3a1275ca25ab58f0d8770c9eb1c51a7850eaf86290a7b06caa4e589a8dcedb14

Analysis

user interaction
yes
max time kernel
299s
max time network
296s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/07/2026, 10:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
farware.xml
Size 233B
Sample260708-m11alsev5w
SHA256 3a1275ca25ab58f0d8770c9eb1c51a7850eaf86290a7b06caa4e589a8dcedb14
MD5 2bc3ab24b547520b709652ed0996a714
SHA1 fd1ee12296b39e1144287ed78a5e605177df8fa0
SHA512 a2f97aea6a327cc24f6a6185350382f5e9ba74e9ac486a8e7302144d92d6983c124863d0425fd05e2fd1ff5fd64214af4d65e3502f8bb1e0094cce1ba64cf0be
TLSH
T1D9D0A762A262B41E5495A5266109F75DEA2290E15288362C9550CD8263CE0696C46642
MD5 SHA1 SHA512 TLSH

Score

8^/10

adware discovery persistence ransomware spyware

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4804	chrome.exe

Checks SCSI registry key(s) 3 TTPs 62 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000\Software\Microsoft\Internet Explorer\Main	explorer.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134279818272872428"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe

Modifies registry class 42 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	StartMenuExperienceHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-200172840-2662118501-695741713-1000\{B131E23E-6DEF-4068-9F42-EA9FD116E33A}	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	StartMenuExperienceHost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-200172840-2662118501-695741713-1000\{7211515D-8911-42EA-9717-6CAC92CF93A9}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\Local Settings\MuiCache	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23"	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
5604	chrome.exe
5604	chrome.exe
5004	explorer.exe
5004	explorer.exe
5604	chrome.exe
5604	chrome.exe
2524	chrome.exe
2524	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
5604	chrome.exe
5604	chrome.exe
5604	chrome.exe
5604	chrome.exe
5604	chrome.exe
5604	chrome.exe
5604	chrome.exe
5604	chrome.exe
5604	chrome.exe
5604	chrome.exe
5604	chrome.exe
5604	chrome.exe
5604	chrome.exe
5604	chrome.exe
5604	chrome.exe
5604	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5604	chrome.exe
Token: SeCreatePagefilePrivilege	5604	chrome.exe
Token: SeShutdownPrivilege	5604	chrome.exe
Token: SeCreatePagefilePrivilege	5604	chrome.exe
Token: SeShutdownPrivilege	5604	chrome.exe
Token: SeCreatePagefilePrivilege	5604	chrome.exe
Token: SeShutdownPrivilege	5604	chrome.exe
Token: SeCreatePagefilePrivilege	5604	chrome.exe
Token: SeShutdownPrivilege	5604	chrome.exe
Token: SeCreatePagefilePrivilege	5604	chrome.exe
Token: SeShutdownPrivilege	5604	chrome.exe
Token: SeCreatePagefilePrivilege	5604	chrome.exe
Token: SeShutdownPrivilege	5604	chrome.exe
Token: SeCreatePagefilePrivilege	5604	chrome.exe
Token: SeShutdownPrivilege	5604	chrome.exe
Token: SeCreatePagefilePrivilege	5604	chrome.exe
Token: SeShutdownPrivilege	5604	chrome.exe
Token: SeCreatePagefilePrivilege	5604	chrome.exe
Token: SeShutdownPrivilege	5604	chrome.exe
Token: SeCreatePagefilePrivilege	5604	chrome.exe
Token: SeShutdownPrivilege	5604	chrome.exe
Token: SeCreatePagefilePrivilege	5604	chrome.exe
Token: SeShutdownPrivilege	5604	chrome.exe
Token: SeCreatePagefilePrivilege	5604	chrome.exe
Token: SeShutdownPrivilege	5604	chrome.exe
Token: SeCreatePagefilePrivilege	5604	chrome.exe
Token: SeShutdownPrivilege	5604	chrome.exe
Token: SeCreatePagefilePrivilege	5604	chrome.exe
Token: SeShutdownPrivilege	5604	chrome.exe
Token: SeCreatePagefilePrivilege	5604	chrome.exe
Token: SeShutdownPrivilege	5604	chrome.exe
Token: SeCreatePagefilePrivilege	5604	chrome.exe
Token: SeShutdownPrivilege	5604	chrome.exe
Token: SeCreatePagefilePrivilege	5604	chrome.exe
Token: SeShutdownPrivilege	5604	chrome.exe
Token: SeCreatePagefilePrivilege	5604	chrome.exe
Token: SeShutdownPrivilege	5604	chrome.exe
Token: SeCreatePagefilePrivilege	5604	chrome.exe
Token: SeShutdownPrivilege	5604	chrome.exe
Token: SeCreatePagefilePrivilege	5604	chrome.exe
Token: SeShutdownPrivilege	5604	chrome.exe
Token: SeCreatePagefilePrivilege	5604	chrome.exe
Token: SeShutdownPrivilege	5604	chrome.exe
Token: SeCreatePagefilePrivilege	5604	chrome.exe
Token: SeShutdownPrivilege	5604	chrome.exe
Token: SeCreatePagefilePrivilege	5604	chrome.exe
Token: SeShutdownPrivilege	5604	chrome.exe
Token: SeCreatePagefilePrivilege	5604	chrome.exe
Token: SeShutdownPrivilege	5604	chrome.exe
Token: SeCreatePagefilePrivilege	5604	chrome.exe
Token: SeShutdownPrivilege	5604	chrome.exe
Token: SeCreatePagefilePrivilege	5604	chrome.exe
Token: SeShutdownPrivilege	5604	chrome.exe
Token: SeCreatePagefilePrivilege	5604	chrome.exe
Token: SeShutdownPrivilege	5604	chrome.exe
Token: SeCreatePagefilePrivilege	5604	chrome.exe
Token: SeShutdownPrivilege	5604	chrome.exe
Token: SeCreatePagefilePrivilege	5604	chrome.exe
Token: SeShutdownPrivilege	5604	chrome.exe
Token: SeCreatePagefilePrivilege	5604	chrome.exe
Token: SeShutdownPrivilege	5604	chrome.exe
Token: SeCreatePagefilePrivilege	5604	chrome.exe
Token: SeShutdownPrivilege	5604	chrome.exe
Token: SeCreatePagefilePrivilege	5604	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
5604	chrome.exe
5604	chrome.exe
5604	chrome.exe
5604	chrome.exe
5604	chrome.exe
5604	chrome.exe
5604	chrome.exe
5604	chrome.exe
5604	chrome.exe
5604	chrome.exe
5604	chrome.exe
5604	chrome.exe
5604	chrome.exe
5604	chrome.exe
5604	chrome.exe
5604	chrome.exe
5604	chrome.exe
5604	chrome.exe
5604	chrome.exe
5604	chrome.exe
5604	chrome.exe
5604	chrome.exe
5604	chrome.exe
5604	chrome.exe
5604	chrome.exe
5604	chrome.exe
5604	chrome.exe
5604	chrome.exe
5604	chrome.exe
5604	chrome.exe
5604	chrome.exe
5604	chrome.exe
5604	chrome.exe
5604	chrome.exe
2288	sihost.exe
5004	explorer.exe
5004	explorer.exe
5004	explorer.exe
5004	explorer.exe
5004	explorer.exe
5004	explorer.exe
5004	explorer.exe
5004	explorer.exe
5004	explorer.exe
5004	explorer.exe
5004	explorer.exe
5004	explorer.exe
5004	explorer.exe
5004	explorer.exe
5004	explorer.exe
5004	explorer.exe
5004	explorer.exe
5004	explorer.exe
5004	explorer.exe
5004	explorer.exe
5004	explorer.exe
5004	explorer.exe
5004	explorer.exe
5004	explorer.exe
5004	explorer.exe
5004	explorer.exe
5004	explorer.exe
5004	explorer.exe
5004	explorer.exe

Suspicious use of SendNotifyMessage 60 IoCs

pid	Process
5604	chrome.exe
5604	chrome.exe
5604	chrome.exe
5604	chrome.exe
5604	chrome.exe
5604	chrome.exe
5604	chrome.exe
5604	chrome.exe
5604	chrome.exe
5604	chrome.exe
5604	chrome.exe
5604	chrome.exe
5604	chrome.exe
5604	chrome.exe
5604	chrome.exe
5604	chrome.exe
5004	explorer.exe
5004	explorer.exe
5004	explorer.exe
5004	explorer.exe
5004	explorer.exe
5004	explorer.exe
5004	explorer.exe
5004	explorer.exe
5004	explorer.exe
5004	explorer.exe
5004	explorer.exe
5004	explorer.exe
5004	explorer.exe
5004	explorer.exe
5004	explorer.exe
5004	explorer.exe
5004	explorer.exe
5004	explorer.exe
5004	explorer.exe
5004	explorer.exe
5004	explorer.exe
5004	explorer.exe
5004	explorer.exe
5004	explorer.exe
5004	explorer.exe
5004	explorer.exe
5004	explorer.exe
5004	explorer.exe
5004	explorer.exe
5004	explorer.exe
5004	explorer.exe
5004	explorer.exe
5004	explorer.exe
5004	explorer.exe
5004	explorer.exe
5004	explorer.exe
5004	explorer.exe
5004	explorer.exe
5004	explorer.exe
5004	explorer.exe
5004	explorer.exe
5004	explorer.exe
5004	explorer.exe
5004	explorer.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
5336	StartMenuExperienceHost.exe
2692	SearchHost.exe
5004	explorer.exe

Suspicious use of WriteProcessMemory 62 IoCs

description	pid	Process	procid_target
PID 5604 wrote to memory of 1684	5604	chrome.exe	89
PID 5604 wrote to memory of 4268	5604	chrome.exe	90
PID 5604 wrote to memory of 4804	5604	chrome.exe	91
PID 5604 wrote to memory of 4268	5604	chrome.exe	90
PID 5604 wrote to memory of 4488	5604	chrome.exe	93
PID 5604 wrote to memory of 4488	5604	chrome.exe	93
PID 5604 wrote to memory of 5916	5604	chrome.exe	94
PID 5604 wrote to memory of 5916	5604	chrome.exe	94
PID 5604 wrote to memory of 4000	5604	chrome.exe	95
PID 5604 wrote to memory of 4000	5604	chrome.exe	95
PID 5604 wrote to memory of 5984	5604	chrome.exe	96
PID 5604 wrote to memory of 5984	5604	chrome.exe	96
PID 5604 wrote to memory of 3752	5604	chrome.exe	97
PID 5604 wrote to memory of 3752	5604	chrome.exe	97
PID 5604 wrote to memory of 124	5604	chrome.exe	98
PID 5604 wrote to memory of 124	5604	chrome.exe	98
PID 5604 wrote to memory of 2972	5604	chrome.exe	99
PID 5604 wrote to memory of 2972	5604	chrome.exe	99
PID 5604 wrote to memory of 4328	5604	chrome.exe	100
PID 5604 wrote to memory of 2228	5604	chrome.exe	101
PID 5604 wrote to memory of 2272	5604	chrome.exe	102
PID 5604 wrote to memory of 2228	5604	chrome.exe	101
PID 5604 wrote to memory of 2272	5604	chrome.exe	102
PID 5604 wrote to memory of 4432	5604	chrome.exe	106
PID 5604 wrote to memory of 2128	5604	chrome.exe	107
PID 5604 wrote to memory of 4432	5604	chrome.exe	106
PID 5604 wrote to memory of 3776	5604	chrome.exe	108
PID 5604 wrote to memory of 2128	5604	chrome.exe	107
PID 5604 wrote to memory of 3776	5604	chrome.exe	108
PID 5604 wrote to memory of 1776	5604	chrome.exe	109
PID 5604 wrote to memory of 1776	5604	chrome.exe	109
PID 5604 wrote to memory of 3320	5604	chrome.exe	110
PID 5604 wrote to memory of 3320	5604	chrome.exe	110
PID 5604 wrote to memory of 3120	5604	chrome.exe	111
PID 5604 wrote to memory of 1836	5604	chrome.exe	112
PID 5604 wrote to memory of 3120	5604	chrome.exe	111
PID 5604 wrote to memory of 1836	5604	chrome.exe	112
PID 5604 wrote to memory of 3412	5604	chrome.exe	113
PID 5604 wrote to memory of 3412	5604	chrome.exe	113
PID 5604 wrote to memory of 2540	5604	chrome.exe	114
PID 5604 wrote to memory of 2540	5604	chrome.exe	114
PID 5604 wrote to memory of 4856	5604	chrome.exe	115
PID 5604 wrote to memory of 2760	5604	chrome.exe	116
PID 5604 wrote to memory of 4856	5604	chrome.exe	115
PID 5604 wrote to memory of 2760	5604	chrome.exe	116
PID 5604 wrote to memory of 2964	5604	chrome.exe	118
PID 5604 wrote to memory of 2964	5604	chrome.exe	118
PID 5604 wrote to memory of 2328	5604	chrome.exe	119
PID 5604 wrote to memory of 2328	5604	chrome.exe	119
PID 5604 wrote to memory of 5684	5604	chrome.exe	120
PID 5604 wrote to memory of 2300	5604	chrome.exe	121
PID 5604 wrote to memory of 6120	5604	chrome.exe	122
PID 5604 wrote to memory of 5664	5604	chrome.exe	123
PID 5604 wrote to memory of 5664	5604	chrome.exe	123
PID 5604 wrote to memory of 5012	5604	chrome.exe	124
PID 5604 wrote to memory of 5012	5604	chrome.exe	124
PID 5604 wrote to memory of 5816	5604	chrome.exe	125
PID 5604 wrote to memory of 5816	5604	chrome.exe	125
PID 2288 wrote to memory of 5004	2288	sihost.exe	130
PID 5604 wrote to memory of 2524	5604	chrome.exe	137
PID 5604 wrote to memory of 4380	5604	chrome.exe	138
PID 5604 wrote to memory of 4380	5604	chrome.exe	138

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE
"C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\farware.xml"
1⤵
PID:3976

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffd4b52c728,0x7ffd4b52c734,0x7ffd4b52c740
  2⤵
  PID:1684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1624,i,12081321505758480578,9464067973943883494,262144 --field-trial-handle=1912,i,1859493087043849002,451494336560251558,262144 --variations-seed-version --mojo-platform-channel-handle=1908 /prefetch:2
  2⤵
  PID:4268
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1404,i,13420977336411825509,5183649445337803846,524288 --field-trial-handle=1912,i,1859493087043849002,451494336560251558,262144 --variations-seed-version --mojo-platform-channel-handle=2128 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2308,i,3359214469103767774,17295824677761193381,524288 --field-trial-handle=1912,i,1859493087043849002,451494336560251558,262144 --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:13
  2⤵
  PID:4488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3268,i,9596880126074597931,5641710178024403712,2097152 --field-trial-handle=1912,i,1859493087043849002,451494336560251558,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:5916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3300,i,13091851586022566627,15988606111075530898,2097152 --field-trial-handle=1912,i,1859493087043849002,451494336560251558,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:4000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4700,i,8371082910862452138,483298932632338747,2097152 --field-trial-handle=1912,i,1859493087043849002,451494336560251558,262144 --variations-seed-version --mojo-platform-channel-handle=4716 /prefetch:1
  2⤵
  PID:5984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4904,i,10599785673394178281,12204824520516426917,524288 --field-trial-handle=1912,i,1859493087043849002,451494336560251558,262144 --variations-seed-version --mojo-platform-channel-handle=4892 /prefetch:14
  2⤵
  PID:3752
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5036,i,863664086860033374,454830530240462510,524288 --field-trial-handle=1912,i,1859493087043849002,451494336560251558,262144 --variations-seed-version --mojo-platform-channel-handle=5040 /prefetch:14
  2⤵
  PID:124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5188,i,1305617220006622512,13484249370709254916,524288 --field-trial-handle=1912,i,1859493087043849002,451494336560251558,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:14
  2⤵
  PID:2972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5408,i,2684336498459961483,5137028893100417792,524288 --field-trial-handle=1912,i,1859493087043849002,451494336560251558,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:14
  2⤵
  PID:4328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5508,i,3431595569354297965,14494108355686252201,2097152 --field-trial-handle=1912,i,1859493087043849002,451494336560251558,262144 --variations-seed-version --mojo-platform-channel-handle=5516 /prefetch:1
  2⤵
  PID:2228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5548,i,18000058431306864376,6103265557678256212,2097152 --field-trial-handle=1912,i,1859493087043849002,451494336560251558,262144 --variations-seed-version --mojo-platform-channel-handle=5584 /prefetch:1
  2⤵
  PID:2272
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5832,i,14391646896228549318,8472907494774973126,2097152 --field-trial-handle=1912,i,1859493087043849002,451494336560251558,262144 --variations-seed-version --mojo-platform-channel-handle=5804 /prefetch:1
  2⤵
  PID:4432
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5844,i,628859327266331751,17925180842081795690,524288 --field-trial-handle=1912,i,1859493087043849002,451494336560251558,262144 --variations-seed-version --mojo-platform-channel-handle=5504 /prefetch:14
  2⤵
  PID:2128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5800,i,16352653334656437630,13419713507116614393,2097152 --field-trial-handle=1912,i,1859493087043849002,451494336560251558,262144 --variations-seed-version --mojo-platform-channel-handle=5700 /prefetch:1
  2⤵
  PID:3776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6216,i,2695017872402049534,18251557501129081676,2097152 --field-trial-handle=1912,i,1859493087043849002,451494336560251558,262144 --variations-seed-version --mojo-platform-channel-handle=5700 /prefetch:1
  2⤵
  PID:1776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5588,i,72814523069319320,4662462183935310732,2097152 --field-trial-handle=1912,i,1859493087043849002,451494336560251558,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:1
  2⤵
  PID:3320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=5992,i,7871345735857693532,2629915639875919456,2097152 --field-trial-handle=1912,i,1859493087043849002,451494336560251558,262144 --variations-seed-version --mojo-platform-channel-handle=6248 /prefetch:1
  2⤵
  PID:3120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5412,i,9194844877685914604,7299188870456462788,524288 --field-trial-handle=1912,i,1859493087043849002,451494336560251558,262144 --variations-seed-version --mojo-platform-channel-handle=6040 /prefetch:14
  2⤵
  PID:1836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=5408,i,2956950015759298853,273493911570035632,2097152 --field-trial-handle=1912,i,1859493087043849002,451494336560251558,262144 --variations-seed-version --mojo-platform-channel-handle=5588 /prefetch:1
  2⤵
  PID:3412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5836,i,11904307753450427527,17122921084058613095,524288 --field-trial-handle=1912,i,1859493087043849002,451494336560251558,262144 --variations-seed-version --mojo-platform-channel-handle=6320 /prefetch:14
  2⤵
  PID:2540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=6504,i,1809241254197658215,15849258857776948945,2097152 --field-trial-handle=1912,i,1859493087043849002,451494336560251558,262144 --variations-seed-version --mojo-platform-channel-handle=5052 /prefetch:9
  2⤵
  PID:4856
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=5596,i,770980734287461020,308709353125768273,2097152 --field-trial-handle=1912,i,1859493087043849002,451494336560251558,262144 --variations-seed-version --mojo-platform-channel-handle=5784 /prefetch:1
  2⤵
  PID:2760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6412,i,12833047282158780551,1434670296661903868,524288 --field-trial-handle=1912,i,1859493087043849002,451494336560251558,262144 --variations-seed-version --mojo-platform-channel-handle=6472 /prefetch:14
  2⤵
  PID:2964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6456,i,13188672574303751855,3519393771484321266,524288 --field-trial-handle=1912,i,1859493087043849002,451494336560251558,262144 --variations-seed-version --mojo-platform-channel-handle=5796 /prefetch:14
  2⤵
  PID:2328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5060,i,12082849573843492165,658982423318801663,524288 --field-trial-handle=1912,i,1859493087043849002,451494336560251558,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:14
  2⤵
  PID:5684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6260,i,6395708374657388553,2497759826543079291,524288 --field-trial-handle=1912,i,1859493087043849002,451494336560251558,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:14
  2⤵
  PID:2300
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6228,i,7354985287882872419,2339439381879867776,524288 --field-trial-handle=1912,i,1859493087043849002,451494336560251558,262144 --variations-seed-version --mojo-platform-channel-handle=6456 /prefetch:14
  2⤵
  PID:6120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --metrics-shmem-handle=256,i,7893355842895000503,16638051492335707234,2097152 --field-trial-handle=1912,i,1859493087043849002,451494336560251558,262144 --variations-seed-version --mojo-platform-channel-handle=5572 /prefetch:1
  2⤵
  PID:5664
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --metrics-shmem-handle=5616,i,9915564718387205198,5272300114277136964,2097152 --field-trial-handle=1912,i,1859493087043849002,451494336560251558,262144 --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:1
  2⤵
  PID:5012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --metrics-shmem-handle=3692,i,5062806415694567712,13997922819516782175,2097152 --field-trial-handle=1912,i,1859493087043849002,451494336560251558,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:1
  2⤵
  PID:5816
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5960,i,9112052215875151226,15759292402264604363,262144 --field-trial-handle=1912,i,1859493087043849002,451494336560251558,262144 --variations-seed-version --mojo-platform-channel-handle=5940 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=4672,i,16142741682934204537,7972432783617641076,524288 --field-trial-handle=1912,i,1859493087043849002,451494336560251558,262144 --variations-seed-version --mojo-platform-channel-handle=4656 /prefetch:14
  2⤵
  PID:4380

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5808

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2344

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:3972

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2288
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Enumerates connected drives
  - Checks SCSI registry key(s)
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:5004

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2692

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5336

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 912B
SHA256 bb4624fb7e7223af4ba39faa409d39157bdc4efaa473c811bbfdfba3ece1e79f
MD5 83748789110caaa7c1b7fd2e0c9ab916
SHA1 0cc2edc587376e19823573caa6c905fa17b986a9
SHA512 96f5e93fe9b3eb1942b554239f1123b3141a015eed48f10c9338fd8ede2991d5302e35ead97b8f671de6f566e9bbe4cb1cd9e3e20d70abb17bfcf93540b70a88
TLSH
T1AB117B3CA18E194EEF6F45380CA904D7269D759D972532144EA4887F724167C91713CB
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 b38fc355d6ed0070b1b9e103911b3b7f90982f730b9cbe4e76e92758177a2934
MD5 9e7d58e265ef39f4d6b918e0a273b93f
SHA1 3869ae150d0c2e72c9f233f35d217c8eec471aa2
SHA512 2fef361ca77326a6de52084566c61b08d695d12e3fa73b0d6725f6614645839fa5dfdac6e884747248313498d8d0e5575ab6a42f2f3cbfc6606ed86968184ff8
SSDEEP 192:Dbind9wHMQVQJnJrGFuYrZylM9gaPtvkrIDfPyI3CNPAIZhICE:Dbind9wHMQVQJnJrGFuYrZylM9gaVMra
TLSH
T13802CEF3C3D8C52D894156F8DB257F2ECE291A28122C3C27C9D8BE5B93E2871D21565E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 cb596c5a8aa56be0fa9caf9a21605d71af42e76f00fd2d9e65dd0055970d389b
MD5 38cc6be4921c664e2eb9e030a86a6cd6
SHA1 a60f08aa096e08ba30551e57fa042b3925f4fbab
SHA512 801ef3d911601ee56b4110b3c3a25d0aa1ddb0f27bea28b41edd84df41982832969904af1c75ac97c5a9e2eb8b4631319f26890671a31c4d340b6394420970b7
SSDEEP 192:Dbind9wHMQVQJnJfp+GFuYrZyl4gaPtvkrIDfPyI3CNPAIZhIR+oaW:Dbind9wHMQVQJnJfp+GFuYrZyl4gaVME
TLSH
T1E012CFF7C3D8C52DC94156F8DB25BF2ECE291A28122C3C26C9D8BE5B93E2471D21165E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 d640bda010725901e37ce23b5667ad17e48ce437f601bb38dfac960d9feb7136
MD5 58c97cc65a4975ec6ba6f8869d360105
SHA1 ab013d65435544242e4d7b498139daddcb99e2ef
SHA512 21d23cda90426595be066c198a2c4dc817aa57dd0731c18dca380f0258bb26e10d0037170662992c1f0e5be4fc97efab3f3f57618f9bbe65049450ced1e5c408
SSDEEP 192:LRE9cBhBQ0oYDv7jQYPRpuKD9/Hsb+WNnL5BBvYWjeOVyIsnAUgE:LRE9mhBQ6731XH5wNzYEE
TLSH
T13B42A91EAD10653B5CC7D21AF966BB57D6F5203121E42E44E7FC8A2C11DB6CC2217817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 4bc481a06c6becd1ee0030771061045c1b728ec35a482839130bb98fe5a1d3e8
MD5 003bf76d0a6c6ada7d1459317d3e2373
SHA1 ea268b271cdcbfbe8e71e5c4df7e347061281429
SHA512 58a43ca0be51891919a34feed5c697ab0186f93589e2950e87fc5973d8b08f4733bed63ad0a03a8dafb4d8c0a010f34bc80a38023697c70b10324f81d067a703
SSDEEP 192:NREBBQ0pWv7+APRp2p9/Hsb+WNnu80ijehVyIsnAUge:NREBBQ6iDXq5wd0Re
TLSH
T1D032972EAE10653B5CCBD21AF965B753D6F5203131D42E84E6FC8A6C11DB6CC2217817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 c7f2d08dd169b62a750567ba965026baedfd265f5fcf1f8e56dbaee14fff3704
MD5 35344b9ccb57be68f71a3b9e1357c11b
SHA1 c807716a4139227e17043c32f171a369dea5471f
SHA512 98ec0aacaf8a01de37c85a37f0e4a090d9a42b8118a8406fc93455e78b818e067aae67f56af33bce848ea501f745d416ac91ed9be041b41f43511616e545d11f
SSDEEP 192:LRE9cBhBQ0xDv7jQYPRpuKD9/Hsb+WNnL5BBvYWjeOVyIsnAUgE:LRE9mhBQM731XH5wNzYEE
TLSH
T19942A91EAD10653B5DCBD21AF966BB57D6F5203121E42E44E7FC8A2C12EBACC2217817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 f03ce5ecc0adbc9a79c8cddcf0c92edc8e94a74214e175e3f8071f5d424fe05a
MD5 97be29cbf0427c1ecd96be1ef81ab3b6
SHA1 32d58f9c343144b6b3705e8a7c3e1b32413c32ff
SHA512 30db5e7e145268f25200d1b79df8b1d62cb4162fd2c31a87ef49a828450c5c09971f2756c05c99d6a74580e283c004852ea758a4afe669d2394e7eaa4e1a4234
SSDEEP 192:LREBBQ0dWv79APRp2p9/Hsb+WNnL5nxjehVyIsnAUge:LREBBQsisXq5wNnqe
TLSH
T19832A72EAE10653B5CCBD21AF966BB53D6F5203131E42E84E7FC8A6C11DB6CC6217817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 28662ca4ae46f318260a1ecceb8278dc5bcd0dd79b02932752f7f18c65051279
MD5 9bc6c681b8224af5a96012255a8f937f
SHA1 fe99151616e7fa643d071de6d3e1442b29e55d17
SHA512 8eaa390ba01943156fc0187b1ca3f4482f78399deaf071495497ef00ee6d4e741166417a24bb09c4fbb3c48799f12819974c5e977642f87731656ede3ba18199
SSDEEP 192:LRE9cBhBQ0MDv7jQAPRp2KD9/Hsb+WNnL5BIe2AjeqVyIsnAUgE:LRE9mhBQ973hXf5wN32qE
TLSH
T17B42A82EAE10653B5CCBD21AF966BB57D7F5102121D42E44E7FCCA6C12DB6CC2217817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 280cdf7cd582a629a0d274cb741789debc135eced65aedbb2f046b1b84e844dd
MD5 fd71613795a490d5733a96336ba48cde
SHA1 2fa5f687739a0f0abcc9da4fec1f4dcafc5b63d0
SHA512 7744faafa223311ec35aabe496366368d315f2b782a47790c581b9364cd3a19067742becc83c3cbad9a854de856bad99361c82a903f2444332d1b9a3ab87d5b2
SSDEEP 192:LREBBQ0M6v7jQAPRp2p9/Hsb+WNnL5nrjeqVyIsnAUgE:LREBBQ9W3hXq5wNnpE
TLSH
T13132972EAE10653B6CCBD21AF966BB53D7F5203121D42E44E6FCCA6C12DB6CC6217817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 cd976e09215c41b762dc76fe6e06ad3314eb63b13b733a6da3c17a866b596eae
MD5 8cea4d55e109e7491ae498cef2a38535
SHA1 4e9df92b583274c4ab89f60ed47333913d097d53
SHA512 810ae0284ba62ae678afaf469f291e04489f8cd21152936303bf41f99840d97375ea303d02020db1961c577911c8adf8154cfc18d1dc57adbe580ee7435d96d2
SSDEEP 384:+Qjqp7KxkXqKf/pUZNCgVLH2HfgslDRXODqB+ErU39+HGuGKSzj:+Uqp7KxkXqKf/pUZNCgVLH2Hfgsd1OWA
TLSH
T15B52F827684C9A3F0FD4D94DE816AF4FADB101576278492893FB5C0803A97CF114A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 52108127a6bcc53506260a40912baef9a67d0af57c9b3da430c34708360bf7d8
MD5 912242d0740f689b8189cdec9968a126
SHA1 f1f0a85c741e26944e1dd3d0e28336bd0efcb505
SHA512 77f52bb965363033946d872066357d0bf80fcdf5b40635a546adb47e2f7254ad8ba1941039a72980afa4e7bbe2adedc39a8c43ec171967c2cf014a9240cd7a8f
TLSH
T165A0025083C75985C86443B113D943C0A3248D509365861B51A831559CD29874102311
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 fca45211d90e282e6ca2ab720f57e42546e7021eb6f7b3c6df54c9218559c0e1
MD5 dad241c636e7fc7e633dfb7d7061c3d9
SHA1 0b962a0153a94ce1e9d8c36bce3c7f6d418d8298
SHA512 27b1b4ab92ce9e9f8914c5d58ea8480c731e0ed32e7b95aadd2b37ab4911e757a84f6d6ffe8eb57c682baf575b87471ed97bc9cfd20794fb64cc0bf7134c51f7
TLSH
T1AFA0021181CD0561ED20827DB1771DCB2A91491529D1C34369A2145C886B1C09141140
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 f2994cfbe69acd71e5234719c901e51fd63314f7a7583fadc7b144b7717fc2ce
MD5 de2d05f0e509b360176b69cbbfbcc5d0
SHA1 9c75c23241c128cdd69b9c9c1037e8bf3d611069
SHA512 5993f7ac93992c507215996fe801f0935b64e3026e844351796c499325cba9e8caebca801cc0bd1271494e15d9fbab736640c37f3fbf4250a6eb6e55b091987b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 187KB
SHA256 0c1f11a58ba0eef9871d6ca3ac218c88a04c3c0bc9ee83c51ff08e63f65961ce
MD5 3d471ced0b2e429f4de14856614bbe9e
SHA1 43e3d4ce7cc36f62bc10f1d3e809fa70ec4694ae
SHA512 4d59bef4ea4f90ebb29af804aea4641c4be1dcab2738b3cfe410069864dbd45ba5654d757b934ad546865d1b081023c417896f987c424e4d8741bf8e3fe1eb28
SSDEEP 3072:eIy5v4gmzrK0MeVjaPFfLUo0MbRWWQ4iRcVDCxtvQUsytbcgjnc9RoaUIIolMUhL:e3v+zr7psV0MnQLREDCxtYT0nc9WaUI9
TLSH
T109141270AAA35C568B30962A593F6C79CD612AF0DD0C91CFE58B1F1C824EEC8375D85B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 121KB
SHA256 ee5d5467643f37f873aea7d2d61518f94cb9e62b40afb356830a1677074e64a7
MD5 a182ff30702ab43b3bba2cc0e698786f
SHA1 8f970e6f53e1a3fe39d1e81ecc3512835f7cf082
SHA512 650e1af8177746279c83911a1163ebe099f318409b3a5116ac1c4ff7f78f49afe3f54047b4addb5fd3f184b3dd65392bf5a684029c610d60ff44d88429adf649
SSDEEP 3072:yOiRcVDCxtvQUsytbcgjnc9RoaUIIolMUhiJpqelY:yZREDCxtYT0nc9WaUIIcPhQFY
TLSH
T14EC312F078735D750B21993D253F3C6ACCB16679CA0D98CBF65A3F18425BE88264C85B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 f6e67cfd9e13b122befac20e0180cf94e583ed28abcb33a98708331d28823c4d
MD5 02e565458b323b3a62b79e050d9294e8
SHA1 b18f75a26bc440308525c9e535fe5fe1218308a5
SHA512 26f1e5ef64ebb69522b955242ebc688f66d45a70e47bdcc920ad1e7a1d4b748c812ac8143fcf8cd53b12bac0185bf92f60d7c1bfae83f23b4b7b51171eecfe8e
SSDEEP 96:MC6Md+x/Egx/22v4RoUJfV7cNa4wEJURDotok5NGNDPB6QGyv0OxgybbH2v4a:MC/6/Egx/22wRB7cNa4eDUDg5k6xgybE
TLSH
T1C7A13B32EA598C7395B6C5C9B5423B03CE78306766219FC4E9EC9F0C10AF5D81341937
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 120KB
SHA256 7310456d1257af214fa625c210eae158ba53d412452f9bd9bc3d5016a8ddc112
MD5 25f0318baab4bf473b2e5c0870f40322
SHA1 e25b8467f6d4a3eabceab5b7f2ff07fc989e045e
SHA512 63f2898af0ade818572ddaeeb572965318f9646376ca7d6370acbd3d7674de447138728b2334a1a3358c9e140f0c6bba0221490934c428ebc1dfbfe42c1b833e
SSDEEP 3072:KiRcVDCxtvQUsytbcgjnc9RoaUIIolMUhiJpqelY:FREDCxtYT0nc9WaUIIcPhQFY
TLSH
T11FC312F079B36D750724963A693F2CAACC7121B8C90D55C7F65B3F28025AE88325C85F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 120KB
SHA256 0b2f2943d56ca688d17a5edf31ebe55baf3866b1b0cbf102395375c35500b396
MD5 ae2d2344c30792f3691b780b006bb06e
SHA1 b24cecf5072d20ed593fa49d41efaf2cdd198c76
SHA512 3d015ffe283087ab20d5fb71454621b5b6f1cb2bbb860ee285fb969428897f85cf3648617cc0a17a233d8a15d10fd77c0dc0232c81e37423a144ecac147a4a3d
SSDEEP 3072:CiRcVDCxtvQUsytbcgjnc9RoaUIIolMUhiJpqelY:dREDCxtYT0nc9WaUIIcPhQFY
TLSH
T191C312F079B36D750724963A693F2CAADC7121B8C90D85C7F65B2F28025AE88325C85F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 120KB
SHA256 966dd28b02edb4a53353dcd0ba749d4e85597a7916dc40030a66e73a4de516e1
MD5 885cddcca497e1dcf01529aa0d88c919
SHA1 db747e92f01e25be233fd2401c10c89e3e5dd4b4
SHA512 3734b4d73ae91864316eb1001a5c15b9e176b02622621eadc3fac714cee67be54971bbd0153cd0169f863aadd04533bf777065c8acc00643691dd8766b3c36d6
SSDEEP 3072:/iRcVDCxtvQUsytbcgjnc9RoaUIIolMUhiJpqelY:6REDCxtYT0nc9WaUIIcPhQFY
TLSH
T1D3C312F079B36D750724963A693F2CAADC7121B8C90D45C7F65B2F28025AE88325C85F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 607B
SHA256 be6b74e52e5eef1f1c27c0976bf3bf1bfa99958c00bbef2898a602f691be6dae
MD5 76b78ed7ff6273215b134d6a6488035d
SHA1 9e7a11ffb68d027036302eccd4c22315054843a9
SHA512 9919504cd4d8c0757abff8da4bbad1c4b6532f81d290c736fc5624ef66de45e6a9e29a8290854ae554d5bdfc5291f1ea81ae62d1b25846bfbcf1515e2ec3e4f1
TLSH
T174F0DC53CBD6536BD527223CC8E207E1FA70E2719E81212386106F2D6CB77241E474B4
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5604_1166252879\CRX_INSTALL\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5604_1166252879\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2692-671-0x00000236001E0000-0x00000236002E0000-memory.dmp

Download

memory/2692-704-0x0000023614200000-0x0000023614220000-memory.dmp

Download

memory/2692-678-0x0000023602A20000-0x0000023602A40000-memory.dmp

Download

memory/2692-679-0x0000023602E60000-0x0000023602F60000-memory.dmp

Download

memory/2692-688-0x0000023602C80000-0x0000023602CA0000-memory.dmp

Download

memory/2692-672-0x00000236001E0000-0x00000236002E0000-memory.dmp

Download

memory/2692-673-0x00000236001E0000-0x00000236002E0000-memory.dmp

Download

memory/3976-13-0x00007FFD56EE0000-0x00007FFD57143000-memory.dmp

Download

memory/3976-16-0x00007FFD17020000-0x00007FFD17030000-memory.dmp

Download

memory/3976-11-0x00007FFD56EE0000-0x00007FFD57143000-memory.dmp

Download

memory/3976-12-0x00007FFD56EE0000-0x00007FFD57143000-memory.dmp

Download

memory/3976-8-0x00007FFD56EE0000-0x00007FFD57143000-memory.dmp

Download

memory/3976-9-0x00007FFD56EE0000-0x00007FFD57143000-memory.dmp

Download

memory/3976-15-0x00007FFD17020000-0x00007FFD17030000-memory.dmp

Download

memory/3976-0-0x00007FFD17020000-0x00007FFD17030000-memory.dmp

Download

memory/3976-14-0x00007FFD17020000-0x00007FFD17030000-memory.dmp

Download

memory/3976-17-0x00007FFD17020000-0x00007FFD17030000-memory.dmp

Download

memory/3976-18-0x00007FFD56EE0000-0x00007FFD57143000-memory.dmp

Download

memory/3976-269-0x00007FFD56EE0000-0x00007FFD57143000-memory.dmp

Download

memory/3976-19-0x00007FFD56EE0000-0x00007FFD57143000-memory.dmp

Download

memory/3976-2-0x00007FFD17020000-0x00007FFD17030000-memory.dmp

Download

memory/3976-10-0x00007FFD56EE0000-0x00007FFD57143000-memory.dmp

Download

memory/3976-7-0x00007FFD17020000-0x00007FFD17030000-memory.dmp

Download

memory/3976-6-0x00007FFD56EE0000-0x00007FFD57143000-memory.dmp

Download

memory/3976-5-0x00007FFD56EE0000-0x00007FFD57143000-memory.dmp

Download

memory/3976-4-0x00007FFD17020000-0x00007FFD17030000-memory.dmp

Download

memory/3976-1-0x00007FFD17020000-0x00007FFD17030000-memory.dmp

Download

memory/3976-3-0x00007FFD5703F000-0x00007FFD57040000-memory.dmp

Download

memory/5336-840-0x00000228CBB40000-0x00000228CBC3F000-memory.dmp

Download