ffe56d932cffdfc91c8f1acf2a94a476

Download Submit
memory/1208-18-0x000001F2A35F0000-0x000001F2A3612000-memory.dmp

Filesize
136KB

Download
memory/1208-2940-0x00007FFB5DE50000-0x00007FFB5E912000-memory.dmp

Filesize
10.8MB

Download
memory/1208-15-0x00007FFB5DE53000-0x00007FFB5DE55000-memory.dmp

Filesize
8KB

Download
memory/1208-16-0x00007FFB5DE50000-0x00007FFB5E912000-memory.dmp

Filesize
10.8MB

Download
memory/1208-1-0x000001F2A1620000-0x000001F2A16EE000-memory.dmp

Filesize
824KB

Download
memory/1208-54-0x00007FFB5DE50000-0x00007FFB5E912000-memory.dmp

Filesize
10.8MB

Download
memory/1208-2456-0x000001F2BBEB0000-0x000001F2BBEBA000-memory.dmp

Filesize
40KB

Download
memory/1208-0-0x00007FFB5DE53000-0x00007FFB5DE55000-memory.dmp

Filesize
8KB

Download
memory/1208-2478-0x000001F2BC240000-0x000001F2BC252000-memory.dmp

Filesize
72KB

Download
memory/1432-2-0x000001DE76C30000-0x000001DE76C31000-memory.dmp

Filesize
4KB

Download
memory/1432-10-0x000001DE76C30000-0x000001DE76C31000-memory.dmp

Filesize
4KB

Download
memory/1432-3-0x000001DE76C30000-0x000001DE76C31000-memory.dmp

Filesize
4KB

Download
memory/1432-4-0x000001DE76C30000-0x000001DE76C31000-memory.dmp

Filesize
4KB

Download
memory/1432-9-0x000001DE76C30000-0x000001DE76C31000-memory.dmp

Filesize
4KB

Download
memory/1432-12-0x000001DE76C30000-0x000001DE76C31000-memory.dmp

Filesize
4KB

Download
memory/1432-8-0x000001DE76C30000-0x000001DE76C31000-memory.dmp

Filesize
4KB

Download
memory/1432-14-0x000001DE76C30000-0x000001DE76C31000-memory.dmp

Filesize
4KB

Download
memory/1432-13-0x000001DE76C30000-0x000001DE76C31000-memory.dmp

Filesize
4KB

Download
memory/1432-11-0x000001DE76C30000-0x000001DE76C31000-memory.dmp

Filesize
4KB

Download
memory/2408-2943-0x0000021534DE0000-0x0000021534E92000-memory.dmp

Filesize
712KB

Download
memory/2408-2941-0x0000021534D20000-0x0000021534DDA000-memory.dmp

Filesize
744KB

Download
memory/2408-2947-0x0000021534EA0000-0x0000021534FAA000-memory.dmp

Filesize
1.0MB

Download
memory/2408-2925-0x000002151A4C0000-0x000002151A4E4000-memory.dmp

Filesize
144KB

Download
memory/2408-2939-0x0000021534FB0000-0x00000215354EC000-memory.dmp

Filesize
5.2MB

Download
memory/3336-6017-0x0000000003260000-0x0000000003261000-memory.dmp

Filesize
4KB

Download
memory/3336-5927-0x00007FFB3E410000-0x00007FFB3E420000-memory.dmp

Filesize
64KB

Download
memory/3732-6030-0x00000236A1270000-0x00000236A1271000-memory.dmp

Filesize
4KB

Download
memory/3732-6027-0x00000236A1270000-0x00000236A1271000-memory.dmp

Filesize
4KB

Download
memory/3732-6025-0x00000236A1270000-0x00000236A1271000-memory.dmp

Filesize
4KB

Download
memory/3732-6024-0x00000236A1270000-0x00000236A1271000-memory.dmp

Filesize
4KB

Download
memory/3732-6031-0x00000236A1270000-0x00000236A1271000-memory.dmp

Filesize
4KB

Download
memory/3732-6032-0x00000236A1270000-0x00000236A1271000-memory.dmp

Filesize
4KB

Download
memory/3732-6028-0x00000236A1270000-0x00000236A1271000-memory.dmp

Filesize
4KB

Download
memory/3732-6029-0x00000236A1270000-0x00000236A1271000-memory.dmp

Filesize
4KB

Download
memory/3732-6023-0x00000236A1270000-0x00000236A1271000-memory.dmp

Filesize
4KB

Download
memory/5852-9689-0x0000000006AF0000-0x0000000006B02000-memory.dmp

Filesize
72KB

Download
memory/5852-9688-0x00000000C6480000-0x00000000C6AD9000-memory.dmp

Filesize
6.3MB

Download