Overview

overview

8

Static

static

3

smartscreen.exe

windows10-2004-x64

smartscreen.exe

windows10-ltsc_2021-x64

3

smartscreen.exe

windows11-21h2-x64

3

smartscreen.exe

windows11-ltsc_2024-x64

8

Analysis

  • user interaction
    yes
  • max time kernel
    900s
  • max time network
    901s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    12/07/2026, 22:37

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    smartscreen.exe
  • Size 596KB
  • Sample260712-2j89hsbw21
  • SHA256 5eba5b6b1dbedcd7db79a7bcbb4a0abd58cb14c0538f12d7fd7b3722beed3d06
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwarediscoverypersistenceransomwarespyware

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Drops desktop.ini file(s) 7 IoCs
  • Enumerates connected drives 3 TTPs 48 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 2 IoCs
  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 13 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 12 IoCs
  • Modifies Internet Explorer settings 1 TTPs 5 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 9 IoCs
  • Modifies registry class 44 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Suspicious behavior: AddClipboardFormatListener 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 28 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 39 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\smartscreen.exe
    "C:\Users\Admin\AppData\Local\Temp\smartscreen.exe"
    1⤵
      PID:3472
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      1⤵
      • Enumerates system info in registry
      • Modifies data under HKEY_USERS
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:5000
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x9c,0x134,0x7ff8db5fc728,0x7ff8db5fc734,0x7ff8db5fc740
        2⤵
          PID:2900
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1712,i,9759063819079831982,17571701362175567922,262144 --field-trial-handle=1912,i,9811769683432700191,17545890752996042474,262144 --variations-seed-version --mojo-platform-channel-handle=1908 /prefetch:2
          2⤵
            PID:5468
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2100,i,14442802517415510220,6093003213328866563,524288 --field-trial-handle=1912,i,9811769683432700191,17545890752996042474,262144 --variations-seed-version --mojo-platform-channel-handle=2224 /prefetch:11
            2⤵
            • System Time Discovery
            PID:1424
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2312,i,3937080034572276700,2808091450060581325,524288 --field-trial-handle=1912,i,9811769683432700191,17545890752996042474,262144 --variations-seed-version --mojo-platform-channel-handle=2356 /prefetch:13
            2⤵
              PID:1932
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3284,i,13972420077034983198,10354111480751799308,2097152 --field-trial-handle=1912,i,9811769683432700191,17545890752996042474,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
              2⤵
                PID:4432
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3312,i,11118713927323693834,12382195041094092539,2097152 --field-trial-handle=1912,i,9811769683432700191,17545890752996042474,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
                2⤵
                  PID:1992
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4580,i,9266835379516707838,7345777889512927091,2097152 --field-trial-handle=1912,i,9811769683432700191,17545890752996042474,262144 --variations-seed-version --mojo-platform-channel-handle=4620 /prefetch:1
                  2⤵
                    PID:3728
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4904,i,15256226510488529114,5931751324523502648,524288 --field-trial-handle=1912,i,9811769683432700191,17545890752996042474,262144 --variations-seed-version --mojo-platform-channel-handle=4896 /prefetch:14
                    2⤵
                      PID:2256
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5376,i,9448537129393298101,15655633954678001105,524288 --field-trial-handle=1912,i,9811769683432700191,17545890752996042474,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:14
                      2⤵
                        PID:5456
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5476,i,12333978466985469353,1944294732234706327,2097152 --field-trial-handle=1912,i,9811769683432700191,17545890752996042474,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:1
                        2⤵
                          PID:1512
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5512,i,3539118069044551465,13629446464403187537,2097152 --field-trial-handle=1912,i,9811769683432700191,17545890752996042474,262144 --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:1
                          2⤵
                            PID:2520
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5832,i,12573097055962142800,3093077835346188370,2097152 --field-trial-handle=1912,i,9811769683432700191,17545890752996042474,262144 --variations-seed-version --mojo-platform-channel-handle=5788 /prefetch:1
                            2⤵
                              PID:4136
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5836,i,2342908157368607705,7316929297805692546,524288 --field-trial-handle=1912,i,9811769683432700191,17545890752996042474,262144 --variations-seed-version --mojo-platform-channel-handle=5580 /prefetch:14
                              2⤵
                                PID:2492
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5504,i,12364471841249399101,13598532594529645714,2097152 --field-trial-handle=1912,i,9811769683432700191,17545890752996042474,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:1
                                2⤵
                                  PID:4076
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5736,i,3267689081270345693,17634203714332879695,2097152 --field-trial-handle=1912,i,9811769683432700191,17545890752996042474,262144 --variations-seed-version --mojo-platform-channel-handle=5824 /prefetch:1
                                  2⤵
                                    PID:2696
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5820,i,7281969888686649414,8016376533268256687,524288 --field-trial-handle=1912,i,9811769683432700191,17545890752996042474,262144 --variations-seed-version --mojo-platform-channel-handle=6188 /prefetch:14
                                    2⤵
                                      PID:2436
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5788,i,18168529301530366881,5799444852312116009,2097152 --field-trial-handle=1912,i,9811769683432700191,17545890752996042474,262144 --variations-seed-version --mojo-platform-channel-handle=6180 /prefetch:1
                                      2⤵
                                        PID:4044
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6312,i,11434807469822717653,9719840276938978238,2097152 --field-trial-handle=1912,i,9811769683432700191,17545890752996042474,262144 --variations-seed-version --mojo-platform-channel-handle=5736 /prefetch:1
                                        2⤵
                                          PID:548
                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5380,i,7385631190339838114,12601235344454189673,524288 --field-trial-handle=1912,i,9811769683432700191,17545890752996042474,262144 --variations-seed-version --mojo-platform-channel-handle=5568 /prefetch:14
                                          2⤵
                                            PID:1248
                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6092,i,2046750204086306990,6283405441226162505,2097152 --field-trial-handle=1912,i,9811769683432700191,17545890752996042474,262144 --variations-seed-version --mojo-platform-channel-handle=6012 /prefetch:1
                                            2⤵
                                              PID:1100
                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=5588,i,7311801663026119181,13514344821653691126,2097152 --field-trial-handle=1912,i,9811769683432700191,17545890752996042474,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:1
                                              2⤵
                                                PID:5400
                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6164,i,8777084608587321538,14070702408415592913,2097152 --field-trial-handle=1912,i,9811769683432700191,17545890752996042474,262144 --variations-seed-version --mojo-platform-channel-handle=6268 /prefetch:9
                                                2⤵
                                                  PID:952
                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6224,i,189513395065023848,363823207915700690,524288 --field-trial-handle=1912,i,9811769683432700191,17545890752996042474,262144 --variations-seed-version --mojo-platform-channel-handle=5684 /prefetch:14
                                                  2⤵
                                                    PID:3712
                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6188,i,6996329087784067789,1703663256203702196,524288 --field-trial-handle=1912,i,9811769683432700191,17545890752996042474,262144 --variations-seed-version --mojo-platform-channel-handle=5488 /prefetch:14
                                                    2⤵
                                                      PID:2644
                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6300,i,14285955674725141850,12988737720281480488,524288 --field-trial-handle=1912,i,9811769683432700191,17545890752996042474,262144 --variations-seed-version --mojo-platform-channel-handle=5480 /prefetch:14
                                                      2⤵
                                                        PID:1112
                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5480,i,17789059037581772450,12145116770696121063,524288 --field-trial-handle=1912,i,9811769683432700191,17545890752996042474,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:14
                                                        2⤵
                                                          PID:688
                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6296,i,15914076072837800517,8553557630645563739,262144 --field-trial-handle=1912,i,9811769683432700191,17545890752996042474,262144 --variations-seed-version --mojo-platform-channel-handle=4940 /prefetch:10
                                                          2⤵
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          PID:2468
                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=3212,i,7322998889143780938,12329490410409895816,524288 --field-trial-handle=1912,i,9811769683432700191,17545890752996042474,262144 --variations-seed-version --mojo-platform-channel-handle=5512 /prefetch:12
                                                          2⤵
                                                            PID:768
                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=272,i,9308076372674537074,11793265248316038524,524288 --field-trial-handle=1912,i,9811769683432700191,17545890752996042474,262144 --variations-seed-version --mojo-platform-channel-handle=4556 /prefetch:14
                                                            2⤵
                                                              PID:4252
                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --metrics-shmem-handle=4472,i,12965041365348458707,13436058459138863423,2097152 --field-trial-handle=1912,i,9811769683432700191,17545890752996042474,262144 --variations-seed-version --mojo-platform-channel-handle=4644 /prefetch:1
                                                              2⤵
                                                                PID:5560
                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --metrics-shmem-handle=5604,i,17882996386344609754,1109050697911492474,2097152 --field-trial-handle=1912,i,9811769683432700191,17545890752996042474,262144 --variations-seed-version --mojo-platform-channel-handle=6180 /prefetch:1
                                                                2⤵
                                                                  PID:4356
                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --metrics-shmem-handle=5920,i,10357294696182863427,10681811982585370509,2097152 --field-trial-handle=1912,i,9811769683432700191,17545890752996042474,262144 --variations-seed-version --mojo-platform-channel-handle=6384 /prefetch:1
                                                                  2⤵
                                                                    PID:5976
                                                                • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                                                  "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                                                  1⤵
                                                                    PID:5952
                                                                  • C:\Windows\system32\svchost.exe
                                                                    C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                                                    1⤵
                                                                      PID:1308
                                                                    • C:\Windows\system32\svchost.exe
                                                                      C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
                                                                      1⤵
                                                                      • Modifies data under HKEY_USERS
                                                                      PID:3068
                                                                    • C:\Windows\system32\svchost.exe
                                                                      C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
                                                                      1⤵
                                                                        PID:2672
                                                                      • C:\Windows\system32\CredentialEnrollmentManager.exe
                                                                        C:\Windows\system32\CredentialEnrollmentManager.exe
                                                                        1⤵
                                                                          PID:2276
                                                                        • C:\Windows\system32\svchost.exe
                                                                          C:\Windows\system32\svchost.exe -k WbioSvcGroup -s WbioSrvc
                                                                          1⤵
                                                                          • Drops file in System32 directory
                                                                          • Checks processor information in registry
                                                                          PID:6072
                                                                        • C:\Windows\system32\NOTEPAD.EXE
                                                                          "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\123.txt
                                                                          1⤵
                                                                          • Modifies registry class
                                                                          • Opens file in notepad (likely ransom note)
                                                                          PID:5708
                                                                        • C:\Windows\system32\svchost.exe
                                                                          C:\Windows\system32\svchost.exe -k GPSvcGroup
                                                                          1⤵
                                                                            PID:4820
                                                                          • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
                                                                            "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Desktop\123.docx" /o ""
                                                                            1⤵
                                                                            • Checks processor information in registry
                                                                            • Enumerates system info in registry
                                                                            • Suspicious behavior: AddClipboardFormatListener
                                                                            • Suspicious use of SetWindowsHookEx
                                                                            PID:2148
                                                                          • C:\Windows\system32\sihost.exe
                                                                            sihost.exe
                                                                            1⤵
                                                                            • Suspicious use of FindShellTrayWindow
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:3244
                                                                            • C:\Windows\explorer.exe
                                                                              explorer.exe /LOADSAVEDWINDOWS
                                                                              2⤵
                                                                              • Boot or Logon Autostart Execution: Active Setup
                                                                              • Enumerates connected drives
                                                                              • Checks SCSI registry key(s)
                                                                              • Modifies Internet Explorer settings
                                                                              • Modifies registry class
                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                              • Suspicious behavior: GetForegroundWindowSpam
                                                                              • Suspicious use of FindShellTrayWindow
                                                                              • Suspicious use of SendNotifyMessage
                                                                              • Suspicious use of SetWindowsHookEx
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:5920
                                                                              • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
                                                                                "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\Desktop\123.xlsx"
                                                                                3⤵
                                                                                • Checks processor information in registry
                                                                                • Enumerates system info in registry
                                                                                • Suspicious behavior: AddClipboardFormatListener
                                                                                • Suspicious use of SetWindowsHookEx
                                                                                PID:5788
                                                                              • C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE
                                                                                "C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" "C:\Users\Admin\Desktop\123.pptx" /ou ""
                                                                                3⤵
                                                                                • Checks processor information in registry
                                                                                • Enumerates system info in registry
                                                                                • Suspicious behavior: AddClipboardFormatListener
                                                                                • Suspicious behavior: GetForegroundWindowSpam
                                                                                • Suspicious use of SetWindowsHookEx
                                                                                PID:2408
                                                                              • C:\Windows\system32\mspaint.exe
                                                                                "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Desktop\New Bitmap Image.bmp"
                                                                                3⤵
                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                • Suspicious use of SetWindowsHookEx
                                                                                PID:4968
                                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
                                                                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"
                                                                                3⤵
                                                                                • System Location Discovery: System Language Discovery
                                                                                • Checks processor information in registry
                                                                                • Modifies Internet Explorer settings
                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                • Suspicious use of SetWindowsHookEx
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:1812
                                                                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
                                                                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
                                                                                  4⤵
                                                                                  • System Location Discovery: System Language Discovery
                                                                                  PID:3012
                                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
                                                                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=65537AE761B056DA10B9762C7B914AC2 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=65537AE761B056DA10B9762C7B914AC2 --renderer-client-id=2 --mojo-platform-channel-handle=1788 --allow-no-sandbox-job /prefetch:1
                                                                                    5⤵
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    PID:3008
                                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
                                                                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=DF7E4130BC7CF52C106184032954B43C --mojo-platform-channel-handle=1780 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
                                                                                    5⤵
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    PID:5156
                                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
                                                                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=FE8CDBBF2FF7BB44FEFB4EB0F8147422 --mojo-platform-channel-handle=2384 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
                                                                                    5⤵
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    PID:1084
                                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
                                                                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=AC022273C88D34EAEF4D96672418C460 --mojo-platform-channel-handle=2132 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
                                                                                    5⤵
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    PID:3656
                                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
                                                                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=44FFA38332EB381CAAEE5C8B16172D59 --mojo-platform-channel-handle=2356 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
                                                                                    5⤵
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    PID:2828
                                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
                                                                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=EB180A96BCA4B73A0F5E800F022923F2 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=EB180A96BCA4B73A0F5E800F022923F2 --renderer-client-id=8 --mojo-platform-channel-handle=2412 --allow-no-sandbox-job /prefetch:1
                                                                                    5⤵
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    PID:1060
                                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
                                                                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=EB2C0FFE6BB6DB1FEEA682E46A9336BB --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=EB2C0FFE6BB6DB1FEEA682E46A9336BB --renderer-client-id=10 --mojo-platform-channel-handle=2600 --allow-no-sandbox-job /prefetch:1
                                                                                    5⤵
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    PID:4944
                                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                            1⤵
                                                                            • Modifies registry class
                                                                            • Suspicious use of SetWindowsHookEx
                                                                            PID:5216
                                                                          • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                                                                            "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                                                                            1⤵
                                                                            • Modifies registry class
                                                                            • Suspicious use of SetWindowsHookEx
                                                                            PID:1848
                                                                          • C:\Windows\System32\SecurityHealthHost.exe
                                                                            \\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
                                                                            1⤵
                                                                              PID:2632
                                                                            • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
                                                                              "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Play -Embedding
                                                                              1⤵
                                                                              • Drops desktop.ini file(s)
                                                                              • Enumerates connected drives
                                                                              • System Location Discovery: System Language Discovery
                                                                              • Modifies registry class
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:1284
                                                                              • C:\Windows\SysWOW64\unregmp2.exe
                                                                                "C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
                                                                                2⤵
                                                                                • System Location Discovery: System Language Discovery
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:4124
                                                                                • C:\Windows\system32\unregmp2.exe
                                                                                  "C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT
                                                                                  3⤵
                                                                                  • Enumerates connected drives
                                                                                  PID:5556
                                                                            • C:\Windows\system32\svchost.exe
                                                                              C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost
                                                                              1⤵
                                                                              • Drops file in Windows directory
                                                                              PID:2116
                                                                            • C:\Windows\system32\svchost.exe
                                                                              C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
                                                                              1⤵
                                                                              • Checks SCSI registry key(s)
                                                                              PID:1432

                                                                            Network

                                                                                  MITRE ATT&CK Enterprise v16

                                                                                  Replay Monitor

                                                                                  Loading Replay Monitor...

                                                                                  Downloads

                                                                                  ReaderMessages
                                                                                  • Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
                                                                                  • Size 36KB
                                                                                  • SHA256 b1b77e96279ead2b460de3de70e2ea4f5ad1b853598a4e27a5caf3f1a32cc4f3
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  ReaderMessages
                                                                                  • Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
                                                                                  • Size 56KB
                                                                                  • SHA256 111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  ReaderMessages
                                                                                  • Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
                                                                                  • Size 64KB
                                                                                  • SHA256 7d78241e9f51c43ac2fa34f18e743ccc2acba49026223d2c4f7dc678be7bfb2b
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  B76BE66D46C355931939D8CF818D03FD_68DC46933CF3DE41CC968E0784D43DC3
                                                                                  • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B76BE66D46C355931939D8CF818D03FD_68DC46933CF3DE41CC968E0784D43DC3
                                                                                  • Size 1KB
                                                                                  • SHA256 890d325f1b448d18be686f02347fabeb2ef27e8f647529f5c73c420c0d370b1b
                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                  Submit Download

                                                                                  B76BE66D46C355931939D8CF818D03FD_68DC46933CF3DE41CC968E0784D43DC3
                                                                                  • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B76BE66D46C355931939D8CF818D03FD_68DC46933CF3DE41CC968E0784D43DC3
                                                                                  • Size 422B
                                                                                  • SHA256 4207899d825ed5992650aaf20e3df5c8d7bf86ad8dd5d46f2b534a32e5ee94f9
                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                  Submit Download

                                                                                  BookmarkMergedSurfaceOrdering
                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
                                                                                  • Size 6B
                                                                                  • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                                                  • MD5 SHA1 SHA512
                                                                                  Submit Download

                                                                                  the-real-index
                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                  • Size 456B
                                                                                  • SHA256 14e4a71b38a4e09c4cc59adc8c7e78b78335a454483ab3ad86d41f1f465ead5a
                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                  Submit Download

                                                                                  messages.json
                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
                                                                                  • Size 593B
                                                                                  • SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                  Submit Download

                                                                                  craw_background.js
                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
                                                                                  • Size 531KB
                                                                                  • SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  CURRENT
                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
                                                                                  • Size 16B
                                                                                  • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                                                                  • MD5 SHA1 SHA512
                                                                                  Submit Download

                                                                                  Network Persistent State
                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                                  • Size 9KB
                                                                                  • SHA256 f4ee25c2260acd915150e3450d86484db54cb914b712a4d6ee8d5030fc7d603f
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  Network Persistent State
                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                                  • Size 9KB
                                                                                  • SHA256 707606404540edc48e615fad3fb65fbf0ada4a8d90c14b4f65fbb5503e24a44a
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  Network Persistent State
                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                                  • Size 4KB
                                                                                  • SHA256 f024b5bb3b822ea97ebfbaf64c38b90180a0a95abeb47a3c90404214dbe9434e
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  Network Persistent State
                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                                  • Size 2KB
                                                                                  • SHA256 9bf36e1c9f79ef35ea15de0d2b7bd76a9b5ea6b077aa16409643ca2bb55a7e4e
                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                  Submit Download

                                                                                  Network Persistent State
                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                                  • Size 5KB
                                                                                  • SHA256 62e222300e4f2cdaddd6c7ce09222930e499216d87902803316bbc9f6e8c8ab7
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  Network Persistent State
                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                                  • Size 5KB
                                                                                  • SHA256 6964694e2e58c1287ed1fe1a73a27712c3fe9da7a567ced92f1701e89b0b3d07
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  Network Persistent State
                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                                  • Size 5KB
                                                                                  • SHA256 e57d8ed9834263d7254db4719546c616889fec6e58476ea6024e5e917f1cffd2
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  Network Persistent State
                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                                  • Size 9KB
                                                                                  • SHA256 b07f20a2053fa1cfaf543bfc29090e642fd100c63e97f7ebef5c4af7ef21eb0c
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  SCT Auditing Pending Reports
                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
                                                                                  • Size 2B
                                                                                  • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                                  • MD5 SHA1 SHA512
                                                                                  Submit Download

                                                                                  TransportSecurity
                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                                                                  • Size 523B
                                                                                  • SHA256 b6f7ce3ff86d3afc40b0a714878511f8f04c7ce594d7a04c07f3cf8632dd89b4
                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                  Submit Download

                                                                                  Preferences
                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                  • Size 11KB
                                                                                  • SHA256 2601ebf020b57ad95dfa7f97809331234bea352b4986f5aea3a167534311d2e9
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  Preferences
                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                  • Size 10KB
                                                                                  • SHA256 caf0e9ad296d20eb609420391cf6ada844316d3fd67bd6b84cb775fc49c4555b
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  Preferences
                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                  • Size 11KB
                                                                                  • SHA256 7a779003d87d7198b3932265ac39d185b15383b27740b0842fc181540103ebd1
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  Preferences
                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                  • Size 12KB
                                                                                  • SHA256 23f84c0a9b34eef4b393faec0ccaae60e9e924b728a526ec336b10baed9d66eb
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  Preferences
                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                  • Size 12KB
                                                                                  • SHA256 944c4917fd05838bb0452db29ffc46fbf6596ef92fbedfbeb986ca3b8b4e7599
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  Preferences
                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                  • Size 11KB
                                                                                  • SHA256 1b7868d3639bb8e982a69ae1ccda32087fca963b287b34b16a8e4142c9c2e580
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  Preferences
                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                  • Size 11KB
                                                                                  • SHA256 09c6e70942c0085b623c3a7ea5109227424e9a121559307f4b8bf91315186f05
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  Preferences
                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                  • Size 11KB
                                                                                  • SHA256 42b2be9e3ec00a177dae0d48ce1161bac0b13cd1c16d2ca466e9752c45300a0c
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  Secure Preferences
                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
                                                                                  • Size 13KB
                                                                                  • SHA256 3f7608eef12e38cb267ab3d44491d4d2fbe0f349d8bb4510c8bdb1992d30b92d
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  the-real-index
                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
                                                                                  • Size 72B
                                                                                  • SHA256 d71b4da8f4fc0518954ba018b1380470d3d743a06f251c39b8a0421faf753745
                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                  Submit Download

                                                                                  the-real-index~RFe59dd85.TMP
                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index~RFe59dd85.TMP
                                                                                  • Size 48B
                                                                                  • SHA256 7ba22bb51831de8bbab01cf5ecc76b41d0b2d6d17fc7a5e9372a645a5d4f045c
                                                                                  • MD5 SHA1 SHA512
                                                                                  Submit Download

                                                                                  data_0
                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
                                                                                  • Size 8KB
                                                                                  • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                  Submit Download

                                                                                  data_1
                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
                                                                                  • Size 264KB
                                                                                  • SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                  Submit Download

                                                                                  data_2
                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
                                                                                  • Size 8KB
                                                                                  • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                  Submit Download

                                                                                  data_3
                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
                                                                                  • Size 8KB
                                                                                  • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
                                                                                  • MD5 SHA1 SHA512 SSDEEP
                                                                                  Submit Download

                                                                                  MANIFEST-000001
                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
                                                                                  • Size 41B
                                                                                  • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                                                                                  • MD5 SHA1 SHA512
                                                                                  Submit Download

                                                                                  Local State
                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                  • Size 121KB
                                                                                  • SHA256 fb041edd5d2ae6c79a3b4e1d58a1c0e02347e7824df2f38db3c6079d2cad92bb
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  Local State
                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                  • Size 121KB
                                                                                  • SHA256 3bc93b65697530a00f15ae08cb74cab6e05e8c427e451013da72734a7feea6c7
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  Local State
                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                  • Size 122KB
                                                                                  • SHA256 9cf0c2775f6017d89ceb3f7ef6cb39c326442fa5929f0a74416d5d8e5c41e045
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  Local State
                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                  • Size 4KB
                                                                                  • SHA256 4dcbb5e09acbbaef87c856bbffb8eccd1b46a56841ffcb42224f2a45f93a7baf
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  Local State
                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                  • Size 122KB
                                                                                  • SHA256 7ccfed4b4898c10f23f722eb1ca06f2b1b7a97c937c6c4fb2e49d5efe56ce412
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  Local State
                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                  • Size 122KB
                                                                                  • SHA256 361a391ce8f627a705cc6bae695b3e5979466a54d70f4dbe8ad37f701f4e52f0
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  CurrentDatabase_400.wmdb
                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
                                                                                  • Size 896KB
                                                                                  • SHA256 37b028ed86b64a761371166c9cec901054ef91f8f09f9a3f6c81e4572304aaff
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  CurrentDatabase_400.wmdb
                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
                                                                                  • Size 1024KB
                                                                                  • SHA256 96b6a86454b0d058b913033623c18a3367d29fce68cb5d89c5720575a0453f02
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  LocalMLS_3.wmdb
                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\LocalMLS_3.wmdb
                                                                                  • Size 68KB
                                                                                  • SHA256 4256f642f5725ef2bd03fa9fa7075a25caff9968aa6e8731dc0543d99269b669
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  999C6683-862F-42FB-9382-BCD3455AAEF3
                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\999C6683-862F-42FB-9382-BCD3455AAEF3
                                                                                  • Size 188KB
                                                                                  • SHA256 38ef2ef0721de0556d44f80075e9ff8efbc96d0b0226e886a89b73da519ddaaf
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  powerpnt.exe_Rules.xml
                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules.xml
                                                                                  • Size 1.4MB
                                                                                  • SHA256 1545007eba02d98a9ef35c0a10ae808adfbcf6e00a88d6d6303f22dbf8e8d531
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  mip_sdk.miplog
                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Office\DLP\mip\logs\mip_sdk.miplog
                                                                                  • Size 17KB
                                                                                  • SHA256 abe85d71f51049d888d0f015bdfd973c3a748b721fd9d24f40fd43ab73fb2712
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  mip_sdk.miplog
                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Office\DLP\mip\logs\mip_sdk.miplog
                                                                                  • Size 14KB
                                                                                  • SHA256 662e6cf944656f20b2bf3fd8009dad279688bdb06f34d74e3ce55bfd3df899e3
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  WMSDKNS.XML.bak
                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML.bak
                                                                                  • Size 9KB
                                                                                  • SHA256 cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  prep_Activatable Class_Hermes_perf.cache
                                                                                  • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
                                                                                  • Size 599B
                                                                                  • SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                  Submit Download

                                                                                  messages.json
                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5000_437618889\CRX_INSTALL\_locales\en\messages.json
                                                                                  • Size 450B
                                                                                  • SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                  Submit Download

                                                                                  wmsetup.log
                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\wmsetup.log
                                                                                  • Size 1KB
                                                                                  • SHA256 7d4de4cbe0ec591e165e6c514258e994697d3aac38897f56c6fa44c761cfe674
                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                  Submit Download

                                                                                  123.docx.LNK
                                                                                  • Path C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\123.docx.LNK
                                                                                  • Size 488B
                                                                                  • SHA256 82410e95ba31f66c6fe0216d12027f05f5a99c6ea9a142158a021451e911cfb1
                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                  Submit Download

                                                                                  index.dat
                                                                                  • Path C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
                                                                                  • Size 328B
                                                                                  • SHA256 b301fd19d2f90694e513c59bf9ad86ee6140b6ad5606e699e6344d4066d0bd92
                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                  Submit Download

                                                                                  index.dat
                                                                                  • Path C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
                                                                                  • Size 315B
                                                                                  • SHA256 9106b04945ad0f3b2675298f731bfa400133ef6baeb72b6c429950e1224bf629
                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                  Submit Download

                                                                                  index.dat
                                                                                  • Path C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
                                                                                  • Size 320B
                                                                                  • SHA256 2eb2d9f38a6ae241d5df3fad34025f5718331e4baafe97a114235198a3ef2229
                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                  Submit Download

                                                                                  CUSTOM.DIC
                                                                                  • Path C:\Users\Admin\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC
                                                                                  • Size 16B
                                                                                  • SHA256 a91a702aab9b8dd722843d3d208a21bcfa6556dfc64e2ded63975de4511eb866
                                                                                  • MD5 SHA1 SHA512
                                                                                  Submit Download

                                                                                  ExcludeDictionaryEN0409.lex
                                                                                  • Path C:\Users\Admin\AppData\Roaming\Microsoft\UProof\ExcludeDictionaryEN0409.lex
                                                                                  • Size 2B
                                                                                  • SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
                                                                                  • MD5 SHA1 SHA512
                                                                                  Submit Download

                                                                                  123.docx
                                                                                  • Path C:\Users\Admin\Desktop\123.docx
                                                                                  • Size 11KB
                                                                                  • SHA256 259d7a5618122e3ad750b9386f1efdae899cee34dad04d1bfc9892506d8f7156
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  123.txt
                                                                                  • Path C:\Users\Admin\Desktop\123.txt
                                                                                  • Size 3B
                                                                                  • SHA256 a665a45920422f9d417e4867efdc4fb8a04a1f3fff1fa07e998e86f7f7a27ae3
                                                                                  • MD5 SHA1 SHA512
                                                                                  Submit Download

                                                                                  34B06E00
                                                                                  • Path C:\Users\Admin\Desktop\34B06E00
                                                                                  • Size 7KB
                                                                                  • SHA256 3ac81dde91c69ac57b5f03402fcbe923a673016f61e07cb4e856bde9eee9aa3d
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  New Bitmap Image.bmp
                                                                                  • Path C:\Users\Admin\Desktop\New Bitmap Image.bmp
                                                                                  • Size 2.1MB
                                                                                  • SHA256 210bacd5cc2fe27da852ec687423e28e4d9020a8b7dfa0a2de8240147cef6c5f
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  New Microsoft Excel Worksheet.xlsx
                                                                                  • Path C:\Users\Admin\Desktop\New Microsoft Excel Worksheet.xlsx
                                                                                  • Size 6KB
                                                                                  • SHA256 fcb6de162d5b21851cea2ceb7297b79263b8b8d7a47ec378d9000e151ebfb0e3
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  New Microsoft Excel Worksheet.xlsx
                                                                                  • Path C:\Users\Admin\Desktop\New Microsoft Excel Worksheet.xlsx
                                                                                  • Size 5KB
                                                                                  • SHA256 4a51286a29368a60ab9b8c76dfc4f96903588c986caee9309e3fc1eb8e5fc5c3
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  pptEAA2.tmp
                                                                                  • Path C:\Users\Admin\Desktop\pptEAA2.tmp
                                                                                  • Size 31KB
                                                                                  • SHA256 83518bdfab93a4b84736f76a6d5b01f544d048baa87f6bc71425aebf6310dde9
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  ~WRD0000.tmp
                                                                                  • Path C:\Users\Admin\Desktop\~WRD0000.tmp
                                                                                  • Size 11KB
                                                                                  • SHA256 d3ed467e3ea5287c9c0d1eceaebd855d0d3814adad9cefc97b3e9985c333e831
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  memory/1284-1132-0x0000000007E20000-0x0000000007E30000-memory.dmp
                                                                                  Download

                                                                                  memory/1284-1145-0x0000000000880000-0x0000000000890000-memory.dmp
                                                                                  Download

                                                                                  memory/1284-1152-0x0000000000880000-0x0000000000890000-memory.dmp
                                                                                  Download

                                                                                  memory/1284-1153-0x0000000000880000-0x0000000000890000-memory.dmp
                                                                                  Download

                                                                                  memory/1284-1154-0x0000000007E20000-0x0000000007E30000-memory.dmp
                                                                                  Download

                                                                                  memory/1284-1150-0x0000000000880000-0x0000000000890000-memory.dmp
                                                                                  Download

                                                                                  memory/1284-1164-0x0000000000880000-0x0000000000890000-memory.dmp
                                                                                  Download

                                                                                  memory/1284-1144-0x0000000000880000-0x0000000000890000-memory.dmp
                                                                                  Download

                                                                                  memory/1284-1165-0x0000000000880000-0x0000000000890000-memory.dmp
                                                                                  Download

                                                                                  memory/1284-1166-0x0000000007E20000-0x0000000007E30000-memory.dmp
                                                                                  Download

                                                                                  memory/1284-1167-0x0000000000880000-0x0000000000890000-memory.dmp
                                                                                  Download

                                                                                  memory/1284-1155-0x0000000000880000-0x0000000000890000-memory.dmp
                                                                                  Download

                                                                                  memory/1284-1158-0x0000000000880000-0x0000000000890000-memory.dmp
                                                                                  Download

                                                                                  memory/1284-1143-0x0000000000880000-0x0000000000890000-memory.dmp
                                                                                  Download

                                                                                  memory/1284-1149-0x0000000000880000-0x0000000000890000-memory.dmp
                                                                                  Download

                                                                                  memory/1284-1148-0x0000000007E20000-0x0000000007E30000-memory.dmp
                                                                                  Download

                                                                                  memory/1284-1147-0x0000000000880000-0x0000000000890000-memory.dmp
                                                                                  Download

                                                                                  memory/1284-1156-0x0000000000880000-0x0000000000890000-memory.dmp
                                                                                  Download

                                                                                  memory/1284-1160-0x0000000007E20000-0x0000000007E30000-memory.dmp
                                                                                  Download

                                                                                  memory/1284-1159-0x0000000000880000-0x0000000000890000-memory.dmp
                                                                                  Download

                                                                                  memory/1284-1141-0x0000000000880000-0x0000000000890000-memory.dmp
                                                                                  Download

                                                                                  memory/1284-1161-0x0000000000880000-0x0000000000890000-memory.dmp
                                                                                  Download

                                                                                  memory/1284-1142-0x0000000007E20000-0x0000000007E30000-memory.dmp
                                                                                  Download

                                                                                  memory/1284-1162-0x0000000000880000-0x0000000000890000-memory.dmp
                                                                                  Download

                                                                                  memory/1284-1140-0x0000000000880000-0x0000000000890000-memory.dmp
                                                                                  Download

                                                                                  memory/1284-1138-0x0000000000880000-0x0000000000890000-memory.dmp
                                                                                  Download

                                                                                  memory/1284-1136-0x0000000007E20000-0x0000000007E30000-memory.dmp
                                                                                  Download

                                                                                  memory/1284-1137-0x0000000000880000-0x0000000000890000-memory.dmp
                                                                                  Download

                                                                                  memory/1848-725-0x00000156801E0000-0x00000156802E0000-memory.dmp
                                                                                  Download

                                                                                  memory/1848-748-0x0000015683E10000-0x0000015683E30000-memory.dmp
                                                                                  Download

                                                                                  memory/1848-736-0x0000015693E90000-0x0000015693F90000-memory.dmp
                                                                                  Download

                                                                                  memory/1848-735-0x0000015683A30000-0x0000015683A50000-memory.dmp
                                                                                  Download

                                                                                  memory/1848-769-0x0000015694250000-0x0000015694270000-memory.dmp
                                                                                  Download

                                                                                  memory/2148-599-0x00007FF8B2CC0000-0x00007FF8B2CD0000-memory.dmp
                                                                                  Download

                                                                                  memory/2148-692-0x00007FF8B2CC0000-0x00007FF8B2CD0000-memory.dmp
                                                                                  Download

                                                                                  memory/2148-595-0x00007FF8B2CC0000-0x00007FF8B2CD0000-memory.dmp
                                                                                  Download

                                                                                  memory/2148-597-0x00007FF8B2CC0000-0x00007FF8B2CD0000-memory.dmp
                                                                                  Download

                                                                                  memory/2148-596-0x00007FF8B2CC0000-0x00007FF8B2CD0000-memory.dmp
                                                                                  Download

                                                                                  memory/2148-598-0x00007FF8B2CC0000-0x00007FF8B2CD0000-memory.dmp
                                                                                  Download

                                                                                  memory/2148-600-0x00007FF8B05C0000-0x00007FF8B05D0000-memory.dmp
                                                                                  Download

                                                                                  memory/2148-601-0x00007FF8B05C0000-0x00007FF8B05D0000-memory.dmp
                                                                                  Download

                                                                                  memory/2148-691-0x00007FF8B2CC0000-0x00007FF8B2CD0000-memory.dmp
                                                                                  Download

                                                                                  memory/2148-690-0x00007FF8B2CC0000-0x00007FF8B2CD0000-memory.dmp
                                                                                  Download

                                                                                  memory/2148-693-0x00007FF8B2CC0000-0x00007FF8B2CD0000-memory.dmp
                                                                                  Download

                                                                                  memory/2408-1006-0x00007FF8B2CC0000-0x00007FF8B2CD0000-memory.dmp
                                                                                  Download

                                                                                  memory/2408-1005-0x00007FF8B2CC0000-0x00007FF8B2CD0000-memory.dmp
                                                                                  Download

                                                                                  memory/2408-1063-0x00007FF8B2CC0000-0x00007FF8B2CD0000-memory.dmp
                                                                                  Download

                                                                                  memory/2408-1064-0x00007FF8B2CC0000-0x00007FF8B2CD0000-memory.dmp
                                                                                  Download

                                                                                  memory/2408-1062-0x00007FF8B2CC0000-0x00007FF8B2CD0000-memory.dmp
                                                                                  Download

                                                                                  memory/2408-1009-0x00007FF8B2CC0000-0x00007FF8B2CD0000-memory.dmp
                                                                                  Download

                                                                                  memory/2408-1008-0x00007FF8B2CC0000-0x00007FF8B2CD0000-memory.dmp
                                                                                  Download

                                                                                  memory/2408-1007-0x00007FF8B2CC0000-0x00007FF8B2CD0000-memory.dmp
                                                                                  Download

                                                                                  memory/2408-1061-0x00007FF8B2CC0000-0x00007FF8B2CD0000-memory.dmp
                                                                                  Download

                                                                                  memory/5788-947-0x00007FF8B2CC0000-0x00007FF8B2CD0000-memory.dmp
                                                                                  Download

                                                                                  memory/5788-999-0x00007FF8B2CC0000-0x00007FF8B2CD0000-memory.dmp
                                                                                  Download

                                                                                  memory/5788-998-0x00007FF8B2CC0000-0x00007FF8B2CD0000-memory.dmp
                                                                                  Download

                                                                                  memory/5788-943-0x00007FF8B2CC0000-0x00007FF8B2CD0000-memory.dmp
                                                                                  Download

                                                                                  memory/5788-944-0x00007FF8B2CC0000-0x00007FF8B2CD0000-memory.dmp
                                                                                  Download

                                                                                  memory/5788-945-0x00007FF8B2CC0000-0x00007FF8B2CD0000-memory.dmp
                                                                                  Download

                                                                                  memory/5788-946-0x00007FF8B2CC0000-0x00007FF8B2CD0000-memory.dmp
                                                                                  Download

                                                                                  memory/5788-1000-0x00007FF8B2CC0000-0x00007FF8B2CD0000-memory.dmp
                                                                                  Download

                                                                                  memory/5788-948-0x00007FF8B05C0000-0x00007FF8B05D0000-memory.dmp
                                                                                  Download

                                                                                  memory/5788-950-0x00007FF8B05C0000-0x00007FF8B05D0000-memory.dmp
                                                                                  Download

                                                                                  memory/5788-997-0x00007FF8B2CC0000-0x00007FF8B2CD0000-memory.dmp
                                                                                  Download