5fb111f32a15763d519bf9ef23e0111153521f641cde7460e5b8e895ca27a1d2

Resubmissions

29/07/2026, 16:41

260729-t7ljcsbe728

29/07/2026, 16:31

260729-t1fdrsbn218

Analysis

user interaction
yes
max time kernel
528s
max time network
538s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/07/2026, 16:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
VirtualBox-7.2.14-174565-Win.exe
Size 169.8MB
Sample260729-t1fdrsbn21
SHA256 5fb111f32a15763d519bf9ef23e0111153521f641cde7460e5b8e895ca27a1d2
MD5 b22e2c92b002609d46790a3c48ed3ad7
SHA1 015310c470b46d1fb55a16d775f8117931ca318a
SHA512 a7e9bcdc2542a674eff48be9f84948a005fe32833f8144c0c2a133c08907117b5000d70a8b1f68b8fcbd2ad9fa3a4b96b75b9e10b93351101b6ab37af8c7bd1e
SSDEEP 3145728:xkF7YfMnLAsLhEczP0mM+1UZRpsuZmNL6DquImhKx837H73+SmIj0EBPfs2R:xk60nLAu2cP0mM+CLHZmNWDquzhx7GbS
TLSH
T17888335473E12C32D78643FFC5935B75AA2FA8344313449B22B6E22E5DB27E853A27C1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence ransomware

Malware Config

Signatures

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\DRIVERS\SETC05E.tmp	MsiExec.exe
File created	C:\Windows\system32\DRIVERS\SETC05E.tmp	MsiExec.exe
File opened for modification	C:\Windows\system32\DRIVERS\VBoxSup.sys	MsiExec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\U:	VirtualBox-7.2.14-174565-Win.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	VirtualBox-7.2.14-174565-Win.exe
File opened (read-only)	\??\H:	VirtualBox-7.2.14-174565-Win.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\D:	VirtualBox-7.2.14-174565-Win.exe
File opened (read-only)	\??\I:	VirtualBox-7.2.14-174565-Win.exe
File opened (read-only)	\??\K:	VirtualBox-7.2.14-174565-Win.exe
File opened (read-only)	\??\L:	VirtualBox-7.2.14-174565-Win.exe
File opened (read-only)	\??\R:	VirtualBox-7.2.14-174565-Win.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	VirtualBox-7.2.14-174565-Win.exe
File opened (read-only)	\??\T:	VirtualBox-7.2.14-174565-Win.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\G:	VirtualBox-7.2.14-174565-Win.exe
File opened (read-only)	\??\N:	VirtualBox-7.2.14-174565-Win.exe
File opened (read-only)	\??\O:	VirtualBox-7.2.14-174565-Win.exe
File opened (read-only)	\??\P:	VirtualBox-7.2.14-174565-Win.exe
File opened (read-only)	\??\V:	VirtualBox-7.2.14-174565-Win.exe
File opened (read-only)	\??\X:	VirtualBox-7.2.14-174565-Win.exe
File opened (read-only)	\??\Y:	VirtualBox-7.2.14-174565-Win.exe
File opened (read-only)	\??\Z:	VirtualBox-7.2.14-174565-Win.exe
File opened (read-only)	\??\M:	VirtualBox-7.2.14-174565-Win.exe
File opened (read-only)	\??\Q:	VirtualBox-7.2.14-174565-Win.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	VirtualBox-7.2.14-174565-Win.exe
File opened (read-only)	\??\S:	VirtualBox-7.2.14-174565-Win.exe
File opened (read-only)	\??\W:	VirtualBox-7.2.14-174565-Win.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe

Drops file in System32 directory 16 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\DriverStore\Temp\{f72ab7ca-d36b-ee4e-9ebc-659219187bc8}\SETBEA9.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{f72ab7ca-d36b-ee4e-9ebc-659219187bc8}\VBoxSup.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{f72ab7ca-d36b-ee4e-9ebc-659219187bc8}\SETBEAA.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{f72ab7ca-d36b-ee4e-9ebc-659219187bc8}\SETBEBB.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{f72ab7ca-d36b-ee4e-9ebc-659219187bc8}\SETBEBB.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\vboxsup.inf_amd64_1c81afc043e2b4e1\VBoxSup.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{f72ab7ca-d36b-ee4e-9ebc-659219187bc8}	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{f72ab7ca-d36b-ee4e-9ebc-659219187bc8}\VBoxSup.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\vboxsup.inf_amd64_1c81afc043e2b4e1.ini	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{f72ab7ca-d36b-ee4e-9ebc-659219187bc8}\SETBEA9.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{f72ab7ca-d36b-ee4e-9ebc-659219187bc8}\VBoxSup.sys	DrvInst.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\vboxsup.inf_amd64_1c81afc043e2b4e1\VBoxSup.inf	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{f72ab7ca-d36b-ee4e-9ebc-659219187bc8}\SETBEAA.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\vboxsup.inf_amd64_1c81afc043e2b4e1\VBoxSup.sys	DrvInst.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Oracle\VirtualBox\VBoxGuestAdditions.iso	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_pt_BR.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\qt_it.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\qt_zh_TW.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\x86\VBoxClient-x86.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxBalloonCtrl.exe	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxDDR0.r0	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\UnattendedTemplates\ubuntu_postinstall.sh	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxSVC.exe	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\drivers\vboxsup\VBoxSup.cat	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_ca.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\qt_ca.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\qt_ja.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\qt_ko.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VMMR0.r0	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\platforms\qwindowsVBox.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\drivers\network\netlwf\VBoxNetLwf.inf	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\doc\UserManual.pdf	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_en.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\qt_hr_HR.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\qt_pt_BR.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxDTrace.exe	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\UnattendedTemplates\ol_ks.cfg	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\drivers\USB\device\VBoxUSB.inf	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\qt_fr.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\qt_ru.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\DbgPlugInDiggers.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxRT.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\dtrace\lib\amd64\vbox-arch-types.d	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\UnattendedTemplates\debian_preseed.cfg	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\drivers\USB\filter\VBoxUSBMon.inf	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_cs.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_sv.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\qt_en.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxDragAndDropSvc.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\qt_id.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\Qt6StateMachineVBox.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxExtPackHelperApp.exe	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\UnattendedTemplates\redhat_postinstall.sh	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\drivers\network\netadp6\VBoxNetAdp6.inf	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_zh_TW.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\qt_fa.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\qt_sk.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxLibSsh.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\qt_sv.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\Qt6WidgetsVBox.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxNetNAT.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\UnattendedTemplates\lgw_ks.cfg	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\drivers\network\netadp6\VBoxNetAdp6.cat	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\drivers\USB\filter\VBoxUSBMon.cat	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\UserManual.qch	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_id.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\qt_pt.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\Qt6SqlVBox.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxAutostartSvc.exe	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxC.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxVMM.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\platforms\qoffscreenVBox.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\UnattendedTemplates\rhel5_ks.cfg	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_ja.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_uk.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxAudioTest.exe	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxHostChannel.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VirtualBox.exe	msiexec.exe

Drops file in Windows directory 34 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSI9BE0.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9C20.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB3AB.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB438.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DFFFFF6772AF11DB93.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB230.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9C70.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB250.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	MsiExec.exe
File opened for modification	C:\Windows\Installer\MSIC07F.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF276A29934D5EFEFC.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9AF4.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9C40.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9CB0.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\inf\oem1.inf	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSI9F12.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB2FD.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DFB450CD99895DD6EC.TMP	msiexec.exe
File created	C:\Windows\Installer\e5b8e33.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5b8e33.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9C00.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB37B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBE2C.tmp	msiexec.exe
File opened for modification	C:\Windows\inf\oem1.inf	DrvInst.exe
File created	C:\Windows\SystemTemp\~DF299CC0DFBE3C587F.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB1C1.tmp	msiexec.exe
File created	C:\Windows\INF\oem1.PNF	MsiExec.exe
File created	C:\Windows\Installer\SourceHash{EC992132-5693-4D1D-85DC-2629AA025B28}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB153.tmp	msiexec.exe
File created	C:\Windows\INF\oem0.PNF	MsiExec.exe

Loads dropped DLL 24 IoCs

pid	Process
6112	MsiExec.exe
6112	MsiExec.exe
6112	MsiExec.exe
6112	MsiExec.exe
6112	MsiExec.exe
6112	MsiExec.exe
6112	MsiExec.exe
1616	MsiExec.exe
1616	MsiExec.exe
1616	MsiExec.exe
1616	MsiExec.exe
1616	MsiExec.exe
1616	MsiExec.exe
1616	MsiExec.exe
4284	MsiExec.exe
4284	MsiExec.exe
4284	MsiExec.exe
4284	MsiExec.exe
4284	MsiExec.exe
4284	MsiExec.exe
4284	MsiExec.exe
4284	MsiExec.exe
4284	MsiExec.exe
4284	MsiExec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VirtualBox-7.2.14-174565-Win.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5524	chrome.exe

Checks SCSI registry key(s) 3 TTPs 21 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000ad3b1fc6af0fc0350000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c0120000000000000000000000002701010000883801ad3b1fc60000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e84101ad3b1fc6000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e3ad3b1fc600000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e6ad3b1fc600000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	DrvInst.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	DrvInst.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 53 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134298165228735677"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1738198120-2966725515-3980530802-1000\{6C8EEA2B-94A4-4302-8995-DF524E569192}	wrapper-offline.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings	chrome.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
4504	msiexec.exe
4504	msiexec.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
4908	chrome.exe
4908	chrome.exe
4324	wrapper-offline.exe
4324	wrapper-offline.exe
4324	wrapper-offline.exe
4324	wrapper-offline.exe
4840	wrapper-offline.exe
4840	wrapper-offline.exe
2428	wrapper-offline.exe
2428	wrapper-offline.exe
4732	wrapper-offline.exe
4732	wrapper-offline.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
820	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs

pid	Process
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5264	VirtualBox-7.2.14-174565-Win.exe
Token: SeIncreaseQuotaPrivilege	5264	VirtualBox-7.2.14-174565-Win.exe
Token: SeSecurityPrivilege	4504	msiexec.exe
Token: SeCreateTokenPrivilege	5264	VirtualBox-7.2.14-174565-Win.exe
Token: SeAssignPrimaryTokenPrivilege	5264	VirtualBox-7.2.14-174565-Win.exe
Token: SeLockMemoryPrivilege	5264	VirtualBox-7.2.14-174565-Win.exe
Token: SeIncreaseQuotaPrivilege	5264	VirtualBox-7.2.14-174565-Win.exe
Token: SeMachineAccountPrivilege	5264	VirtualBox-7.2.14-174565-Win.exe
Token: SeTcbPrivilege	5264	VirtualBox-7.2.14-174565-Win.exe
Token: SeSecurityPrivilege	5264	VirtualBox-7.2.14-174565-Win.exe
Token: SeTakeOwnershipPrivilege	5264	VirtualBox-7.2.14-174565-Win.exe
Token: SeLoadDriverPrivilege	5264	VirtualBox-7.2.14-174565-Win.exe
Token: SeSystemProfilePrivilege	5264	VirtualBox-7.2.14-174565-Win.exe
Token: SeSystemtimePrivilege	5264	VirtualBox-7.2.14-174565-Win.exe
Token: SeProfSingleProcessPrivilege	5264	VirtualBox-7.2.14-174565-Win.exe
Token: SeIncBasePriorityPrivilege	5264	VirtualBox-7.2.14-174565-Win.exe
Token: SeCreatePagefilePrivilege	5264	VirtualBox-7.2.14-174565-Win.exe
Token: SeCreatePermanentPrivilege	5264	VirtualBox-7.2.14-174565-Win.exe
Token: SeBackupPrivilege	5264	VirtualBox-7.2.14-174565-Win.exe
Token: SeRestorePrivilege	5264	VirtualBox-7.2.14-174565-Win.exe
Token: SeShutdownPrivilege	5264	VirtualBox-7.2.14-174565-Win.exe
Token: SeDebugPrivilege	5264	VirtualBox-7.2.14-174565-Win.exe
Token: SeAuditPrivilege	5264	VirtualBox-7.2.14-174565-Win.exe
Token: SeSystemEnvironmentPrivilege	5264	VirtualBox-7.2.14-174565-Win.exe
Token: SeChangeNotifyPrivilege	5264	VirtualBox-7.2.14-174565-Win.exe
Token: SeRemoteShutdownPrivilege	5264	VirtualBox-7.2.14-174565-Win.exe
Token: SeUndockPrivilege	5264	VirtualBox-7.2.14-174565-Win.exe
Token: SeSyncAgentPrivilege	5264	VirtualBox-7.2.14-174565-Win.exe
Token: SeEnableDelegationPrivilege	5264	VirtualBox-7.2.14-174565-Win.exe
Token: SeManageVolumePrivilege	5264	VirtualBox-7.2.14-174565-Win.exe
Token: SeImpersonatePrivilege	5264	VirtualBox-7.2.14-174565-Win.exe
Token: SeCreateGlobalPrivilege	5264	VirtualBox-7.2.14-174565-Win.exe
Token: SeCreateTokenPrivilege	5264	VirtualBox-7.2.14-174565-Win.exe
Token: SeAssignPrimaryTokenPrivilege	5264	VirtualBox-7.2.14-174565-Win.exe
Token: SeLockMemoryPrivilege	5264	VirtualBox-7.2.14-174565-Win.exe
Token: SeIncreaseQuotaPrivilege	5264	VirtualBox-7.2.14-174565-Win.exe
Token: SeMachineAccountPrivilege	5264	VirtualBox-7.2.14-174565-Win.exe
Token: SeTcbPrivilege	5264	VirtualBox-7.2.14-174565-Win.exe
Token: SeSecurityPrivilege	5264	VirtualBox-7.2.14-174565-Win.exe
Token: SeTakeOwnershipPrivilege	5264	VirtualBox-7.2.14-174565-Win.exe
Token: SeLoadDriverPrivilege	5264	VirtualBox-7.2.14-174565-Win.exe
Token: SeSystemProfilePrivilege	5264	VirtualBox-7.2.14-174565-Win.exe
Token: SeSystemtimePrivilege	5264	VirtualBox-7.2.14-174565-Win.exe
Token: SeProfSingleProcessPrivilege	5264	VirtualBox-7.2.14-174565-Win.exe
Token: SeIncBasePriorityPrivilege	5264	VirtualBox-7.2.14-174565-Win.exe
Token: SeCreatePagefilePrivilege	5264	VirtualBox-7.2.14-174565-Win.exe
Token: SeCreatePermanentPrivilege	5264	VirtualBox-7.2.14-174565-Win.exe
Token: SeBackupPrivilege	5264	VirtualBox-7.2.14-174565-Win.exe
Token: SeRestorePrivilege	5264	VirtualBox-7.2.14-174565-Win.exe
Token: SeShutdownPrivilege	5264	VirtualBox-7.2.14-174565-Win.exe
Token: SeDebugPrivilege	5264	VirtualBox-7.2.14-174565-Win.exe
Token: SeAuditPrivilege	5264	VirtualBox-7.2.14-174565-Win.exe
Token: SeSystemEnvironmentPrivilege	5264	VirtualBox-7.2.14-174565-Win.exe
Token: SeChangeNotifyPrivilege	5264	VirtualBox-7.2.14-174565-Win.exe
Token: SeRemoteShutdownPrivilege	5264	VirtualBox-7.2.14-174565-Win.exe
Token: SeUndockPrivilege	5264	VirtualBox-7.2.14-174565-Win.exe
Token: SeSyncAgentPrivilege	5264	VirtualBox-7.2.14-174565-Win.exe
Token: SeEnableDelegationPrivilege	5264	VirtualBox-7.2.14-174565-Win.exe
Token: SeManageVolumePrivilege	5264	VirtualBox-7.2.14-174565-Win.exe
Token: SeImpersonatePrivilege	5264	VirtualBox-7.2.14-174565-Win.exe
Token: SeCreateGlobalPrivilege	5264	VirtualBox-7.2.14-174565-Win.exe
Token: SeCreateTokenPrivilege	5264	VirtualBox-7.2.14-174565-Win.exe
Token: SeAssignPrimaryTokenPrivilege	5264	VirtualBox-7.2.14-174565-Win.exe
Token: SeLockMemoryPrivilege	5264	VirtualBox-7.2.14-174565-Win.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
5264	VirtualBox-7.2.14-174565-Win.exe
5264	VirtualBox-7.2.14-174565-Win.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe

Suspicious use of SendNotifyMessage 34 IoCs

pid	Process
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe
3344	chrome.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4504	msiexec.exe
6112	MsiExec.exe
1616	MsiExec.exe
4284	MsiExec.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4504 wrote to memory of 6112	4504	msiexec.exe	90
PID 4504 wrote to memory of 4220	4504	msiexec.exe	96
PID 4504 wrote to memory of 1616	4504	msiexec.exe	98
PID 4504 wrote to memory of 4284	4504	msiexec.exe	99
PID 3344 wrote to memory of 5476	3344	chrome.exe	105
PID 3344 wrote to memory of 4684	3344	chrome.exe	106
PID 3344 wrote to memory of 5524	3344	chrome.exe	107
PID 3344 wrote to memory of 4684	3344	chrome.exe	106
PID 3344 wrote to memory of 5528	3344	chrome.exe	109
PID 3344 wrote to memory of 5528	3344	chrome.exe	109
PID 3344 wrote to memory of 3468	3344	chrome.exe	110
PID 3344 wrote to memory of 3468	3344	chrome.exe	110
PID 3344 wrote to memory of 4288	3344	chrome.exe	111
PID 3344 wrote to memory of 4288	3344	chrome.exe	111
PID 3344 wrote to memory of 6080	3344	chrome.exe	112
PID 3344 wrote to memory of 6080	3344	chrome.exe	112
PID 3344 wrote to memory of 3540	3344	chrome.exe	113
PID 3344 wrote to memory of 3540	3344	chrome.exe	113
PID 3344 wrote to memory of 1364	3344	chrome.exe	114
PID 3344 wrote to memory of 6012	3344	chrome.exe	115
PID 3344 wrote to memory of 4224	3344	chrome.exe	116
PID 3344 wrote to memory of 6012	3344	chrome.exe	115
PID 3344 wrote to memory of 4224	3344	chrome.exe	116
PID 3344 wrote to memory of 4184	3344	chrome.exe	120
PID 3344 wrote to memory of 4868	3344	chrome.exe	121
PID 3344 wrote to memory of 4184	3344	chrome.exe	120
PID 3344 wrote to memory of 2580	3344	chrome.exe	122
PID 3344 wrote to memory of 4868	3344	chrome.exe	121
PID 3344 wrote to memory of 2580	3344	chrome.exe	122
PID 3344 wrote to memory of 684	3344	chrome.exe	123
PID 3344 wrote to memory of 6028	3344	chrome.exe	125
PID 3344 wrote to memory of 2452	3344	chrome.exe	124
PID 3344 wrote to memory of 684	3344	chrome.exe	123
PID 3344 wrote to memory of 6028	3344	chrome.exe	125
PID 3344 wrote to memory of 2452	3344	chrome.exe	124
PID 3344 wrote to memory of 5504	3344	chrome.exe	126
PID 3344 wrote to memory of 5376	3344	chrome.exe	127
PID 3344 wrote to memory of 5504	3344	chrome.exe	126
PID 3344 wrote to memory of 6072	3344	chrome.exe	128
PID 3344 wrote to memory of 6072	3344	chrome.exe	128
PID 3344 wrote to memory of 5376	3344	chrome.exe	127
PID 3344 wrote to memory of 5516	3344	chrome.exe	129
PID 3344 wrote to memory of 5516	3344	chrome.exe	129
PID 3344 wrote to memory of 1728	3344	chrome.exe	130
PID 3344 wrote to memory of 1728	3344	chrome.exe	130
PID 3344 wrote to memory of 1236	3344	chrome.exe	131
PID 3344 wrote to memory of 1236	3344	chrome.exe	131
PID 3344 wrote to memory of 4328	3344	chrome.exe	132
PID 3344 wrote to memory of 4328	3344	chrome.exe	132
PID 3344 wrote to memory of 4224	3344	chrome.exe	133
PID 3344 wrote to memory of 4224	3344	chrome.exe	133
PID 3344 wrote to memory of 3708	3344	chrome.exe	134
PID 3344 wrote to memory of 4784	3344	chrome.exe	135
PID 3344 wrote to memory of 1088	3344	chrome.exe	136
PID 3344 wrote to memory of 5584	3344	chrome.exe	143
PID 3344 wrote to memory of 5584	3344	chrome.exe	143
PID 3344 wrote to memory of 4908	3344	chrome.exe	145
PID 3344 wrote to memory of 1336	3344	chrome.exe	146
PID 3344 wrote to memory of 1336	3344	chrome.exe	146
PID 3344 wrote to memory of 4784	3344	chrome.exe	147
PID 4324 wrote to memory of 4780	4324	wrapper-offline.exe	151
PID 4324 wrote to memory of 4780	4324	wrapper-offline.exe	151
PID 4324 wrote to memory of 4840	4324	wrapper-offline.exe	152
PID 4324 wrote to memory of 2428	4324	wrapper-offline.exe	154

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\VirtualBox-7.2.14-174565-Win.exe
"C:\Users\Admin\AppData\Local\Temp\VirtualBox-7.2.14-174565-Win.exe"
1⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5264

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4504
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding DA2E52EB71D65C96019D56A4A03A1979 C
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:6112
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:4220
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding D67389E918ADE152A40B7DB9F5C386E2
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:1616
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 6097ED0E547C00D7EF72C46F0B556ECE E Global\MSI0000
  2⤵
  - Drops file in Drivers directory
  - Drops file in Windows directory
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:4284

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:1316

C:\Windows\system32\DrvInst.exe
DrvInst.exe "4" "9" "C:\Program Files\Oracle\VirtualBox\drivers\vboxsup\VBoxSup.inf" "9" "4ff1aec5b" "00000000000001A4" "WinSta0\Default" "00000000000001A8" "208" "C:\Program Files\Oracle\VirtualBox\drivers\vboxsup"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:5720

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x108,0x134,0x7ffa4f08c728,0x7ffa4f08c734,0x7ffa4f08c740
  2⤵
  PID:5476
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1708,i,1582424058467616755,12396038312021581018,262144 --field-trial-handle=1896,i,15871501153388478668,2892167636022579470,262144 --variations-seed-version --mojo-platform-channel-handle=1920 /prefetch:2
  2⤵
  PID:4684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1976,i,6583514967544965429,12941312625993913026,524288 --field-trial-handle=1896,i,15871501153388478668,2892167636022579470,262144 --variations-seed-version --mojo-platform-channel-handle=2008 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2380,i,9184983752160608250,6090812335803524173,524288 --field-trial-handle=1896,i,15871501153388478668,2892167636022579470,262144 --variations-seed-version --mojo-platform-channel-handle=2408 /prefetch:13
  2⤵
  PID:5528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3300,i,13034477459145310450,8758984018763128980,2097152 --field-trial-handle=1896,i,15871501153388478668,2892167636022579470,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:3468
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3084,i,9017818490322090127,6976052071759915520,2097152 --field-trial-handle=1896,i,15871501153388478668,2892167636022579470,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:4288
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4660,i,13155805281603288155,17048319902145906616,2097152 --field-trial-handle=1896,i,15871501153388478668,2892167636022579470,262144 --variations-seed-version --mojo-platform-channel-handle=4664 /prefetch:1
  2⤵
  PID:6080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4904,i,1804700751004902558,7311245056218895853,524288 --field-trial-handle=1896,i,15871501153388478668,2892167636022579470,262144 --variations-seed-version --mojo-platform-channel-handle=4916 /prefetch:14
  2⤵
  PID:3540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5404,i,14388451702900105277,7523203868537076196,524288 --field-trial-handle=1896,i,15871501153388478668,2892167636022579470,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:14
  2⤵
  PID:1364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5464,i,405347476802967218,2905259901786585035,2097152 --field-trial-handle=1896,i,15871501153388478668,2892167636022579470,262144 --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:1
  2⤵
  PID:6012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5508,i,3488083141437318832,13899387556384458041,2097152 --field-trial-handle=1896,i,15871501153388478668,2892167636022579470,262144 --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:1
  2⤵
  PID:4224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5836,i,10237904445231011350,14076695070852062261,2097152 --field-trial-handle=1896,i,15871501153388478668,2892167636022579470,262144 --variations-seed-version --mojo-platform-channel-handle=5572 /prefetch:1
  2⤵
  PID:4184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5792,i,1368904767161400253,10020025613016730829,524288 --field-trial-handle=1896,i,15871501153388478668,2892167636022579470,262144 --variations-seed-version --mojo-platform-channel-handle=5568 /prefetch:14
  2⤵
  PID:4868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5424,i,10794136726322767770,4141503728771607991,2097152 --field-trial-handle=1896,i,15871501153388478668,2892167636022579470,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:1
  2⤵
  PID:2580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6212,i,12403225595600719272,3228716592161646602,2097152 --field-trial-handle=1896,i,15871501153388478668,2892167636022579470,262144 --variations-seed-version --mojo-platform-channel-handle=5504 /prefetch:1
  2⤵
  PID:684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5856,i,13716910990156337173,15209926830058643489,524288 --field-trial-handle=1896,i,15871501153388478668,2892167636022579470,262144 --variations-seed-version --mojo-platform-channel-handle=5572 /prefetch:14
  2⤵
  PID:2452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5712,i,13189778495980294153,7844376232001586570,2097152 --field-trial-handle=1896,i,15871501153388478668,2892167636022579470,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:1
  2⤵
  PID:6028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6240,i,12488669028491523995,5463763339363541926,524288 --field-trial-handle=1896,i,15871501153388478668,2892167636022579470,262144 --variations-seed-version --mojo-platform-channel-handle=5760 /prefetch:14
  2⤵
  PID:5504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6280,i,6798712295301565435,17674538000954480085,2097152 --field-trial-handle=1896,i,15871501153388478668,2892167636022579470,262144 --variations-seed-version --mojo-platform-channel-handle=5712 /prefetch:1
  2⤵
  PID:5376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6316,i,17739026570328542692,11702502173873383336,2097152 --field-trial-handle=1896,i,15871501153388478668,2892167636022579470,262144 --variations-seed-version --mojo-platform-channel-handle=5764 /prefetch:1
  2⤵
  PID:6072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=5752,i,17405294516494692462,18247754651800585990,2097152 --field-trial-handle=1896,i,15871501153388478668,2892167636022579470,262144 --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:1
  2⤵
  PID:5516
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6128,i,5252078986042992596,3364875271317691031,2097152 --field-trial-handle=1896,i,15871501153388478668,2892167636022579470,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:9
  2⤵
  PID:1728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=5780,i,14180335581263544022,9708599830674258181,2097152 --field-trial-handle=1896,i,15871501153388478668,2892167636022579470,262144 --variations-seed-version --mojo-platform-channel-handle=6572 /prefetch:1
  2⤵
  PID:1236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=4872,i,3185469853681786922,14957039525708468158,2097152 --field-trial-handle=1896,i,15871501153388478668,2892167636022579470,262144 --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:1
  2⤵
  PID:4328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=3540,i,14490088357937331355,8459262942762248629,2097152 --field-trial-handle=1896,i,15871501153388478668,2892167636022579470,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:1
  2⤵
  PID:4224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6388,i,5967815235437102161,4974700070210041198,524288 --field-trial-handle=1896,i,15871501153388478668,2892167636022579470,262144 --variations-seed-version --mojo-platform-channel-handle=6400 /prefetch:14
  2⤵
  PID:3708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4776,i,7557305462589773800,3249401410723872219,524288 --field-trial-handle=1896,i,15871501153388478668,2892167636022579470,262144 --variations-seed-version --mojo-platform-channel-handle=5396 /prefetch:14
  2⤵
  PID:4784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6420,i,1384985693029271838,4455260556872401217,524288 --field-trial-handle=1896,i,15871501153388478668,2892167636022579470,262144 --variations-seed-version --mojo-platform-channel-handle=6840 /prefetch:14
  2⤵
  PID:1088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=4632,i,1559268768484542307,885924582130082726,2097152 --field-trial-handle=1896,i,15871501153388478668,2892167636022579470,262144 --variations-seed-version --mojo-platform-channel-handle=5812 /prefetch:1
  2⤵
  PID:5584
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5064,i,1086639978839559790,214505453029203345,262144 --field-trial-handle=1896,i,15871501153388478668,2892167636022579470,262144 --variations-seed-version --mojo-platform-channel-handle=6532 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=6320,i,6101491974944259150,5298144423864482023,524288 --field-trial-handle=1896,i,15871501153388478668,2892167636022579470,262144 --variations-seed-version --mojo-platform-channel-handle=4576 /prefetch:14
  2⤵
  PID:1336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=7028,i,4964892271487422478,3767861456542283025,524288 --field-trial-handle=1896,i,15871501153388478668,2892167636022579470,262144 --variations-seed-version --mojo-platform-channel-handle=6836 /prefetch:14
  2⤵
  PID:4784

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:52

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1284

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:4040

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4408

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5840

C:\Users\Admin\AppData\Local\Temp\55037f5f-94b7-41e4-a516-13bc20e3cc61_wrapper-offline-win32-x64.7z.c61\wrapper-offline-win32-x64\wrapper-offline.exe
"C:\Users\Admin\AppData\Local\Temp\55037f5f-94b7-41e4-a516-13bc20e3cc61_wrapper-offline-win32-x64.7z.c61\wrapper-offline-win32-x64\wrapper-offline.exe"
1⤵
PID:5472

C:\Users\Admin\Downloads\wrapper-offline-win32-x64\wrapper-offline-win32-x64\wrapper-offline.exe
"C:\Users\Admin\Downloads\wrapper-offline-win32-x64\wrapper-offline-win32-x64\wrapper-offline.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4324
- C:\Users\Admin\Downloads\wrapper-offline-win32-x64\wrapper-offline-win32-x64\wrapper-offline.exe
  "C:\Users\Admin\Downloads\wrapper-offline-win32-x64\wrapper-offline-win32-x64\wrapper-offline.exe" --type=gpu-process --field-trial-handle=1624,16724169611662573875,12805927955050926063,131072 --enable-features=WebComponentsV0Enabled --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1640 /prefetch:2
  2⤵
  PID:4780
- C:\Users\Admin\Downloads\wrapper-offline-win32-x64\wrapper-offline-win32-x64\wrapper-offline.exe
  "C:\Users\Admin\Downloads\wrapper-offline-win32-x64\wrapper-offline-win32-x64\wrapper-offline.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1624,16724169611662573875,12805927955050926063,131072 --enable-features=WebComponentsV0Enabled --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=2036 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4840
- C:\Users\Admin\Downloads\wrapper-offline-win32-x64\wrapper-offline-win32-x64\wrapper-offline.exe
  "C:\Users\Admin\Downloads\wrapper-offline-win32-x64\wrapper-offline-win32-x64\wrapper-offline.exe" --type=renderer --field-trial-handle=1624,16724169611662573875,12805927955050926063,131072 --enable-features=WebComponentsV0Enabled --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --lang=en-US --app-path="C:\Users\Admin\Downloads\wrapper-offline-win32-x64\wrapper-offline-win32-x64\resources\app" --enable-plugins --no-sandbox --no-zygote --context-isolation --background-color=#fff --enable-spellcheck --enable-websql --disable-electron-site-instance-overrides --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2580 /prefetch:1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2428
- C:\Users\Admin\Downloads\wrapper-offline-win32-x64\wrapper-offline-win32-x64\wrapper-offline.exe
  "C:\Users\Admin\Downloads\wrapper-offline-win32-x64\wrapper-offline-win32-x64\wrapper-offline.exe" --type=ppapi --field-trial-handle=1624,16724169611662573875,12805927955050926063,131072 --enable-features=WebComponentsV0Enabled --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --ppapi-flash-args --lang=en-US --device-scale-factor=1 --ppapi-antialiased-text-enabled=1 --ppapi-subpixel-rendering-setting=1 --mojo-platform-channel-handle=2916 /prefetch:3
  2⤵
  PID:2940
- C:\Users\Admin\Downloads\wrapper-offline-win32-x64\wrapper-offline-win32-x64\wrapper-offline.exe
  "C:\Users\Admin\Downloads\wrapper-offline-win32-x64\wrapper-offline-win32-x64\wrapper-offline.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1624,16724169611662573875,12805927955050926063,131072 --enable-features=WebComponentsV0Enabled --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3044 /prefetch:8
  2⤵
  PID:2128
- C:\Users\Admin\Downloads\wrapper-offline-win32-x64\wrapper-offline-win32-x64\wrapper-offline.exe
  "C:\Users\Admin\Downloads\wrapper-offline-win32-x64\wrapper-offline-win32-x64\wrapper-offline.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1624,16724169611662573875,12805927955050926063,131072 --enable-features=WebComponentsV0Enabled --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=3052 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:4732

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

VBoxSup.cat

Path C:\PROGRA~1\Oracle\VIRTUA~1\drivers\vboxsup\VBoxSup.cat
Size 11KB
SHA256 191d53d9d65efcd8cb2d48962f71d529b2ede51d1dca50dfc764a8103c5129fa
MD5 4659483f4910cc61c4ab5a25bd4bda57
SHA1 ac7323520471250d5afcc00bba664f45f7e0180d
SHA512 7df48e998f976bfc39442ada6a5594b3d2468ab08d71cd15d38793984967e65a72f904c585495feb36b32e185ea11bccc3940c82bd18f380efaad0589f0bb128
SSDEEP 192:YzXEqJCfT+/OXJEwlLdthYCISUFTsX01k9z3AS5n2uMg:kUT+/ORdth3ISSoR9zb52uZ
TLSH
T111323AA649681183FDABAC6053E8F947BC3D27CB5C50486562AFF3090D973C9E71816E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VBoxSup.sys

Path C:\PROGRA~1\Oracle\VIRTUA~1\drivers\vboxsup\VBoxSup.sys
Size 1.0MB
SHA256 257fb12b25cd673ca1bfabd957f9c183a2f1f08192581fa365e279c080db8124
MD5 73b3ad4907c7078498ac9fee3edcdff2
SHA1 f79a601e5bdd5b3aeafcde2537fdecca774b240f
SHA512 936ee9f6831d6451c43f9510d3b504fbea7b4e6c48a3e608ad4853e017f3f3da7f22ff15c56ecae205d2b156ef2ac9751cefde65c9b1fab790a23f1215a79a2d
SSDEEP 12288:BOOgiLyqHEuFQTVVTyvRBPHuOrEzBGUMnVZJ3eQDO1PanF/wLA3o:gOVRlQTVVTyvPOOrTaanF4h
TLSH
T1A0359E9EF6A40AE5C5AB8134D2C1452BD2B678011760C7EF06E693A51EB3FDA1E3F305
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VBoxSup.inf

Path C:\Program Files\Oracle\VirtualBox\drivers\vboxsup\VBoxSup.inf
Size 2KB
SHA256 472f69d3b956ea8eb7579c144c438533704f4cfe905604931a0658ffdeab9ddb
MD5 4cac39eeb410260aa5c79b042b495f23
SHA1 2d51874e0a0d6a21b61ce7c5ecdb222d4ce3b286
SHA512 dc8fc327773ded37956364879220cacdb472ecb8a8e9d4a3c8c0d19a111e413f500306d228e44295d3be41a925dfa12a4d6655022ef96fd8655d401fcbb74612
TLSH
T11051616E5840877139A6029A3F0BA6C7F3E9701A3CEB286030DEC916925DC2C87394F6
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 8774e5b4c245670b4fd2683cc0f6273af62477136ec51bc0cc4bf9b3cbb91105
MD5 eab051ac5b032dc817c4966dc02e6706
SHA1 8914676de845131cfdfa4f51fffe65f3d4232073
SHA512 e7ac1d525c8257fa879f8950a55f331eae633eb94157d358cc6970bc02ba121b09fc7099b346f2ea5e0096ce865e806a7314e8153e629dcb3a6f4f17cf6dee4f
TLSH
T12481B96B4942727DCB5955B104E104AA7AF98E9C33438EF5404247FF4B9E3A5D04D376
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 0c72aaf916cb4e384c7aecf0dc186630f23e423e1a75eadac8cd53c3eae67154
MD5 aab5a1b84f8b1426b56bdd3fd3d6e84f
SHA1 3c2ce841867cebc175e775eb94f35b3bad4164f8
SHA512 af7212d4d358c2326436adcadde39f584928ab73e532e82ee06dc48e463a65472143dc38c8f4d5a31a5aa56e768b389b87f7f8ad9bcfe2d36e322ceca15a12ca
SSDEEP 192:Dc4I94cbiwdJmwmwJkyHu77o9WkKNP4aPDvPfPFNmlmmmsVmDmtmzj:Dc4I94cbiwdJmwmwJkyHu77o9WkKNwaF
TLSH
T10BF1AEF7C3D8866DC91156F4EB156F1FCE2A0A28432C3C26C8D4AE5B93E2971D25534E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 8b93838458e5a94504690c7f247dc9e02e3230a4faa338aae9c36aa08d2594dd
MD5 6065c6840594ff5c7c4fbbbd7112de13
SHA1 6b2882b8b35ec7562491a675894bd71b6498d79b
SHA512 506aac71288759d5e10ca40e10a9abfcc89514c318b769483408cf9ef76a31019b6cf716a2e69ae0d89f558dfb1feed3bdfe05b6e34e9a2c6250a8538f0f0d36
SSDEEP 192:Dc4I94cbiwdJmwm90JkyHu77o9WkKNP4aPDvPfPFNmlmQmDmt0mzmxeK:Dc4I94cbiwdJmwm90JkyHu77o9WkKNww
TLSH
T13C02AEF7C3D8856DC91156F4EB15AF1FCE2A0A28432C3C26C8D4AE5B93E2971D25534E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 9d9c447eb75f81376818ebb6f8f309617400fbfd7bb379bef3f837bbef603cdd
MD5 5953a4f4ef3a47a75e4a9af981a7be8b
SHA1 85c87a5c259b9d0b13f3f3a0c977289a97db64b3
SHA512 ec6a56735b7dddb647e65cdb7a0d6b9745052db2293d9feed6b3982fc08192d851f222d8f293d9833010e69e3b8998a49e6f697c071403f991bd2171a1dfb53f
SSDEEP 192:pRPcBzs1xBv7pLPRprvWDyN49XxHsb+WN55sTnzhYS2MHN20f2teUyVyIsnAUgE:pRPmzsLR1Xafwk9gW2i2YE
TLSH
T1F252A62FBA10597B6DDAC22DF955BB56E7F2102166D42E40E7FC8A2C01EB6CC6217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 4c6bb29dc79470d680643e6907ef7264f006a84b00fdaa8d19d54171221ba397
MD5 a2d7b47d1d82d3e8535d51a3343e7b15
SHA1 4089b3e600add91e22b46545b7fcaf0569b81fd3
SHA512 57c6142d7a06d966c72fad41c6248126015ca67a301962ca0fbde8ecf7924c435adcff957eab1eab323678aa210f8db6c74d8f95064f0b099c907c719383d806
SSDEEP 192:pRTIaxVv7pAPRp2o9XxHsb+WNnR9Z0vf2teUcVyIsnAUge:pRTIGlAXjfwF0X2+e
TLSH
T15732752EBE10693B6DDBD22DFA667B53D7F6102161D42E40E6FC8A2C11DB5CC622701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 b6ced70316a9f025aa74ec282fcf345c899f70036f669476221aa74de70a9381
MD5 92e6ec065b91697dd4c9de4c0c00f9a9
SHA1 2e12e399d07057b9d867f7761607dd0e17572e32
SHA512 151ec36c6d8771936e245a7d89b8747b1288deb3429ac207ba445205b60481b29d2cad3902c6c9172a018d5238511376a0ea4fcccb4241fd0bbbfc06fe982c6d
SSDEEP 192:pRPcBzIaxVv7pLPRprvWDyN49XxHsb+WN5FzhYS2MHN2If2teUyVyIsnAUgE:pRPmzIGl1Xafw5gW2G2YE
TLSH
T1D352A62FBA10593BADDBC229F965BB57D7F2202265D42E40E7FC8A2C01DB6CC6217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 d826ee4bef5b72dc298f534cc48160e4222fd904c6edbc0ab626cf565f40d265
MD5 f0fd275faaaf23749616279aa855719c
SHA1 6e86d7ca758bdc887bb94e9878424c3bc1012867
SHA512 b5bdd6c4048789d1b0eb7d30767d49ad066c2c92865f7f6638f9dfb67e1513cfb7329d3b532ebd9d820d1b5f105c5bf8c7c0f957ea2e9394dbf05055f6bf398d
SSDEEP 192:pRPcBzsaxBv7pLPRprvWDyN49XxHsb+WN55sTnzhYS2MHN20f2teUyVyIsnAUgE:pRPmzsGR1Xafwk9gW2i2YE
TLSH
T18852A62FBA10593B6DDAC22DF955BB56E7F2102266D42E40E7FC8A2C01EB6CC6217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 24a2ccbe5ed36b062ed9206eb4fd5475c7dd8e99b785f73f0d1d3c440be93dfd
MD5 7598b499bc5acbaac6e2445ff86beb53
SHA1 0bd7d944ebea96339601c70e45a23b24a1bcf7d5
SHA512 f55530c806e8462b35b4920eedd24d3e863ba9768c5757c16c88f03b8a161e29352cd548434d2fed6000fbc1b80bec91e3e93f7b5c91e5d1d5f958889de45b6f
SSDEEP 192:pRPcBzIaxVv7pAPRp2vWDl49XxHsb+WN5FzhrHN2Zf2teUcVyIsnAUge:pRPmzIGlAXmfw5J2l2+e
TLSH
T19242952EBA20693B6DDBC22DF9657B57D7F6102261D42E80E7FC8A2C11DB5CC6217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 1c887b10dba1173379829712fb47e93b6dbf0d9aee72dc2493119d470901bd20
MD5 a100b2f98fefcb926301ccf900a97b62
SHA1 f0726d38e16253db8db4209375e57545f77ee3b8
SHA512 565025ca137184c5ce4de8e64bc49a5fb1e7429cc99b517325f6fc4a71e18756a3e3a93a096b96b6ea79293e68e7445679c11d4d416792813557160ec30f8727
SSDEEP 384:/9j0X7KxkXqKf/pUZNCgVLH2HfgslNTXOD0b+ErU390HGSEM8Pf:/d0X7KxkXqKf/pUZNCgVLH2Hfgs77O4Y
TLSH
T1BD52F827684D9A3F0FC8D64CDC166F8FADF60146A6784D2497FA5D0803A97DB110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 0fbf3cb97aaa92506e284612e148accd183cdfc9155bf9a34b9f3ed107ab56a2
MD5 fec00c38429928398df1231bd06ed61a
SHA1 c22c141acebac9df877a2e371e3762e3829373e6
SHA512 5bb2e95f9871e115d1ff12a2e0428503426c63b19a72ceacfdc77c0774e2a32c875f955dd4746341ddeb1aa01bf0d65b73a4b24820b0863b7bec2b1d3d140273
TLSH
T1E8A0022B0D80152AE00C927051C10249F319497001814705C1D45446889C951C571C04
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 84b085ae0f0053a280d274bd83c025f8d90338d5dbcdcee15f9159e5b75678d0
MD5 7a1fdbeeb40d0aa1b9c480fd81fd4d25
SHA1 439442720298a6a6c8ae97834ce4f08dc28baff8
SHA512 d89370d52f5c71c79ce1a3db0e7f54f35cb91e60d4ba7439449c4f5a1d16112e71b806fc3c3e2884ba386678091efef0202a9fffd6ce5866d439eb3a61b63330
TLSH
T185A002A382C04C76CD118674646245E12295586856915347D5B21C47986F1E48206704
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5d0f64.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index~RFe5d0f64.TMP
Size 48B
SHA256 11c20529107f1004b90ae64cfce97850ac335e1c71b8150cb26f36fe775cc73c
MD5 00d0d06b20f12c6a4463cc2151fbf249
SHA1 f76d73ae6f3ca447588d83b92255d623aa2105dd
SHA512 6a95df8f42651cef80a77f2e7df6dc92976e2f4a9b1a3a3a2082ac3eca3b61524a1c6067ddca3c803e924a7965b9093233e562705205cae3d5c4b54f9f892f8e
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 161KB
SHA256 ee6f7954661e102099753a800e5aa5bdc881932e2e390dbeb990055c4c09ec4b
MD5 121ea92ad04190a550b4b8a36b156097
SHA1 ad0c82d8b8541ccc4d60717352768fe5aee48062
SHA512 42cd809df6554d94280e83230513fdeadcf16b230eba1a03b1d0e9248823092cda9e96447fe1bbf1e04704f32959d95abfb19820b1cb84343230fe89b5cf4bb1
SSDEEP 3072:laJrqHiCajGjdQ1SfBqC8QAa/qKYhcc3sM6+MeV+8hTtTHiA+9wCUedCOak:0JrqCCCCdkyBtza5n1+IuA+9wCUedCG
TLSH
T16FF31333AF3C0E9315F57790745E4653CCF4B2AAAD5676B84399370A81C34A29B1FC8A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 126KB
SHA256 69f6a7fa7b47a010acc9f914e2f39321a8975255311d6540c763160f1258055a
MD5 ac6b04fa1f3523fa7e496bd2d702691c
SHA1 50a377544d7f8d563af0663cf21eaebb18314989
SHA512 d5ab2d539b5c122596a9b3ba52342312370b54a3dfa88378e7738b583575ba7d4215fd65fa2ef12852d1ff368d65483b7a623429c449f2e9e8b74c55f9aa170d
SSDEEP 3072:lQ1SfBqC8QAa/qKYhcc3sM6+MeV+8hTtTHiA+9wCUedCOak:lkyBtza5n1+IuA+9wCUedCG
TLSH
T1C2C31332AE3C5D5221F62B94209F9B57CCB0716BED5676F853943F0B80C3491AE5EC4A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 126KB
SHA256 22214004e003a95a173d284e7e34df79cc84aac2a831a76758133bf8abdb7658
MD5 62d6f6df284b450b28fba2bf895d42a5
SHA1 7c286fd86f239cc8a7f876e5879a7e3910c91e2d
SHA512 b51605a8c97523d847ccb2259cb85a0f2d9ceea42b140a4977e54e62d20e25ed137cb9033d9c60b0f11a98e96f6351e06fadb9db1fc6da81c2d1e81b5658c482
SSDEEP 3072:dQ1SfBqC8QAa/qKYhcc3sM6+MeV+8hTtTHiA+9wCUedCOak:dkyBtza5n1+IuA+9wCUedCG
TLSH
T1BCC31332AE3C5D5221F62B94209F9B57CCB0716BED5676F853943F0B80C3491AA5EC4A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 125KB
SHA256 0ed635e93b1515c98d05c3dce77ac1f61d00ae18f4cda605c921e43c8181ec03
MD5 bd59be3fe34c63364cbcdb9bbe5dca92
SHA1 dbda2c3cbe5fed000b7c218be30a15b379a8281b
SHA512 bbde7c9dbfa3b283d1e39d36ec6e738822824d2e322301c4709833fde3bf41e6824c32be6f3675974f3d0826562ef26354b93f7f163708267333457145d8b0cc
SSDEEP 3072:wyQ1SfBqC8QAa/qKYhcc3sM6+MeV+8hTtTHiA+9wCUedCOak:wykyBtza5n1+IuA+9wCUedCG
TLSH
T17AC31232BF3C5E1222E6375460AF8757CC707264EDA635F493943B0B81C34A1AB9EC0A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 7e2accd9006c6e4b3cd96dc30cec779b6a8725bea8fc70d2af1e3f170700c75a
MD5 7d6496ccb5239f1777321ca3e7d11b31
SHA1 1210ae03a204497f49b2f9be4e91b6b0d1c62b09
SHA512 3f5f0fca434f623f85ecaca3d46086e3baa0c17570f6ae993540a07bc667152f83b48472b00cd9738e800478d2aee97b2b55adc78d3305b100200bd7becc17eb
SSDEEP 96:xC0d+r2io+TJ/E0f6m934zM4RDotok5cumDIaB6nGyvn0b4T8PybJv4a:xC0ITo+TQ0InDUD0IKPPb4T8Pybl
TLSH
T123A1F835A0284DB74476D44AB1626A53CEB97067E972AFA0EADD0F0D15F70EC1341A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 126KB
SHA256 f8386745129559963035ac85f43bad37f4dd6f4648e87042c7967965b1e425a1
MD5 e700e13f0172367c59adcb3d347edfc5
SHA1 7db9af0c6b20a60e57c943d3f159e4f752d59d30
SHA512 6e8990cc49bacb07ec472f54caecbf20c850bf4f2eeb4605f8db73fdb006967db768c0199d442d211b3369bc5427abf86b72491f32b204abc10f402400dfc18a
SSDEEP 3072:tQ1SfBqC8QAa/qKYhcc3sM6+MeV+8hTtTHiA+9wCUedCOak:tkyBtza5n1+IuA+9wCUedCG
TLSH
T103C31332AE3C5D5221F62B94209F9B57CCB0726BED5676FC53943F0B80C3491AA5EC4A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI99b9a.LOG

Path C:\Users\Admin\AppData\Local\Temp\MSI99b9a.LOG
Size 124KB
SHA256 79b73504d5f0eb147bce72ff5369bc0e85578056ea120e43299e501f4ac11d6b
MD5 e8c5f3d7ae303ab37fb4ab01bf715769
SHA1 99a4f45cd219a61e6bed0c65eee8625d79faacc0
SHA512 d495af49d251e53d255f021930be304e8956ad7b355945e76d93403756e9c9de7c7310895e9e8ab48d98d7823701a9418b974da442d3a72775bfe1c238a72922
SSDEEP 1536:cqY/lTlpVLjGAfXJ79Xtb53VBmZnpTp/pTprhNfRjBmZnpTp/pTpLBNfRjBmZnp8:EmoboomHRScN8SU0JX6UbmEaeE
TLSH
T1FAC326296FF41246B2B797479EF704274E37B91A6935CD4D20C1C60D41B2E09BEAC3AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIA157.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSIA157.tmp
Size 494KB
SHA256 98a4a140ff5195bb9564efe60457e495289d9808b28eb86d672d8425535a42d4
MD5 70470dfc01443fe1a8937a10fc137dd7
SHA1 7fc1fd54c11b3a35d2578486e0758b109eb0beae
SHA512 937e00deb88b078bbc3ccc7ef52f8b636e240213a190f76904da093a8bde98fcdbbfb1e75ffcf6a2abdd124b77f5669c84311b0aa2739c7c9f810ec3cd4d210e
SSDEEP 12288:BnnOZtHHUd0UxCcsWnOtlmVI3OXdOwZ+cA2sPT:1AtHHUmUxCcsWnO3sdVx8T
TLSH
T159B4AD66B7D12B75D85BC13D88A34002E7F37442131482EB47A682594EA3FD2BB3EF65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3344_1423614568\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

default.exc

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.exc
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Roaming\wrapper-offline\Code Cache\js\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\wrapper-offline\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 fe13de53845a00ead2d1af4df8da8a16f106a8bc5a86d46d4f5832df66c1f5b7
MD5 8f34b03ba2b3d78b0b9b0271437d2b94
SHA1 d456b68fbaa77b149323a2954f807f6d67e594dd
SHA512 4e3c9dbcf135b6d960a92a0843394b20aa5be0e3d53ede59423ef9db32780340a653a884e6fb980146da4a137307ccb9cb00b030723bca656d87c208fd5e1e27
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\wrapper-offline\Code Cache\js\index-dir\the-real-index
Size 144B
SHA256 7f017142881a1648e0b8b81ad31090ae2fdda2e2fb963cb39d285d08d7651cb9
MD5 41130d3c5c6ff2e303308e60de40d07e
SHA1 9a909910a5c16c7c54e2cf70b28b48a24b4e60f6
SHA512 1144a599068fea6fa52f4bf8fafa95ccaffacee10002bb6b5b3dc3b50a513fc8d87caf52dc41a5f3b147d131f01515dd94ee781e1acd62066078dd5975cc60c6
TLSH
T1ECC092A30430550EC31239705ABE2000B671942C07530ECB408432BB916137402F9401
MD5 SHA1 SHA512 TLSH

Submit Download

cacheSize.txt

Path C:\Users\Admin\AppData\Roaming\wrapper-offline\Pepper Data\Shockwave Flash\CacheWritableAdobeRoot\AssetCache\XC7CWPTZ\cacheSize.txt
Size 7B
SHA256 f118f098b0c1ef31cb3cac91ebb02f9b90bfaadaa481ad50e87a633d17ffc6ff
MD5 37eb49cf0aa467710c059db3f02e0e54
SHA1 8c654607c5323cdde67db5b91d147b7a9ab1ab93
SHA512 88700af0351cfeb89c4b8950ad22038cc372541412bcff19e06bfa7d04af1de9e132f7909cb0aca9a37540b8c0525f000f959ef80fbc27f88666f224679f3d7f
MD5 SHA1 SHA512

Submit Download

cacheSize.txt

Path C:\Users\Admin\AppData\Roaming\wrapper-offline\Pepper Data\Shockwave Flash\CacheWritableAdobeRoot\AssetCache\XC7CWPTZ\cacheSize.txt
Size 7B
SHA256 9dad54d77e9610c358763b14a6eb0a429e21baf02d5aaa7e88dab7dcd3bde7fb
MD5 c975d128f512cbf5368a62e21fbd680e
SHA1 72e5ce89e9933512315427e7f4e4a775acbe7700
SHA512 8b055085e91cf69cb019fd8f9b7b64c942a6a5080e5eab0c74b30f739a37750610386ccb3d30f5def1b9e5e0b4844ed54cfc5927608e68d36bc117279f4353a4
MD5 SHA1 SHA512

Submit Download

cacheSize.txt

Path C:\Users\Admin\AppData\Roaming\wrapper-offline\Pepper Data\Shockwave Flash\CacheWritableAdobeRoot\AssetCache\XC7CWPTZ\cacheSize.txt
Size 8B
SHA256 1baa438bd53dc0283dc04c099ca04cf3bc95f91da64c92d5d6431787cd13080a
MD5 b039ceb2b8ec9b8f72f50afe98e99825
SHA1 77d2526998a67102ce178b4a8534754841f68af7
SHA512 feae7373a4ba0c67925489c17cdb37be92ee678fef4701dc779974b3fe57859953cac3828610f6af6a69adf323014afecc429ce0796f6ca7db3048923e73d0a4
MD5 SHA1 SHA512

Submit Download

cacheSize.txt

Path C:\Users\Admin\AppData\Roaming\wrapper-offline\Pepper Data\Shockwave Flash\CacheWritableAdobeRoot\AssetCache\XC7CWPTZ\cacheSize.txt
Size 8B
SHA256 a8f9313b8930472663dc9162fe1d3539939202de77f38ad082cb1bde564613f0
MD5 1ae1851cb6ccfe80274c1610e999d1c2
SHA1 b480754c4504ca1bcf9e9e3196b8329fe4e2113f
SHA512 28c6ad8c8cf3cae3b1f59fda5ed7e5d91ad94eab3a3760fecfa690fd21f1e32a2d550f7a4a204c7c608e66c608968609c50040ff4fe1525708ae0f84bfeea353
MD5 SHA1 SHA512

Submit Download

settings.sxx

Path C:\Users\Admin\AppData\Roaming\wrapper-offline\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\ULJUUGXU\macromedia.com\support\flashplayer\sys\settings.sxx
Size 1KB
SHA256 bc1b4c25fe5d71310c70ce71cc1d054144509dd72cd46eba9dbcec161cc98edc
MD5 b9a44901ed2461618b9b4e468cd5427b
SHA1 99f2388ac85f19cebaa3f522b4e58cebf1b0a04f
SHA512 c38a874eaa97077148e79938c44677b3c93a062bf47a82e870ee85299342b98f401f2f006d72acf8cc7046fb237188e5e21e810773c7da7530c91e8216e0ed04
TLSH
T15A11AAD31E348715E327633E6596002C3AB19B3F111268B2A4D044798E6A9FF8E5EEF1
MD5 SHA1 SHA512 TLSH

Submit Download

settings.sxx

Path C:\Users\Admin\AppData\Roaming\wrapper-offline\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\ULJUUGXU\macromedia.com\support\flashplayer\sys\settings.sxx
Size 1KB
SHA256 e4f51ebc4f4c271053ca3ad00b3583018c2fb4f54cf0bcf17c6cb068865160d6
MD5 052e1c989ffa15f55bcf64ff63fca603
SHA1 c2f6938a6ba6f2f66a1ab877553a6c5f6ff4bcd2
SHA512 5e174e95bc5f31cde38ab8580069ee97e960acca5ca891576d64375ce47d8980a607da8c5f22c9d9098c8c845f7ed1ccf0cd82bcff2c5b295be8d799a9f1c211
TLSH
T10B21BBC31E348314E367633E6556012C2AB29B3F111668A2A4D044798E6A9FF4A5BEF1
MD5 SHA1 SHA512 TLSH

Submit Download

settings.sxx

Path C:\Users\Admin\AppData\Roaming\wrapper-offline\Pepper Data\Shockwave Flash\WritableRoot\#SharedObjects\ULJUUGXU\macromedia.com\support\flashplayer\sys\settings.sxx
Size 461B
SHA256 af7f65fdd5b1724ab62cd4d38a39d94faa9f6c26e6a51b96dbafd74a346aecd3
MD5 c221b937ed90b5eb49840e4674cf5438
SHA1 0c6718ea710d0ebdbafe40266cba5b63231d43f1
SHA512 5dbbf3246762265d835da0e0e8388e777da5e99fc86b049a779f039dd1adcc4aded1870a89c40e581e2d9bbe28153b0d6529413bee0ee9f199c1b60331a12b9f
TLSH
T1E7F0AB827620C5A5D66F4E3D2144623C2A32AB6F31963D5260D9A1710F8E8F68D0E791
MD5 SHA1 SHA512 TLSH

Submit Download

database.json

Path C:\Users\Admin\Downloads\wrapper-offline-win32-x64\wrapper-offline-win32-x64\resources\app\_SAVED\database.json
Size 32B
SHA256 34fc985a234d4b16b445903063b843fa32dabb2f5d4091a911daeda8bea2cf68
MD5 afa5afdfcb69aedc307a8ddc19fd3ec2
SHA1 d6560c1204bd7ae36273ee48dbb4e678b801e01d
SHA512 86b73d6732cdcef0cd8497cb58d5df3f05a58672c3e16245bd01462ae32a469ab7f7fddfc257f3be2818210c8b56ec8acdb11708937da7a94c0bc242899dfd1d
MD5 SHA1 SHA512

Submit Download

settings.json

Path C:\Users\Admin\Downloads\wrapper-offline-win32-x64\wrapper-offline-win32-x64\resources\app\_SAVED\settings.json
Size 97B
SHA256 8996466195702b1bc7149411513f926584aeb26c01c1156293a086b714ce01b5
MD5 6ad5175881f26ec8fe9a80e92d7cd4fd
SHA1 ddd994927831b17cf53ef69609c111a179097267
SHA512 a159d58c096da95aa024493e9d883ab196d7213bf82e58892709dc4f28380553c0d3cec4d0612f78fb0491be1ea529cb7f1bac0622a65157390123acb60624c6
TLSH
T127B01240C16A8EBD0362910C4C9C209585BD520801D7106CD0004DC8D00273204C69C8
MD5 SHA1 SHA512 TLSH

Submit Download

oem0.PNF

Path C:\Windows\INF\oem0.PNF
Size 6KB
SHA256 d57c5c0d7f083e145ceeaab87a14f4852439f40b713305907d0a99e81db9fe2b
MD5 56437f9a45f8a079e71b6bdc24f19f41
SHA1 caf00a284c6ff8ab3343b3bf9f25fb6ef42d61e3
SHA512 81ae0557887e73035812563a631da952d867f9d1d5b6d4bfea040d90d311e8179a1af5869e0ae2e833839d2ee5fec9836b010d36ad8f5f8e6b630a020ce3fc56
SSDEEP 96:l4rgQY2e/NI0IXSu6o4zvM181fQ1UvZUuQSCUJ:h2e/BfosxZUK/
TLSH
T1BCD14646B3F88B15F1BA9B306DB512E65432BC619C12C71F3160338E0D72E949AB0B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI9C70.tmp

Path C:\Windows\Installer\MSI9C70.tmp
Size 383KB
SHA256 61a20a2e5b2e759c2db35545419cb75ab9db16e66fd21ce580a6f9836f3e7a9b
MD5 bca7365c591167f140b6ee5af5cda59e
SHA1 a6f299b5e70bd7c5b6a724fa869b0d8fcd0bb4a0
SHA512 c5651e422034c625e4abd3a46458069e6a9c6e74fb189ab06a3ff32ddc843e023cd68106a52c6d850532d0ca4650d370f063b8fde9624fcf8fd2f6ef700b9bd5
SSDEEP 6144:UEMG77h/h+OuGMgdH2NjItYRzCuY88tTUP8Mng8:UwJZbMtItYRzCuYVTe8M
TLSH
T12D846B29B7E408EDE4B78276C5A68131FF75744D3720D5AE8BA8452D1F3BAA070BB701
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vboxsup.inf_amd64_1c81afc043e2b4e1.ini

Path C:\Windows\System32\DriverStore\FileRepository\vboxsup.inf_amd64_1c81afc043e2b4e1.ini
Size 418B
SHA256 45fbe1c56a303bf19bfe4c55a990b15da8b1121d181ac84ab8fd6a72e386f4e7
MD5 685dc4c9c0c2c103aeaeee9546735514
SHA1 acfeb7056ce6e8754a22190e2ee9507d54bc33fb
SHA512 28777aa33a4da7ebaaaa7a43e15fab535f9a010a6188fd6ae78b46935e8697f69521411547e0aba8fda968422b36502fa9cefc7b5d30550992117a507d8f16b1
TLSH
T16BE061815570DAFF804442816F3E0E79C4D5F15FDF19249533C1D6D06F29C2669D9B93
MD5 SHA1 SHA512 TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 26.1MB
SHA256 a7a803054c2d12a30e28485a749dbe4272b118435d7664e93539d54b9c94af34
MD5 d4244d227d600aee6fc56553827f7834
SHA1 e06a1ebcd69eb1987ef9fcf0decfd1be744c32a5
SHA512 8c6fc154f87db4d3d418c81feb2198dce61446a2a7541413093c0f95e38a74e50aecfda486955cb24852d0783ccfc3deaf9ecc67c4e31dc5e7b8538ce0d66579
SSDEEP 24576:lFo3DMPRdoO/vvTL/Sg88iFQvrumHb7P0BKudxSUKpyKpb9cMoRWclmd4+S:xHU
TLSH
T19A57B42436F92200E7F79E3DA8F06A234D397D5BAC15DE8D45511B4E0822F71E872F6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{48756005-48e1-46ff-ae17-1e6d13d62999}_OnDiskSnapshotProp

Path \??\Volume{c61f3bad-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{48756005-48e1-46ff-ae17-1e6d13d62999}_OnDiskSnapshotProp
Size 6KB
SHA256 240e5874d5878ef46ec20e438fc3267d344eacd9e30a436ad38a449d30b1b2fe
MD5 3307e72f9153c81b269f9c54a5904286
SHA1 11b2fd675107da4bdaf9b0bb4ff211b989b28215
SHA512 1fdd494b7bb6367866d47c4a0618c5a4c5c8de1c76692c53c0d13e1b5442ca49553abf9e2962c95008846cea3e25d55adca0aaf5764ffbab208d56dcf9de0584
SSDEEP 96:FHn/7dICvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpuN:Zn5Ieb++uVmN
TLSH
T144D1780C5AE54711E2B3AB7229F14557A877B811EF33CB8E0198238E2631A10F975F6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1316-50-0x00000274B8D50000-0x00000274B8F7D000-memory.dmp

Download

memory/1316-44-0x00000274B8D50000-0x00000274B8F7D000-memory.dmp

Download

memory/1316-1309-0x00000274B8D50000-0x00000274B8F7D000-memory.dmp

Download

memory/1316-1308-0x00000274B8D50000-0x00000274B8F7D000-memory.dmp

Download

memory/1316-196-0x00000274B8D50000-0x00000274B8F7D000-memory.dmp

Download

memory/1316-1289-0x00000274B8D50000-0x00000274B8F7D000-memory.dmp

Download

memory/1316-1237-0x00000274B8D50000-0x00000274B8F7D000-memory.dmp

Download

memory/1316-1229-0x00000274B8D50000-0x00000274B8F7D000-memory.dmp

Download

memory/2128-4176-0x00000206FCDB0000-0x00000206FCE86000-memory.dmp

Download

memory/2940-4172-0x000001C0FAC80000-0x000001C0FAD56000-memory.dmp

Download

memory/2940-1530-0x00007FFA68AD0000-0x00007FFA68AD1000-memory.dmp

Download

memory/2940-1529-0x00007FFA68C50000-0x00007FFA68C51000-memory.dmp

Download

memory/4220-197-0x0000026487B70000-0x0000026487D9D000-memory.dmp

Download

memory/4504-1279-0x0000020869A20000-0x0000020869C4D000-memory.dmp

Download

memory/4504-354-0x0000020869A20000-0x0000020869C4D000-memory.dmp

Download

memory/4504-1412-0x0000020869A20000-0x0000020869C4D000-memory.dmp

Download

memory/4504-349-0x0000020869A20000-0x0000020869C4D000-memory.dmp

Download

memory/4504-1392-0x0000020869A20000-0x0000020869C4D000-memory.dmp

Download

memory/4504-43-0x0000020869A20000-0x0000020869C4D000-memory.dmp

Download

memory/4504-1310-0x0000020869A20000-0x0000020869C4D000-memory.dmp

Download

memory/4504-1290-0x0000020869A20000-0x0000020869C4D000-memory.dmp

Download

memory/4504-45-0x0000020869A20000-0x0000020869C4D000-memory.dmp

Download

memory/4504-82-0x0000020869A20000-0x0000020869C4D000-memory.dmp

Download

memory/4504-812-0x0000020869A20000-0x0000020869C4D000-memory.dmp

Download

memory/4780-1520-0x0000016CB82F0000-0x0000016CB83C6000-memory.dmp

Download

memory/4780-1432-0x00007FFA68AC0000-0x00007FFA68AC1000-memory.dmp

Download