discordrat | cb6d814bf564af56be38a29e93aebd665c29736179462cfb9f9b69f946af8466

Analysis

max time kernel
210s
max time network
204s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
13-12-2024 03:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

LoaderBasic.exe
Size

92KB
MD5

46094da1bb8a34bf64fdf689691b2595
SHA1

9b95170dd9c718a14e49396a9f8a374e72357220
SHA256

cb6d814bf564af56be38a29e93aebd665c29736179462cfb9f9b69f946af8466
SHA512

0a1fb7d4d540161501978dde8a141ac899f35e3e8cce0a7a54d712592de9512e86392ed265811f44ecc930a42f17b96cf572d31901cde3646be19cedb99e1657
SSDEEP

1536:EbPuJtGN8F+9okEPBAqcBPDyc5I0bpAkAfLgbGNrE9xCIpOMel53:SuJkN8FwokzBBPDyc5RQgbGNrPlt

Score

10^/10

discordrat defense_evasion discovery persistence ransomware rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTEyODc1NDE4NjI0MzI5NzMwMg.G_xQWE.8Vr08GKNWwCukUxcxGqNOzrKAxZRbWmAMlXKag
server_id
1316838123023630386

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Discordrat family
discordrat

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 3756 created 612	3756	LoaderBasic.exe	5

Downloads MZ/PE file

Indicator Removal: Clear Windows Event Logs 1 TTPs 4 IoCs

Clear Windows Event Logs to hide the activity of an intrusion.

defense_evasion

Clear Windows Event Logs

T1070.001

description	ioc	Process
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Application-Experience%4Program-Telemetry.evtx	svchost.exe
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Application-Experience%4Program-Inventory.evtx	svchost.exe
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Application-Experience%4Steps-Recorder.evtx	svchost.exe
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Application-Experience%4Program-Compatibility-Troubleshooter.evtx	svchost.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 16 IoCs

Web Service

T1102

flow	ioc
40	discord.com
50	discord.com
26	discord.com
20	discord.com
51	discord.com
87	raw.githubusercontent.com
91	discord.com
19	discord.com
90	discord.com
110	raw.githubusercontent.com
111	discord.com
89	raw.githubusercontent.com
49	discord.com
60	discord.com
99	discord.com
48	discord.com

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tmp6F5F.tmp.png"	LoaderBasic.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3756 set thread context of 5816	3756	LoaderBasic.exe	133

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 8 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	SystemSettings.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SystemSettings.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	SystemSettings.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	SystemSettings.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	SystemSettings.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SystemSettings.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	SystemSettings.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SystemSettings.exe

Enumerates system info in registry 2 TTPs 8 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	SystemSettings.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	SystemSettings.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133785331971586528"	chrome.exe

Modifies registry class 14 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\windows.immersivecontrolpanel_cw5n1h2txyewy\PersistedTitleBarData\windows.immersivecontrolpanel_cw5n1h2txy = "4292311040"	ApplicationFrameHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\windows.immersivecontrolpanel_cw5n1h2txyewy\PersistedTitleBarData\windows.immersivecontrolpanel_cw5n1h2txy	ApplicationFrameHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\windows.immersivecontrolpanel_cw5n1h2txyewy\PersistedTitleBarData\windows.immersivecontrolpanel_cw5n1h2txy = "1"	ApplicationFrameHost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\windows.immersivecontrolpanel_cw5n1h2txyewy\ApplicationFrame\windows.immersivecontrolpanel_cw5n1h2txyewy!m = 2c0000000200000003000000ffffffffffffffffffffffffffffffff280000002000000058030000a1020000	Explorer.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\windows.immersivecontrolpanel_cw5n1h2txyewy\SplashScreen	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\windows.immersivecontrolpanel_cw5n1h2txyewy\PersistedTitleBarData\windows.immersivecontrolpanel_cw5n1h2txy = "4294967295"	ApplicationFrameHost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\windows.immersivecontrolpanel_cw5n1h2txyewy\ApplicationFrame\windows.immersivecontrolpanel_cw5n1h2txyewy!m = f401000040010000	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.Search_cw5n1h2txyewy\WasEverActivated = "1"	sihost.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\windows.immersivecontrolpanel_cw5n1h2txyewy\ApplicationFrame	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\windows.immersivecontrolpanel_cw5n1h2txyewy\PersistedTitleBarData\windows.immersivecontrolpanel_cw5n1h2txy = "2814749767238632"	ApplicationFrameHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\windows.immersivecontrolpanel_cw5n1h2txyewy\ApplicationFrame\windows.immersivecontrolpanel_cw5n1h2txyewy!m	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\windows.immersivecontrolpanel_cw5n1h2txyewy\PersistedTitleBarData	ApplicationFrameHost.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1580	SCHTASKS.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1892	chrome.exe
1892	chrome.exe
2964	msedge.exe
2964	msedge.exe
3032	msedge.exe
3032	msedge.exe
3756	LoaderBasic.exe
3756	LoaderBasic.exe
5816	dllhost.exe
5816	dllhost.exe
5816	dllhost.exe
5816	dllhost.exe
5816	dllhost.exe
5816	dllhost.exe
5816	dllhost.exe
5816	dllhost.exe
5816	dllhost.exe
5816	dllhost.exe
3756	LoaderBasic.exe
5816	dllhost.exe
5816	dllhost.exe
5816	dllhost.exe
5816	dllhost.exe
5816	dllhost.exe
5816	dllhost.exe
5816	dllhost.exe
5816	dllhost.exe
3756	LoaderBasic.exe
5816	dllhost.exe
5816	dllhost.exe
5816	dllhost.exe
5816	dllhost.exe
5816	dllhost.exe
5816	dllhost.exe
5816	dllhost.exe
5816	dllhost.exe
5816	dllhost.exe
5816	dllhost.exe
3756	LoaderBasic.exe
5816	dllhost.exe
5816	dllhost.exe
5816	dllhost.exe
5816	dllhost.exe
5816	dllhost.exe
5816	dllhost.exe
5816	dllhost.exe
5816	dllhost.exe
5816	dllhost.exe
5816	dllhost.exe
3756	LoaderBasic.exe
5816	dllhost.exe
5816	dllhost.exe
5816	dllhost.exe
5816	dllhost.exe
5816	dllhost.exe
5816	dllhost.exe
5816	dllhost.exe
5816	dllhost.exe
3756	LoaderBasic.exe
5816	dllhost.exe
5816	dllhost.exe
5816	dllhost.exe
5816	dllhost.exe
5816	dllhost.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3472	Explorer.EXE

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1892	chrome.exe
1892	chrome.exe
1892	chrome.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3756	LoaderBasic.exe
Token: SeShutdownPrivilege	1892	chrome.exe
Token: SeCreatePagefilePrivilege	1892	chrome.exe
Token: SeShutdownPrivilege	1892	chrome.exe
Token: SeCreatePagefilePrivilege	1892	chrome.exe
Token: SeShutdownPrivilege	1892	chrome.exe
Token: SeCreatePagefilePrivilege	1892	chrome.exe
Token: SeShutdownPrivilege	1892	chrome.exe
Token: SeCreatePagefilePrivilege	1892	chrome.exe
Token: SeShutdownPrivilege	1892	chrome.exe
Token: SeCreatePagefilePrivilege	1892	chrome.exe
Token: SeShutdownPrivilege	1892	chrome.exe
Token: SeCreatePagefilePrivilege	1892	chrome.exe
Token: SeShutdownPrivilege	1892	chrome.exe
Token: SeCreatePagefilePrivilege	1892	chrome.exe
Token: SeShutdownPrivilege	1892	chrome.exe
Token: SeCreatePagefilePrivilege	1892	chrome.exe
Token: SeShutdownPrivilege	1892	chrome.exe
Token: SeCreatePagefilePrivilege	1892	chrome.exe
Token: SeShutdownPrivilege	1892	chrome.exe
Token: SeCreatePagefilePrivilege	1892	chrome.exe
Token: SeShutdownPrivilege	1892	chrome.exe
Token: SeCreatePagefilePrivilege	1892	chrome.exe
Token: SeShutdownPrivilege	1892	chrome.exe
Token: SeCreatePagefilePrivilege	1892	chrome.exe
Token: SeShutdownPrivilege	1892	chrome.exe
Token: SeCreatePagefilePrivilege	1892	chrome.exe
Token: SeShutdownPrivilege	1892	chrome.exe
Token: SeCreatePagefilePrivilege	1892	chrome.exe
Token: SeShutdownPrivilege	1892	chrome.exe
Token: SeCreatePagefilePrivilege	1892	chrome.exe
Token: SeShutdownPrivilege	1892	chrome.exe
Token: SeCreatePagefilePrivilege	1892	chrome.exe
Token: SeShutdownPrivilege	1892	chrome.exe
Token: SeCreatePagefilePrivilege	1892	chrome.exe
Token: SeShutdownPrivilege	1892	chrome.exe
Token: SeCreatePagefilePrivilege	1892	chrome.exe
Token: SeShutdownPrivilege	1892	chrome.exe
Token: SeCreatePagefilePrivilege	1892	chrome.exe
Token: SeShutdownPrivilege	1892	chrome.exe
Token: SeCreatePagefilePrivilege	1892	chrome.exe
Token: SeShutdownPrivilege	1892	chrome.exe
Token: SeCreatePagefilePrivilege	1892	chrome.exe
Token: SeShutdownPrivilege	1892	chrome.exe
Token: SeCreatePagefilePrivilege	1892	chrome.exe
Token: SeDebugPrivilege	3756	LoaderBasic.exe
Token: SeDebugPrivilege	5816	dllhost.exe
Token: SeShutdownPrivilege	1892	chrome.exe
Token: SeCreatePagefilePrivilege	1892	chrome.exe
Token: SeShutdownPrivilege	1892	chrome.exe
Token: SeCreatePagefilePrivilege	1892	chrome.exe
Token: SeShutdownPrivilege	1892	chrome.exe
Token: SeCreatePagefilePrivilege	1892	chrome.exe
Token: SeShutdownPrivilege	1892	chrome.exe
Token: SeCreatePagefilePrivilege	1892	chrome.exe
Token: SeShutdownPrivilege	1892	chrome.exe
Token: SeCreatePagefilePrivilege	1892	chrome.exe
Token: SeShutdownPrivilege	1892	chrome.exe
Token: SeCreatePagefilePrivilege	1892	chrome.exe
Token: SeShutdownPrivilege	3472	Explorer.EXE
Token: SeCreatePagefilePrivilege	3472	Explorer.EXE
Token: SeShutdownPrivilege	3472	Explorer.EXE
Token: SeCreatePagefilePrivilege	3472	Explorer.EXE
Token: SeShutdownPrivilege	5896	SystemSettings.exe

Suspicious use of FindShellTrayWindow 57 IoCs

pid	Process
1892	chrome.exe
1892	chrome.exe
1892	chrome.exe
1892	chrome.exe
1892	chrome.exe
1892	chrome.exe
1892	chrome.exe
1892	chrome.exe
1892	chrome.exe
1892	chrome.exe
1892	chrome.exe
1892	chrome.exe
1892	chrome.exe
1892	chrome.exe
1892	chrome.exe
1892	chrome.exe
1892	chrome.exe
1892	chrome.exe
1892	chrome.exe
1892	chrome.exe
1892	chrome.exe
1892	chrome.exe
1892	chrome.exe
1892	chrome.exe
1892	chrome.exe
1892	chrome.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
5860	ApplicationFrameHost.exe
3472	Explorer.EXE
3472	Explorer.EXE
3472	Explorer.EXE

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
1892	chrome.exe
1892	chrome.exe
1892	chrome.exe
1892	chrome.exe
1892	chrome.exe
1892	chrome.exe
1892	chrome.exe
1892	chrome.exe
1892	chrome.exe
1892	chrome.exe
1892	chrome.exe
1892	chrome.exe
1892	chrome.exe
1892	chrome.exe
1892	chrome.exe
1892	chrome.exe
1892	chrome.exe
1892	chrome.exe
1892	chrome.exe
1892	chrome.exe
1892	chrome.exe
1892	chrome.exe
1892	chrome.exe
1892	chrome.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3472	Explorer.EXE
3472	Explorer.EXE
3472	Explorer.EXE
3472	Explorer.EXE
3472	Explorer.EXE
3472	Explorer.EXE
3472	Explorer.EXE
3472	Explorer.EXE
3472	Explorer.EXE
3472	Explorer.EXE
3472	Explorer.EXE
3472	Explorer.EXE
3472	Explorer.EXE
3472	Explorer.EXE
3472	Explorer.EXE
3472	Explorer.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3472	Explorer.EXE
5896	SystemSettings.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
4212	RuntimeBroker.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3756 wrote to memory of 1580	3756	LoaderBasic.exe	88
PID 3756 wrote to memory of 1580	3756	LoaderBasic.exe	88
PID 1892 wrote to memory of 2072	1892	chrome.exe	106
PID 1892 wrote to memory of 2072	1892	chrome.exe	106
PID 1892 wrote to memory of 4888	1892	chrome.exe	107
PID 1892 wrote to memory of 4888	1892	chrome.exe	107
PID 1892 wrote to memory of 4888	1892	chrome.exe	107
PID 1892 wrote to memory of 4888	1892	chrome.exe	107
PID 1892 wrote to memory of 4888	1892	chrome.exe	107
PID 1892 wrote to memory of 4888	1892	chrome.exe	107
PID 1892 wrote to memory of 4888	1892	chrome.exe	107
PID 1892 wrote to memory of 4888	1892	chrome.exe	107
PID 1892 wrote to memory of 4888	1892	chrome.exe	107
PID 1892 wrote to memory of 4888	1892	chrome.exe	107
PID 1892 wrote to memory of 4888	1892	chrome.exe	107
PID 1892 wrote to memory of 4888	1892	chrome.exe	107
PID 1892 wrote to memory of 4888	1892	chrome.exe	107
PID 1892 wrote to memory of 4888	1892	chrome.exe	107
PID 1892 wrote to memory of 4888	1892	chrome.exe	107
PID 1892 wrote to memory of 4888	1892	chrome.exe	107
PID 1892 wrote to memory of 4888	1892	chrome.exe	107
PID 1892 wrote to memory of 4888	1892	chrome.exe	107
PID 1892 wrote to memory of 4888	1892	chrome.exe	107
PID 1892 wrote to memory of 4888	1892	chrome.exe	107
PID 1892 wrote to memory of 4888	1892	chrome.exe	107
PID 1892 wrote to memory of 4888	1892	chrome.exe	107
PID 1892 wrote to memory of 4888	1892	chrome.exe	107
PID 1892 wrote to memory of 4888	1892	chrome.exe	107
PID 1892 wrote to memory of 4888	1892	chrome.exe	107
PID 1892 wrote to memory of 4888	1892	chrome.exe	107
PID 1892 wrote to memory of 4888	1892	chrome.exe	107
PID 1892 wrote to memory of 4888	1892	chrome.exe	107
PID 1892 wrote to memory of 4888	1892	chrome.exe	107
PID 1892 wrote to memory of 4888	1892	chrome.exe	107
PID 1892 wrote to memory of 1368	1892	chrome.exe	108
PID 1892 wrote to memory of 1368	1892	chrome.exe	108
PID 1892 wrote to memory of 920	1892	chrome.exe	109
PID 1892 wrote to memory of 920	1892	chrome.exe	109
PID 1892 wrote to memory of 920	1892	chrome.exe	109
PID 1892 wrote to memory of 920	1892	chrome.exe	109
PID 1892 wrote to memory of 920	1892	chrome.exe	109
PID 1892 wrote to memory of 920	1892	chrome.exe	109
PID 1892 wrote to memory of 920	1892	chrome.exe	109
PID 1892 wrote to memory of 920	1892	chrome.exe	109
PID 1892 wrote to memory of 920	1892	chrome.exe	109
PID 1892 wrote to memory of 920	1892	chrome.exe	109
PID 1892 wrote to memory of 920	1892	chrome.exe	109
PID 1892 wrote to memory of 920	1892	chrome.exe	109
PID 1892 wrote to memory of 920	1892	chrome.exe	109
PID 1892 wrote to memory of 920	1892	chrome.exe	109
PID 1892 wrote to memory of 920	1892	chrome.exe	109
PID 1892 wrote to memory of 920	1892	chrome.exe	109
PID 1892 wrote to memory of 920	1892	chrome.exe	109
PID 1892 wrote to memory of 920	1892	chrome.exe	109
PID 1892 wrote to memory of 920	1892	chrome.exe	109
PID 1892 wrote to memory of 920	1892	chrome.exe	109
PID 1892 wrote to memory of 920	1892	chrome.exe	109
PID 1892 wrote to memory of 920	1892	chrome.exe	109
PID 1892 wrote to memory of 920	1892	chrome.exe	109
PID 1892 wrote to memory of 920	1892	chrome.exe	109
PID 1892 wrote to memory of 920	1892	chrome.exe	109
PID 1892 wrote to memory of 920	1892	chrome.exe	109
PID 1892 wrote to memory of 920	1892	chrome.exe	109
PID 1892 wrote to memory of 920	1892	chrome.exe	109

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:612
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:64
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{7476582a-8520-4c87-85df-3d0de8a062b7}
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5816

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:668

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:944

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:528

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:724

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1100
- C:\Windows\system32\taskhostw.exe
  taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
  2⤵
  PID:3100

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1124

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1136

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1168

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
- Indicator Removal: Clear Windows Event Logs
PID:1188

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1332

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1348

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1376
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  - Modifies registry class
  PID:3048

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1432

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1588

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1600

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1640

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1708

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1744

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1788

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1864

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2012

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:2024

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:2036

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1028

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:1908

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2156

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2260

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2320

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2488

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2496

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
PID:2636

C:\Windows\sysmon.exe
C:\Windows\sysmon.exe
1⤵
PID:2664

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2696

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2712

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2772

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:2904

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2624

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
1⤵
PID:3244

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:3388

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:3472
- C:\Users\Admin\AppData\Local\Temp\LoaderBasic.exe
  "C:\Users\Admin\AppData\Local\Temp\LoaderBasic.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Sets desktop wallpaper using registry
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3756
- - C:\Windows\SYSTEM32\SCHTASKS.exe
    "SCHTASKS.exe" /create /tn "$77LoaderBasic.exe" /tr "'C:\Users\Admin\AppData\Local\Temp\LoaderBasic.exe'" /sc onlogon /rl HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1580
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.xvideos.com/
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:3032
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8d47846f8,0x7ff8d4784708,0x7ff8d4784718
      4⤵
      PID:1296
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,13773774182121808784,11190844902674687139,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
      4⤵
      PID:4800
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,13773774182121808784,11190844902674687139,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2304 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2964
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,13773774182121808784,11190844902674687139,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2948 /prefetch:8
      4⤵
      PID:1480
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,13773774182121808784,11190844902674687139,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
      4⤵
      PID:3064
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,13773774182121808784,11190844902674687139,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
      4⤵
      PID:3280
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,13773774182121808784,11190844902674687139,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4964 /prefetch:1
      4⤵
      PID:5292
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1892
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff8d5b4cc40,0x7ff8d5b4cc4c,0x7ff8d5b4cc58
    3⤵
    PID:2072
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1944,i,3403559104268851465,9166508382263903998,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1940 /prefetch:2
    3⤵
    PID:4888
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2192,i,3403559104268851465,9166508382263903998,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2224 /prefetch:3
    3⤵
    PID:1368
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2300,i,3403559104268851465,9166508382263903998,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2516 /prefetch:8
    3⤵
    PID:920
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3192,i,3403559104268851465,9166508382263903998,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3200 /prefetch:1
    3⤵
    PID:3560
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3232,i,3403559104268851465,9166508382263903998,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3224 /prefetch:1
    3⤵
    PID:1980
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3756,i,3403559104268851465,9166508382263903998,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4544 /prefetch:1
    3⤵
    PID:4532
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4844,i,3403559104268851465,9166508382263903998,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4864 /prefetch:8
    3⤵
    PID:2840
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4912,i,3403559104268851465,9166508382263903998,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4424 /prefetch:8
    3⤵
    PID:3980

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3588

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3792

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3956

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
- Suspicious use of UnmapMainImage
PID:4212

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:5020

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:5108

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:1620

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:1624

C:\Windows\system32\SppExtComObj.exe
C:\Windows\system32\SppExtComObj.exe -Embedding
1⤵
PID:4124

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:3992

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:1388

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:4656

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:4428

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3744

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
PID:4780

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
PID:864

C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\servicing\TrustedInstaller.exe
1⤵
PID:3564

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
1⤵
PID:2420

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s PcaSvc
1⤵
PID:1704

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:3460

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1396

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4948

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2412

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:2808

C:\Windows\ImmersiveControlPanel\SystemSettings.exe
"C:\Windows\ImmersiveControlPanel\SystemSettings.exe" -ServerName:microsoft.windows.immersivecontrolpanel
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5896

C:\Windows\system32\ApplicationFrameHost.exe
C:\Windows\system32\ApplicationFrameHost.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of FindShellTrayWindow
PID:5860

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
PID:5204

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s BthAvctpSvc
1⤵
PID:5248

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
PID:6452

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s camsvc
1⤵
PID:6552

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
PID:6984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Indicator Removal

T1070

Clear Windows Event Logs

T1070.001

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\26C212D9399727259664BDFCA073966E_F9F7D6A7ECE73106D2A8C63168CDA10D

Filesize
400B

MD5
3f4aa99f3082778faa188e613285958a

SHA1
fd29512f495fbf68c5bc05192e856094bb156fcd

SHA256
5bd9c9aec1a46e8f3c910487bd885e81ab0020308c302dfbc9698f600ba2c567

SHA512
5664be9edd1667842b4839407931ce45e648d173e5613e695d1819c902781611cfd8b3e23e5dbb0c301301b680b424cbe15f83a24c543e5b86c32e3d4bdff5d0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_363582827213C09529A76F35FB615187

Filesize
412B

MD5
b180973db1ddde07ef24209dd7c5ac30

SHA1
6b1bdf2d1f56bdeca690fbedeb8d0ea2d30caf4f

SHA256
4b3a0720201a9c5378f22af89229a96b5044742abc03c72a7e2a7be2203bb398

SHA512
f87dd8c390097e792b6400e302749174f3e44e6485dc17e3338a1d5a4ba6922136b9fdbc6d54765c936182cb703027c6768ed84982a7ce5d9555e92bb79d8779

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
d2059d94adc402ec576b330dbf1bded4

SHA1
fafdacb8a43a94e9ef25eb32ae5af0577ac9615a

SHA256
3f5da4bf654f888b31e2facdd7310db409f35b55b441d5cf8990a84c1f211b60

SHA512
65dfee37c1b1b4e57906e52506f5740737ffb5bacd3b74644be08ea8d9154aa7a6c1f475536c5d0480e675ea4e115be42674e880b06bbeb95e739de7f83cfc95

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
987df9b573e83bc40246e05af60c51e0

SHA1
3cef8e68f44e4a75f914105d22bed7654c791f36

SHA256
271bf28eda89bcc371fbbabad845f917ce04da90da5b8801ef704b211e383daa

SHA512
db2cf0d492a6d02f33e9c0938a2e0e10b8b80ba8c6bb03b48af2074455247e254dd4c0fa54f54aacfc59fa30c5a644b210f3a29cedb024d37b0e51c6eb567632

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
356B

MD5
fbab79c94415dfbaaa3c2fabcd6a312f

SHA1
0454ecb33c9264a15e8b8715da7bd910ec076979

SHA256
f894c5c9d8ee1fdd27d7a215a7e1ffb7123598504150732c057d6ab1503f6c41

SHA512
774cc5fdbf4a38ac2a3ae3a20d1786608fddac0ceebb56bd7e240c6632ebcf6c3c8d4acf12df4602c09e0f806a6e78f00463ee33862efc134681a72107377a7a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
7293ca7534ded0168761ad2e028356a7

SHA1
408ff5a29e08dcb6fd4353d2b592e93d4f4a5297

SHA256
5daae365a3da85ad98f0fcbad210da9f1c1d50ed1ea7ada411eeefcf44b9fb11

SHA512
15c9aff32e8f1b9913830e7ffe02f8a155f49b3146818642ebe3193a1a7780c1df457ab556a29c17a9de25099a6606d54ac0ec753bf0fbc1236a5e4375fd0c6c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
aa0285b14ef62d58bd17fac3ab74e960

SHA1
6f06a7700423a66b35a79c36b14813f626b92208

SHA256
6083525c4c1be096f51afb148be92520d9eb159461b143f8995040bf247863c0

SHA512
779270ba03c3d8a89ac8a0a6c1979432071f40aa2a80fe8b7bf800618fb787724580801e5387c88587e10901db830cb7ab2636cfbb6fafc9d1b86f815f5a599f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
6dda3d55e53a6a6efd87b089ab22aa4b

SHA1
9fa4cb5f2af0ffa27eeed407dbb82b1bc23313f3

SHA256
b36b3d23935361de7ffdf28543a1233266897fcd9f86bb16240b74933ad851d9

SHA512
99e11b1bc6bb2fe63e75554cfed5333753e2b4bfe2b9671f0dbca496615d807a15c0a0c7399d27c6c87964eb08be4a5570dbaed9dde93d49e5af2514f7ff4d23

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
f90cfd45d634b6020c76fa2b433c3f1a

SHA1
5525c5677d5e1507557ecf47e106f3cc95d95534

SHA256
fb608cae4f1bdecda28209ecc9893a1bb0fa646f65dfc4eabee14060a16ba35c

SHA512
dc4fe973fd4462fbb2c71c0c07c8d062d2b6e2863f4abb73c76fc91dc73254e3129f4e6ec91239641df0b836e6009250e5b616959f35291fdeee4c6b5f44394d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
b49b031f5703038c43abd64ddd5ed1ca

SHA1
2cf1f287daca84b1cffdb5078642f1cd617c2bb7

SHA256
d6514554ebc9957012408194092d36395ee31ebe917daf79dbfbb9d15877dcef

SHA512
f1dc91f5838d8ebd374b3906e778c07f58a60c0b48097fb3c138dbc6dd85d1169c12df02219e5db8f6846ea1cb7b6cfa6c1391234b6007235515b959168c0ee5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
2e874b2ee284d14a349d7c0589756a34

SHA1
bef43a43d9d243f5a076272455cc52d847930c8d

SHA256
f26450d158fffaca190c512b606b03ec865d366b8c5fc0d8f9ed3e25fed55492

SHA512
39f4b2b11eb47efa06fd2a1989322278776df390156224bace78225ffa1f678dc43a31bb75ef346c136ec70d616e8a63c935c768bfc960853894fbf2237792a1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
960201295095d1571544a7c8adda9295

SHA1
4a82d401938c8e0da143a42029bc36c33896aa94

SHA256
0d62c2e87f923c44876d06b550bd20a0c221f7ac9b0b9eeebdc2f02edd6f03ec

SHA512
cf6f335945ef52c2d6ba1acd8775081838a3ca45ebb31b46c97f3ff569041a54136ee80f16c23f8fa603204fe1845b474114b54245144d894b869b1394c2f698

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
9cd78104fafc49ed82eb09ed2097f7cf

SHA1
1024bc5c825364c2c923c102fac1b3cbadcbac41

SHA256
87e8f374e4cce62399354fbcc554719248f9077e3c40645461d7edabc7b83d23

SHA512
53f1fa18c20c249a8d1fb53df2ae106fa63c7f20f040efcc9523cbdd4296775f341f74537e62de78cfd2f239228e0e15f38041e067e1b7ef5b23e63a845eb16b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
231KB

MD5
7e6ccc0e02510ffa2f62ea8ae64a9bc1

SHA1
c45004d02ec6b9e4d28f883a33ffdc1136523c03

SHA256
8e5dfdbe26fd6460cb385a1168a252a3c4b3ebe2fda35371ade67acd4a47a7b0

SHA512
9902d1ebe81b6da28d39da2e8d0d8d88526e2aa1aaa054e68181aa6361861a9d2d9c7496fe4ee97ad1573f7b038260027b7ecf8120d983d25bdadab28e042cb4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
231KB

MD5
7c91f31e55722b02074256431c9d4158

SHA1
268b2e98a5d5e0cd16ce946744d55eb9567a4449

SHA256
7ca4108b2bae15c6687339b92e7d874d68a464042917b074c29decb473edc1c7

SHA512
bcd5920e17b92504daec441481b2d5333da2fd2657bc4a1015f120bd50785737e2a34bbdb36158a4a4f7f88237b3c600f482eb8dfc521824aa99d74b958f1ba1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d22073dea53e79d9b824f27ac5e9813e

SHA1
6d8a7281241248431a1571e6ddc55798b01fa961

SHA256
86713962c3bb287964678b148ee08ea83fb83483dff8be91c8a6085ca560b2a6

SHA512
97152091ee24b6e713b8ec8123cb62511f8a7e8a6c6c3f2f6727d0a60497be28814613b476009b853575d4931e5df950e28a41afbf6707cb672206f1219c4413

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
bffcefacce25cd03f3d5c9446ddb903d

SHA1
8923f84aa86db316d2f5c122fe3874bbe26f3bab

SHA256
23e7cbbf64c81122c3cb30a0933c10a320e254447771737a326ce37a0694d405

SHA512
761dae5315b35ec0b2fe68019881397f5d2eadba3963aba79a89f8953a0cd705012d7faf3a204a5f36008926b9f614980e333351596b06ce7058d744345ce2e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
193B

MD5
dc9a7d221c588ae10939dc8990fd94ee

SHA1
fc8245d7cb38130c5a20fb8afc785f78e34d049d

SHA256
d227a768344deacfefbd1a2693332aa8bdf880a12acef61d0e72c2098fa78bcc

SHA512
459fcbd3d2c8895b751e82600743699cfea5efcc218a5cad97051b9d67c68f458f6a5a34c3e2eb6371ede64f7e58e914fee3e1c1924b426775943a12f73f4619

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5aa10218443d3e1fb0509856a7e0e9d3

SHA1
65fe4e0e039912baf39aff780a03f1326bf792ee

SHA256
ec9c9c5be36c2716b17cffcf4a76782294ea8d7bcd9407a8d3a04624edab0df1

SHA512
33153f7f5c4aa2b7f9f8881a1c0eca4f6d150b5ae633184b1ea428f202194ee4218969569ae38650cd866053b3ed7dfd34b6f5af6a40c4fb699c4923f4da0d94

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
22acc368b9caa6b1a301912eb3242d30

SHA1
7184baef7346fca36e364d6bb71ba18075b779c2

SHA256
e61d48c98d570a6946c8254a7d2b3a3cec64c1a06578be351f0c8d529ba35c91

SHA512
e9af931e4a15da249741c532c5b808992d671a4996e6d9270ab13888254c5ffb579a406c9fdf8d7eb43978bfffca24d465402b5880296740ca0a5cab83d5a5db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
da00429fb0b86772fd9edb45f47fd0b1

SHA1
2a2bdfb1fe363b7ea523983226f58e2d236d4d68

SHA256
dec7fa3468686ac61473a5664af628ebeaa18708176e72c6f21ac5788c4c2deb

SHA512
e25812904515ec6ac4488bfe3d310d9278d22311299237c99a6962c7f69bb66129eb8d6278cc1ae991fb881889ff072c99e317a756359e3b205df9da94f336f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Themes\Custom.theme

Filesize
1KB

MD5
1348e4e8fc451e8021f935f4b1376c95

SHA1
c6fecb47e09a1a255cbe9a9f03d91d2100cd1737

SHA256
cdf0440a375c4d4a180a358ea3c87448482622fbc71833bc797ec1410e54bb01

SHA512
ef23469825048d1fdc7f693a9efce5a1bdb8472743917288fa06244c7172d933347d8403440598a9f4062b3514ee313462655e21bc1c1a8dde78cfb607796703

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Themes\Custom.theme

Filesize
1KB

MD5
a2d5c41311177bf18a795638cc4e2777

SHA1
40625aa169f3bceb6b96060b8a0634bf8cf5eac1

SHA256
63b9d5b599c016878ea7fa9de88fd0a6e89b09210475f4869b0d8e5a71946c23

SHA512
e5c5cacd31a05a67449ea44fd403f4585960ff3a45104bc1044d2cac2acdc1a3e309241092a327df4f186367cde75355c7622d213925efbbd813cdb22fdc7ec0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Themes\Custom.theme

Filesize
1KB

MD5
447469d4e78a51faced68b9e1398353c

SHA1
fb1e898dac18b914e39283ce7b3f795dbd3526bf

SHA256
fa053e5cbf2f49a488070f9a52091a30961d563b754a6d7ea6cc7604cddeac75

SHA512
a08b5b088eb967d0b3fb4d59ce19fadf88c8bc9b498449a486793f9dd79026e44346181682a1c3cae4f8092a9dd6f2ce820ff57c7e166077b016f4831f939c15

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Themes\Custom.theme

Filesize
1KB

MD5
8853faa15cfed6223abbd6043c1fb5cc

SHA1
3e3869f4c75a0e764e646afff217e2b7806ac6dd

SHA256
8ad6228d1b7c4fc49f02b886e7ec327ab09845275a2e7d82c5be083f442e79e5

SHA512
571ff3735e8563636a08fa1934662d7dcf216de2a889cd64caf3c7a18da9c4c41d38d9d174ad0d0c8cc1dd6942aff67cda142ed0cccc4a214760b8f44520dc2f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Themes\Custom.theme

Filesize
1KB

MD5
fd132bc0aff3dc64c2148d5628e93983

SHA1
a27b0a64208024ad9ae46f88200e79eed3fcbdcc

SHA256
939323f06c2c04fc0303df6a0e2e1de690a68fcbba7e809a64ca7d5e2b2bd3a3

SHA512
a92d5b808248933c649ec641f043bc3c2fe4fe09c4808e3b3e24fed5e526a8e85a471f34e3d1444ef62e807beaa9a77cbb684ad20ec785866e300979e15c775b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\5f7b5f1e01b83767.automaticDestinations-ms

Filesize
11KB

MD5
40c31b1803224563e6ef3c7d138f8a9f

SHA1
4439dd8b442e13114699886c65670b1fcf723a1e

SHA256
0a4e99a922d8f384a56a637f71c07fbd0640e535bc6ac22e1a108d7549654dcd

SHA512
ac1139ac8a742ce9f5ba3c86fdf9892d0f08fe79a2f7b117a95158bda46ece58fe3db26d76bc3e61428bcecd900d7b6e5d74aa978f7bdaf07d5275be8cd8b552

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\f18460fded109990.customDestinations-ms

Filesize
24B

MD5
4fcb2a3ee025e4a10d21e1b154873fe2

SHA1
57658e2fa594b7d0b99d02e041d0f3418e58856b

SHA256
90bf6baa6f968a285f88620fbf91e1f5aa3e66e2bad50fd16f37913280ad8228

SHA512
4e85d48db8c0ee5c4dd4149ab01d33e4224456c3f3e3b0101544a5ca87a0d74b3ccd8c0509650008e2abed65efd1e140b1e65ae5215ab32de6f6a49c9d3ec3ff

Download Submit
C:\Users\Admin\Desktop\CompletePing.AAC

Filesize
329KB

MD5
65ac4761ab03badc73840a8a210a051e

SHA1
423065305bfcba7e93fb1f03d322b1e82779b305

SHA256
e2633e027a9786d4da7712cc5e919259d6c717a235f74280b54d60abaf4da655

SHA512
28d634ab06293926f6b909f6b106508b69981a0ff374dd7d5cedb540aecc324d0738de8d56feebd824abadd6f24a5ae6e02f25894acb073ff270c27143782115

Download Submit
C:\Users\Admin\Desktop\DebugPublish.shtml

Filesize
299KB

MD5
b841fe9d819ab53504a7fde16122ab55

SHA1
955facf73f486f32e9d23d1b8f6d56c5142c2e5c

SHA256
43a620368f24ea620a348c06a9d3ee035f10208307c8944d423bd2820e3b2ad5

SHA512
d9d420168d54689dd5087b85d001f95fa1957aba565f4d60215873acb03577281dc749d9c3a275864047d582ea042a402b85719e6776badfc5ed02cfa69cecaa

Download Submit
C:\Users\Admin\Desktop\DisableConfirm.xlsx

Filesize
13KB

MD5
d00dbfd09326e0c3a4512265c9cac1f8

SHA1
ce9b4b094d86a4b5fec0721b810c9d249a447af9

SHA256
225c62239916112a54bdd9deddbb67604bb150a170a7721d47f164fd69c393af

SHA512
21c948f1c2dda6de7077cd62b6c22710b2e04027aeca4775d12f9f34ca3f6c67ed8d2dd01d2da361411eab80d5c63b436eabfba5957f23c05f122bc0ca750add

Download Submit
C:\Users\Admin\Desktop\DisableStart.wmf

Filesize
481KB

MD5
51b6dd6ad2a016f31d7e20493db26483

SHA1
ffc8f80c2f95f739e53ed9aff5a78d8f097d28e7

SHA256
11f77072e333beefb9f8cec1d8fda3be131e7c5ecc5b5dc2584837bbd1318510

SHA512
f40296e6916134d6fd075648012a588d672ce224324f034fbe2df43c075082648f95e6500db11136eec330ccdbcd3ee67e21d8c9c003f5d90e8dfeadca4753a4

Download Submit
C:\Users\Admin\Desktop\ImportExpand.lock

Filesize
162KB

MD5
651f6a69aaa0df41f3d5daa0b2b93df3

SHA1
65a25f53976707bea4f3e244af6e459c2fc7564a

SHA256
2101e473e6e4738108b7a50f9f8b5420cc720b729103c7847bd496ed71817cb8

SHA512
68335d5ab53d6c19837f597dd86526751a84f192b5663287c3ba9d7264a520e38f094bd0d1767db466a0854aeb28a41857ad7ab36f0644a6c8fbe0d2a4869c64

Download Submit
C:\Users\Admin\Desktop\InitializeRevoke.docx

Filesize
17KB

MD5
baac7fda1c7d04224ea120d5ff76d347

SHA1
5d9740c3d72abf16da5f2ad1ab5e2cc8432e7cbe

SHA256
072a22f21014d2315df03218d46f3b5f62f3844f061e04c5625b1b3cdbb33ae5

SHA512
e79c23575d4139094a6c1f0f2a3b8667b4abc2004e76165df18e3df1f0fe3aa9e88fa5ccce2b7e3b85aabbe42372ced76f4938b0d7b758709493776f3aedaf7d

Download Submit
C:\Users\Admin\Desktop\InstallLimit.vssm

Filesize
221KB

MD5
5a0689279c8ceef830a696002f277b67

SHA1
cd3e2638771e74cb11e303907bfc25e55156f209

SHA256
1b0cb62b64f6ce5322a861a364e45dea461fd4ad1e6b48fb691423db2cd9351c

SHA512
e005a4fbd3f036b06c0f3b6155f540ec5fbebcdb069dbffc8802dc4d80b754d0ffb592868550b8fa00d720ea399419f6e4e5e4a56f4fbc45688618337a3eede1

Download Submit
C:\Users\Admin\Desktop\LimitCompress.wm

Filesize
260KB

MD5
895aeb816c5ce7f4f837e58b75ccd9e1

SHA1
500405844c7c13d619d81f37400d59c22a43727d

SHA256
4dac19e71ed1aa6eb08697d9c46e8ecb888e5e3b990665a794278e2c7f00ac98

SHA512
c53d9d9bcba3a14c2405844a8d1416dcf6d1532b493566e3adc31ff0caee0c1bdda67813011055ccdd93f80568356069373bc924d5da89b57a67f3ac3632b6af

Download Submit
C:\Users\Admin\Desktop\LimitRedo.asx

Filesize
250KB

MD5
fc2792ec0a113e62d91d9c56de26efcb

SHA1
1dd82fd870d2d635bb3ebcbb869b6b47e0879a2f

SHA256
0677e74e613a0ce615d9b14190c244c3f08fcdb780cec93801627ed14e63a8e2

SHA512
e8153ecd3d5ca18150670d18dcbeead6faf7968ef93fcf55e2e440f701630630fcf105b326da7a274bd8c9a63530acdb459a7f52f8150bfc33db60f0a89cf907

Download Submit
C:\Users\Admin\Desktop\MeasureSend.dotm

Filesize
191KB

MD5
b2d714afc45423b480d898bd7a95bc69

SHA1
06640fda2c43cde62fcbec6fdd3a65ceaf56eccb

SHA256
d596cd76a40316d6472f90a9098dba32b9879d6ccc8d5f7d36333e1d6d68e3df

SHA512
a40788846f057ed2872bb7a759d4b76332c16f5083f6c67cbf957ce99b3565fa2c40be4f553080e48d69c7e632a81821f4c5e799eebce3848eca917fd7f00465

Download Submit
C:\Users\Admin\Desktop\OpenRead.docm

Filesize
348KB

MD5
c2090e1df6f561e35b7648e2e94ec566

SHA1
51abeba8259c8dea5910a929c018838998074138

SHA256
7da4fa834efefb429887ce499c6df2b7b54513bc00dfc000bcea86ac6177446a

SHA512
829ae00b7af423ae15856cbd1da9d3d91aa2da76b6b2b82c6e587917b024169504a7298297fb32d802755482cd1d56d5c6834f2bf71617252c2b0c79029622b5

Download Submit
C:\Users\Admin\Desktop\OptimizeGroup.xlsx

Filesize
11KB

MD5
5ed6f40300f2ccf2c2344babc28977ef

SHA1
6057df7cd023def3d369a5022af52b7a8e7a52cf

SHA256
feb8e95d060d5d2ceeb2a45fc31924c44d263007768ae802803ca6fbc46339b4

SHA512
f73137c1fbe17806ab47879e0dc4d634672377f3a0f9b6fcdc4872d6b86a052c75c1c3d33f9fea9523423a075ee8dfcc064bbd9c2199276a98ea0abf3937b339

Download Submit
C:\Users\Admin\Desktop\PopTest.pdf

Filesize
319KB

MD5
cb37b0dbbec7bec62bf14b265b11e7e6

SHA1
a6717fca111d1f39ba303721895fa08370a38f15

SHA256
a545dbba87ceb96ad51b65ce3737205882a5db65bfc4c20a8f1073a27c2153ec

SHA512
e2615f0160e46bf36c0a81eba1b78faa6c5a6bc1105400bea570bddc927f6a5c74773e7f131cd2fa1cac42bcfc2a47c4a063c39639b2743c811e0dd5fb9bf68b

Download Submit
C:\Users\Admin\Desktop\ProtectOptimize.txt

Filesize
280KB

MD5
b54ffe2af1a73d441cf98de7358c4d1f

SHA1
f649c2136940f2903a35c6e69a8fd80323d6fbce

SHA256
113b06c0d4c4274edde22bceebc37e88fbbc77b730f8dff4fd39057ccfead7e3

SHA512
a709f133a20bedfdd0ace490ad7cbd0321e35cad29647175cd5712889091fb027788c95fac2f5c774682d0cc4295c9875c618181c1eabb533fb441668721fbb7

Download Submit
C:\Users\Admin\Desktop\PublishRemove.ppt

Filesize
289KB

MD5
91efbdfdbbef2aad3e94adc31ca1ef68

SHA1
140486b8a42b957cadda11d51467563990d01610

SHA256
58eac60a8d7c88155c64f7e42fa1d71cf01befc0e850357bdf46e6bcbaf50206

SHA512
18be607b9e8906a6f3877641b14ffdeca182e1c89c653e719673a0a78494b123ab91d0bd2108f74c1026d4439fba99e7b76d055ee15c6292bfb270f9143c057a

Download Submit
C:\Users\Admin\Desktop\PushExit.xlsx

Filesize
10KB

MD5
92d4a1d548360fce547c1592610f3f0c

SHA1
023984cbe197e9781d0268dc71411e63f05efa7b

SHA256
a179cf8b4e3adc712381a7ff67aba574914ed9793785c8cf841c4d428c1b73f0

SHA512
2771d9c9cb1cb2bef1f31aed927dd784990d8c4d93a9f622eb7d11692ad74fe01e961177ee365d87c332ca2e19bbc7aaacf4208808cd923c1e4c7439f72ff62e

Download Submit
C:\Users\Admin\Desktop\PushHide.docx

Filesize
20KB

MD5
a2ef800c4c5492642fc18462ce4b1614

SHA1
6c07e3170b37430a1ba8f955a463f626c847e32d

SHA256
65e4b12f20c11795f3db418d1c915a0efa0a1d112c9ddf0674bbe0075bc25e69

SHA512
f744cd7f67365158a1f9d664c2838b1e98d97d7666054d9ff223d21f6307773a7d7981a678d654ea67bd328657e0aafb9d436c08514f6ec3135ee010d58f2dc6

Download Submit
C:\Users\Admin\Desktop\RestartResume.xlsx

Filesize
12KB

MD5
12d86ecce62d2afb82970dea772ad1ea

SHA1
94b601c1116613cf3f73f478355df7a41f459326

SHA256
1495ab7715ff552529ba08a7d711033168440d3c3d1c54007d2b3da132714531

SHA512
27cf01b2ef750874ba5a59b2c60d2b801d5a772ff79f5559877e51ad80ac434b10340cd61e30a12324639407c2e7d588d049a181b7cd05d90d9d5841fb63e80f

Download Submit
C:\Users\Admin\Desktop\SaveJoin.wma

Filesize
339KB

MD5
a58afa7ca39201b65caeaff5a225f2d3

SHA1
d346e024a2ef64a648a8e86f7587b3444806668e

SHA256
6ef47412638cf0788da80ed8de5c60f5a9cc1f29112e3689aecd48041cda722d

SHA512
be27a083f617d4d7f70f75ba03a84305ddccb3e84037be4d9757a80e1110ed2313b9c04ebdfbfe4d232f52a7c6d66f5f8aa27659dd7aaeeb72e3f07068b3c488

Download Submit
C:\Users\Admin\Desktop\SaveRestore.odp

Filesize
142KB

MD5
ca3375192fc92728a8aaa959058340ea

SHA1
d8a3f43946b61848889cbaeefe8a881cb4798381

SHA256
3118ae6da8c1169da2465a032184e12cee1667906c8124679b9588b9ef45fd6b

SHA512
67bf190c875cad1035fbf9c3218db58f134a84f6e40d35b23d1ac67a2943bb307b287dfdc83b9b841e2a595579f6ef980bc412712800e2bc31ad71f2fa0049d8

Download Submit
C:\Users\Admin\Desktop\SetRestore.bin

Filesize
309KB

MD5
962ad64ef94180de61c0fcc6c9d1666b

SHA1
5baba98bf6f6ceb00ad74bed83e08f14f967a996

SHA256
c1500ff1d8edd44dbfbb9452535cca0fd80a26ebd1991b2da0ded2d444952829

SHA512
14160f6e0cd3e2d7918f883aecef4318c4c01270ba473d6ed41f38c13494c944a411df05580f767edd010f9100b948e9b1ac3894043b856f5c972cfaf4084da8

Download Submit
C:\Users\Admin\Desktop\SplitDisconnect.dib

Filesize
181KB

MD5
ba6adc42ed3bfbf51d201345d80d5fc6

SHA1
6786f4fc682a2c874ffb3792053b93b4a1c55d7d

SHA256
411a9ae656b6b0a4461cd6f521b5904a45bbb135dfcbe419e0e046e07f84db56

SHA512
3d7bb1a996dceee252ac2038110d586b185d96df71ff12298ebd0a4f7463acdc5603193e9ad924373c2a80416f4c378650ff3c0f0a4c607d3220201d21739644

Download Submit
C:\Users\Admin\Desktop\StopConfirm.vsdx

Filesize
122KB

MD5
7a8f3afe13c391c9f1cad215ad33d546

SHA1
d356a13a50e598ed882f10e7d1c9e50a522f98a7

SHA256
2c23892a7693637181a8162abcdf873523bdc31db5636478c143b391dabdf321

SHA512
5da7894f46545292e17d8cfd92f00ab6215cf869ecf33edce5a146b0ffa8226af6bac34ad7c474b7489b56f55c25f5556274cafe66b7fb2184c1856f88e4ebc4

Download Submit
C:\Users\Admin\Desktop\UnprotectUnpublish.lock

Filesize
231KB

MD5
8bf18b2c40063d42d8d71c5c92a7df8c

SHA1
886fe6e768521fd232e84ee7b4135f289a7567b6

SHA256
fd7308ec273c988133b518197a052989769d8221f713bb7ca31e97d4be0c6212

SHA512
bacf573960def19e97a8f6aea2ae23fe023c6cc49ace538b284f96eb4c2d1edeb431207173d4404ece17b2af4ff798a21950af1ea05e970ce9b2a9a780f0d7c0

Download Submit
C:\Users\Admin\Desktop\UnregisterUse.pot

Filesize
201KB

MD5
82f5cd72bf152c2969524355ba04dfa4

SHA1
1a212ace3a9b75d54c526afbbcdf68ebe24fd154

SHA256
2952aef1dca6cca77ad09c902bda82496f48ce132781cbf21967e4eb9bc07e95

SHA512
45d0ab7e619f62a690e012dd24add3b3bf9a2f205d21e056150544005947ddcfc64511d1f5df15d0cb9390c296b63b42e5db437169012c15ba765f0ae64ed853

Download Submit
C:\Users\Public\Desktop\Acrobat Reader DC.lnk

Filesize
2KB

MD5
8784ae5eef9ae4766715de154e454fc2

SHA1
a093214aa037e7254b05d20a555a8052d91ee8c1

SHA256
1647906acdd8e3989caadaf9ea4863163a7f65a696b291943c7f600f6258922f

SHA512
1655c654fd11a93417eda5bee9409b41ba07494b33cee2c4d56200218fa7485b9d3c5c5df02868128a1dd6294fce04c5073cae051bda463b25901b60a299b15b

Download Submit
C:\Users\Public\Desktop\Firefox.lnk

Filesize
1000B

MD5
ad830e8fee7b8a9b21c90e1926fd617c

SHA1
ac1f333bc885dfa4b7e36d5d821f449d9bf1bd43

SHA256
e1fdeac90384ffc3c0583887ef7f42924f9b0e1c5dc0104869b29f678ed40d99

SHA512
606048ae44b0c687345ba181210445fab47d36d40e306947046ca208b71443ac232765c43aadc13cdb92f7b92955e7dfa0a39de7a6fe804866176743436dcab0

Download Submit
C:\Users\Public\Desktop\Google Chrome.lnk

Filesize
2KB

MD5
0aae640c2a857d0d49be0e0df96f66c3

SHA1
5d96b60d8dd01f380f8525884b4d096982a822e1

SHA256
cb45c4b931cf1df6d4755862cb4b4e0408f82767eb6593b867d8a293a78c595d

SHA512
fef7ee833d4a16bdefebceb0bdc6342c434c0619a2438b68eaf6fbc6bad117a710e390d8f54a39f086888fdd6390a1bb47d2f5be99f65b3d369a05b05fa5400e

Download Submit
C:\Users\Public\Desktop\VLC media player.lnk

Filesize
923B

MD5
453bd9d54e69c23c58e30d9e04d49ae6

SHA1
a49296955cb05431f3c339a8ef7fb82b1921527b

SHA256
f7736403fe5b15349f17078ed999a8a864209104e8e880ac1a61afec303a9a9f

SHA512
487be1adbdc43cc5c84738347ec4dc2a078f5515099296ff1405282a4145871547e9ab89626b7a8c3e35692dd7e93f583de9892afbdedc0a46c687e903796336

Download Submit
memory/64-188-0x0000021640970000-0x000002164099A000-memory.dmp

Filesize
168KB

Download
memory/64-189-0x00007FF8B9F10000-0x00007FF8B9F20000-memory.dmp

Filesize
64KB

Download
memory/528-195-0x000001EF4E740000-0x000001EF4E76A000-memory.dmp

Filesize
168KB

Download
memory/528-196-0x00007FF8B9F10000-0x00007FF8B9F20000-memory.dmp

Filesize
64KB

Download
memory/612-178-0x0000020941270000-0x0000020941293000-memory.dmp

Filesize
140KB

Download
memory/612-181-0x00007FF8B9F10000-0x00007FF8B9F20000-memory.dmp

Filesize
64KB

Download
memory/612-180-0x00000209412A0000-0x00000209412CA000-memory.dmp

Filesize
168KB

Download
memory/668-186-0x00007FF8B9F10000-0x00007FF8B9F20000-memory.dmp

Filesize
64KB

Download
memory/668-185-0x0000023269700000-0x000002326972A000-memory.dmp

Filesize
168KB

Download
memory/724-202-0x000001671A990000-0x000001671A9BA000-memory.dmp

Filesize
168KB

Download
memory/724-203-0x00007FF8B9F10000-0x00007FF8B9F20000-memory.dmp

Filesize
64KB

Download
memory/944-193-0x00007FF8B9F10000-0x00007FF8B9F20000-memory.dmp

Filesize
64KB

Download
memory/944-192-0x000001D9725D0000-0x000001D9725FA000-memory.dmp

Filesize
168KB

Download
memory/1100-205-0x000001A94CD60000-0x000001A94CD8A000-memory.dmp

Filesize
168KB

Download
memory/1100-206-0x00007FF8B9F10000-0x00007FF8B9F20000-memory.dmp

Filesize
64KB

Download
memory/1124-208-0x000001ABD6AB0000-0x000001ABD6ADA000-memory.dmp

Filesize
168KB

Download
memory/1124-209-0x00007FF8B9F10000-0x00007FF8B9F20000-memory.dmp

Filesize
64KB

Download
memory/1136-212-0x00007FF8B9F10000-0x00007FF8B9F20000-memory.dmp

Filesize
64KB

Download
memory/1136-211-0x0000015949D60000-0x0000015949D8A000-memory.dmp

Filesize
168KB

Download
memory/1168-216-0x000002297ED20000-0x000002297ED4A000-memory.dmp

Filesize
168KB

Download
memory/1168-217-0x00007FF8B9F10000-0x00007FF8B9F20000-memory.dmp

Filesize
64KB

Download
memory/1188-220-0x00007FF8B9F10000-0x00007FF8B9F20000-memory.dmp

Filesize
64KB

Download
memory/1188-219-0x0000022F4DA90000-0x0000022F4DABA000-memory.dmp

Filesize
168KB

Download
memory/1332-231-0x0000022358F80000-0x0000022358FAA000-memory.dmp

Filesize
168KB

Download
memory/1332-232-0x00007FF8B9F10000-0x00007FF8B9F20000-memory.dmp

Filesize
64KB

Download
memory/3756-6-0x0000027C21880000-0x0000027C21DA8000-memory.dmp

Filesize
5.2MB

Download
memory/3756-0-0x00007FF8DBAB3000-0x00007FF8DBAB5000-memory.dmp

Filesize
8KB

Download
memory/3756-1-0x0000027C069A0000-0x0000027C069BC000-memory.dmp

Filesize
112KB

Download
memory/3756-2-0x0000027C20F80000-0x0000027C21142000-memory.dmp

Filesize
1.8MB

Download
memory/3756-3-0x00007FF8DBAB0000-0x00007FF8DC571000-memory.dmp

Filesize
10.8MB

Download
memory/3756-4-0x00007FF8DBAB3000-0x00007FF8DBAB5000-memory.dmp

Filesize
8KB

Download
memory/3756-170-0x00007FF8F9E90000-0x00007FF8FA085000-memory.dmp

Filesize
2.0MB

Download
memory/3756-171-0x00007FF8F8520000-0x00007FF8F85DE000-memory.dmp

Filesize
760KB

Download
memory/3756-169-0x0000027C21300000-0x0000027C2133E000-memory.dmp

Filesize
248KB

Download
memory/3756-41-0x0000027C21270000-0x0000027C2127E000-memory.dmp

Filesize
56KB

Download
memory/3756-5-0x00007FF8DBAB0000-0x00007FF8DC571000-memory.dmp

Filesize
10.8MB

Download
memory/5816-176-0x0000000140000000-0x0000000140040000-memory.dmp

Filesize
256KB

Download
memory/5816-175-0x00007FF8F8520000-0x00007FF8F85DE000-memory.dmp

Filesize
760KB

Download
memory/5816-174-0x00007FF8F9E90000-0x00007FF8FA085000-memory.dmp

Filesize
2.0MB

Download
memory/5816-173-0x0000000140000000-0x0000000140040000-memory.dmp

Filesize
256KB

Download
memory/5816-172-0x0000000140000000-0x0000000140040000-memory.dmp

Filesize
256KB

Download