41008ed5bbe29ab369256264b80bc28b77b3f2abe28ffc2d6c084b2aa03ed7c2

Analysis

user interaction
yes
max time kernel
544s
max time network
542s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/07/2026, 16:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
explainthisnoodle.gif
Size 4.4MB
Sample260709-tpkt4sds5q
SHA256 41008ed5bbe29ab369256264b80bc28b77b3f2abe28ffc2d6c084b2aa03ed7c2
MD5 c004f0cb934f4b06f8e939ac3a7a0d20
SHA1 b9bf5bd04b35b1f13ac83fa815448566a529c937
SHA512 104be8c2ba478bff00742bd85df8f25b55248068232efdcafca17da50f98ee6d99621856778641a028c70b9f8616703afe65dfebc9d3725fb53729890665c3df
SSDEEP 98304:kRaULrs6YIAKLTnLtfdgXtsrhk2eTDXVJygUAFZToxCRCg:WM9wDtdgdQhfe3XLygfeCRCg
TLSH
T1EF263380ED6EC4C35BB9365A3A52ABB07E5D2C1DC5A50F6072D2ED2EA2001D5D7E87C3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware discovery persistence spyware

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5044	chrome.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main	explorer.exe

Modifies data under HKEY_USERS 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe

Modifies registry class 39 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23"	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3797332335-34111092-3597280141-1000\{B5DC1A7B-51D6-440E-B4FE-ABF9246506E0}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\MuiCache	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23"	SearchHost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3797332335-34111092-3597280141-1000\{6D15FFF8-94C1-4AE9-9F9C-8EF2B7D9E424}	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56"	SearchHost.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1656	mspaint.exe
1656	mspaint.exe
6068	chrome.exe
6068	chrome.exe
6068	chrome.exe
6068	chrome.exe
2400	chrome.exe
2400	chrome.exe
4248	explorer.exe
4248	explorer.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 21 IoCs

pid	Process
6068	chrome.exe
6068	chrome.exe
6068	chrome.exe
6068	chrome.exe
6068	chrome.exe
6068	chrome.exe
6068	chrome.exe
6068	chrome.exe
6068	chrome.exe
6068	chrome.exe
6068	chrome.exe
6068	chrome.exe
6068	chrome.exe
6068	chrome.exe
6068	chrome.exe
6068	chrome.exe
6068	chrome.exe
6068	chrome.exe
6068	chrome.exe
6068	chrome.exe
6068	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	6068	chrome.exe
Token: SeCreatePagefilePrivilege	6068	chrome.exe
Token: SeShutdownPrivilege	6068	chrome.exe
Token: SeCreatePagefilePrivilege	6068	chrome.exe
Token: SeShutdownPrivilege	6068	chrome.exe
Token: SeCreatePagefilePrivilege	6068	chrome.exe
Token: SeShutdownPrivilege	6068	chrome.exe
Token: SeCreatePagefilePrivilege	6068	chrome.exe
Token: SeShutdownPrivilege	6068	chrome.exe
Token: SeCreatePagefilePrivilege	6068	chrome.exe
Token: SeShutdownPrivilege	6068	chrome.exe
Token: SeCreatePagefilePrivilege	6068	chrome.exe
Token: SeShutdownPrivilege	6068	chrome.exe
Token: SeCreatePagefilePrivilege	6068	chrome.exe
Token: SeShutdownPrivilege	6068	chrome.exe
Token: SeCreatePagefilePrivilege	6068	chrome.exe
Token: SeShutdownPrivilege	6068	chrome.exe
Token: SeCreatePagefilePrivilege	6068	chrome.exe
Token: SeShutdownPrivilege	6068	chrome.exe
Token: SeCreatePagefilePrivilege	6068	chrome.exe
Token: SeShutdownPrivilege	6068	chrome.exe
Token: SeCreatePagefilePrivilege	6068	chrome.exe
Token: SeShutdownPrivilege	6068	chrome.exe
Token: SeCreatePagefilePrivilege	6068	chrome.exe
Token: SeShutdownPrivilege	6068	chrome.exe
Token: SeCreatePagefilePrivilege	6068	chrome.exe
Token: SeShutdownPrivilege	6068	chrome.exe
Token: SeCreatePagefilePrivilege	6068	chrome.exe
Token: SeShutdownPrivilege	6068	chrome.exe
Token: SeCreatePagefilePrivilege	6068	chrome.exe
Token: SeShutdownPrivilege	6068	chrome.exe
Token: SeCreatePagefilePrivilege	6068	chrome.exe
Token: SeShutdownPrivilege	6068	chrome.exe
Token: SeCreatePagefilePrivilege	6068	chrome.exe
Token: SeShutdownPrivilege	6068	chrome.exe
Token: SeCreatePagefilePrivilege	6068	chrome.exe
Token: SeShutdownPrivilege	6068	chrome.exe
Token: SeCreatePagefilePrivilege	6068	chrome.exe
Token: SeShutdownPrivilege	6068	chrome.exe
Token: SeCreatePagefilePrivilege	6068	chrome.exe
Token: SeShutdownPrivilege	6068	chrome.exe
Token: SeCreatePagefilePrivilege	6068	chrome.exe
Token: SeShutdownPrivilege	6068	chrome.exe
Token: SeCreatePagefilePrivilege	6068	chrome.exe
Token: SeShutdownPrivilege	6068	chrome.exe
Token: SeCreatePagefilePrivilege	6068	chrome.exe
Token: SeShutdownPrivilege	6068	chrome.exe
Token: SeCreatePagefilePrivilege	6068	chrome.exe
Token: SeShutdownPrivilege	6068	chrome.exe
Token: SeCreatePagefilePrivilege	6068	chrome.exe
Token: SeShutdownPrivilege	6068	chrome.exe
Token: SeCreatePagefilePrivilege	6068	chrome.exe
Token: SeShutdownPrivilege	6068	chrome.exe
Token: SeCreatePagefilePrivilege	6068	chrome.exe
Token: SeShutdownPrivilege	6068	chrome.exe
Token: SeCreatePagefilePrivilege	6068	chrome.exe
Token: SeShutdownPrivilege	6068	chrome.exe
Token: SeCreatePagefilePrivilege	6068	chrome.exe
Token: SeShutdownPrivilege	6068	chrome.exe
Token: SeCreatePagefilePrivilege	6068	chrome.exe
Token: SeShutdownPrivilege	6068	chrome.exe
Token: SeCreatePagefilePrivilege	6068	chrome.exe
Token: SeShutdownPrivilege	6068	chrome.exe
Token: SeCreatePagefilePrivilege	6068	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
6068	chrome.exe
6068	chrome.exe
6068	chrome.exe
6068	chrome.exe
6068	chrome.exe
6068	chrome.exe
6068	chrome.exe
6068	chrome.exe
6068	chrome.exe
6068	chrome.exe
6068	chrome.exe
6068	chrome.exe
6068	chrome.exe
6068	chrome.exe
6068	chrome.exe
6068	chrome.exe
6068	chrome.exe
6068	chrome.exe
6068	chrome.exe
6068	chrome.exe
6068	chrome.exe
6068	chrome.exe
6068	chrome.exe
6068	chrome.exe
6068	chrome.exe
6068	chrome.exe
6068	chrome.exe
6068	chrome.exe
6068	chrome.exe
6068	chrome.exe
6068	chrome.exe
6068	chrome.exe
6068	chrome.exe
6068	chrome.exe
3012	sihost.exe
4248	explorer.exe
4248	explorer.exe
4248	explorer.exe
4248	explorer.exe
4248	explorer.exe
4248	explorer.exe
4248	explorer.exe
4248	explorer.exe
4248	explorer.exe
4248	explorer.exe
4248	explorer.exe
4248	explorer.exe
4248	explorer.exe
4248	explorer.exe
4248	explorer.exe
4248	explorer.exe
4248	explorer.exe
4248	explorer.exe
4248	explorer.exe
4248	explorer.exe
4248	explorer.exe
4248	explorer.exe
4248	explorer.exe
4248	explorer.exe
4248	explorer.exe
4248	explorer.exe
4248	explorer.exe
4248	explorer.exe
4248	explorer.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
6068	chrome.exe
6068	chrome.exe
6068	chrome.exe
6068	chrome.exe
6068	chrome.exe
6068	chrome.exe
6068	chrome.exe
6068	chrome.exe
6068	chrome.exe
6068	chrome.exe
6068	chrome.exe
6068	chrome.exe
6068	chrome.exe
6068	chrome.exe
6068	chrome.exe
6068	chrome.exe
4248	explorer.exe
4248	explorer.exe
4248	explorer.exe
4248	explorer.exe
4248	explorer.exe
4248	explorer.exe
4248	explorer.exe
4248	explorer.exe
4248	explorer.exe
4248	explorer.exe
4248	explorer.exe
4248	explorer.exe
4248	explorer.exe
4248	explorer.exe
4248	explorer.exe
4248	explorer.exe
4248	explorer.exe
4248	explorer.exe
4248	explorer.exe
4248	explorer.exe
4248	explorer.exe
4248	explorer.exe
4248	explorer.exe
4248	explorer.exe
4248	explorer.exe
4248	explorer.exe
4248	explorer.exe
4248	explorer.exe
4248	explorer.exe
4248	explorer.exe
4248	explorer.exe
4248	explorer.exe
4248	explorer.exe
4248	explorer.exe
4248	explorer.exe
4248	explorer.exe
4248	explorer.exe
4248	explorer.exe
4248	explorer.exe
4248	explorer.exe
4248	explorer.exe
4248	explorer.exe
4248	explorer.exe
4248	explorer.exe
4248	explorer.exe
4248	explorer.exe
4248	explorer.exe
4248	explorer.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
1656	mspaint.exe
1656	mspaint.exe
1656	mspaint.exe
1656	mspaint.exe
2060	StartMenuExperienceHost.exe
2324	SearchHost.exe
4248	explorer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 6068 wrote to memory of 5936	6068	chrome.exe	92
PID 6068 wrote to memory of 3740	6068	chrome.exe	93
PID 6068 wrote to memory of 5044	6068	chrome.exe	94
PID 6068 wrote to memory of 3740	6068	chrome.exe	93
PID 6068 wrote to memory of 4204	6068	chrome.exe	96
PID 6068 wrote to memory of 4204	6068	chrome.exe	96
PID 6068 wrote to memory of 4880	6068	chrome.exe	97
PID 6068 wrote to memory of 6000	6068	chrome.exe	98
PID 6068 wrote to memory of 4880	6068	chrome.exe	97
PID 6068 wrote to memory of 6000	6068	chrome.exe	98
PID 6068 wrote to memory of 2900	6068	chrome.exe	99
PID 6068 wrote to memory of 2900	6068	chrome.exe	99
PID 6068 wrote to memory of 2256	6068	chrome.exe	100
PID 6068 wrote to memory of 2256	6068	chrome.exe	100
PID 6068 wrote to memory of 2324	6068	chrome.exe	101
PID 6068 wrote to memory of 2324	6068	chrome.exe	101
PID 6068 wrote to memory of 2648	6068	chrome.exe	102
PID 6068 wrote to memory of 2648	6068	chrome.exe	102
PID 6068 wrote to memory of 2772	6068	chrome.exe	103
PID 6068 wrote to memory of 5860	6068	chrome.exe	105
PID 6068 wrote to memory of 3456	6068	chrome.exe	104
PID 6068 wrote to memory of 5860	6068	chrome.exe	105
PID 6068 wrote to memory of 3456	6068	chrome.exe	104
PID 6068 wrote to memory of 4016	6068	chrome.exe	106
PID 6068 wrote to memory of 4016	6068	chrome.exe	106
PID 6068 wrote to memory of 3556	6068	chrome.exe	108
PID 6068 wrote to memory of 3556	6068	chrome.exe	108
PID 6068 wrote to memory of 1456	6068	chrome.exe	109
PID 6068 wrote to memory of 1456	6068	chrome.exe	109
PID 6068 wrote to memory of 3808	6068	chrome.exe	110
PID 6068 wrote to memory of 3808	6068	chrome.exe	110
PID 6068 wrote to memory of 5544	6068	chrome.exe	111
PID 6068 wrote to memory of 5544	6068	chrome.exe	111
PID 6068 wrote to memory of 4156	6068	chrome.exe	112
PID 6068 wrote to memory of 4156	6068	chrome.exe	112
PID 6068 wrote to memory of 2644	6068	chrome.exe	113
PID 6068 wrote to memory of 2644	6068	chrome.exe	113
PID 6068 wrote to memory of 2412	6068	chrome.exe	116
PID 6068 wrote to memory of 2412	6068	chrome.exe	116
PID 6068 wrote to memory of 2560	6068	chrome.exe	117
PID 6068 wrote to memory of 2560	6068	chrome.exe	117
PID 6068 wrote to memory of 2260	6068	chrome.exe	118
PID 6068 wrote to memory of 2084	6068	chrome.exe	119
PID 6068 wrote to memory of 2260	6068	chrome.exe	118
PID 6068 wrote to memory of 2084	6068	chrome.exe	119
PID 6068 wrote to memory of 4200	6068	chrome.exe	120
PID 6068 wrote to memory of 4200	6068	chrome.exe	120
PID 6068 wrote to memory of 4332	6068	chrome.exe	121
PID 6068 wrote to memory of 1948	6068	chrome.exe	122
PID 6068 wrote to memory of 2140	6068	chrome.exe	123
PID 6068 wrote to memory of 3652	6068	chrome.exe	124
PID 6068 wrote to memory of 3652	6068	chrome.exe	124
PID 6068 wrote to memory of 2148	6068	chrome.exe	125
PID 6068 wrote to memory of 2148	6068	chrome.exe	125
PID 6068 wrote to memory of 2328	6068	chrome.exe	126
PID 6068 wrote to memory of 2328	6068	chrome.exe	126
PID 6068 wrote to memory of 5596	6068	chrome.exe	127
PID 6068 wrote to memory of 5596	6068	chrome.exe	127
PID 6068 wrote to memory of 928	6068	chrome.exe	128
PID 6068 wrote to memory of 928	6068	chrome.exe	128
PID 6068 wrote to memory of 2400	6068	chrome.exe	129
PID 6068 wrote to memory of 1600	6068	chrome.exe	130
PID 6068 wrote to memory of 1600	6068	chrome.exe	130
PID 6068 wrote to memory of 3528	6068	chrome.exe	131

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\explainthisnoodle.gif"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1656

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
- Checks SCSI registry key(s)
PID:5060

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:6068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x5c,0x134,0x7fff8790c728,0x7fff8790c734,0x7fff8790c740
  2⤵
  PID:5936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1712,i,14935445218153134678,18136362503894732011,262144 --field-trial-handle=1928,i,2092904035175164669,5293416632682270542,262144 --variations-seed-version --mojo-platform-channel-handle=1924 /prefetch:2
  2⤵
  PID:3740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2068,i,1437452753599293847,5885110392779173527,524288 --field-trial-handle=1928,i,2092904035175164669,5293416632682270542,262144 --variations-seed-version --mojo-platform-channel-handle=2144 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2352,i,15376881691983961977,13166420415332045533,524288 --field-trial-handle=1928,i,2092904035175164669,5293416632682270542,262144 --variations-seed-version --mojo-platform-channel-handle=2376 /prefetch:13
  2⤵
  PID:4204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3292,i,613582731199474745,733066585441270517,2097152 --field-trial-handle=1928,i,2092904035175164669,5293416632682270542,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:4880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3380,i,13115298783025983675,10128786318377105372,2097152 --field-trial-handle=1928,i,2092904035175164669,5293416632682270542,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:6000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4628,i,2694266127259170823,4748023021148441605,2097152 --field-trial-handle=1928,i,2092904035175164669,5293416632682270542,262144 --variations-seed-version --mojo-platform-channel-handle=4648 /prefetch:1
  2⤵
  PID:2900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4844,i,13397492292748958864,2946079717698867988,524288 --field-trial-handle=1928,i,2092904035175164669,5293416632682270542,262144 --variations-seed-version --mojo-platform-channel-handle=4856 /prefetch:14
  2⤵
  PID:2256
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4848,i,14881265556764768871,3371319854313658944,524288 --field-trial-handle=1928,i,2092904035175164669,5293416632682270542,262144 --variations-seed-version --mojo-platform-channel-handle=4944 /prefetch:14
  2⤵
  PID:2324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5104,i,603559906895028176,2842655923813069181,524288 --field-trial-handle=1928,i,2092904035175164669,5293416632682270542,262144 --variations-seed-version --mojo-platform-channel-handle=4988 /prefetch:14
  2⤵
  PID:2648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5416,i,9944653377045183736,8634590062513775637,524288 --field-trial-handle=1928,i,2092904035175164669,5293416632682270542,262144 --variations-seed-version --mojo-platform-channel-handle=5428 /prefetch:14
  2⤵
  PID:2772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5536,i,13430890639253387842,12360830558970877543,2097152 --field-trial-handle=1928,i,2092904035175164669,5293416632682270542,262144 --variations-seed-version --mojo-platform-channel-handle=5572 /prefetch:1
  2⤵
  PID:3456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5468,i,4130254402256324292,5577430441889326703,2097152 --field-trial-handle=1928,i,2092904035175164669,5293416632682270542,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:1
  2⤵
  PID:5860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5520,i,11621152305002811431,3102945634783241071,2097152 --field-trial-handle=1928,i,2092904035175164669,5293416632682270542,262144 --variations-seed-version --mojo-platform-channel-handle=5856 /prefetch:1
  2⤵
  PID:4016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5952,i,15917936587377177402,1002947003910444204,2097152 --field-trial-handle=1928,i,2092904035175164669,5293416632682270542,262144 --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:1
  2⤵
  PID:3556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6132,i,16234048794568513073,2879955147636646888,2097152 --field-trial-handle=1928,i,2092904035175164669,5293416632682270542,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:1
  2⤵
  PID:1456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6232,i,8061807243571766685,1228988556885669053,2097152 --field-trial-handle=1928,i,2092904035175164669,5293416632682270542,262144 --variations-seed-version --mojo-platform-channel-handle=5952 /prefetch:1
  2⤵
  PID:3808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6400,i,14975808355717283176,10146127908605496961,524288 --field-trial-handle=1928,i,2092904035175164669,5293416632682270542,262144 --variations-seed-version --mojo-platform-channel-handle=6368 /prefetch:14
  2⤵
  PID:5544
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6216,i,9338800548029327295,13953470147546290306,2097152 --field-trial-handle=1928,i,2092904035175164669,5293416632682270542,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:1
  2⤵
  PID:4156
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6692,i,1628863993227172855,9002779978112695996,2097152 --field-trial-handle=1928,i,2092904035175164669,5293416632682270542,262144 --variations-seed-version --mojo-platform-channel-handle=6232 /prefetch:1
  2⤵
  PID:2644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4596,i,15730726575529227044,5988107608766913634,524288 --field-trial-handle=1928,i,2092904035175164669,5293416632682270542,262144 --variations-seed-version --mojo-platform-channel-handle=5612 /prefetch:14
  2⤵
  PID:2412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5764,i,14879688878307702019,18427773308125319079,524288 --field-trial-handle=1928,i,2092904035175164669,5293416632682270542,262144 --variations-seed-version --mojo-platform-channel-handle=5724 /prefetch:14
  2⤵
  PID:2560
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=5840,i,9427586260256313338,8271316174571587120,2097152 --field-trial-handle=1928,i,2092904035175164669,5293416632682270542,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:9
  2⤵
  PID:2260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=6304,i,6909911361160554681,4670491284833386115,2097152 --field-trial-handle=1928,i,2092904035175164669,5293416632682270542,262144 --variations-seed-version --mojo-platform-channel-handle=6184 /prefetch:1
  2⤵
  PID:2084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=5776,i,12129240051912486340,10682816234764190400,2097152 --field-trial-handle=1928,i,2092904035175164669,5293416632682270542,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:1
  2⤵
  PID:4200
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4808,i,2107482814400998626,12020065420489814564,524288 --field-trial-handle=1928,i,2092904035175164669,5293416632682270542,262144 --variations-seed-version --mojo-platform-channel-handle=3212 /prefetch:14
  2⤵
  PID:4332
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3484,i,11382075162486904897,2444116498457113118,524288 --field-trial-handle=1928,i,2092904035175164669,5293416632682270542,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:14
  2⤵
  PID:1948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3480,i,2382008364619538656,15489898218247206179,524288 --field-trial-handle=1928,i,2092904035175164669,5293416632682270542,262144 --variations-seed-version --mojo-platform-channel-handle=3740 /prefetch:14
  2⤵
  PID:2140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=3740,i,17753945197107970337,7250292316676616289,2097152 --field-trial-handle=1928,i,2092904035175164669,5293416632682270542,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
  2⤵
  PID:3652
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --metrics-shmem-handle=4728,i,16612844674115039216,1499719716771847570,2097152 --field-trial-handle=1928,i,2092904035175164669,5293416632682270542,262144 --variations-seed-version --mojo-platform-channel-handle=4756 /prefetch:1
  2⤵
  PID:2148
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=6528,i,15947148002980305314,16095539868164360511,524288 --field-trial-handle=1928,i,2092904035175164669,5293416632682270542,262144 --variations-seed-version --mojo-platform-channel-handle=6776 /prefetch:12
  2⤵
  PID:2328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --metrics-shmem-handle=6140,i,7571996167846726547,1319794712930706061,2097152 --field-trial-handle=1928,i,2092904035175164669,5293416632682270542,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:1
  2⤵
  PID:5596
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --metrics-shmem-handle=6284,i,14480437814185964962,10410638078941182826,2097152 --field-trial-handle=1928,i,2092904035175164669,5293416632682270542,262144 --variations-seed-version --mojo-platform-channel-handle=6748 /prefetch:1
  2⤵
  PID:928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=604,i,3247957108515180131,6794294116192366488,262144 --field-trial-handle=1928,i,2092904035175164669,5293416632682270542,262144 --variations-seed-version --mojo-platform-channel-handle=6852 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --metrics-shmem-handle=4108,i,1206036230264707089,13070536519508492973,2097152 --field-trial-handle=1928,i,2092904035175164669,5293416632682270542,262144 --variations-seed-version --mojo-platform-channel-handle=3196 /prefetch:1
  2⤵
  PID:1600
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=4432,i,17433490920735300065,12114957692583402430,524288 --field-trial-handle=1928,i,2092904035175164669,5293416632682270542,262144 --variations-seed-version --mojo-platform-channel-handle=4708 /prefetch:14
  2⤵
  PID:3528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --metrics-shmem-handle=4696,i,4797895661851942328,6127731343037326607,2097152 --field-trial-handle=1928,i,2092904035175164669,5293416632682270542,262144 --variations-seed-version --mojo-platform-channel-handle=5700 /prefetch:1
  2⤵
  PID:4404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --metrics-shmem-handle=6164,i,679444743072239609,13814800240497099844,2097152 --field-trial-handle=1928,i,2092904035175164669,5293416632682270542,262144 --variations-seed-version --mojo-platform-channel-handle=5848 /prefetch:1
  2⤵
  PID:4332

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3800

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2764

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:3412

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1824

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
PID:3012
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Enumerates connected drives
  - Checks SCSI registry key(s)
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:4248

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2324

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2060

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000018

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000018
Size 22KB
SHA256 02cc0273b8a41f11795488b2fccdb575605aed8f8b4a28b4a515177c6d9914be
MD5 024e58b8c655d916866e137c5d279268
SHA1 103b54aca11b8b4816f4faff4c26dbd6a1da1088
SHA512 9c523b0b697bf330fbea4818a42ae1fd5425cb2ca07d1a4d23989be4e02cdcd0100fcb7c3a074cb93903366341e07de7785ec2ff08b2597d974c2aaad3498cc6
SSDEEP 384:4to2iafLIdaUmRdTyGIA+SMuyXUgKZ0X0X+MqlzwI6I0U1aR2ijpxdOakuWgPJtg:4i2iakgzRdTyjAR2AvXe2I50UK2iVHLE
TLSH
T17FA2DF09ADC351AF5A558DDAE42FAB2CCC0C626A50B158AFF9FE34FEA04048297095E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00001d

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001d
Size 1024KB
SHA256 72331f9fc51f6128dcd7988a0ecfdc39847f8e3c20c8bbafafd05d5bf10ff65c
MD5 54d1a17a6bad1429f47b0498cd38b0d0
SHA1 2df031cd0ee8ca77e8392d558bd9e2d550164f9b
SHA512 d5b2ff928f6dcd9ac7826b027ef77c498d7c2988a2188644413c92f152083888ce87dd7a87e62f0b7bddf4bfdfdc8ddcc41323185aef37f2ccc206c457d28a82
SSDEEP 24576:KynEbdlL7l0/CKM+lT4q11Wf8oe7zpvMEZ04E:KCEbfGMYTv1WfFe7zpx6
TLSH
T19825339D328C7E0EC571E1FE8A4D0F8E65A4B282BA1577F3E8D09D0A5F183397C15968
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00001e

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001e
Size 182KB
SHA256 21dede176fc5dbcf6c87606c8d29f09c4eba7b12a7eb484a623069bbe35757f7
MD5 c5395e04dc01137d4777f6992d0ed1a6
SHA1 9038c72c65f2e71e202aed8c1aeaba4a862bd511
SHA512 1a56afaf38cd6c61538b304e84f46c8fe3ee59f73ab576037cb05b5213e094d36f262a2e8a908c8a5c25d33f748f6a7e8a45946d383e728975fd079d8865f742
SSDEEP 3072:+uoLmYOuydK49toN90wkZCzKCEpzIGYhWnECwgOJB23txcQnkuKeb8GRrayUicWh:ToMD9aN90w9KCWI9m53sUkuKeb8GRVUu
TLSH
T1B2041261B3168712EA144B7295E84F15B379EDFAB75B93CF4282263CDC823C41E578E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000029

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000029
Size 20KB
SHA256 a3a9443c9af9168d3822fd966e5824812c39787a8830fa0181df3e7ef97c18c0
MD5 32dbd7105e338e4e845014b07645bfa7
SHA1 976ff905b33a2e42b122a56d580a91b413ef999c
SHA512 f2669c917b4cb110f4cb2a4b8a48e007f0e5a45774696359756988ed80c7107a1618d82b0173857751c32c16641fe4cb2a95ea54f4a4b2ed7264fe457043e4eb
SSDEEP 384:g/x/IvvKoR4A9/auEk8VnbL1xCgWTrmTig8oP4LUdi8bZJyRL7ZIRIGi4BogIj:gZWrR4A9ykevDCgW0ig8oP40hbZJyRyQ
TLSH
T17492D19CA84F372346CF6D2D3A83A63D46121E002781D69E31FD1CB4E62A8717D75EC2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00002b

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00002b
Size 19KB
SHA256 4b3714a0e64153b98414c134c0718ef2625bb38efc4c94b5d71feec3bdb37204
MD5 c1d89a1d9982a0a82168d8ef92f4c6de
SHA1 8e657d238b9b7a81ddc7cf0956d304976b26c3ce
SHA512 590127ef4606ff917d2b39d0463f56921c7b73b6f878e74d31cd835376bcce4b827fe061f6861650352679d6815b4169d1793468121cd10e274791cff41ee1c4
SSDEEP 384:H5qTq9bwCGj4o0vo9+OOoQgVIb4bUEtVVQhBkDzUqcsTkVjYYMS8:QAGEniUoQrb5UVKhB4UUIBCS8
TLSH
T19B92D0CE81FCCE0E1246E0B7075CFC6DA08678DA51E9A585C524F0BA7E71233B9606C3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00002c

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00002c
Size 24KB
SHA256 350b0c1f01df367b346a8ac391fedb2fe60a7141a87d2e61cb8fee1d1a29e99c
MD5 2618295a89c093046a0231fb708dbc8a
SHA1 f8ec6fb44d97e5aa8a93a9002095e05cd494b076
SHA512 fd173cc2f103f0963ce60ab03a7b86ffae0a3497f8d9d1c424a62684c62f2577f18c07560da9bf9ebfcd35d6bcaac616f0eb4e40f33ae84f5ec9614fe5cf3ccd
SSDEEP 768:KVXLpflUtJ22xFUR2G1GtddSystHuSesGu/h5l0IPRU:6gJ22xF+AtdkTtMsL/hvU
TLSH
T183B2E174867B8E35E16B8AB55B8203549978BC0B9665A039B31860C0F0CD57EE5EE13F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000030

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000030
Size 170KB
SHA256 0dc774d95bcf4ad57333ced33a10e0f135fd4ef71273525b2e4a0a31c1b379ca
MD5 4926bf69012f1b182bc4481bfffb7deb
SHA1 afd039fba7d433cbd97035315015b208df9cbd61
SHA512 a50c3a98723c1721f2a410032c20c6e31dbd61454cd730c0dfe347b94e306c06bb158c706962852eee4efabf2e4ecbd3c486942853fac59761325e823ddf79db
SSDEEP 3072:RXMlcbFtIBYxlrfNpt4dJMEwMGmJlE5Sy9lS7LtyMpqQ9bV47/4Dw+zKcdNvwxk:qCbMsF85wMGslE5Sy9lS7ZyMsQmO/Kcj
TLSH
T104041261D76C6585C67A723925C00B507735CDB1AAA30B8FFFF4A228B8913E06C669CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000031

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000031
Size 318KB
SHA256 8205c39410764430e681be4a3817f872c54a2f441be7ebf48cdc59c3afb2a72a
MD5 03267cf820912f182759ec2b87ea91b7
SHA1 1f7e22f64654f6f85355230faf9ff87b095b4d19
SHA512 3c6e5ead0697b18d8575234d5875af2a1a3c35523b24ad6391ba666ab3661cd041916b5eceb1fc961564a0ec9f180f87a557d5afbd1cf6fcaffe1b97bf3b1566
SSDEEP 6144:45Ttp63l1jcIBbQw3FKeZKzlDiwT6tby+AICjYfYe7s0u1AGw:ixWjX1Ktzcd+5sAe70Vw
TLSH
T1D4641225977D0DD4F432197913C812E370B4E6A8CA569F6BB7A482B3FDE33D41C6A188
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 8a03cc932e16c09978b55fc9627d5f6e40a794c04cf1ef61b244332c7ce49fcf
MD5 52350259b37358448565f8f2061567d8
SHA1 24b51fa298d30b77096bcc803225406fb9ee5dee
SHA512 4f87e74a8d564d80ed7c39d3371315aefcf6aad617aed8e8680d414f04dbbdee19889da1f5c3762cb7822974223d1ae6b6cd5f7a491e2b7d5cedd7e8d4f72cb9
TLSH
T1D931C75A1A4312E3EF6854FB8CCB0A40BA32D818101F1B17B90C8039F8937A8E2C08CD
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 609d1d83cdbcc95c4b2825821c2b1b505da69bd17c4e6fdafb9396a846cb7840
MD5 87fca8372ef4d707557e586b0ba5dfcf
SHA1 36f001f5aef473cff95a15d28a9f3b0ca4f948e7
SHA512 d7628dfb813e7911c20a6757e7cd563246aa73761c18113043c86255ab8ef9be838d2d54c3ac9de076a957b2754606fb69a76223eeb162dfc8c4927ec398e7b2
TLSH
T13931D95A1A4312F3FF6414F35CFA4A91BA31E809001F0A6BE15DC139D8A33B4A7C108F
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 16KB
SHA256 2f4367781ad086483b7251b9832ab2c8289d84839494e96e469414477dc52893
MD5 824412b4f693516c0998c631ea98e7b7
SHA1 e3be48837188bf8a7825e0cc64b4466789446080
SHA512 1633b25b620fdb6f9cd6fbdfc15f4761cce8f991de8e3898663f2f64c5ec3460ee84b2f873cd2612531c45432df9b27b46fe94d39ad68a7ff5add7a4033c2301
SSDEEP 384:D8zV+OyVJMJrfc1atkmlN3H44gKJJCAYyOCKasBfUAN5+Z1y15MXt0ivbCyofeQY:lq5+NJ/uR
TLSH
T107727BB7C7E8C56DC81155F8DB15AE1BCE290B28426C3C2AC8D4BF5BA7E3871E11164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 14KB
SHA256 a5cfb4b97f78c371c6353e08c396ed6833e53d40b4d66e695b12145367ca0a58
MD5 44068435d6ce46943b0139f602a1647c
SHA1 dc5cd06a6b83adc7aba7bca3586b181fe55373b1
SHA512 31dffb8675b7352076b560696262b8d0cffb57f090b715a023635cda9dba673237ddc4ea025ef76c121d3e938649cd2aac5285fa1d21cebab990ec1ac3f2c3b2
SSDEEP 384:DhumOitJJ5Jec1E7f2sXN3H4WFgKJEdAYSZCKasSfqNNqZ1y15MXt0imhohQXBmM:bDf9AvNIM
TLSH
T1FE6266B787E4D52DC81195F4EA15EE1FCE290728426C3C3AC9D4BE1BA7E3872E11164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 14KB
SHA256 60a0b73ba90b71516352be8ba7261a05170eb997f3f339f8f51c9afe77141b11
MD5 16a39ca5a211733e1245127559242729
SHA1 efc8a24100f22eacd9429e1ae760ee0a69468dd6
SHA512 175bd216f1d275b5109a65551c709f2db9fa90f5a6c19842c491ab4427a72267f1f9ec7b4640110fd5316bd53fdb6cf87212321904d2ff28b7dbd59f8e45eea0
SSDEEP 384:DhumOitJJ5Jec1E7f2sXZ5rcWFgKJEdAYSZCKasSfqNNqZ1y15Mje0imsohQXBmP:bDZ9AceIP
TLSH
T1565266B787E4D52DC91199F4DA15EE1FCE280728426C3C3AC9D4BE1BA7E3872E11164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 14KB
SHA256 f503589fffc603b77139deaf9d94e41c35f0036831490c11b17ce776c3689ddb
MD5 5346b86ce3d7cf9efc0ea8ca7d76380f
SHA1 171b03f13861ac169b75ee87fedb14fff39b0cfd
SHA512 0aeae1c1595b28d73232e3514ee1639aa6259a94816779d23dbdb707a27c1f5293b75f598ac8c0654249d80f130238517fb6a92297eb5fd6391d6f38b41cc26e
SSDEEP 384:D8zV+OyVJMJrfc1atkmlNhgKJJCLMYyOCKasBfUANqxX/YOUpLebVjqCZ1yGM71F:lqj+NHT1D
TLSH
T166527DB7C7E8D52DC81155F8E715AE1BCE290B28426C3C2AC8D4BF5BA7E3871E11164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 30ac2a7e5dbcbc94d22ed1e5abbee68571a4f8bfe2820faf4ae650dd6e21db58
MD5 c4432dc28acbf441c434ce03f259feb3
SHA1 7b0414c85ea937bcc4f91ffa7970e211c8aa51a6
SHA512 86dcef7e73b84a5b887b84c66bad805bf14a191ab37217796fcb075ee76cfe68a791ea163d0111e9f903c20aa808fbbfe431336903135c4187390d5ee1256f01
SSDEEP 192:cRbfb4YLVv7gAPRp2X964Hsb+WNnTYWsGdVyIsnAUge:cRbDTlVXUbwsWDre
TLSH
T19722843EB965657B6DCBC319F9217A93E7F5102221A03E84E7F89A2C15E7ACC3217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 50cf5a798b3209e2f5286c1f6e9f940e0b687f8299636b80b7a9fa99f2dcd0ff
MD5 32394509ccf5e75caffa2e9da7fda57b
SHA1 480e67f78d739d3f5727b5179d738e685ab6b57c
SHA512 858483c5a776f07345950347f5328e86be087929d6979b352ac39f240f5a7d0d20a429f2970d778a87740f9fb8966f83d0b3f3de1abe93753a8bbdadd2e5a129
SSDEEP 192:cRHcBzfb4YLLv7gRPRp15rM0O7964Hsb+WN7bQf8TYfF6g7o2uqdVyIsnAUgE:cRHmzDTzqXObwMgj2HrE
TLSH
T16E42A52FB9255A7B6DD6C219F921BB96E3F5102225E03E84E7FC8A1C15E7ACD3203417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 8889ac878c6bad7577152446808c8f1a6c5fa9a989f909601592111fa8f59605
MD5 8fa40f20daee97c60ed22579017f9ac5
SHA1 9f293dea75af488cef806001252becf1934ba1d0
SHA512 b677242ea17916a4b0b42f3094e5ce7b400913e3e61fb938cdef01d7ffb7bf55e76bdd5d6afe9bfa0b40114b1dc9592695ecb59efcd036aa329e2cf3fa9646b9
SSDEEP 192:cRHcBzfb4YLbv7gAPRp2+M0O7964Hsb+WNY8TYe7o2nQdVyIsnAUgE:cRHmzDTjVXGbwOh2QrE
TLSH
T19632B62FB9256A7B6DC7C219F9217B97E7F5102221903E84E7F88A2C11E7ACD3213413
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 74447383b00856c85dc3396d99fee1471c69fa78e29705362cee54891c08e079
MD5 bd80265fb1d16bf13318a8d2b7d0eadf
SHA1 f685891356909bf10a8d86aa63a579a4a609e3f6
SHA512 5c7ff6c2bc66e14afd0879c79c51ae1232e0887c64a8e2ade71be6e6ed5723a90ab805c386fa16e58880cca8dbd88a76abe72c98dcfb0ff57c98a4d47554fd27
SSDEEP 192:cRHcBzfb4YLfv7gRPRp15rM0O7964Hsb+WN7bQf8TYfF6g7o2uqdVyIsnAUgE:cRHmzDT3qXObwMgj2HrE
TLSH
T13842A52FB9255A7B6DD6C219F921BB96E3F5102225E03E84E7FC8A1C15E7ACD3203417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 d599925ae473434c7863aafb69dd9314441280fb1148d033cac23fecfa11bbf5
MD5 3fa46b837ca079ce16b275d233075a6d
SHA1 d9e93d30b8c616581404b1c462410c6204c4e841
SHA512 1766db86233f30c7f9d903cfba04eabf403ef8ebdb1be160065d1ae4a820ed5af49bf26ce4476e4475bd01f390544cbed5fe85839a98304903eee675b7d0b5e9
SSDEEP 192:cRHcBzfbVYLpv7gRPRp15rE0OI964Hsb+WN7bQf8TYfZNE7o2SqdVyIsnAUgE:cRHmzD0pqX1bwMrP2rrE
TLSH
T1BC42A62FB9255A7BADD6C219F911BB96E3F5202225E03E84E7FC8A1C14E7ACD3107413
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 7c0c48a6454be137a018bea6ee7d5ce7df09cfbfca6f77d8db88194d0813249b
MD5 f3e8228ea260b19bcd4692936b3484c8
SHA1 df11bdada9016030f60287e01cea9134c41f7222
SHA512 4cb73ba86101ab05e767cafcaa03c6dc90284d3984d472623a7448c1b0d0c533e801cdbb96004bbfec1f0e20052b3ef7b2ac132683374deaea3c7036317e7167
SSDEEP 192:cRHcBzfb4YLRv7gAPRp25rM0O7964Hsb+WN7bQf8TYfF6g7o2RQdVyIsnAUgE:cRHmzDTBVX5bwMgj2urE
TLSH
T19B42B52FB9256A7B6DD6C219F921BB97E3F5102225D03E84E7F88A1C15E7ACD3213413
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 b4b33057da0343cfdcbf12a44571afd29bdfe9945d2d91485d45d657073b92c0
MD5 4366fd639eee17bc26110f66bfd4bf29
SHA1 8b986e55fcda1cce024ee7f691fb059297f6f0ad
SHA512 d70bcc6f64bf26e0414a611c0cd8b203398db2e9eb9acda80e7398fc79b27b6dcdff3113acde1a9b0d653dd45176aabaeb186d9bff4117a606bbe59d5ede7378
SSDEEP 192:cRHcBzfbVYLev7gRPRp15rM0O7964Hsb+WN7bQf8TYfF6g7o2uqdVyIsnAUgE:cRHmzD0aqXObwMgj2HrE
TLSH
T14E42A52FB9255A7B6DD6C219F921BB96E3F5102225E03E84E7FC8A1C15E7ACD3213413
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 14823d1b9acaad3a2166286c063e41611321df5e13d68c92325bf0b5f6e9e960
MD5 21e841a0f13aed573573c739e57d85cf
SHA1 b689081002b3ce9acb8306425906de1a9903e102
SHA512 a83dbd4a98b607771f749f4f437b68011c0e04bc7168f4c577f284d5771a1a54dc1d345966a1037279a4dfd56ef15dcfefa08e05fe817e87f6debbb801c4c640
SSDEEP 384:lzjxQ7KxkXqKf/pUZNCgVLH2HfgslzSXODxQ+ErU3XKJHGj7RqxU:l/xQ7KxkXqKf/pUZNCgVLH2HfgsNAON/
TLSH
T177520867648D9A3F0FC8DA8CD8237F4FADF501576668092496FB9C0803E5BCA114A2F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 7e914f47be84709b4a726c3078655f1ae84005c52c07a0b3859663c367628916
MD5 406537c4aefbeaa5abc57c56ef1fcf49
SHA1 04f07f4374d99ffe0aa33224749b7b8f51f01872
SHA512 4aaa36cc45f0409b621019cfc41b9d47c6c0a21a98d2f8f4492153b6bab2ead330f5a5523c5b5b3eb8379a3dbb1eec4b3e749c64cec9d24352a14d908c60ed5b
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 d886f1b71c7ab64a91322f27e2d6e8582683f1c8a1199208634187aabc42b657
MD5 df58b70cb355ce5d3379fafe7df91cf9
SHA1 cf90505305209d0fe902444d155a8e54c1ddeee3
SHA512 4ef9fa1999686933a1165e965c8669f2e638365052ca1bd4f3d34e81325f1ea7487f315646fa05791917ae12b849f6bc8ea212e97d9f71d649501dff90179213
TLSH
T169A0021841DA1916CD304AB464F645C52265D81529A14B175996045C8D6B1F04103100
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 122KB
SHA256 c0bb0c91740a6a62fedeff59ef996d8d36241104b731e8d4025d2972c2f27120
MD5 8e5e22f724e8fe2c11282bc1da1fff17
SHA1 a0851437de0ad4c52a8327785ba0eccb909d2576
SHA512 2934a83686d41292b7457c7e264329bc830cfec232550251bb9a8366ea3b1ce371ce0cb101024c1b45bfe6520211861140665301ec4c149d01bef490972cb058
SSDEEP 3072:pnMU6FRinYKkQrFTgTSAou8VOYLzkxY9REViGsm0kjLt4CkJ:pneRinYKkQTo+OYUxY9R+in1qLt4CE
TLSH
T1DAC3123A686B2D268A7742953103BE820CFC963744E589B8E32D7BCF4607F5634D69D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 121KB
SHA256 fb7f21e1ab8e87557474d9ce6b205839f9bd80ff4899489fafb86a47530ccb4c
MD5 fbd1472bd90656acec27930a267edccc
SHA1 f318cf0227381cd85b96fd15857c705aebbcdca5
SHA512 7e8fafa158c4bc701767a0ac88e213e8d3ffcabf333ce364c1d04f354a8becccf968ea857c2c3f8354d1ca54a85f48ec22fceedc16c6284aa3fae48eaa1ec4d2
SSDEEP 3072:enMU6FRinYKkQrFTgTSAou8VOYLzkxY9REViGsm0kjLt4CkJ:eneRinYKkQTo+OYUxY9R+in1qLt4CE
TLSH
T11BC31239A87B2D36C6BB82693247B98204FC563340E589B4D32D6BCF4A13F5635D56C3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 122KB
SHA256 8abf60e82e581a2d195de4e2883673d03bb9d2a6c36ca1b580e97b8955016d82
MD5 e39e0b33192b19ec5692c5d38735f0a6
SHA1 3b4cfdd95a7627a7add77be0ae5b0fb9a079b546
SHA512 25b7ba88c38095eec97f88f61a2867865dd59d4ed64330c9e29bd60ddcd50ff08452a3d4413604232c30b28c21eded6c56c2e610e1d088f62c60166fc68fa0f4
SSDEEP 3072:SnMU6FRinYKkQrFTgTSAou8VOYLzkxY9REViGsm0kjLt4CkJ:SneRinYKkQTo+OYUxY9R+in1qLt4CE
TLSH
T100C3123A686B2D268A7742953103BE820CFC963744E589B8E32D7BCF4607F5634D69D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 122KB
SHA256 0aded4583805c1b7cb82749cacb945b60f6f14864e5319eeb8e8c944522f27b2
MD5 aa2d192b28ecd31b83e7235871004297
SHA1 aebc4c008834815848674cb54cc509fca57a5d3a
SHA512 f609fe099f4c14dae4ef872fe9a316a8e2fc2c213bdf8db80d3ff1c313a5c4cf4f90f5c1a475e1075c1f27eb90064b7022cc3807b54e29d843344d3723ad472a
SSDEEP 3072:unMU6FRinYKkQrFTgTSAou8VOYLzkxY9REViGsm0kjLt4CkJ:uneRinYKkQTo+OYUxY9R+in1qLt4CE
TLSH
T127C3123A686B2D268A7742993103BE820CFC963744E54978E32D7BCF0607F5634D69D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 122KB
SHA256 5bec5b27cd99ad8298405e3cfbf095cfa8159a90e1188afca35e78c28ab2264a
MD5 5ecd4398fcdd8b68c2187bef66e647d9
SHA1 d86296627eea9b465160bba303598899cb79acc2
SHA512 9661efad06e74fdcb97139dbc16d93e444c9bf532e44b73a6fa3c33b625830a1a000b38f73f0d99f9a2f1af4201b81345448f41a96e7ce31229d3a989c38d1ef
SSDEEP 3072:dnMU6FRinYKkQrFTgTSAou8VOYLzkxY9REViGsm0kjLt4CkJ:dneRinYKkQTo+OYUxY9R+in1qLt4CE
TLSH
T1B6C3123A686B2D268A7742993103BE820CFC963744E549B8E32D7BCF0607F5634D69D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 121KB
SHA256 a2bfa3b485351c2e499911265e38d0b9ca1a2120100f436c60ed7a59124fee84
MD5 9f722994131fc270547731fcc3116181
SHA1 83e72ecc62a118957aaf749180f0bf22827c1c37
SHA512 288b8dc6aa8cc938b9e6e124f3172c4185cb8ebea5a83cee3db954c40252ff9da3a9d049497215e8e8d0e33da9b8ca362ba51b97d0cc0e6fab57447d86baa0b3
SSDEEP 3072:0nMU6FRinYKkQrFTgTSAou8VOYLzkxY9REViGsm0kjLt4CkJ:0neRinYKkQTo+OYUxY9R+in1qLt4CE
TLSH
T1F4C31239A87B2D3686BB82693247B98204FC563340E589B4D32D6BCF4A13F5635D5AC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 bc268414e536d7e93b29a860c6f382dd077f64f4a1dd42f2e592729ed3834178
MD5 a7f992ff41447adccad92cb2da9bc298
SHA1 53c221dea9257fae2390bd039b6d7ca4d974c286
SHA512 9e0f887de033473be41e8a4a94cee7a4aca9e975df958117857409327f4fc63e8cb6fe0d4cc4f26d7226d08576162206daf753ed6ea551ad89c5290ac92a8034
SSDEEP 96:gC6yd+cAOIt5aDVmufj7jcbRDotok5xCDHB6/dGyv95Sehbb2Jv4a:gCrLA/TE57cDUDehUweSehbKl
TLSH
T1FEA1F77174B95EB35DB9C588F4827E83DF78A113A9226E84D8DD5F0C10E75EC1382927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 121KB
SHA256 384fd2ff13ca22021f8145227a67e073502f454ba992d4b273f12e19875c58f7
MD5 c99e09b93d51fb918a2c8037050def45
SHA1 333043d4d6211682b1cb47ce7e8f9238a39867d0
SHA512 da05423e9aba9a3048f4c084a9bc042692923ede697475d44ba9f0d8563007b361196b859fc3d9a03efba0297d8ea8b60e5d912e066d99976c48586de2cacb26
SSDEEP 3072:lnMU6FRinYKkQrFTgTSAou8VOYLzkxY9REViGsm0kjLt4CkJ:lneRinYKkQTo+OYUxY9R+in1qLt4CE
TLSH
T105C31239A87B2D36C6BB82693247B98204FC563340E589B4D32DABCF4A13F5635D56C3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 607B
SHA256 be6b74e52e5eef1f1c27c0976bf3bf1bfa99958c00bbef2898a602f691be6dae
MD5 76b78ed7ff6273215b134d6a6488035d
SHA1 9e7a11ffb68d027036302eccd4c22315054843a9
SHA512 9919504cd4d8c0757abff8da4bbad1c4b6532f81d290c736fc5624ef66de45e6a9e29a8290854ae554d5bdfc5291f1ea81ae62d1b25846bfbcf1515e2ec3e4f1
TLSH
T174F0DC53CBD6536BD527223CC8E207E1FA70E2719E81212386106F2D6CB77241E474B4
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6068_379102254\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2324-1029-0x000001BA801E0000-0x000001BA802E0000-memory.dmp

Download

memory/2324-1027-0x000001BA801E0000-0x000001BA802E0000-memory.dmp

Download

memory/2324-1048-0x000001C28D190000-0x000001C28D1B0000-memory.dmp

Download

memory/2324-1073-0x000001C29D710000-0x000001C29D730000-memory.dmp

Download

memory/2324-1036-0x000001C28D350000-0x000001C28D450000-memory.dmp

Download

memory/2324-1035-0x000001C28BE30000-0x000001C28BE50000-memory.dmp

Download

memory/2324-1028-0x000001BA801E0000-0x000001BA802E0000-memory.dmp

Download

memory/3412-471-0x000002499F980000-0x000002499FA12000-memory.dmp

Download