hxxp://roblox[.]com

Analysis

max time kernel
269s
max time network
254s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241211-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241211-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
10-01-2025 01:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://roblox.com

Score

5^/10

microsoft discovery phishing

Malware Config

Signatures

Detected potential entity reuse from brand MICROSOFT.
phishing microsoft

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	POWERPNT.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	taskmgr.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	POWERPNT.EXE

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2062871678-1047416116-518495306-1000\Software\Microsoft\Internet Explorer\GPU	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-2062871678-1047416116-518495306-1000\SOFTWARE\Microsoft\Internet Explorer\GPU	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-2062871678-1047416116-518495306-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2062871678-1047416116-518495306-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe

Modifies data under HKEY_USERS 22 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Key created	\REGISTRY\USER\S-1-5-19\Software	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography	wwahost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "236"	LogonUI.exe
Key created	\REGISTRY\USER\S-1-5-19	wwahost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133809453580169943"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	wwahost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2062871678-1047416116-518495306-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2062871678-1047416116-518495306-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\account.live.com\ = "0"	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2062871678-1047416116-518495306-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.cloudexperiencehost\ = "1"	wwahost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2062871678-1047416116-518495306-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-2062871678-1047416116-518495306-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-2062871678-1047416116-518495306-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	wwahost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2062871678-1047416116-518495306-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0\MRUListEx = ffffffff	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2062871678-1047416116-518495306-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DomStorageState\EdpState = "0"	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-2062871678-1047416116-518495306-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.cloudexperiencehost	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2062871678-1047416116-518495306-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CacheLimit = "51200"	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2062871678-1047416116-518495306-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CacheLimit = "1"	wwahost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2062871678-1047416116-518495306-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\MRUListEx = 00000000ffffffff	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2062871678-1047416116-518495306-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "48"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2062871678-1047416116-518495306-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0\NodeSlot = "3"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2062871678-1047416116-518495306-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2062871678-1047416116-518495306-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2062871678-1047416116-518495306-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\live.com\NumberOfSubdomains = "0"	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2062871678-1047416116-518495306-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2062871678-1047416116-518495306-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "48"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2062871678-1047416116-518495306-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2062871678-1047416116-518495306-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "124"	wwahost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2062871678-1047416116-518495306-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2062871678-1047416116-518495306-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2062871678-1047416116-518495306-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2062871678-1047416116-518495306-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Settings	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-2062871678-1047416116-518495306-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2062871678-1047416116-518495306-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\live.com\Total = "0"	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2062871678-1047416116-518495306-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "0"	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2062871678-1047416116-518495306-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "6"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2062871678-1047416116-518495306-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\live.com\NumberOfSubdomai = "0"	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2062871678-1047416116-518495306-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\account.live.com\ = "0"	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2062871678-1047416116-518495306-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\live.com\NumberOfSubdomains = "1"	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2062871678-1047416116-518495306-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2062871678-1047416116-518495306-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\live.com\ = "0"	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2062871678-1047416116-518495306-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\Microsoft.Windows.ControlPanel\ShowCmd = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2062871678-1047416116-518495306-1000_Classes\Local Settings	taskmgr.exe
Key created	\REGISTRY\USER\S-1-5-21-2062871678-1047416116-518495306-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2062871678-1047416116-518495306-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\account.live.com\ = "124"	wwahost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2062871678-1047416116-518495306-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2062871678-1047416116-518495306-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\Microsoft.Windows.ControlPanel\WFlags = "0"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2062871678-1047416116-518495306-1000_Classes\Local Settings	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2062871678-1047416116-518495306-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1 = 0c0001008421de39090000000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2062871678-1047416116-518495306-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2062871678-1047416116-518495306-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2062871678-1047416116-518495306-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-2062871678-1047416116-518495306-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2062871678-1047416116-518495306-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0 = 0b010000050100eeebbef7000400000000005500000031535053537def0c64fad111a2030000f81fedee3900000005000000001f000000140000007000610067006500520065006e0061006d0065004d0079004100630063006f0075006e007400000000000000510000003153505330f125b7ef471a10a5f102608c9eebac350000000a000000001f000000110000004300680061006e0067006500200059006f007500720020004e0061006d00650000000000000000004d000000315350538727bf5ccf480842b90eee5e5d4202943100000019000000001f0000000f0000007500730065007200630070006c002e0064006c006c002c002d00310000000000000000000000000000000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2062871678-1047416116-518495306-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2062871678-1047416116-518495306-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000010000001800000030f125b7ef471a10a5f102608c9eebac0a000000a0000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2062871678-1047416116-518495306-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\account.live.com	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-2062871678-1047416116-518495306-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Extensible Cache	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2062871678-1047416116-518495306-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CacheVersion = "1"	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2062871678-1047416116-518495306-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.cloudexperiencehost\ = "0"	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-2062871678-1047416116-518495306-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\windows.cloudexperienceho	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2062871678-1047416116-518495306-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "18874369"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2062871678-1047416116-518495306-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2062871678-1047416116-518495306-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "2"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2062871678-1047416116-518495306-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0 = 1e007180000000000000000000005427636023c5624bb45c4172da0126190000	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2062871678-1047416116-518495306-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "6"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2062871678-1047416116-518495306-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2062871678-1047416116-518495306-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total\ = "0"	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2062871678-1047416116-518495306-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "18874385"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2062871678-1047416116-518495306-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CacheVersion = "1"	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2062871678-1047416116-518495306-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CacheLimit = "1"	wwahost.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
4092	POWERPNT.EXE
3140	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4852	chrome.exe
4852	chrome.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3332	taskmgr.exe

Suspicious behavior: LoadsDriver 64 IoCs

pid	Process
5304	Process not Found
5160	Process not Found
5192	Process not Found
2724	Process not Found
5276	Process not Found
712	Process not Found
4304	Process not Found
4276	Process not Found
64	Process not Found
2120	Process not Found
1572	Process not Found
2340	Process not Found
3812	Process not Found
3268	Process not Found
1212	Process not Found
5240	Process not Found
5292	Process not Found
6080	Process not Found
1868	Process not Found
1792	Process not Found
2984	Process not Found
1464	Process not Found
188	Process not Found
5656	Process not Found
5940	Process not Found
5472	Process not Found
5700	Process not Found
5836	Process not Found
5672	Process not Found
5828	Process not Found
5684	Process not Found
2836	Process not Found
5724	Process not Found
5944	Process not Found
828	Process not Found
1772	Process not Found
5692	Process not Found
5640	Process not Found
5852	Process not Found
5668	Process not Found
5900	Process not Found
5720	Process not Found
5820	Process not Found
5172	Process not Found
5984	Process not Found
4656	Process not Found
2584	Process not Found
6024	Process not Found
3452	Process not Found
6120	Process not Found
5960	Process not Found
5812	Process not Found
5420	Process not Found
5904	Process not Found
5908	Process not Found
5376	Process not Found
5816	Process not Found
2304	Process not Found
6012	Process not Found
5488	Process not Found
5552	Process not Found
5928	Process not Found
6000	Process not Found
5824	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
4852	chrome.exe
4852	chrome.exe
4852	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4852	chrome.exe
Token: SeCreatePagefilePrivilege	4852	chrome.exe
Token: SeShutdownPrivilege	4852	chrome.exe
Token: SeCreatePagefilePrivilege	4852	chrome.exe
Token: SeShutdownPrivilege	4852	chrome.exe
Token: SeCreatePagefilePrivilege	4852	chrome.exe
Token: SeShutdownPrivilege	4852	chrome.exe
Token: SeCreatePagefilePrivilege	4852	chrome.exe
Token: SeShutdownPrivilege	4852	chrome.exe
Token: SeCreatePagefilePrivilege	4852	chrome.exe
Token: SeShutdownPrivilege	4852	chrome.exe
Token: SeCreatePagefilePrivilege	4852	chrome.exe
Token: SeShutdownPrivilege	4852	chrome.exe
Token: SeCreatePagefilePrivilege	4852	chrome.exe
Token: SeShutdownPrivilege	4852	chrome.exe
Token: SeCreatePagefilePrivilege	4852	chrome.exe
Token: SeShutdownPrivilege	4852	chrome.exe
Token: SeCreatePagefilePrivilege	4852	chrome.exe
Token: SeShutdownPrivilege	4852	chrome.exe
Token: SeCreatePagefilePrivilege	4852	chrome.exe
Token: SeShutdownPrivilege	4852	chrome.exe
Token: SeCreatePagefilePrivilege	4852	chrome.exe
Token: SeShutdownPrivilege	4852	chrome.exe
Token: SeCreatePagefilePrivilege	4852	chrome.exe
Token: SeTcbPrivilege	696	svchost.exe
Token: SeRestorePrivilege	696	svchost.exe
Token: SeShutdownPrivilege	4852	chrome.exe
Token: SeCreatePagefilePrivilege	4852	chrome.exe
Token: SeShutdownPrivilege	4852	chrome.exe
Token: SeCreatePagefilePrivilege	4852	chrome.exe
Token: SeShutdownPrivilege	4852	chrome.exe
Token: SeCreatePagefilePrivilege	4852	chrome.exe
Token: SeShutdownPrivilege	4852	chrome.exe
Token: SeCreatePagefilePrivilege	4852	chrome.exe
Token: SeShutdownPrivilege	4852	chrome.exe
Token: SeCreatePagefilePrivilege	4852	chrome.exe
Token: SeShutdownPrivilege	4852	chrome.exe
Token: SeCreatePagefilePrivilege	4852	chrome.exe
Token: SeShutdownPrivilege	4852	chrome.exe
Token: SeCreatePagefilePrivilege	4852	chrome.exe
Token: SeShutdownPrivilege	4852	chrome.exe
Token: SeCreatePagefilePrivilege	4852	chrome.exe
Token: SeShutdownPrivilege	4852	chrome.exe
Token: SeCreatePagefilePrivilege	4852	chrome.exe
Token: SeShutdownPrivilege	4852	chrome.exe
Token: SeCreatePagefilePrivilege	4852	chrome.exe
Token: SeShutdownPrivilege	4852	chrome.exe
Token: SeCreatePagefilePrivilege	4852	chrome.exe
Token: SeShutdownPrivilege	4852	chrome.exe
Token: SeCreatePagefilePrivilege	4852	chrome.exe
Token: SeShutdownPrivilege	4852	chrome.exe
Token: SeCreatePagefilePrivilege	4852	chrome.exe
Token: SeShutdownPrivilege	4852	chrome.exe
Token: SeCreatePagefilePrivilege	4852	chrome.exe
Token: SeShutdownPrivilege	4852	chrome.exe
Token: SeCreatePagefilePrivilege	4852	chrome.exe
Token: SeShutdownPrivilege	4852	chrome.exe
Token: SeCreatePagefilePrivilege	4852	chrome.exe
Token: SeShutdownPrivilege	4852	chrome.exe
Token: SeCreatePagefilePrivilege	4852	chrome.exe
Token: SeShutdownPrivilege	4852	chrome.exe
Token: SeCreatePagefilePrivilege	4852	chrome.exe
Token: SeShutdownPrivilege	4852	chrome.exe
Token: SeCreatePagefilePrivilege	4852	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4852	chrome.exe
4852	chrome.exe
4852	chrome.exe
4852	chrome.exe
4852	chrome.exe
4852	chrome.exe
4852	chrome.exe
4852	chrome.exe
4852	chrome.exe
4852	chrome.exe
4852	chrome.exe
4852	chrome.exe
4852	chrome.exe
4852	chrome.exe
4852	chrome.exe
4852	chrome.exe
4852	chrome.exe
4852	chrome.exe
4852	chrome.exe
4852	chrome.exe
4852	chrome.exe
4852	chrome.exe
4852	chrome.exe
4852	chrome.exe
4852	chrome.exe
4852	chrome.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4852	chrome.exe
4852	chrome.exe
4852	chrome.exe
4852	chrome.exe
4852	chrome.exe
4852	chrome.exe
4852	chrome.exe
4852	chrome.exe
4852	chrome.exe
4852	chrome.exe
4852	chrome.exe
4852	chrome.exe
4852	chrome.exe
4852	chrome.exe
4852	chrome.exe
4852	chrome.exe
4852	chrome.exe
4852	chrome.exe
4852	chrome.exe
4852	chrome.exe
4852	chrome.exe
4852	chrome.exe
4852	chrome.exe
4852	chrome.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe
3332	taskmgr.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
4092	POWERPNT.EXE
4092	POWERPNT.EXE
2056	AccountsControlHost.exe
1256	wwahost.exe
6036	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4852 wrote to memory of 3680	4852	chrome.exe	81
PID 4852 wrote to memory of 3680	4852	chrome.exe	81
PID 4852 wrote to memory of 3756	4852	chrome.exe	82
PID 4852 wrote to memory of 3756	4852	chrome.exe	82
PID 4852 wrote to memory of 3756	4852	chrome.exe	82
PID 4852 wrote to memory of 3756	4852	chrome.exe	82
PID 4852 wrote to memory of 3756	4852	chrome.exe	82
PID 4852 wrote to memory of 3756	4852	chrome.exe	82
PID 4852 wrote to memory of 3756	4852	chrome.exe	82
PID 4852 wrote to memory of 3756	4852	chrome.exe	82
PID 4852 wrote to memory of 3756	4852	chrome.exe	82
PID 4852 wrote to memory of 3756	4852	chrome.exe	82
PID 4852 wrote to memory of 3756	4852	chrome.exe	82
PID 4852 wrote to memory of 3756	4852	chrome.exe	82
PID 4852 wrote to memory of 3756	4852	chrome.exe	82
PID 4852 wrote to memory of 3756	4852	chrome.exe	82
PID 4852 wrote to memory of 3756	4852	chrome.exe	82
PID 4852 wrote to memory of 3756	4852	chrome.exe	82
PID 4852 wrote to memory of 3756	4852	chrome.exe	82
PID 4852 wrote to memory of 3756	4852	chrome.exe	82
PID 4852 wrote to memory of 3756	4852	chrome.exe	82
PID 4852 wrote to memory of 3756	4852	chrome.exe	82
PID 4852 wrote to memory of 3756	4852	chrome.exe	82
PID 4852 wrote to memory of 3756	4852	chrome.exe	82
PID 4852 wrote to memory of 3756	4852	chrome.exe	82
PID 4852 wrote to memory of 3756	4852	chrome.exe	82
PID 4852 wrote to memory of 3756	4852	chrome.exe	82
PID 4852 wrote to memory of 3756	4852	chrome.exe	82
PID 4852 wrote to memory of 3756	4852	chrome.exe	82
PID 4852 wrote to memory of 3756	4852	chrome.exe	82
PID 4852 wrote to memory of 3756	4852	chrome.exe	82
PID 4852 wrote to memory of 3756	4852	chrome.exe	82
PID 4852 wrote to memory of 1260	4852	chrome.exe	83
PID 4852 wrote to memory of 1260	4852	chrome.exe	83
PID 4852 wrote to memory of 4600	4852	chrome.exe	84
PID 4852 wrote to memory of 4600	4852	chrome.exe	84
PID 4852 wrote to memory of 4600	4852	chrome.exe	84
PID 4852 wrote to memory of 4600	4852	chrome.exe	84
PID 4852 wrote to memory of 4600	4852	chrome.exe	84
PID 4852 wrote to memory of 4600	4852	chrome.exe	84
PID 4852 wrote to memory of 4600	4852	chrome.exe	84
PID 4852 wrote to memory of 4600	4852	chrome.exe	84
PID 4852 wrote to memory of 4600	4852	chrome.exe	84
PID 4852 wrote to memory of 4600	4852	chrome.exe	84
PID 4852 wrote to memory of 4600	4852	chrome.exe	84
PID 4852 wrote to memory of 4600	4852	chrome.exe	84
PID 4852 wrote to memory of 4600	4852	chrome.exe	84
PID 4852 wrote to memory of 4600	4852	chrome.exe	84
PID 4852 wrote to memory of 4600	4852	chrome.exe	84
PID 4852 wrote to memory of 4600	4852	chrome.exe	84
PID 4852 wrote to memory of 4600	4852	chrome.exe	84
PID 4852 wrote to memory of 4600	4852	chrome.exe	84
PID 4852 wrote to memory of 4600	4852	chrome.exe	84
PID 4852 wrote to memory of 4600	4852	chrome.exe	84
PID 4852 wrote to memory of 4600	4852	chrome.exe	84
PID 4852 wrote to memory of 4600	4852	chrome.exe	84
PID 4852 wrote to memory of 4600	4852	chrome.exe	84
PID 4852 wrote to memory of 4600	4852	chrome.exe	84
PID 4852 wrote to memory of 4600	4852	chrome.exe	84
PID 4852 wrote to memory of 4600	4852	chrome.exe	84
PID 4852 wrote to memory of 4600	4852	chrome.exe	84
PID 4852 wrote to memory of 4600	4852	chrome.exe	84
PID 4852 wrote to memory of 4600	4852	chrome.exe	84
PID 4852 wrote to memory of 4600	4852	chrome.exe	84

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://roblox.com
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x21c,0x220,0x224,0x1f8,0x228,0x7ffb8fbfcc40,0x7ffb8fbfcc4c,0x7ffb8fbfcc58
  2⤵
  PID:3680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2084,i,4756331853763590141,11305509418416570247,262144 --variations-seed-version=20241210-050121.637000 --mojo-platform-channel-handle=2080 /prefetch:2
  2⤵
  PID:3756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2004,i,4756331853763590141,11305509418416570247,262144 --variations-seed-version=20241210-050121.637000 --mojo-platform-channel-handle=2128 /prefetch:3
  2⤵
  PID:1260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2352,i,4756331853763590141,11305509418416570247,262144 --variations-seed-version=20241210-050121.637000 --mojo-platform-channel-handle=2348 /prefetch:8
  2⤵
  PID:4600
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3040,i,4756331853763590141,11305509418416570247,262144 --variations-seed-version=20241210-050121.637000 --mojo-platform-channel-handle=3156 /prefetch:1
  2⤵
  PID:3272
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3044,i,4756331853763590141,11305509418416570247,262144 --variations-seed-version=20241210-050121.637000 --mojo-platform-channel-handle=3184 /prefetch:1
  2⤵
  PID:708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4496,i,4756331853763590141,11305509418416570247,262144 --variations-seed-version=20241210-050121.637000 --mojo-platform-channel-handle=3788 /prefetch:1
  2⤵
  PID:2100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=840,i,4756331853763590141,11305509418416570247,262144 --variations-seed-version=20241210-050121.637000 --mojo-platform-channel-handle=500 /prefetch:8
  2⤵
  PID:1996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=3392,i,4756331853763590141,11305509418416570247,262144 --variations-seed-version=20241210-050121.637000 --mojo-platform-channel-handle=4972 /prefetch:8
  2⤵
  PID:5360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=4996,i,4756331853763590141,11305509418416570247,262144 --variations-seed-version=20241210-050121.637000 --mojo-platform-channel-handle=4684 /prefetch:8
  2⤵
  PID:4308

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:4888

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:696
- C:\Windows\system32\dashost.exe
  dashost.exe {335c08a0-2649-42ef-abff40d807fdee53}
  2⤵
  PID:1676

C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE
"C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" /s "C:\Users\Admin\Desktop\UninstallMount.ppsx" /ou ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4092

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3332

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
- System Location Discovery: System Language Discovery
PID:1672

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{5BD95610-9434-43C2-886C-57852CC8A120} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
PID:3140
- C:\Windows\System32\rundll32.exe
  "C:\Windows\System32\rundll32.exe" keymgr.dll,PRShowSaveWizardExW
  2⤵
  PID:952
- C:\Windows\System32\rundll32.exe
  "C:\Windows\System32\rundll32.exe" keymgr.dll,PRShowSaveWizardExW
  2⤵
  PID:4804

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
PID:2676

C:\Windows\SystemApps\Microsoft.AccountsControl_cw5n1h2txyewy\AccountsControlHost.exe
"C:\Windows\SystemApps\Microsoft.AccountsControl_cw5n1h2txyewy\AccountsControlHost.exe" -ServerName:App.AppX20qnn98vxw5bhxrjtb1f6rggecb2k15a.mca
1⤵
- Suspicious use of SetWindowsHookEx
PID:2056

C:\Windows\system32\wwahost.exe
"C:\Windows\system32\wwahost.exe" -ServerName:App.wwa
1⤵
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1256

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5604

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0 /state0:0xa3989055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:6036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Comms\UnistoreDB\store.jfm

Filesize
16KB

MD5
c466575ffc0968c0cc1c5914c8e8207b

SHA1
02f65d665d0ebd86b3831595cc9a3307b419f783

SHA256
167322fe24754ea7c3fa1638c6cc64a5f67dde66ea4346c3635a0fb54eac3fbb

SHA512
5a0105e558a97f315fd9d217bed9e4a2f89cb7276f9bf6e5d2922acff55374cc40b49f08571e9919b8c7fddb042818ae74ddfd6ef41a875f3640e13365dbb929

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx

Filesize
64KB

MD5
6f68f3ffb1dadefc96d1de1c1d440acf

SHA1
93abcf8fdcd282debdd613bcf41ced6c773cdf9b

SHA256
28d04b9d08d447ac0be9dd4cb06480e452d106575bde529e4d6c1f033e4cf4fd

SHA512
8c39f9efc73e3df517ceca202a6ef9cf38a35be10aeefff95fd9eb3c912174ba89f3c42e356434c3ac77ab342ac5a4d2af2e5e4c8247c8b413d2b7ae3bbabcc1

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock

Filesize
4B

MD5
f49655f856acb8884cc0ace29216f511

SHA1
cb0f1f87ec0455ec349aaa950c600475ac7b7b6b

SHA256
7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba

SHA512
599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val

Filesize
992B

MD5
ff9615348bafab70a615c61fd851b1ad

SHA1
4a42b22af709709fb9e23911cc2290aae99ccd8a

SHA256
896ac590c141fe0109068f3a3d4059fd0a888c0202574e3c4326f9fcec62c38f

SHA512
a0fc04d882774717cd8aa4967b2ac8b0bd401a960f7d318c3864bf347c424412047fe4c18c8854c03920d376601adbd784a8808ef9e9c6ca6276a466dd3e0be1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
92539eeef90e9ee218b5a2031a51fca9

SHA1
529e9927d7e107de0c892a464a12f8a276e1b979

SHA256
be27ba73978574f4e2c3553db3a25b4a1b334e82e7ea0fe341aa43d6ca2be126

SHA512
cec57da12e0d6c6daccb1bf6f00eda2c2b65dbdd06c1209fbc2bc68ee9ff8abde1fb046bfc6ea8574435a8766c13269fe92a7c69f3803615525a9cab541444c4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
9c38fb92a6b3e057f10c4a142d0da9c7

SHA1
ffe2885e5408140071402d84b20c4894ea044361

SHA256
c990f37788b3af32cc35b11ac3f654748a7bc057fd4573fb669bcc4e5f221e37

SHA512
40e18841ef16822759d4f04743f620568640715d838a44bbab1b8bcb24c16b0dd19b46bc1c61214c2e183f78a84c19e53f458642ec443f937ab77e15537d8f53

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
ae8f723538a40ceb25f7792e968a0d77

SHA1
7dbb24198c3b1cc647596e79b461ff211b62af39

SHA256
3f3f04cd7a9581299abe8d73b99cc64ff53294704c4da6f97c578e4352866185

SHA512
98010e575cc8508a2b0f57f88e10c18b1375dea267780320960f84960da2739cb0e3f4cf06a76270702b0a70b7a17ab0eb157dd162f938db435f9e1d383fe4c6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
092b4baa587dcd8f1a41a6f73f15f139

SHA1
1aad827636e3c92a75b24abe4648ca36d9f30da6

SHA256
8c04406f3ea30a4d147f3eb852db5a0727eaffe7a6e1ddd582229b29d841a556

SHA512
68d43144aa079082f88f61df2933813da6c5803a239d30e4ff4650d57d5723dbe56dfcb97db3483b67c572f56e2955159aadbb454e294e1f05da397746a929fc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
692B

MD5
71ee61bbf22a3e04bfed037ba9d11e68

SHA1
778588d11d13a91abedacf3f9f3aef437eef3f03

SHA256
5810a95fdb0f1bcf92bd95e00767715120ab112aeaaeeae0a17c2b31e79ff3dc

SHA512
0c72692b330aa698ee49ef8ec2edc97af112736b744e323170766ee1ab61bcc341cc958ed96ac8a531270babdeb88426ec6ffe756ec4ea96be7530bb6f34e45f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
34e07919acf193c2b300361597f60fa5

SHA1
7530015ade3c6c1f7738bcd1b168910aa1347303

SHA256
e12bdc0a3d7f52420eff463fa42c90e1ad3be7c0225fb804c54f1371ae04abb5

SHA512
98a9839f294dccc27ea30f903e51393fe67ec5f8f09cacb65e233143531b1d8ceb13d4c799ff9acdad5a086927e034c22f447b0cc5eb8629ad402da3cc138023

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
d7e00ecd847b5992a2491d009c14f194

SHA1
6323f2eedd758ae5d91e1bf729bd97f26c51677b

SHA256
e8f0b089e370001ceba03b2eb6aa83867a06d1d899af7962e87a88a8b8b78b73

SHA512
8f5deac67bcb46a25b2094703ccde03eaa468a2e01709279da272d0271189ed4eee2819ed1dd9c2b20c9c4f9b95381f1fa91b2cf5fee9b898ee90f9cc3a88d95

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
a3978d5bc438fd0c0b8dcc31c79e8033

SHA1
6a12acc576f2994ab13a0360f6cc0036cadb58c2

SHA256
7b41da27ff0f43d9a6330f4cf563b7dde2b4a3a6f1db46b065836aa6b00c5db9

SHA512
c1f59a31d39c14642ee6395fa7bdba02c24f2331d0a86cadc9561c06ed64e3b0871aba5ca784e7b4c56e6050afc56579ba1ce101dc39d9e5a51f674a0fcb2565

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
1f57f1c014c8180821ebc8c91d054b4d

SHA1
588157052c082d43e5989d50ffc4bc1f97fc7651

SHA256
c496ed2389550a35d5ef4a8709c4bc02a6e86825f624463f1c6095ad68e89a5a

SHA512
9f077ad8d1961b85ef71d8d8566d0422a373bb783b097861d2d426c45b7aea1538a8600dd9444c8a47dae56c573d8a857fca95ba35e537f8a9c733b37a7d3bcd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
50aa01e38bca7ce8c7db367a64073f93

SHA1
5e671f329aa04135ae4a66cfb90bf5bfdfab0f45

SHA256
1f14939cac5ea303bf5652007aee8d630da42ceffee4602672bbcf6bade14ece

SHA512
16a3b70f06b2c0b62e0b0520988374993de427743004f2964bd9a5ef3c03788b673c4f9bbb73e98e66b881ff7d86d502213c9a1a7f9c277dd109130e12a7a7b2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
f66dd0ac57d7a62a1c67f53dc5e59f75

SHA1
8d4294eed353d056cdc665c6d90928b91e387aac

SHA256
1ba09c16e4a55ecc05c299971e294d3c0fb62d14a4f69e8a2ede9f7a67fc0b1d

SHA512
a2a6fffba8309d5b3bdf52e636d0bbc98b843a6f8fe3cba2169341de0b20603b94f5f08f2ab44b1197e6d58b8a9ec993e7959f99b557d85a39164eaa649cb899

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
407d8fd3fce941af9a7f95e6031dbf0d

SHA1
75f4434548bb926ea447d47cbdf2a427bf2d2276

SHA256
f9876ea5e60aadd29c907fcb3cfdbc4b7e157a947194d6b97de890160a3e2722

SHA512
c1857f6451f25c3bd13c8963820eff51d24556fca5fc927df85b63d36519108139b96ef0280d0d82329984c93421c8e18aa85a8232df6c1db1ef8a5ffff2b102

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
a79b722c7b2a7289beed796e00890cb1

SHA1
103080050f51791c3e506d1aa9882bb69c18b821

SHA256
66c23b08688b90880c3825764fd43edcd5e8a7d1d1bc66c321da44467761c591

SHA512
62b47992f3d045fc4dd366523acdfc38fa4fe04bd9dfc8488fec908f4619405267fa0e34cdf6e887182dd3573bd5af0e72917bdc961bdd899794a95e7ffb5c51

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
4e2a069278915cbe5af4d855781dfab9

SHA1
afb923926e0df32e8cd6379fd40302fd89197227

SHA256
3c5bf03cfd7553b83cc1c1378060467d6ba055072f3f013623f0be9084c389a7

SHA512
6609477abb9fbb43afeecbb38a59bd12de906d863e1d29f016dde6df4d1aca9a547a371c72d2c438b32bd435143e5136bbd2522b4c0444f98e1da462c1c716b7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
f380623f99a80e84879ba2d4c132eb1d

SHA1
b86fae968dbcf2fd01f24f1843a34e2c18250e38

SHA256
1a104c32f1d11cd7b226460849615360ce9d79021dcea659722e0d72b0ccddac

SHA512
fa3ae1f5edaff409d29cc573eba6fe55e1e3716e9ad3d7e6c8d4b0a269a35a8f9396fa1e29b3e4e2e07ce32f8a854a57df47a30607eb0758f46d4954c9784f21

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
1140e7b3c1cf14d8d19b1853104ddb36

SHA1
b551405c59709fec4cfb6ea1a244bdf8af934d83

SHA256
d6eb76ab5cde8b05e48fc065181a0835835fb6c3e743c6ae668a608ed28c45df

SHA512
541e9c409c6f2191b22ad48f046f28c414091964f436dfa0de094ad0d34fc990b81be6767b674cc7c01018f0e2a40b43c70df98df1afb07cc188846aa9dadbde

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
28434d8150610163a797978451a84f35

SHA1
e9e0e48d52a3fd6d61b7e3e4f4a4da451b41b282

SHA256
8a3d6f425bd784a6dc05e4f495483c0d85a760ed42d38a9e6929b4a17522ac1c

SHA512
f96646019276d76d44128b45707efcced49d614157d36f54d6f00d32e36e11362679a65999047c068bb51cd381faafb295a49b0b870746964ed809dac203ab68

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
0801e04f50e842fb0e6cf20f0c10f926

SHA1
fc8ded0bfdb439f317cfa231f5482448932dac04

SHA256
82b933bede7315d1cfa17a6a119eb2ade39a7d39c5b582a149aeb5a9557e2da0

SHA512
e2a3ef4b1776c2260c6b5f9d2d50e023987b67f4e18943f2d4942ddcf77595895bc1dfa20b8fe07e72ff17b4d4cafbf3c41890931173dfd70002aa4c34a482de

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
b31c80672be4dc4ceb6425cf9f1be441

SHA1
50bca9a9160570628ae53253fd9210f7ad18b6cb

SHA256
1b9d023052de18621958579c7e329b3bb5c811cf602e1d9a828a59527dc54a98

SHA512
ec9aee9b2b7c947789935328ca45903c74c3860922c35faa2acca06cb0ef42e36a3ec06948a7c1bd99a6e37baedda177f815c070c345053d50f3f2e91bf5488d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
500109eff9fe2cf5c3fe4252827f2514

SHA1
0d10e291eda7c61b988aae1f34da87c9a2b05744

SHA256
ba4ede4b4ae90116b4ef89c86f877d6e7e2e08bdf9a84cf5cdd7054663e6a1a6

SHA512
ef6a3af30826fbdd5de324434f8f1614c37e873d9c274a90cd96f3f4a50550b4c8e0af7d1eff50af63deaf1d399bafc44594c16b7b732ff32b68cb808ba52648

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
1870e1d59920bcdffc0defa958a7f07d

SHA1
551b5bf9247e3507d54e852b41c934d5e95d9033

SHA256
bba71768bcb22ff90aaf9577cde69f007056c35404237a8a3b106917cfa17db5

SHA512
5f6aef3df3d408a6f436444d35ce85e80ab171254eb5bb5a5b48129a0cd109a8806bc9396aa1adbc8981b9a15e5656b32bada72f7a5928080b5851c12ab5eae9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
7f2ce0bbc11ecb9d88c62ea8d9839776

SHA1
69f2b0066d33b8bc3edb2e9c8f97939f22e4b216

SHA256
28434d7fa9f72d5250f1342659661f78049ad4788ca386b023a4d999113a0e29

SHA512
687e4cee99a8e1b1cd7d174dab46734d7819bf26e4e0527421d0c0b19e0a989958f94c198930ebc92d21dba6acca74f89cb2c4b1a7114a6bb923e4cfa416ecb9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
a3fcb41c04a223baca144148e864e575

SHA1
59b703253dafa485a86bb2ebfd55514c83cbcbfa

SHA256
161cb1b1b110af76aaadeb36074a85a9496652e83bb8283619dd1d1e321dc86f

SHA512
6d2c0715599936c4b3f7238f3d0e53eae8a473e75fae6f7dbd0c017e8768b7dd87b2de6bc6f875ec0045f9de4851f1d57911810515b227a81d77c8c6a15ded7c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
42176dee43bd9ed3188724c25bf2499c

SHA1
ee82d01af083bb85a2b9a3990a43a5be19f41f31

SHA256
2f7d804e3ddfc85bb4219810765c2f760cfef8c77f0654ae9f09709437015c87

SHA512
c9adad942153eb8d7f3a609f42af98c4d1fe9064e8dee0fa57a0262bee8b6b0d1a8f1f477ece87f72061b6282c9a9d1c1ffb2a7c8bb5bbdcd4954366f2f625d8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
232KB

MD5
33dd554c2a7df9e21b52e2c70253b210

SHA1
a89e232e2064b5e2c158ffa53ee1798288027702

SHA256
e8dc4bcb455240b44e539e36bb16e16d3160f2f9bf41d46a69d9c82af41f3b8d

SHA512
4cb85a1fbed100114eb03c211a85d21fc30da96be06ca4227fd23f65a7ceb5b437e6775f356ef33ff9f9c1af1c6c329ed7e20e0c2dd830c61b789118bca73190

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
232KB

MD5
667431a53cd2117bef63829434c5b678

SHA1
d20d8602c6045fb8874726ae782ab42b90484af9

SHA256
91cc0bc3d1c574c67acd94e6f8020e5c02370db6327f4e6cb9b12cb05edb43d5

SHA512
0d4183783e72ca84d060205a79d71cfac0eb56145d9afab0c51fb2e42e1bb352be67634fcfb5ecc46e8f5695034b0d783801b306f506237907a71159f0bac3d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db

Filesize
28KB

MD5
7c21f317b12ed9d3bec08ba780e5235e

SHA1
38bb930a43baf05d228e3801e6f8136f6861d0dd

SHA256
5b43da72c1045f63075e554bfc04022276ebdebf566b7d65891d49a918883956

SHA512
257e39e369cb272539d714e8f4ade339fefde6b16233ae8097726cf4fe43b7468b172eab9e0f4c788f6af696d52a81fed3522502e9d9557be29ef82c27c6daaa

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\ESDF2XBD\account.live[1].xml

Filesize
13B

MD5
c1ddea3ef6bbef3e7060a1a9ad89e4c5

SHA1
35e3224fcbd3e1af306f2b6a2c6bbea9b0867966

SHA256
b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db

SHA512
6be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed

Download Submit
memory/2676-431-0x00000244393A0000-0x00000244393A1000-memory.dmp

Filesize
4KB

Download
memory/2676-438-0x00000244393A0000-0x00000244393A1000-memory.dmp

Filesize
4KB

Download
memory/2676-437-0x00000244393A0000-0x00000244393A1000-memory.dmp

Filesize
4KB

Download
memory/2676-398-0x0000024430C80000-0x0000024430C90000-memory.dmp

Filesize
64KB

Download
memory/2676-414-0x0000024430D80000-0x0000024430D90000-memory.dmp

Filesize
64KB

Download
memory/2676-430-0x0000024439370000-0x0000024439371000-memory.dmp

Filesize
4KB

Download
memory/2676-436-0x00000244393A0000-0x00000244393A1000-memory.dmp

Filesize
4KB

Download
memory/2676-432-0x00000244393A0000-0x00000244393A1000-memory.dmp

Filesize
4KB

Download
memory/2676-433-0x00000244393A0000-0x00000244393A1000-memory.dmp

Filesize
4KB

Download
memory/2676-434-0x00000244393A0000-0x00000244393A1000-memory.dmp

Filesize
4KB

Download
memory/2676-435-0x00000244393A0000-0x00000244393A1000-memory.dmp

Filesize
4KB

Download
memory/3332-296-0x0000022954A20000-0x0000022954A21000-memory.dmp

Filesize
4KB

Download
memory/3332-306-0x0000022954A20000-0x0000022954A21000-memory.dmp

Filesize
4KB

Download
memory/3332-305-0x0000022954A20000-0x0000022954A21000-memory.dmp

Filesize
4KB

Download
memory/3332-304-0x0000022954A20000-0x0000022954A21000-memory.dmp

Filesize
4KB

Download
memory/3332-303-0x0000022954A20000-0x0000022954A21000-memory.dmp

Filesize
4KB

Download
memory/3332-302-0x0000022954A20000-0x0000022954A21000-memory.dmp

Filesize
4KB

Download
memory/3332-301-0x0000022954A20000-0x0000022954A21000-memory.dmp

Filesize
4KB

Download
memory/3332-300-0x0000022954A20000-0x0000022954A21000-memory.dmp

Filesize
4KB

Download
memory/3332-294-0x0000022954A20000-0x0000022954A21000-memory.dmp

Filesize
4KB

Download
memory/3332-295-0x0000022954A20000-0x0000022954A21000-memory.dmp

Filesize
4KB

Download
memory/4092-275-0x00007FFB9EB10000-0x00007FFB9ED08000-memory.dmp

Filesize
2.0MB

Download
memory/4092-274-0x0000014942AC0000-0x0000014942D1F000-memory.dmp

Filesize
2.4MB

Download
memory/4092-273-0x00007FFB5EB90000-0x00007FFB5EBA0000-memory.dmp

Filesize
64KB

Download
memory/4092-271-0x00007FFB5EB90000-0x00007FFB5EBA0000-memory.dmp

Filesize
64KB

Download
memory/4092-272-0x00007FFB5EB90000-0x00007FFB5EBA0000-memory.dmp

Filesize
64KB

Download
memory/4092-270-0x00007FFB5EB90000-0x00007FFB5EBA0000-memory.dmp

Filesize
64KB

Download
memory/4092-233-0x00007FFB9EB10000-0x00007FFB9ED08000-memory.dmp

Filesize
2.0MB

Download
memory/4092-235-0x00007FFB9EB10000-0x00007FFB9ED08000-memory.dmp

Filesize
2.0MB

Download
memory/4092-234-0x00007FFB9EB10000-0x00007FFB9ED08000-memory.dmp

Filesize
2.0MB

Download
memory/4092-231-0x00007FFB9EB10000-0x00007FFB9ED08000-memory.dmp

Filesize
2.0MB

Download
memory/4092-232-0x00007FFB9EB10000-0x00007FFB9ED08000-memory.dmp

Filesize
2.0MB

Download
memory/4092-230-0x00007FFB9EB10000-0x00007FFB9ED08000-memory.dmp

Filesize
2.0MB

Download
memory/4092-229-0x00007FFB9EB10000-0x00007FFB9ED08000-memory.dmp

Filesize
2.0MB

Download
memory/4092-228-0x00007FFB9EB10000-0x00007FFB9ED08000-memory.dmp

Filesize
2.0MB

Download
memory/4092-224-0x00007FFB9EB10000-0x00007FFB9ED08000-memory.dmp

Filesize
2.0MB

Download
memory/4092-226-0x00007FFB9EB10000-0x00007FFB9ED08000-memory.dmp

Filesize
2.0MB

Download
memory/4092-227-0x00007FFB9EB10000-0x00007FFB9ED08000-memory.dmp

Filesize
2.0MB

Download
memory/4092-225-0x00007FFB5CB20000-0x00007FFB5CB30000-memory.dmp

Filesize
64KB

Download
memory/4092-223-0x00007FFB9EB10000-0x00007FFB9ED08000-memory.dmp

Filesize
2.0MB

Download
memory/4092-222-0x00007FFB9EB10000-0x00007FFB9ED08000-memory.dmp

Filesize
2.0MB

Download
memory/4092-221-0x00007FFB5CB20000-0x00007FFB5CB30000-memory.dmp

Filesize
64KB

Download
memory/4092-218-0x00007FFB9EB10000-0x00007FFB9ED08000-memory.dmp

Filesize
2.0MB

Download
memory/4092-220-0x00007FFB9EB10000-0x00007FFB9ED08000-memory.dmp

Filesize
2.0MB

Download
memory/4092-219-0x00007FFB9EB10000-0x00007FFB9ED08000-memory.dmp

Filesize
2.0MB

Download
memory/4092-217-0x00007FFB9EB10000-0x00007FFB9ED08000-memory.dmp

Filesize
2.0MB

Download
memory/4092-211-0x00007FFB5EB90000-0x00007FFB5EBA0000-memory.dmp

Filesize
64KB

Download
memory/4092-216-0x00007FFB5EB90000-0x00007FFB5EBA0000-memory.dmp

Filesize
64KB

Download
memory/4092-215-0x00007FFB5EB90000-0x00007FFB5EBA0000-memory.dmp

Filesize
64KB

Download
memory/4092-213-0x00007FFB5EB90000-0x00007FFB5EBA0000-memory.dmp

Filesize
64KB

Download
memory/4092-214-0x00007FFB5EB90000-0x00007FFB5EBA0000-memory.dmp

Filesize
64KB

Download
memory/4092-212-0x00007FFB9EBAD000-0x00007FFB9EBAE000-memory.dmp

Filesize
4KB

Download