338c92562300957fbb21ed6c3b048d366d17afb62ee14c17cde68d5005604983

Analysis

user interaction
yes
max time kernel
1049s
max time network
1039s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/07/2026, 23:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
winver_edit.exe
Size 569KB
Sample260730-31nvkshf26
SHA256 338c92562300957fbb21ed6c3b048d366d17afb62ee14c17cde68d5005604983
MD5 bf46bc146e40788051cc7f6a796fa592
SHA1 8a477923f16dc5dd39344c042792d436d1d266e9
SHA512 4eeae473730005124b2206630b0e58b417e668067e1c827afeaa811c4d4bd3f543bab69b474458469186d05b2d6eeecfad4c9aef91d52bb89eed185da0c04fd4
SSDEEP 12288:6YWoQFwrvBHj4dLT+yMTXS35eKvxyPKQLwRjcAUuLyDQHH:6YWoQFKvBHjOGhaRjpUuLj
TLSH
T131C4191B4FBE451AC1D0ADFA0F307269E4F19980061DC763CF6AAE6C5E3DAD43A858C5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution persistence

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
271	4212	chrome.exe

Executes dropped EXE 1 IoCs

pid	Process
1020	winver_arkheos.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 9 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3344	powershell.exe
2140	powershell.exe
1488	powershell.exe
4416	powershell.exe
2188	powershell.exe
3048	powershell.exe
3856	powershell.exe
4540	powershell.exe
1280	powershell.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 51 IoCs

pid	Process
1392	chrome.exe
1392	chrome.exe
1392	chrome.exe
1392	chrome.exe
1392	chrome.exe
1392	chrome.exe
1392	chrome.exe
1392	chrome.exe
1392	chrome.exe
1392	chrome.exe
1392	chrome.exe
1392	chrome.exe
1392	chrome.exe
1392	chrome.exe
1392	chrome.exe
1392	chrome.exe
1392	chrome.exe
1392	chrome.exe
1392	chrome.exe
1392	chrome.exe
1392	chrome.exe
1392	chrome.exe
1392	chrome.exe
1392	chrome.exe
1392	chrome.exe
1392	chrome.exe
1392	chrome.exe
1392	chrome.exe
1392	chrome.exe
1392	chrome.exe
1392	chrome.exe
1392	chrome.exe
1392	chrome.exe
1392	chrome.exe
1392	chrome.exe
1392	chrome.exe
1392	chrome.exe
1392	chrome.exe
1392	chrome.exe
1392	chrome.exe
1392	chrome.exe
1392	chrome.exe
1392	chrome.exe
1392	chrome.exe
1392	chrome.exe
1392	chrome.exe
1392	chrome.exe
1392	chrome.exe
1392	chrome.exe
1392	chrome.exe
1392	chrome.exe

Launches sc.exe 37 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4464	sc.exe
1536	sc.exe
2656	sc.exe
1684	sc.exe
4616	sc.exe
4868	sc.exe
3092	sc.exe
436	sc.exe
5000	sc.exe
3648	sc.exe
1536	sc.exe
3436	sc.exe
4372	sc.exe
3048	sc.exe
1152	sc.exe
1052	sc.exe
1076	sc.exe
3356	sc.exe
5092	sc.exe
3932	sc.exe
3092	sc.exe
1984	sc.exe
388	sc.exe
2104	sc.exe
4232	sc.exe
640	sc.exe
3724	sc.exe
440	sc.exe
3180	sc.exe
4796	sc.exe
4304	sc.exe
2712	sc.exe
2584	sc.exe
2860	sc.exe
3016	sc.exe
3688	sc.exe
1328	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Executes a command shell one-liner 1 TTPs 36 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4756	cmd.exe
1216	cmd.exe
1472	cmd.exe
2620	cmd.exe
4376	cmd.exe
4156	cmd.exe
740	cmd.exe
4100	cmd.exe
3900	cmd.exe
3492	cmd.exe
1100	cmd.exe
4744	cmd.exe
3096	cmd.exe
5064	cmd.exe
3236	cmd.exe
4520	cmd.exe
1184	cmd.exe
2304	cmd.exe
2860	cmd.exe
4492	cmd.exe
3696	cmd.exe
4636	cmd.exe
4392	cmd.exe
1564	cmd.exe
1828	cmd.exe
3732	cmd.exe
2724	cmd.exe
4072	cmd.exe
3100	cmd.exe
964	cmd.exe
4740	cmd.exe
4808	cmd.exe
4296	cmd.exe
4900	cmd.exe
1712	cmd.exe
3016	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 6 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3100	cmd.exe
2784	PING.EXE
4392	cmd.exe
1824	PING.EXE
4492	cmd.exe
3900	PING.EXE

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4212	chrome.exe
3832	chrome.exe

Checks SCSI registry key(s) 3 TTPs 12 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	clipup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	clipup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	Clipup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	Clipup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	Clipup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	clipup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	clipup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	clipup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	Clipup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	Clipup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	Clipup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	clipup.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 25 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Property	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{D6D5A677-0872-4AB0-9442-BB792FCE85C5}	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\IdentityCRL	reg.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\IdentityCRL	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\IdentityCRL\Immersive	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\IdentityCRL\Immersive\production	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\IdentityCRL\Immersive\production\Token\{D6D5A677-0872-4AB0-9442-BB792FCE85C5}	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\IdentityCRL\Immersive\production\Property	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{D6D5A677-0872-4AB0-9442-BB792FCE85C5}	svchost.exe
Set value (data)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{D6D5A677-0872-4AB0-9442-BB792FCE85C5}\DeviceTicket = 0100000001000000d08c9ddf0115d1118c7a00c04fc297eb010000005cbbf88555dc124181ee187f97d64b8300000000020000000000106600000001000020000000402cb1f8b4633743c21952e4f8615228ddfae1545fb2ee5962073d34c73c4a8d000000000e800000000200002000000057bdfaf60af542ba6298c81d4dc5158cb9a150ff523521a5d1578ac1acba6345700f00004f1d3c3e72ded9ef665ce27f8a469163974c1fecf4bc4cead3637165c180feecae81909e2711fb99acf69a6762626e2b1d30fe33094c527ae721b696bcfe6525c156c6f403d8f2263a3bf87a2aaa1777b7ce8d98dae587da9ded7dbd6e4214c62c136cf3b072a40a7c9f0be3ccc1169f6e769fba5976087c13b8130341b1c1cfb90bf2cf46ade77262a5b22e28a05134ceb9ef6689fba61d59cecc6023c0e920c85c8ef8b2d6fffb0fedf63b02ecb5019dbcc351d240149ed040f8cb13b5f3ad423e40feffa8fc96646d7ebb525344b47f5e14a5a5ba8cb67d75e09af928ebc9483d85b19c1115cf0604d2427b715662491fa50480d8e3f7c739e3146fe08165aed7d97e3c84b4b2261614c34a425371ced5ba009e5ab78c0a4d65df3f32a1fd18ba2910f2fe9b2a1712207a6e15cd44b8c5849fa794486c73dfd15cc6089d1871acc3a0979e02d54345a6802f8d4e5bf1cf8da73035975de80cce28b045d520721c7a74a0cf9dc254ef83043cbe26e10e3b75e9030482897b698cc0303a8bcd3ac5719772f0dd414204d260edee00daa580116042475b9bc967ca3b5b8ed910e43ae450a4f92f91a0ca1f4cd8eed8cdb592bbfd68aebd1af98b795667570ffafbf040310972ffb5962d3c02c9b464ccb80e85093dcca2237c6f5893cf5472b1cef5cdbd6a4568dce7541378d0c582576b68a4d1d3de96785ddde3abfcc70430927cdaeacc271ce8b3e7de7fa31163601a08f2d1cb02622d76d67f2666df8e6ed915656375b7a3decee0d28252a39bd2962f99d830ad488fd847cc8f812916dcb23bd99124cdcbeaa853b94ba29afd3e6240d2bd8b74a032256b2958db4719e22b754986d603dfd215e6c60a1c0d9fd94a21c18b33ac6f15d4bbd42060c5ee485ed1627b5becbdbedf0e07ed238290475f703933740957e2867e87ea3ac184e85864aae4feaf4bfc2f8bae1dbc94955604675fab8bd35659415c65bcc62bdcb128868b7870c90f97e8cc04508c277381771de31012a985b4042e21fa0b7b8d9293ae85621fbcb9972e9f281ab04bff69cd1b6abcd4d6ea584209a514fd57ff6639b5dc1270fea8417687b06cded94a74a6eb20d4a95767d1d661fd638a408e825469f97c1d832439275bbb181fa59e69bcea00ce314c12ea1d5be7d26dd922cbc025e71ecc7d3d1fdc4e3fff3eec4971a8b21e76f64b91db25df0e2f969b9704decd45e336862b7d3ee6bf8d714560c85c68362a04aff29934e5668530a36f62ad0b1c42edf32a75b16d0413034ca313b068fff3f831f55647e4f5b32a8216412bf844c393b09373ec5feef1af2aa137ec6fc68f579b4b92b20e5c976c71928e234cd14121811e1327390a1c7a1e36e997354d9f6beb5fa41bdb5e50b822f16d5df3bdb9050ac54ada069eb9b641c1b3a5f8b677b3284c65d90b798cb4cbce610060c1d2905c3e5eff9f95ca5e3a282cf857bdfcddbe70f1d465564cbe2a1036f40d57fbac29d9fbcf9b7e838a891a21dd6c4564adaf4c3ef73f6ef202474ac8cad9c9f8638c628f13719631df5e4ab8f8c205e940f81be3f48a989075a315d0f2ed1296d8657eb9f7e829738c8408b7c8fcabc6bbe1bf0b3531dd55f8e48619fd5254dcd6fb858c6948bbb7828754849566284b556e0fc65f8e1b1248350f679338fb633a93427ef618d66ce6fcbe72954d25b96541782c11b00f920b16d3fb5b7a675ebce6d269872260563a4f92cb1cbec10dccd24ced17711658fa1f8cae1d60d98a21535a4a54bade9704aa39143f411013e09ce2ae2131dc9d1fa13ffa266095838d7f07756af68f0dd977f68e5153b2d357166bbf6a1ed2e75ed0d3fe32b2a40cadab6cae96ef1a9f003e02802c8eee02770c38389ffcf80ff1402544efccc199d941784167d7cebbb0febcd4b48b05fe528c2b9cb7c6c98f57116b3298cb8065cb4f64ac96f7283507012c8d7f8d277ff1f9e67c4ef4786e9f08be7f3c4a530e529d498878fdeff660b824032b325d39015ada9e8b3a4c1191fcbf7fc51b2876fa350f2063a81a6f91c80932c075bd2e15f3d148c72f396cc79d1c05b59d0c0aa689ef88c15025578eb4bdaf0e51c791312cf955505cc139ff9c2da9636fef98fae6f41a89b481367e2e12bed3010eba68b421d133fa753aff383f895ef28a320b692d3a60f2a6c35e05a2fc6e8e08aabd432d09ff1c6d0ef99827f2495583069e14bb75831f849eb119935f9d7f5bed4188232b1e23499a922a138304ed1d0cc36dd14e029381d93100bece0ee2cf8ad6e08e70594c2e716f314624cfd5638563fa1b98ac6483ca38d3c6a6a49ad0114266d52af6e9d42735a9caf0a25c4d0ff095587543630f86740d4078ed99ea348143ce3d5dea1d3b401f38086b604e2e77a6fdd678de84fce4523b8b4689611a596b3fc80901a30aa76c88ba8096da46601b770898fecb74741014d62466adea3f416e7f72739d4ab11471265ddccbe8beabb0680d714f205b4ccdd8c5e6b9e7e527539588ba3eaf47019feac65307bb2abf4779358d9c9f4be8707977482039d92ec30277485f53b07659923c25a9599a9cbe2de70afc12121ce838abef0ca03f58b045f68ab057cf318c4998e6b1ab74f3109783ba58fe84db33db64d5be14936519a7851c89cca75b07bc93e3ded3a8ed8507426912aa0592f4b0e289ff7ca75d23aa84e79e6ce759ee0969a7bf2b4e85cc2a4b5a8c59cbfdc25b7b299dd7470ab4a2e91a8e01dd196d3c135c0659abb103495a41771b7aa8e57c57552d1c4902c9d2fa0a9c9a708251055672baabdd8aead6d26f675dbdf7bd1c3c1091c01609e1db47a6edc57234da400b50db8d2e39c3677a4ac2054b5e721039c54da817a3500436e90339ddedbfe8110af7df405b357106d71be5e1617dc79ab3aecafe49f041b56d7dc07bb5bfe14164ca338e9eceb89a640ab1abce6394b11fca6f60823ee11037af570f23c162518c3f316bd64feb6445d1a1ec0340816c908a57802bf87d6ed39e434c1d0d0c8c727e5924749d17373ffd7fdd26ed428df3049afa6a91edb2ca7bcb79b080fb91e822bc7e7de1c7dca6cb4f2b4eab7b515c588e5d8cfb8f2476895f57614c1372ce10f9c24766d190c0bf0b699cbbf1fff4ab4d47875b0941648038db7855fb990595e64de4a5fda01f54e0ca399ddc403de3ca1745632350bfca371f33e58c743de24110ea055dd9e107ac3944c00f15b0ad1214bc369422c1da074396bbf48732930be4f37fa75c6f38845abc88d59a89ff4527a766c9471dd7335b9bf40cb5b82b6ced7a95cab9457093ac75f7b9718b69556bfb438cc1f1c9845bef4307a06762c901f31fdae85301fb7e85e96e14e02faa1cd8a8641ae14014c88b12d138ebd76d8718b858c10772c9c999a044e14212ea3a37c17c161a2e6f78f117d16be8903a70ea2a35a5f432358254888ca019d154f2bad450c69c3dac1234c8a206759436d7c34c455fe5946e2e753c9dd165eaeb01e6abfc69dc71dd567d2036b32fd575f741e6ecede913bc9d6466f1a50b66803b1897148b6def4f8265b4ff6713ef58db280e60805ff95027328357dc04e02beafa0f25ada3ebd838014ea7b8f89a21a134c8f835fd2c31f7e71d37fd9631b59ad6014c8c59725792d7e53b0935f075df4ca3a8b53f6cc5078b664d366a4fda176e58c73c8217e47efd8e46179ac19a3fa81745815d83fd707b4883a42816b579b9d8163df142766545f59c30e07b7013e435f53a656e0758c7cd6e16646405f1979b904668b67536b1014eb1cc30e2053f922f9ad11ad4944ff833c73cbb70b92c3c3fecd82e7da7a1421dda0d9a0c42da214638ac903e6a29b65656c9ad9e4205edd7f23bbfd6f24289c8fdf451be1f3cc39248a8e92325110760dfb3fa15571b43cde8aaf36ad35ba49536d98d95eaea0040b5864603d11825fbb7434a9e98d2cc1154d2fd1ecbd6cf3bd30e8e62679086bce313a363ec76721b9312f018bead0f6d66690442d2c8aa6a80c319d9056fb5e000f263bfc2e31ac930de07256bd3b8f307fbd6757d08d69d8ad1a718afe92393e999a0833c7efe356c163d1ab1d1d908b6e5f1264861242da836c811c0aa249ecfe95e5e6d6d6c9cec1b6c7c2af5b055b9c77e0f35a975d5e47993aacf2fba36f96122950283cb62978c71b2432659c050860ee32ee59056d249a2ab0a830aefb68ccf5debf2d032b9fe45483c0e767b9728807c584599dd4cb29274eba1351c02b3c2f4933b7ece5685698af733c596de8bac1bf44d75313d35001e3074efec9d0a3561d515587f29c5243747b238c3125e11e2cb88f3cb6c51634c63313c05c0e8473fba2eb1f280f3147dee9d62cbec375c932505662e61faf7177f1da188229b8af01e67f3ab8e3bffb2b1e846e064c3df5b39b677e2b37c14fb86f7c90a5b7b56e4cb725adaf6e8706512541a0c92cfc357991050f05cbba2520085b024c4d1c14cf0382e5fe42391d9ede46fe38071058cf38ad145f19c279a1961ec63a6a96b616a455c7d52a32239b89fa2ac94ec142b94582d428d998d747a1142c4bddc7ea9684335950b8727776b44d3b89da216b34122e69250641cfde5acf4a4854183f318d29430fff5ddb911e340a10ba0ec861c821f84ff1a07ecda936a93ac01b9a723cbc9c5d805787c53a6e418885327650e33717e26ab18b101ea6db09c3da98ed1e5a9d161f73b24e4882e874593b3d189086c2a0ddd091b7a3f639e67191bd93b75a1172fc37a94e5bbae452317462a2b7783674ee6c547f372dd1236626e46de4c5a0a6c9a25bc27202095b8a101f5a48e78a8a6d10e6d12be2190899ee8a036580e9ee68e1d5b6d11b921f73e46e08678d05355f3df1d2dec503e91c205bc37ced0a66ee4ea5c0f7808a1fe613ab7b3d02d882e62c6715470d3be2795e5fb305acb515ef3e9143c983301c5c4dd24d5d54c58aa09c7a7d2372452255daf6bda634304e4cd269837af76fce7ba1a1da6680151296e7e69e3644195f223cec0c3ee7ecceae13648e6af9325346d100a4771f0d0e4aa4eaf666393f1f156dc427ea7691c204d1199546a1901cd9b0fb0a44d8549ea6943b47c82b1bf72329e9be77ca0aa105ffa58ef0b25af8b4130672c17f57a80ccfa36eefcdc676cb63ca8639446b526604e602af498a2bef29f980eee369698240b482371f721f5a0ffbffb752f05ca7ceb05b3a37528c0978dac295ccbba0c6ca521f800dc95a79c0ba589baadc4d30355f66a099f80a336afd26aaac63f852600eaabff9f465cf00749d24eded472e36674ad97ca098b7a6bde0181172571fc6582a2178724e35853030dd3ff2142f1274cc4c56169e0ea5ec1d900ed5da99d36b7db3d3c6f23dc3818d9f3b91d275023a34fd4eba382809bd30b1c0b69b6ee1051f38dbeec2d1b90b7035bb67a3d719f1698a38507d1e1a742158dcd12303923ff438a02a46d22f553d46af35577d80f3404afc4f134062606c155adf8d5b2c9de91f905cd22ae702cccfef175523c00d181fcc8f6ed7391173a629a2776839415f0fd2886c78c2d71a52e087b4000000098ebd40a263a7de31bea4496140dd62881a1eb3bcd3a460aa427f196920d089c880b781ea86473ff708e5d638f01bef071e20e069c7fde0e501dfd3c690fc8ad	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{D6D5A677-0872-4AB0-9442-BB792FCE85C5}\DeviceId = "0018001963B9BB39"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{D6D5A677-0872-4AB0-9442-BB792FCE85C5}\ApplicationFlags = "1"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key deleted	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\IdentityCRL\ExtendedProperties	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\IdentityCRL\Immersive\production	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\IdentityCRL\Immersive	reg.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Property	svchost.exe
Set value (data)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Property\0018001963B9BB39 = 0100000001000000d08c9ddf0115d1118c7a00c04fc297eb010000005cbbf88555dc124181ee187f97d64b830000000002000000000010660000000100002000000040085524e56d10d7738ce31e5300eb0098edbfa6d21f0efcd7ac2f042add962c000000000e800000000200002000000074978d9492cf0a713c75e6f03fa7b077a1d8eeeed7fa398b42a8d26db59d2e7e800000006c1a99e5dc8434478ae005ae5b7c815c9dcf99d02b967910150ff20ce3e3c622d377dccb76d9e052b90cd947e5e21fe33e58bff1545b021116203d87f36b7f41b3e8ee330c0f8c001e0bb70726b61d795e912462f0626ca38f599cc54abeedefcbd5b1e8ab782cec05c6b2d0ca8b8c5f6ad7b8852679655b4794baae7e5d75f5400000002e71074667dc3acb4291b6daa765c836593715f7cdee036713120072a4de0950f3fe591eecc17cccbcecdfa3dafcc63a11d80d2c1ab81d35bced64a2adf87ed6	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134299295780332073"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Modifies registry key 1 TTPs 55 IoCs

Modify Registry

T1112

pid	Process
3688	reg.exe
1296	reg.exe
5092	reg.exe
4928	reg.exe
3304	reg.exe
4268	reg.exe
656	reg.exe
1232	reg.exe
4656	reg.exe
3772	reg.exe
4188	reg.exe
1632	reg.exe
3724	reg.exe
4604	reg.exe
4536	reg.exe
3028	reg.exe
4528	reg.exe
3400	reg.exe
3968	reg.exe
5048	reg.exe
4884	reg.exe
4812	reg.exe
1828	reg.exe
5000	reg.exe
3180	reg.exe
4232	reg.exe
388	reg.exe
1536	reg.exe
3948	reg.exe
4104	reg.exe
3096	reg.exe
4060	reg.exe
4868	reg.exe
4400	reg.exe
4468	reg.exe
3560	reg.exe
640	reg.exe
4296	reg.exe
1528	reg.exe
3356	reg.exe
732	reg.exe
4268	reg.exe
3948	reg.exe
1828	reg.exe
1884	reg.exe
2292	reg.exe
1076	reg.exe
4604	reg.exe
2392	reg.exe
4100	reg.exe
2728	reg.exe
3908	reg.exe
4812	reg.exe
4824	reg.exe
3560	reg.exe

Runs ping.exe 1 TTPs 3 IoCs

Remote System Discovery

T1018

pid	Process
3900	PING.EXE
2784	PING.EXE
1824	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1120	chrome.exe
1120	chrome.exe
4284	powershell.exe
4284	powershell.exe
4284	powershell.exe
3064	powershell.exe
3064	powershell.exe
3064	powershell.exe
2204	powershell.exe
2204	powershell.exe
2204	powershell.exe
3676	powershell.exe
3676	powershell.exe
3676	powershell.exe
3856	powershell.exe
3856	powershell.exe
3856	powershell.exe
4176	powershell.exe
4176	powershell.exe
4176	powershell.exe
1488	powershell.exe
1488	powershell.exe
1488	powershell.exe
2352	powershell.exe
2352	powershell.exe
2352	powershell.exe
732	powershell.exe
732	powershell.exe
732	powershell.exe
4540	powershell.exe
4540	powershell.exe
4540	powershell.exe
4656	powershell.exe
4656	powershell.exe
4656	powershell.exe
4044	powershell.exe
4044	powershell.exe
4044	powershell.exe
4812	powershell.exe
4812	powershell.exe
4812	powershell.exe
412	powershell.exe
412	powershell.exe
412	powershell.exe
3956	powershell.exe
3956	powershell.exe
3956	powershell.exe
2840	powershell.exe
2840	powershell.exe
2840	powershell.exe
4416	powershell.exe
4416	powershell.exe
4416	powershell.exe
1280	powershell.exe
1280	powershell.exe
1280	powershell.exe
2456	powershell.exe
2456	powershell.exe
2456	powershell.exe
2188	powershell.exe
2188	powershell.exe
2188	powershell.exe
4268	powershell.exe
4268	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
1120	chrome.exe
1120	chrome.exe
1120	chrome.exe
1120	chrome.exe
1120	chrome.exe
1120	chrome.exe
1120	chrome.exe
1704	chrome.exe
1704	chrome.exe
1704	chrome.exe
1704	chrome.exe
1704	chrome.exe
1704	chrome.exe
1704	chrome.exe
1704	chrome.exe
1704	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1120	chrome.exe
Token: SeCreatePagefilePrivilege	1120	chrome.exe
Token: SeShutdownPrivilege	1120	chrome.exe
Token: SeCreatePagefilePrivilege	1120	chrome.exe
Token: SeShutdownPrivilege	1120	chrome.exe
Token: SeCreatePagefilePrivilege	1120	chrome.exe
Token: SeShutdownPrivilege	1120	chrome.exe
Token: SeCreatePagefilePrivilege	1120	chrome.exe
Token: SeShutdownPrivilege	1120	chrome.exe
Token: SeCreatePagefilePrivilege	1120	chrome.exe
Token: SeShutdownPrivilege	1120	chrome.exe
Token: SeCreatePagefilePrivilege	1120	chrome.exe
Token: SeShutdownPrivilege	1120	chrome.exe
Token: SeCreatePagefilePrivilege	1120	chrome.exe
Token: SeShutdownPrivilege	1120	chrome.exe
Token: SeCreatePagefilePrivilege	1120	chrome.exe
Token: SeShutdownPrivilege	1120	chrome.exe
Token: SeCreatePagefilePrivilege	1120	chrome.exe
Token: SeShutdownPrivilege	1120	chrome.exe
Token: SeCreatePagefilePrivilege	1120	chrome.exe
Token: SeShutdownPrivilege	1120	chrome.exe
Token: SeCreatePagefilePrivilege	1120	chrome.exe
Token: SeShutdownPrivilege	1120	chrome.exe
Token: SeCreatePagefilePrivilege	1120	chrome.exe
Token: SeShutdownPrivilege	1120	chrome.exe
Token: SeCreatePagefilePrivilege	1120	chrome.exe
Token: SeShutdownPrivilege	1120	chrome.exe
Token: SeCreatePagefilePrivilege	1120	chrome.exe
Token: SeShutdownPrivilege	1120	chrome.exe
Token: SeCreatePagefilePrivilege	1120	chrome.exe
Token: SeShutdownPrivilege	1120	chrome.exe
Token: SeCreatePagefilePrivilege	1120	chrome.exe
Token: SeShutdownPrivilege	1120	chrome.exe
Token: SeCreatePagefilePrivilege	1120	chrome.exe
Token: SeShutdownPrivilege	1120	chrome.exe
Token: SeCreatePagefilePrivilege	1120	chrome.exe
Token: SeShutdownPrivilege	1120	chrome.exe
Token: SeCreatePagefilePrivilege	1120	chrome.exe
Token: SeShutdownPrivilege	1120	chrome.exe
Token: SeCreatePagefilePrivilege	1120	chrome.exe
Token: SeShutdownPrivilege	1120	chrome.exe
Token: SeCreatePagefilePrivilege	1120	chrome.exe
Token: SeShutdownPrivilege	1120	chrome.exe
Token: SeCreatePagefilePrivilege	1120	chrome.exe
Token: SeShutdownPrivilege	1120	chrome.exe
Token: SeCreatePagefilePrivilege	1120	chrome.exe
Token: SeShutdownPrivilege	1120	chrome.exe
Token: SeCreatePagefilePrivilege	1120	chrome.exe
Token: SeShutdownPrivilege	1120	chrome.exe
Token: SeCreatePagefilePrivilege	1120	chrome.exe
Token: SeShutdownPrivilege	1120	chrome.exe
Token: SeCreatePagefilePrivilege	1120	chrome.exe
Token: SeShutdownPrivilege	1120	chrome.exe
Token: SeCreatePagefilePrivilege	1120	chrome.exe
Token: SeShutdownPrivilege	1120	chrome.exe
Token: SeCreatePagefilePrivilege	1120	chrome.exe
Token: SeShutdownPrivilege	1120	chrome.exe
Token: SeCreatePagefilePrivilege	1120	chrome.exe
Token: SeShutdownPrivilege	1120	chrome.exe
Token: SeCreatePagefilePrivilege	1120	chrome.exe
Token: SeShutdownPrivilege	1120	chrome.exe
Token: SeCreatePagefilePrivilege	1120	chrome.exe
Token: SeShutdownPrivilege	1120	chrome.exe
Token: SeCreatePagefilePrivilege	1120	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
680	winver_edit.exe
680	winver_edit.exe
680	winver_edit.exe
1120	chrome.exe
1120	chrome.exe
1120	chrome.exe
1120	chrome.exe
1120	chrome.exe
1120	chrome.exe
1120	chrome.exe
1120	chrome.exe
1120	chrome.exe
1120	chrome.exe
1120	chrome.exe
1120	chrome.exe
1120	chrome.exe
1120	chrome.exe
1120	chrome.exe
1120	chrome.exe
1120	chrome.exe
1120	chrome.exe
1120	chrome.exe
1120	chrome.exe
1120	chrome.exe
1120	chrome.exe
1120	chrome.exe
1120	chrome.exe
1120	chrome.exe
1120	chrome.exe
1120	chrome.exe
1120	chrome.exe
1120	chrome.exe
1120	chrome.exe
1120	chrome.exe
1120	chrome.exe
1120	chrome.exe
1120	chrome.exe
1120	chrome.exe
1120	chrome.exe
1120	chrome.exe
1120	chrome.exe
1120	chrome.exe
1120	chrome.exe
1120	chrome.exe
1120	chrome.exe
1120	chrome.exe
2808	winver_edit.exe
2808	winver_edit.exe
2808	winver_edit.exe
1704	chrome.exe
1704	chrome.exe
1704	chrome.exe
1704	chrome.exe
1704	chrome.exe
1704	chrome.exe
1704	chrome.exe
1704	chrome.exe
1704	chrome.exe
1704	chrome.exe
1704	chrome.exe
1704	chrome.exe
1704	chrome.exe
1704	chrome.exe
1704	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
1120	chrome.exe
1120	chrome.exe
1120	chrome.exe
1120	chrome.exe
1120	chrome.exe
1120	chrome.exe
1120	chrome.exe
1120	chrome.exe
1120	chrome.exe
1120	chrome.exe
1120	chrome.exe
1120	chrome.exe
1120	chrome.exe
1120	chrome.exe
1120	chrome.exe
1120	chrome.exe
1120	chrome.exe
1120	chrome.exe
1120	chrome.exe
1120	chrome.exe
1120	chrome.exe
1120	chrome.exe
1120	chrome.exe
1120	chrome.exe
1120	chrome.exe
1120	chrome.exe
1120	chrome.exe
1120	chrome.exe
1120	chrome.exe
1120	chrome.exe
1120	chrome.exe
1120	chrome.exe
1704	chrome.exe
1704	chrome.exe
1704	chrome.exe
1704	chrome.exe
1704	chrome.exe
1704	chrome.exe
1704	chrome.exe
1704	chrome.exe
1704	chrome.exe
1704	chrome.exe
1704	chrome.exe
1704	chrome.exe
1704	chrome.exe
1704	chrome.exe
1704	chrome.exe
1704	chrome.exe
1704	chrome.exe
1704	chrome.exe
1704	chrome.exe
1704	chrome.exe
1704	chrome.exe
1704	chrome.exe
1704	chrome.exe
1704	chrome.exe
1704	chrome.exe
1704	chrome.exe
1704	chrome.exe
1704	chrome.exe
1704	chrome.exe
1704	chrome.exe
1704	chrome.exe
1704	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1120 wrote to memory of 2472	1120	chrome.exe	95
PID 1120 wrote to memory of 3964	1120	chrome.exe	96
PID 1120 wrote to memory of 3964	1120	chrome.exe	96
PID 1120 wrote to memory of 3832	1120	chrome.exe	97
PID 1120 wrote to memory of 4488	1120	chrome.exe	98
PID 1120 wrote to memory of 4488	1120	chrome.exe	98
PID 1120 wrote to memory of 1648	1120	chrome.exe	99
PID 1120 wrote to memory of 1648	1120	chrome.exe	99
PID 1120 wrote to memory of 1552	1120	chrome.exe	100
PID 1120 wrote to memory of 1552	1120	chrome.exe	100
PID 1120 wrote to memory of 4812	1120	chrome.exe	102
PID 1120 wrote to memory of 4812	1120	chrome.exe	102
PID 1120 wrote to memory of 1980	1120	chrome.exe	103
PID 1120 wrote to memory of 1980	1120	chrome.exe	103
PID 1120 wrote to memory of 2264	1120	chrome.exe	104
PID 1120 wrote to memory of 2264	1120	chrome.exe	104
PID 1120 wrote to memory of 3460	1120	chrome.exe	107
PID 1120 wrote to memory of 1280	1120	chrome.exe	109
PID 1120 wrote to memory of 1280	1120	chrome.exe	109
PID 1120 wrote to memory of 2252	1120	chrome.exe	110
PID 1120 wrote to memory of 2252	1120	chrome.exe	110
PID 1120 wrote to memory of 1824	1120	chrome.exe	111
PID 1120 wrote to memory of 860	1120	chrome.exe	112
PID 1120 wrote to memory of 1328	1120	chrome.exe	113
PID 1120 wrote to memory of 4536	1120	chrome.exe	117
PID 1120 wrote to memory of 3236	1120	chrome.exe	118
PID 3236 wrote to memory of 3724	3236	cmd.exe	120
PID 3236 wrote to memory of 4072	3236	cmd.exe	121
PID 3236 wrote to memory of 4156	3236	cmd.exe	122
PID 3236 wrote to memory of 2620	3236	cmd.exe	124
PID 3236 wrote to memory of 3564	3236	cmd.exe	125
PID 3236 wrote to memory of 3192	3236	cmd.exe	126
PID 3236 wrote to memory of 4636	3236	cmd.exe	127
PID 3236 wrote to memory of 4220	3236	cmd.exe	128
PID 3236 wrote to memory of 3732	3236	cmd.exe	129
PID 3732 wrote to memory of 2656	3732	cmd.exe	130
PID 3732 wrote to memory of 4188	3732	cmd.exe	131
PID 3236 wrote to memory of 4536	3236	cmd.exe	132
PID 3236 wrote to memory of 5060	3236	cmd.exe	133
PID 3236 wrote to memory of 1940	3236	cmd.exe	134
PID 3236 wrote to memory of 2304	3236	cmd.exe	135
PID 2304 wrote to memory of 4284	2304	cmd.exe	136
PID 3236 wrote to memory of 1100	3236	cmd.exe	137
PID 1100 wrote to memory of 1824	1100	cmd.exe	138
PID 3236 wrote to memory of 3724	3236	cmd.exe	139
PID 3236 wrote to memory of 4284	3236	cmd.exe	140
PID 3236 wrote to memory of 4884	3236	cmd.exe	141
PID 3236 wrote to memory of 4744	3236	cmd.exe	142
PID 3236 wrote to memory of 4100	3236	cmd.exe	143
PID 4744 wrote to memory of 1536	4744	cmd.exe	146
PID 4744 wrote to memory of 640	4744	cmd.exe	147
PID 4744 wrote to memory of 4372	4744	cmd.exe	148
PID 4744 wrote to memory of 4288	4744	cmd.exe	149
PID 4744 wrote to memory of 3188	4744	cmd.exe	150
PID 4744 wrote to memory of 2860	4744	cmd.exe	151
PID 4744 wrote to memory of 1768	4744	cmd.exe	152
PID 4744 wrote to memory of 5004	4744	cmd.exe	153
PID 4744 wrote to memory of 2560	4744	cmd.exe	154
PID 4744 wrote to memory of 3392	4744	cmd.exe	155
PID 4744 wrote to memory of 4520	4744	cmd.exe	156
PID 4520 wrote to memory of 2440	4520	cmd.exe	157
PID 4520 wrote to memory of 3600	4520	cmd.exe	158
PID 4744 wrote to memory of 1328	4744	cmd.exe	159
PID 4744 wrote to memory of 2584	4744	cmd.exe	160

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\winver_edit.exe
"C:\Users\Admin\AppData\Local\Temp\winver_edit.exe"
1⤵
- Suspicious use of FindShellTrayWindow
PID:680

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff8ae4ec728,0x7ff8ae4ec734,0x7ff8ae4ec740
  2⤵
  PID:2472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1760,i,10146171157309821926,6308403600574480421,262144 --field-trial-handle=2004,i,6290070731966362086,16092705640863088243,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1988 /prefetch:2
  2⤵
  PID:3964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1616,i,7615723781273292287,2329721476167110101,524288 --field-trial-handle=2004,i,6290070731966362086,16092705640863088243,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2252 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2412,i,14566451607974345278,16005790806543202770,524288 --field-trial-handle=2004,i,6290070731966362086,16092705640863088243,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2576 /prefetch:8
  2⤵
  PID:4488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3264,i,6696013118176994127,5804598433601684335,2097152 --field-trial-handle=2004,i,6290070731966362086,16092705640863088243,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:1648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3276,i,3442612285451312161,3915040901644812002,2097152 --field-trial-handle=2004,i,6290070731966362086,16092705640863088243,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:1552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4452,i,18005754990987264148,2561222476017625483,2097152 --field-trial-handle=2004,i,6290070731966362086,16092705640863088243,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4472 /prefetch:2
  2⤵
  PID:4812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4712,i,16249287712003663979,12382851620890907359,2097152 --field-trial-handle=2004,i,6290070731966362086,16092705640863088243,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4728 /prefetch:1
  2⤵
  PID:1980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4704,i,198832104611738829,13597599016982038274,2097152 --field-trial-handle=2004,i,6290070731966362086,16092705640863088243,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4956 /prefetch:1
  2⤵
  PID:2264
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5588,i,9760188329788958569,17106960730703083854,524288 --field-trial-handle=2004,i,6290070731966362086,16092705640863088243,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5676 /prefetch:8
  2⤵
  PID:3460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3364,i,4081723197079273605,17903844149273765359,2097152 --field-trial-handle=2004,i,6290070731966362086,16092705640863088243,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3376 /prefetch:1
  2⤵
  PID:1280
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5832,i,13581095808179121293,585923507388333086,2097152 --field-trial-handle=2004,i,6290070731966362086,16092705640863088243,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5820 /prefetch:1
  2⤵
  PID:2252
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6140,i,15011190375369477533,15201890753718730067,524288 --field-trial-handle=2004,i,6290070731966362086,16092705640863088243,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6152 /prefetch:8
  2⤵
  PID:1824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6124,i,9271782920279747456,5058814454453773739,524288 --field-trial-handle=2004,i,6290070731966362086,16092705640863088243,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6156 /prefetch:8
  2⤵
  PID:860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3408,i,13261975355959853005,18030672288036182393,524288 --field-trial-handle=2004,i,6290070731966362086,16092705640863088243,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6164 /prefetch:8
  2⤵
  PID:1328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6308,i,483124080248190615,9851164979948894307,524288 --field-trial-handle=2004,i,6290070731966362086,16092705640863088243,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6244 /prefetch:8
  2⤵
  PID:4536
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\MAS_AIO.cmd" "
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3236
- - C:\Windows\System32\sc.exe
    sc query Null
    3⤵
    - Launches sc.exe
    PID:3724
- - C:\Windows\System32\find.exe
    find /i "RUNNING"
    3⤵
    PID:4072
- - C:\Windows\System32\findstr.exe
    findstr /v "$" "C:\Users\Admin\Downloads\MAS_AIO.cmd"
    3⤵
    PID:4156
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c ver
    3⤵
    - Executes a command shell one-liner
    PID:2620
- - C:\Windows\System32\reg.exe
    reg query "HKCU\Console" /v ForceV2
    3⤵
    PID:3564
- - C:\Windows\System32\find.exe
    find /i "0x0"
    3⤵
    PID:3192
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /S /D /c" echo "AMD64 " "
    3⤵
    PID:4636
- - C:\Windows\System32\find.exe
    find /i "ARM64"
    3⤵
    PID:4220
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c echo prompt $E | cmd
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3732
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /S /D /c" echo prompt $E "
      4⤵
      PID:2656
  - - C:\Windows\System32\cmd.exe
      cmd
      4⤵
      PID:4188
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /S /D /c" echo "C:\Users\Admin\Downloads\MAS_AIO.cmd" "
    3⤵
    PID:4536
- - C:\Windows\System32\find.exe
    find /i "C:\Users\Admin\AppData\Local\Temp"
    3⤵
    PID:5060
- - C:\Windows\System32\fltMC.exe
    fltmc
    3⤵
    PID:1940
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "if ($PSVersionTable.PSEdition -ne 'Core') {$f=[IO.File]::ReadAllText('C:\Users\Admin\Downloads\MAS_AIO.cmd') -split ':pstst';. ([scriptblock]::Create($f[1]))}" 2>nul
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2304
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "if ($PSVersionTable.PSEdition -ne 'Core') {$f=[IO.File]::ReadAllText('C:\Users\Admin\Downloads\MAS_AIO.cmd') -split ':pstst';. ([scriptblock]::Create($f[1]))}"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4284
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c mode con
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1100
  - - C:\Windows\System32\mode.com
      mode con
      4⤵
      PID:1824
- - C:\Windows\System32\reg.exe
    reg query HKCU\Console /v QuickEdit
    3⤵
    - Modifies registry key
    PID:3724
- - C:\Windows\System32\find.exe
    find /i "0x0"
    3⤵
    PID:4284
- - C:\Windows\System32\reg.exe
    reg add HKCU\Console /v QuickEdit /t REG_DWORD /d 0 /f
    3⤵
    - Modifies registry key
    PID:4884
- - C:\Windows\System32\cmd.exe
    cmd.exe /c ""C:\Users\Admin\Downloads\MAS_AIO.cmd" -qedit"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4744
  - - C:\Windows\System32\sc.exe
      sc query Null
      4⤵
      Launches sc.exe
      PID:1536
  - - C:\Windows\System32\find.exe
      find /i "RUNNING"
      4⤵
      PID:640
  - - C:\Windows\System32\findstr.exe
      findstr /v "$" "C:\Users\Admin\Downloads\MAS_AIO.cmd"
      4⤵
      PID:4372
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /S /D /c" echo "-qedit" "
      4⤵
      PID:4288
  - - C:\Windows\System32\find.exe
      find /i "/"
      4⤵
      PID:3188
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c ver
      4⤵
      Executes a command shell one-liner
      PID:2860
  - - C:\Windows\System32\reg.exe
      reg query "HKCU\Console" /v ForceV2
      4⤵
      PID:1768
  - - C:\Windows\System32\find.exe
      find /i "0x0"
      4⤵
      PID:5004
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /S /D /c" echo "AMD64 " "
      4⤵
      PID:2560
  - - C:\Windows\System32\find.exe
      find /i "ARM64"
      4⤵
      PID:3392
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c echo prompt $E | cmd
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:4520
    - - C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /S /D /c" echo prompt $E "
        5⤵
        
        PID:2440
    - - C:\Windows\System32\cmd.exe
        
        cmd
        5⤵
        
        PID:3600
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /S /D /c" echo "C:\Users\Admin\Downloads\MAS_AIO.cmd" "
      4⤵
      PID:1328
  - - C:\Windows\System32\find.exe
      find /i "C:\Users\Admin\AppData\Local\Temp"
      4⤵
      PID:2584
  - - C:\Windows\System32\fltMC.exe
      fltmc
      4⤵
      PID:1708
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "if ($PSVersionTable.PSEdition -ne 'Core') {$f=[IO.File]::ReadAllText('C:\Users\Admin\Downloads\MAS_AIO.cmd') -split ':pstst';. ([scriptblock]::Create($f[1]))}" 2>nul
      4⤵
      Executes a command shell one-liner
      PID:4376
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "if ($PSVersionTable.PSEdition -ne 'Core') {$f=[IO.File]::ReadAllText('C:\Users\Admin\Downloads\MAS_AIO.cmd') -split ':pstst';. ([scriptblock]::Create($f[1]))}"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3064
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c mode con
      4⤵
      Executes a command shell one-liner
      PID:4072
    - - C:\Windows\System32\mode.com
        
        mode con
        5⤵
        
        PID:1324
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c ping -n 1 activated.win
      4⤵
      Executes a command shell one-liner
      System Network Configuration Discovery: Internet Connection Discovery
      PID:4492
    - - C:\Windows\System32\PING.EXE
        
        ping -n 1 activated.win
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3900
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c ping -n 1 updatecheck312.activated.win
      4⤵
      Executes a command shell one-liner
      System Network Configuration Discovery: Internet Connection Discovery
      PID:3100
    - - C:\Windows\System32\PING.EXE
        
        ping -n 1 updatecheck312.activated.win
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2784
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /S /D /c" echo "-qedit" "
      4⤵
      PID:4556
  - - C:\Windows\System32\find.exe
      find /i "/S"
      4⤵
      PID:1184
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /S /D /c" echo "-qedit" "
      4⤵
      PID:732
  - - C:\Windows\System32\find.exe
      find /i "/"
      4⤵
      PID:1772
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v Desktop
      4⤵
      Executes a command shell one-liner
      PID:4756
    - - C:\Windows\System32\reg.exe
        
        reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v Desktop
        5⤵
        
        PID:4468
  - - C:\Windows\System32\mode.com
      mode 76, 34
      4⤵
      PID:3788
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SOFTWARE\Microsoft\Office\ClickToRun\Configuration /v ProductReleaseIds
      4⤵
      Modifies registry key
      PID:3304
  - - C:\Windows\System32\find.exe
      find /i "O365"
      4⤵
      PID:1980
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Office\ClickToRun\Configuration /v ProductReleaseIds
      4⤵
      Modifies registry key
      PID:4824
  - - C:\Windows\System32\find.exe
      find /i "O365"
      4⤵
      PID:3648
  - - C:\Windows\System32\choice.exe
      choice /C:12345678EH0 /N
      4⤵
      PID:1248
  - - C:\Windows\System32\mode.com
      mode 110, 34
      4⤵
      PID:3372
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\taskcache\tasks" /f Path /s
      4⤵
      PID:2836
  - - C:\Windows\System32\find.exe
      find /i "AutoPico"
      4⤵
      PID:1280
  - - C:\Windows\System32\find.exe
      find /i "avira.com" C:\Windows\System32\drivers\etc\hosts
      4⤵
      PID:2656
  - - C:\Windows\System32\find.exe
      find /i "kaspersky.com" C:\Windows\System32\drivers\etc\hosts
      4⤵
      PID:4892
  - - C:\Windows\System32\find.exe
      find /i "virustotal.com" C:\Windows\System32\drivers\etc\hosts
      4⤵
      PID:1684
  - - C:\Windows\System32\find.exe
      find /i "mcafee.com" C:\Windows\System32\drivers\etc\hosts
      4⤵
      PID:3220
  - - C:\Windows\System32\sc.exe
      sc start sppsvc
      4⤵
      Launches sc.exe
      PID:4616
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /S /D /c" echo "1056" "
      4⤵
      PID:4656
  - - C:\Windows\System32\findstr.exe
      findstr "577 225"
      4⤵
      PID:2140
  - - C:\Windows\System32\cmd.exe
      cmd /c "wmic path Win32_ComputerSystem get CreationClassName /value"
      4⤵
      Executes a command shell one-liner
      PID:3696
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path Win32_ComputerSystem get CreationClassName /value
        5⤵
        
        PID:1076
  - - C:\Windows\System32\find.exe
      find /i "computersystem"
      4⤵
      PID:4828
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c $AssemblyBuilder = [AppDomain]::CurrentDomain.DefineDynamicAssembly(4, 1); $ModuleBuilder = $AssemblyBuilder.DefineDynamicModule(2, $False); $TypeBuilder = $ModuleBuilder.DefineType(0); [void]$TypeBuilder.DefinePInvokeMethod('SLGetWindowsInformationDWORD', 'slc.dll', 'Public, Static', 1, [int], @([String], [int].MakeByRefType()), 1, 3); $Sku = 0; [void]$TypeBuilder.CreateType()::SLGetWindowsInformationDWORD('Kernel-BrandingInfo', [ref]$Sku); $Sku"
      4⤵
      Executes a command shell one-liner
      PID:4156
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c $AssemblyBuilder = [AppDomain]::CurrentDomain.DefineDynamicAssembly(4, 1); $ModuleBuilder = $AssemblyBuilder.DefineDynamicModule(2, $False); $TypeBuilder = $ModuleBuilder.DefineType(0); [void]$TypeBuilder.DefinePInvokeMethod('SLGetWindowsInformationDWORD', 'slc.dll', 'Public, Static', 1, [int], @([String], [int].MakeByRefType()), 1, 3); $Sku = 0; [void]$TypeBuilder.CreateType()::SLGetWindowsInformationDWORD('Kernel-BrandingInfo', [ref]$Sku); $Sku
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2204
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\ProductOptions" /v OSProductPfn 2>nul
      4⤵
      Executes a command shell one-liner
      PID:1216
    - - C:\Windows\System32\reg.exe
        
        reg query "HKLM\SYSTEM\CurrentControlSet\Control\ProductOptions" /v OSProductPfn
        5⤵
        
        PID:5116
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c "wmic Path Win32_OperatingSystem Get OperatingSystemSKU /format:LIST" 2>nul
      4⤵
      Executes a command shell one-liner
      PID:740
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic Path Win32_OperatingSystem Get OperatingSystemSKU /format:LIST
        5⤵
        
        PID:4740
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$f=[IO.File]::ReadAllText('C:\Users\Admin\Downloads\MAS_AIO.cmd') -split ':winsubstatus\:.*';. ([scriptblock]::Create($f[1]))"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3676
  - - C:\Windows\System32\find.exe
      find /i "Subscription_is_activated"
      4⤵
      PID:1528
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c $AssemblyBuilder = [AppDomain]::CurrentDomain.DefineDynamicAssembly(4, 1); $ModuleBuilder = $AssemblyBuilder.DefineDynamicModule(2, $False); $TypeBuilder = $ModuleBuilder.DefineType(0); $meth = $TypeBuilder.DefinePInvokeMethod('BrandingFormatString', 'winbrand.dll', 'Public, Static', 1, [String], @([String]), 1, 3); $meth.SetImplementationFlags(128); $TypeBuilder.CreateType()::BrandingFormatString('%WINDOWS_LONG%') -replace [string][char]0xa9, '' -replace [string][char]0xae, '' -replace [string][char]0x2122, ''"
      4⤵
      Executes a command shell one-liner
      PID:964
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c $AssemblyBuilder = [AppDomain]::CurrentDomain.DefineDynamicAssembly(4, 1); $ModuleBuilder = $AssemblyBuilder.DefineDynamicModule(2, $False); $TypeBuilder = $ModuleBuilder.DefineType(0); $meth = $TypeBuilder.DefinePInvokeMethod('BrandingFormatString', 'winbrand.dll', 'Public, Static', 1, [String], @([String]), 1, 3); $meth.SetImplementationFlags(128); $TypeBuilder.CreateType()::BrandingFormatString('%WINDOWS_LONG%') -replace [string][char]0xa9, '' -replace [string][char]0xae, '' -replace [string][char]0x2122, ''
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:3856
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /S /D /c" echo "Windows 10 Pro" "
      4⤵
      PID:364
  - - C:\Windows\System32\find.exe
      find /i "Windows"
      4⤵
      PID:4812
  - - C:\Windows\System32\sc.exe
      sc start sppsvc
      4⤵
      Launches sc.exe
      PID:2712
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$job = Start-Job { (Get-WmiObject -Query 'SELECT * FROM SoftwareLicensingService').Version }; if (-not (Wait-Job $job -Timeout 30)) {write-host 'sppsvc is not working correctly. Check this webpage for help - https://massgrave.dev/troubleshoot'}"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4176
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:1488
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path SoftwareLicensingProduct where (LicenseStatus='1' and GracePeriodRemaining='0' and PartialProductKey is not NULL AND LicenseDependsOn is NULL) get Name /value
      4⤵
      PID:4220
  - - C:\Windows\System32\findstr.exe
      findstr /i "Windows"
      4⤵
      PID:2652
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v PROCESSOR_ARCHITECTURE
      4⤵
      Executes a command shell one-liner
      PID:4900
    - - C:\Windows\System32\reg.exe
        
        reg query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v PROCESSOR_ARCHITECTURE
        5⤵
        
        PID:2568
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c ver
      4⤵
      Executes a command shell one-liner
      PID:4636
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c ping -n 1 l.root-servers.net
      4⤵
      Executes a command shell one-liner
      System Network Configuration Discovery: Internet Connection Discovery
      PID:4392
    - - C:\Windows\System32\PING.EXE
        
        ping -n 1 l.root-servers.net
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1824
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\taskcache\tasks" /f Path /s
      4⤵
      PID:3400
  - - C:\Windows\System32\find.exe
      find /i "AutoPico"
      4⤵
      PID:3880
  - - C:\Windows\System32\find.exe
      find /i "avira.com" C:\Windows\System32\drivers\etc\hosts
      4⤵
      PID:436
  - - C:\Windows\System32\find.exe
      find /i "kaspersky.com" C:\Windows\System32\drivers\etc\hosts
      4⤵
      PID:1324
  - - C:\Windows\System32\find.exe
      find /i "virustotal.com" C:\Windows\System32\drivers\etc\hosts
      4⤵
      PID:3212
  - - C:\Windows\System32\find.exe
      find /i "mcafee.com" C:\Windows\System32\drivers\etc\hosts
      4⤵
      PID:520
  - - C:\Windows\System32\sc.exe
      sc start sppsvc
      4⤵
      Launches sc.exe
      PID:4868
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /S /D /c" echo "1056" "
      4⤵
      PID:1088
  - - C:\Windows\System32\findstr.exe
      findstr "577 225"
      4⤵
      PID:1528
  - - C:\Windows\System32\sc.exe
      sc query Null
      4⤵
      Launches sc.exe
      PID:3356
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WinPE" /v InstRoot
      4⤵
      PID:4468
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\State" /v ImageState
      4⤵
      Executes a command shell one-liner
      PID:1712
    - - C:\Windows\System32\reg.exe
        
        reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\State" /v ImageState
        5⤵
        
        PID:4876
  - - C:\Windows\System32\sc.exe
      sc start ClipSVC
      4⤵
      Launches sc.exe
      PID:3016
  - - C:\Windows\System32\sc.exe
      sc query ClipSVC
      4⤵
      Launches sc.exe
      PID:5092
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\ClipSVC /v DependOnService
      4⤵
      Modifies registry key
      PID:3560
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\ClipSVC /v Description
      4⤵
      Modifies registry key
      PID:4268
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\ClipSVC /v DisplayName
      4⤵
      Modifies registry key
      PID:3948
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\ClipSVC /v ErrorControl
      4⤵
      Modifies registry key
      PID:4812
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\ClipSVC /v ImagePath
      4⤵
      Modifies registry key
      PID:1828
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\ClipSVC /v ObjectName
      4⤵
      Modifies registry key
      PID:4604
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\ClipSVC /v Start
      4⤵
      Modifies registry key
      PID:5000
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\ClipSVC /v Type
      4⤵
      Modifies registry key
      PID:3688
  - - C:\Windows\System32\sc.exe
      sc start wlidsvc
      4⤵
      Launches sc.exe
      PID:3092
  - - C:\Windows\System32\sc.exe
      sc query wlidsvc
      4⤵
      Launches sc.exe
      PID:3436
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\wlidsvc /v DependOnService
      4⤵
      Modifies registry key
      PID:3180
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\wlidsvc /v Description
      4⤵
      Modifies registry key
      PID:4232
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\wlidsvc /v DisplayName
      4⤵
      Modifies registry key
      PID:640
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\wlidsvc /v ErrorControl
      4⤵
      Modifies registry key
      PID:4536
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\wlidsvc /v ImagePath
      4⤵
      Modifies registry key
      PID:1232
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\wlidsvc /v ObjectName
      4⤵
      Modifies registry key
      PID:656
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\wlidsvc /v Start
      4⤵
      Modifies registry key
      PID:4656
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\wlidsvc /v Type
      4⤵
      Modifies registry key
      PID:3772
  - - C:\Windows\System32\sc.exe
      sc start sppsvc
      4⤵
      Launches sc.exe
      PID:4372
  - - C:\Windows\System32\sc.exe
      sc query sppsvc
      4⤵
      Launches sc.exe
      PID:3048
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /v DependOnService
      4⤵
      Modifies registry key
      PID:4188
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /v Description
      4⤵
      Modifies registry key
      PID:1884
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /v DisplayName
      4⤵
      Modifies registry key
      PID:2292
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /v ErrorControl
      4⤵
      Modifies registry key
      PID:388
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /v ImagePath
      4⤵
      Modifies registry key
      PID:1632
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /v ObjectName
      4⤵
      Modifies registry key
      PID:1536
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /v Start
      4⤵
      Modifies registry key
      PID:1076
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /v Type
      4⤵
      Modifies registry key
      PID:4104
  - - C:\Windows\System32\sc.exe
      sc start KeyIso
      4⤵
      Launches sc.exe
      PID:1152
  - - C:\Windows\System32\sc.exe
      sc query KeyIso
      4⤵
      Launches sc.exe
      PID:2584
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\KeyIso /v DependOnService
      4⤵
      Modifies registry key
      PID:1296
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\KeyIso /v Description
      4⤵
      Modifies registry key
      PID:3028
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\KeyIso /v DisplayName
      4⤵
      Modifies registry key
      PID:2728
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\KeyIso /v ErrorControl
      4⤵
      Modifies registry key
      PID:4296
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\KeyIso /v ImagePath
      4⤵
      Modifies registry key
      PID:4528
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\KeyIso /v ObjectName
      4⤵
      Modifies registry key
      PID:3908
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\KeyIso /v Start
      4⤵
      Modifies registry key
      PID:3096
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\KeyIso /v Type
      4⤵
      Modifies registry key
      PID:3400
  - - C:\Windows\System32\sc.exe
      sc start LicenseManager
      4⤵
      Launches sc.exe
      PID:1052
  - - C:\Windows\System32\sc.exe
      sc query LicenseManager
      4⤵
      Launches sc.exe
      PID:436
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\LicenseManager /v DependOnService
      4⤵
      Modifies registry key
      PID:3968
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\LicenseManager /v Description
      4⤵
      Modifies registry key
      PID:5048
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\LicenseManager /v DisplayName
      4⤵
      Modifies registry key
      PID:4060
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\LicenseManager /v ErrorControl
      4⤵
      Modifies registry key
      PID:4868
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\LicenseManager /v ImagePath
      4⤵
      Modifies registry key
      PID:4400
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\LicenseManager /v ObjectName
      4⤵
      Modifies registry key
      PID:1528
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\LicenseManager /v Start
      4⤵
      Modifies registry key
      PID:3356
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\LicenseManager /v Type
      4⤵
      Modifies registry key
      PID:4468
  - - C:\Windows\System32\sc.exe
      sc start Winmgmt
      4⤵
      Launches sc.exe
      PID:3932
  - - C:\Windows\System32\sc.exe
      sc query Winmgmt
      4⤵
      Launches sc.exe
      PID:440
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt /v DependOnService
      4⤵
      Modifies registry key
      PID:732
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt /v Description
      4⤵
      Modifies registry key
      PID:5092
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt /v DisplayName
      4⤵
      Modifies registry key
      PID:3560
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt /v ErrorControl
      4⤵
      Modifies registry key
      PID:4268
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt /v ImagePath
      4⤵
      Modifies registry key
      PID:3948
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt /v ObjectName
      4⤵
      Modifies registry key
      PID:4812
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt /v Start
      4⤵
      Modifies registry key
      PID:1828
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt /v Type
      4⤵
      Modifies registry key
      PID:4604
  - - C:\Windows\System32\sc.exe
      sc start ClipSVC
      4⤵
      Launches sc.exe
      PID:5000
  - - C:\Windows\System32\sc.exe
      sc start wlidsvc
      4⤵
      Launches sc.exe
      PID:3688
  - - C:\Windows\System32\sc.exe
      sc start sppsvc
      4⤵
      Launches sc.exe
      PID:3092
  - - C:\Windows\System32\sc.exe
      sc start KeyIso
      4⤵
      Launches sc.exe
      PID:1984
  - - C:\Windows\System32\sc.exe
      sc start LicenseManager
      4⤵
      Launches sc.exe
      PID:3180
  - - C:\Windows\System32\sc.exe
      sc start Winmgmt
      4⤵
      Launches sc.exe
      PID:4232
  - - C:\Windows\System32\sc.exe
      sc query ClipSVC
      4⤵
      Launches sc.exe
      PID:640
  - - C:\Windows\System32\find.exe
      find /i "RUNNING"
      4⤵
      PID:1716
  - - C:\Windows\System32\sc.exe
      sc start ClipSVC
      4⤵
      Launches sc.exe
      PID:2656
  - - C:\Windows\System32\sc.exe
      sc query wlidsvc
      4⤵
      Launches sc.exe
      PID:1684
  - - C:\Windows\System32\find.exe
      find /i "RUNNING"
      4⤵
      PID:656
  - - C:\Windows\System32\sc.exe
      sc start wlidsvc
      4⤵
      Launches sc.exe
      PID:2860
  - - C:\Windows\System32\sc.exe
      sc query sppsvc
      4⤵
      Launches sc.exe
      PID:4796
  - - C:\Windows\System32\find.exe
      find /i "RUNNING"
      4⤵
      PID:4372
  - - C:\Windows\System32\sc.exe
      sc start sppsvc
      4⤵
      Launches sc.exe
      PID:1328
  - - C:\Windows\System32\sc.exe
      sc query KeyIso
      4⤵
      Launches sc.exe
      PID:3648
  - - C:\Windows\System32\find.exe
      find /i "RUNNING"
      4⤵
      PID:1884
  - - C:\Windows\System32\sc.exe
      sc start KeyIso
      4⤵
      Launches sc.exe
      PID:4464
  - - C:\Windows\System32\sc.exe
      sc query LicenseManager
      4⤵
      Launches sc.exe
      PID:388
  - - C:\Windows\System32\find.exe
      find /i "RUNNING"
      4⤵
      PID:4044
  - - C:\Windows\System32\sc.exe
      sc start LicenseManager
      4⤵
      Launches sc.exe
      PID:1536
  - - C:\Windows\System32\sc.exe
      sc query Winmgmt
      4⤵
      Launches sc.exe
      PID:1076
  - - C:\Windows\System32\find.exe
      find /i "RUNNING"
      4⤵
      PID:4612
  - - C:\Windows\System32\sc.exe
      sc start Winmgmt
      4⤵
      Launches sc.exe
      PID:4304
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path Win32_ComputerSystem get CreationClassName /value
      4⤵
      PID:4760
  - - C:\Windows\System32\find.exe
      find /i "computersystem"
      4⤵
      PID:4220
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path SoftwareLicensingService get Version
      4⤵
      PID:2620
  - - C:\Windows\System32\cmd.exe
      cmd /c exit /b 0
      4⤵
      Executes a command shell one-liner
      PID:3096
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /S /D /c" echo "0" "
      4⤵
      PID:3400
  - - C:\Windows\System32\findstr.exe
      findstr /i "0x800410 0x800440 0x80131501"
      4⤵
      PID:3064
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\Plugins\Objects\msft:rm/algorithm/hwid/4.0" /f ba02fed39662 /d
      4⤵
      PID:2456
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /v TokenStore 2>nul
      4⤵
      Executes a command shell one-liner
      PID:2724
    - - C:\Windows\System32\reg.exe
        
        reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /v TokenStore
        5⤵
        
        PID:3540
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$acl = (Get-Acl 'C:\Windows\System32\spp\store\2.0' | fl | Out-String); if (-not ($acl -match 'NT SERVICE\\sppsvc Allow FullControl') -or ($acl -match 'NT SERVICE\\sppsvc Deny')) {Exit 2}"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2352
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$acl = (Get-Acl 'HKLM:\SYSTEM\WPA' | fl | Out-String); if (-not ($acl -match 'NT SERVICE\\sppsvc Allow QueryValues, EnumerateSubKeys, WriteKey') -or ($acl -match 'NT SERVICE\\sppsvc Deny')) {Exit 2}"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:732
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$acl = (Get-Acl 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' | fl | Out-String); if (-not ($acl -match 'NT SERVICE\\sppsvc Allow SetValue') -or ($acl -match 'NT SERVICE\\sppsvc Deny')) {Exit 2}"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4540
  - - C:\Windows\System32\reg.exe
      reg query "HKU\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion"
      4⤵
      PID:3668
  - - C:\Windows\System32\reg.exe
      reg query "HKU\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\Policies"
      4⤵
      PID:2140
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$netServ = (New-Object Security.Principal.SecurityIdentifier('S-1-5-20')).Translate([Security.Principal.NTAccount]).Value; $aclString = Get-Acl 'Registry::HKU\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\Policies' | Format-List | Out-String; if (-not ($aclString.Contains($netServ + ' Allow FullControl') -or $aclString.Contains('NT SERVICE\sppsvc Allow FullControl')) -or ($aclString.Contains('Deny'))) {Exit 3}"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4656
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$f=[IO.File]::ReadAllText('C:\Users\Admin\Downloads\MAS_AIO.cmd') -split ':wpatest\:.*';. ([scriptblock]::Create($f[1]))" 2>nul
      4⤵
      Executes a command shell one-liner
      PID:4100
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$f=[IO.File]::ReadAllText('C:\Users\Admin\Downloads\MAS_AIO.cmd') -split ':wpatest\:.*';. ([scriptblock]::Create($f[1]))"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4044
  - - C:\Windows\System32\reg.exe
      reg query "HKU\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\PersistedTSReArmed"
      4⤵
      PID:4760
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ClipSVC\Volatile\PersistedSystemState"
      4⤵
      PID:4528
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c "wmic path SoftwareLicensingProduct where (ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f' and PartialProductKey is not null) get ID /VALUE" 2>nul
      4⤵
      Executes a command shell one-liner
      PID:4740
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path SoftwareLicensingProduct where (ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f' and PartialProductKey is not null) get ID /VALUE
        5⤵
        
        PID:4412
  - - C:\Windows\System32\reg.exe
      reg query "HKU\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion"
      4⤵
      PID:2188
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c "wmic path SoftwareLicensingProduct where (ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f' AND LicenseDependsOn is NULL AND PartialProductKey IS NOT NULL) get LicenseFamily /VALUE" 2>nul
      4⤵
      Executes a command shell one-liner
      PID:4808
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path SoftwareLicensingProduct where (ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f' AND LicenseDependsOn is NULL AND PartialProductKey IS NOT NULL) get LicenseFamily /VALUE
        5⤵
        
        PID:5048
  - - C:\Windows\System32\sc.exe
      sc query wlms
      4⤵
      Launches sc.exe
      PID:2104
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.exe"
      4⤵
      PID:4784
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SLsvc.exe"
      4⤵
      PID:1772
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sppsvc.exe"
      4⤵
      PID:2432
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sppsvc.exe\PerfOptions"
      4⤵
      PID:3840
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /v "SkipRearm" 2>nul
      4⤵
      Executes a command shell one-liner
      PID:3016
    - - C:\Windows\System32\reg.exe
        
        reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /v "SkipRearm"
        5⤵
        
        PID:3460
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "Get-WmiObject -Query 'SELECT Description FROM SoftwareLicensingProduct WHERE PartialProductKey IS NOT NULL AND LicenseDependsOn IS NULL' | Select-Object -Property Description"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4812
  - - C:\Windows\System32\findstr.exe
      findstr /i "KMS_"
      4⤵
      PID:460
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$s=New-Object -ComObject 'Schedule.Service'; $s.Connect(); $state=$s.GetFolder('\Microsoft\Windows\SoftwareProtectionPlatform').GetTask('SvcRestartTask').State; @{0='Unknown';1='Disabled';2='Queued';3='Ready';4='Running'}[$state]" 2>nul
      4⤵
      Executes a command shell one-liner
      PID:1564
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$s=New-Object -ComObject 'Schedule.Service'; $s.Connect(); $state=$s.GetFolder('\Microsoft\Windows\SoftwareProtectionPlatform').GetTask('SvcRestartTask').State; @{0='Unknown';1='Disabled';2='Queued';3='Ready';4='Running'}[$state]"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:412
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /S /D /c" echo "
      4⤵
      PID:1632
  - - C:\Windows\System32\find.exe
      find /i "Ready"
      4⤵
      PID:4684
  - - C:\Windows\System32\reg.exe
      reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /v "actionlist" /f
      4⤵
      PID:3220
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTask"
      4⤵
      PID:772
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /S /D /c" echo "Removed" "
      4⤵
      PID:2768
  - - C:\Windows\System32\findstr.exe
      findstr /i "Removed Not Found"
      4⤵
      PID:656
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c "wmic path SoftwareLicensingProduct where (ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f') get ID /VALUE" 2>nul
      4⤵
      Executes a command shell one-liner
      PID:4296
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path SoftwareLicensingProduct where (ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f') get ID /VALUE
        5⤵
        
        PID:3924
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /S /D /c" echo "040fa323-92b1-4baf-97a2-5b67feaefddb 0724cb7d-3437-4cb7-93cb-830375d0079d 0ad2ac98-7bb9-4201-8d92-312299201369 1a9a717a-cf13-4ba5-83c3-0fe25fa868d5 221a02da-e2a1-4b75-864c-0a4410a33fdf 291ece0e-9c38-40ca-a9e1-32cc7ec19507 2936d1d2-913a-4542-b54e-ce5a602a2a38 2c293c26-a45a-4a2a-a350-c69a67097529 2de67392-b7a7-462a-b1ca-108dd189f588 2ffd8952-423e-4903-b993-72a1aa44cf82 30a42c86-b7a0-4a34-8c90-ff177cb2acb7 345a5db0-d94f-4e3b-a0c0-7c42f7bc3ebf 3502365a-f88a-4ba4-822a-5769d3073b65 377333b1-8b5d-48d6-9679-1225c872d37c 3df374ef-d444-4494-a5a1-4b0d9fd0e203 3f1afc82-f8ac-4f6c-8005-1d233e606eee 49cd895b-53b2-4dc4-a5f7-b18aa019ad37 4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c 4f3da0d2-271d-4508-ae81-626b60809a38 60b3ec1b-9545-4921-821f-311b129dd6f6 613d217f-7f13-4268-9907-1662339531cd 62f0c100-9c53-4e02-b886-a3528ddfe7f6 6365275e-368d-46ca-a0ef-fc0404119333 721f9237-9341-4453-a661-09e8baa6cca5 73111121-5638-40f6-bc11-f1d7b0d64300 7a802526-4c94-4bd1-ba14-835a1aca2120 7cb546c0-c7d5-44d8-9a5c-69ecdd782b69 82bbc092-bc50-4e16-8e18-b74fc486aec3 8ab9bdd1-1f67-4997-82d9-8878520837d9 8b351c9c-f398-4515-9900-09df49427262 90da7373-1c51-430b-bf26-c97e9c5cdc31 95dca82f-385d-4d39-b85b-5c73fa285d6f a48938aa-62fa-4966-9d44-9f04da3f72f2 b0773a15-df3a-4312-9ad2-83d69648e356 b4bfe195-541e-4e64-ad23-6177f19e395e b68e61d2-68ca-4757-be45-0cc2f3e68eee bd3762d7-270d-4760-8fb3-d829ca45278a c86d5194-4840-4dae-9c1c-0301003a5ab0 d552befb-48cc-4327-8f39-47d2d94f987c d6eadb3b-5ca8-4a6b-986e-35b550756111 df96023b-dcd9-4be2-afa0-c6c871159ebe e0c42288-980c-4788-a014-c080d2e1926e e4db50ea-bda1-4566-b047-0ca50abc6f07 e558417a-5123-4f6f-91e7-385c1c7ca9d4 e7a950a2-e548-4f10-bf16-02ec848e0643 eb6d346f-1c60-4643-b960-40ec31596c45 ec868e65-fadf-4759-b23e-93fe37f2cc29 ef51e000-2659-4f25-8345-3de70a9cf4c4 f7af7d09-40e4-419c-a49b-eae366689ebd fa755fe6-6739-40b9-8d84-6d0ea3b6d1ab fe74f55b-0338-41d6-b267-4a201abe7285 " "
      4⤵
      PID:2060
  - - C:\Windows\System32\find.exe
      find /i "4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c"
      4⤵
      PID:3704
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path SoftwareLicensingService where __CLASS='SoftwareLicensingService' call InstallProductKey ProductKey="VK7JG-NPHTM-C97JM-9MPGT-3V66T"
      4⤵
      PID:4044
  - - C:\Windows\System32\cmd.exe
      cmd /c exit /b 0
      4⤵
      Executes a command shell one-liner
      PID:3900
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path SoftwareLicensingService where __CLASS='SoftwareLicensingService' call RefreshLicenseStatus
      4⤵
      PID:4636
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c reg query "HKCU\Control Panel\International\Geo" /v Name 2>nul
      4⤵
      Executes a command shell one-liner
      PID:1184
    - - C:\Windows\System32\reg.exe
        
        reg query "HKCU\Control Panel\International\Geo" /v Name
        5⤵
        
        PID:1528
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c reg query "HKCU\Control Panel\International\Geo" /v Nation 2>nul
      4⤵
      Executes a command shell one-liner
      PID:5064
    - - C:\Windows\System32\reg.exe
        
        reg query "HKCU\Control Panel\International\Geo" /v Nation
        5⤵
        
        PID:1144
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$f=[IO.File]::ReadAllText('C:\Users\Admin\Downloads\MAS_AIO.cmd') -split ':sign\:.*';. ([scriptblock]::Create($f[1]))"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3956
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "Start-Job { Restart-Service ClipSVC } | Wait-Job -Timeout 20 | Out-Null"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2840
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:4416
  - - C:\Windows\System32\ClipUp.exe
      clipup -v -o
      4⤵
      PID:440
    - - C:\Windows\System32\clipup.exe
        
        clipup -v -o -ppl C:\Users\Admin\AppData\Local\Temp\tem9774.tmp
        5⤵
        Checks SCSI registry key(s)
        
        PID:1232
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c $AssemblyBuilder = [AppDomain]::CurrentDomain.DefineDynamicAssembly(4, 1); $ModuleBuilder = $AssemblyBuilder.DefineDynamicModule(2, $False); $TypeBuilder = $ModuleBuilder.DefineType(0); $meth = $TypeBuilder.DefinePInvokeMethod('BrandingFormatString', 'winbrand.dll', 'Public, Static', 1, [String], @([String]), 1, 3); $meth.SetImplementationFlags(128); $TypeBuilder.CreateType()::BrandingFormatString('%WINDOWS_LONG%') -replace [string][char]0xa9, '' -replace [string][char]0xae, '' -replace [string][char]0x2122, ''"
      4⤵
      Executes a command shell one-liner
      PID:1828
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c $AssemblyBuilder = [AppDomain]::CurrentDomain.DefineDynamicAssembly(4, 1); $ModuleBuilder = $AssemblyBuilder.DefineDynamicModule(2, $False); $TypeBuilder = $ModuleBuilder.DefineType(0); $meth = $TypeBuilder.DefinePInvokeMethod('BrandingFormatString', 'winbrand.dll', 'Public, Static', 1, [String], @([String]), 1, 3); $meth.SetImplementationFlags(128); $TypeBuilder.CreateType()::BrandingFormatString('%WINDOWS_LONG%') -replace [string][char]0xa9, '' -replace [string][char]0xae, '' -replace [string][char]0x2122, ''
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:1280
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /S /D /c" echo "Windows 10 Pro" "
      4⤵
      PID:4928
  - - C:\Windows\System32\find.exe
      find /i "Windows"
      4⤵
      PID:3468
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path SoftwareLicensingProduct where "ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f' AND PartialProductKey IS NOT NULL AND LicenseDependsOn is NULL" call Activate
      4⤵
      PID:2928
  - - C:\Windows\System32\cmd.exe
      cmd /c exit /b -805307370
      4⤵
      Executes a command shell one-liner
      PID:1472
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path SoftwareLicensingProduct where (LicenseStatus='1' and GracePeriodRemaining='0' and PartialProductKey is not NULL AND LicenseDependsOn is NULL) get Name /value
      4⤵
      PID:4164
  - - C:\Windows\System32\findstr.exe
      findstr /i "Windows"
      4⤵
      PID:2032
  - - C:\Windows\System32\reg.exe
      reg delete "HKU\S-1-5-19\SOFTWARE\Microsoft\IdentityCRL" /f
      4⤵
      Modifies data under HKEY_USERS
      PID:1064
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "Start-Job { Restart-Service wlidsvc } | Wait-Job -Timeout 20 | Out-Null"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2456
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:2188
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "Start-Job { Restart-Service LicenseManager } | Wait-Job -Timeout 20 | Out-Null"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4268
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3048
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "Start-Job { Restart-Service sppsvc } | Wait-Job -Timeout 20 | Out-Null"
      4⤵
      PID:1524
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3344
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path SoftwareLicensingService where __CLASS='SoftwareLicensingService' call RefreshLicenseStatus
      4⤵
      PID:4412
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path SoftwareLicensingProduct where "ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f' AND PartialProductKey IS NOT NULL AND LicenseDependsOn is NULL" call Activate
      4⤵
      PID:3968
  - - C:\Windows\System32\cmd.exe
      cmd /c exit /b 0
      4⤵
      Executes a command shell one-liner
      PID:3492
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path SoftwareLicensingProduct where (LicenseStatus='1' and GracePeriodRemaining='0' and PartialProductKey is not NULL AND LicenseDependsOn is NULL) get Name /value
      4⤵
      PID:4536
  - - C:\Windows\System32\findstr.exe
      findstr /i "Windows"
      4⤵
      PID:3712
  - - C:\Windows\System32\reg.exe
      reg query "HKU\S-1-5-19\SOFTWARE\Microsoft\IdentityCRL"
      4⤵
      PID:4104
  - - C:\Windows\System32\reg.exe
      reg delete "HKU\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\PersistedSystemState" /v "State" /f
      4⤵
      PID:4008
  - - C:\Windows\System32\reg.exe
      reg delete "HKU\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\PersistedSystemState" /v "SuppressRulesEngine" /f
      4⤵
      PID:4372
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "Start-Job { Stop-Service sppsvc -force } | Wait-Job -Timeout 20 | Out-Null; $TB = [AppDomain]::CurrentDomain.DefineDynamicAssembly(4, 1).DefineDynamicModule(2, $False).DefineType(0); [void]$TB.DefinePInvokeMethod('SLpTriggerServiceWorker', 'sppc.dll', 22, 1, [Int32], @([UInt32], [IntPtr], [String], [UInt32]), 1, 3); [void]$TB.CreateType()::SLpTriggerServiceWorker(0, 0, 'reeval', 0)"
      4⤵
      PID:4796
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2140
  - - C:\Windows\System32\choice.exe
      choice /C:10 /N
      4⤵
      PID:1836
  - - C:\Windows\System32\mode.com
      mode 76, 34
      4⤵
      PID:4608
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SOFTWARE\Microsoft\Office\ClickToRun\Configuration /v ProductReleaseIds
      4⤵
      Modifies registry key
      PID:4928
  - - C:\Windows\System32\find.exe
      find /i "O365"
      4⤵
      PID:4536
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Office\ClickToRun\Configuration /v ProductReleaseIds
      4⤵
      Modifies registry key
      PID:2392
  - - C:\Windows\System32\find.exe
      find /i "O365"
      4⤵
      PID:3360
  - - C:\Windows\System32\choice.exe
      choice /C:12345678EH0 /N
      4⤵
      PID:1684
- - C:\Windows\System32\reg.exe
    reg add HKCU\Console /v QuickEdit /t REG_DWORD /d 1 /f
    3⤵
    - Modifies registry key
    PID:4100

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2840

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3080

C:\Windows\system32\Clipup.exe
"C:\Windows\system32\Clipup.exe" -o
1⤵
PID:3064
- C:\Windows\system32\Clipup.exe
  "C:\Windows\system32\Clipup.exe" -o -ppl C:\Windows\TEMP\tem967A.tmp
  2⤵
  - Checks SCSI registry key(s)
  PID:2124

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
- Modifies data under HKEY_USERS
PID:2204

C:\Users\Admin\AppData\Local\Temp\winver_edit.exe
"C:\Users\Admin\AppData\Local\Temp\winver_edit.exe"
1⤵
- Suspicious use of FindShellTrayWindow
PID:2808

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1704
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8ae4ec728,0x7ff8ae4ec734,0x7ff8ae4ec740
  2⤵
  PID:2512
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1672,i,1994787676871274256,4425077689057831690,262144 --field-trial-handle=1972,i,2240095331801306893,2307059576379361942,262144 --variations-seed-version=20260730-090050.054000-production --mojo-platform-channel-handle=1948 /prefetch:2
  2⤵
  PID:1008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2152,i,3761353784394184662,13998686048072878613,524288 --field-trial-handle=1972,i,2240095331801306893,2307059576379361942,262144 --variations-seed-version=20260730-090050.054000-production --mojo-platform-channel-handle=2220 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:4212
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2360,i,1749941984317733379,9618072116046483343,524288 --field-trial-handle=1972,i,2240095331801306893,2307059576379361942,262144 --variations-seed-version=20260730-090050.054000-production --mojo-platform-channel-handle=2332 /prefetch:8
  2⤵
  PID:4760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3224,i,13032933221726035260,18366785707329526832,2097152 --field-trial-handle=1972,i,2240095331801306893,2307059576379361942,262144 --variations-seed-version=20260730-090050.054000-production --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:2024
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3228,i,15474202982361013820,7516992534793220414,2097152 --field-trial-handle=1972,i,2240095331801306893,2307059576379361942,262144 --variations-seed-version=20260730-090050.054000-production --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:4168
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4548,i,13665055914783472520,11736907994877509723,2097152 --field-trial-handle=1972,i,2240095331801306893,2307059576379361942,262144 --variations-seed-version=20260730-090050.054000-production --mojo-platform-channel-handle=4560 /prefetch:1
  2⤵
  PID:4552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5324,i,3308234435846585802,17637668064602392235,524288 --field-trial-handle=1972,i,2240095331801306893,2307059576379361942,262144 --variations-seed-version=20260730-090050.054000-production --mojo-platform-channel-handle=5328 /prefetch:8
  2⤵
  PID:3980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5592,i,5094221779359835932,17682453884049957077,524288 --field-trial-handle=1972,i,2240095331801306893,2307059576379361942,262144 --variations-seed-version=20260730-090050.054000-production --mojo-platform-channel-handle=5376 /prefetch:8
  2⤵
  PID:4304
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5600,i,18021393202041992172,2394780501356067117,524288 --field-trial-handle=1972,i,2240095331801306893,2307059576379361942,262144 --variations-seed-version=20260730-090050.054000-production --mojo-platform-channel-handle=5628 /prefetch:8
  2⤵
  PID:4456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5608,i,237097821825945473,9052871684285668725,524288 --field-trial-handle=1972,i,2240095331801306893,2307059576379361942,262144 --variations-seed-version=20260730-090050.054000-production --mojo-platform-channel-handle=5452 /prefetch:8
  2⤵
  PID:3692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5676,i,8104472635521600046,17024635606718389403,2097152 --field-trial-handle=1972,i,2240095331801306893,2307059576379361942,262144 --variations-seed-version=20260730-090050.054000-production --mojo-platform-channel-handle=5692 /prefetch:1
  2⤵
  PID:4820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=3212,i,14776828954782020631,8637161431197167227,2097152 --field-trial-handle=1972,i,2240095331801306893,2307059576379361942,262144 --variations-seed-version=20260730-090050.054000-production --mojo-platform-channel-handle=5760 /prefetch:1
  2⤵
  PID:3140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=media.mojom.CdmServiceBroker --lang=en-US --service-sandbox-type=cdm --force-high-res-timeticks=disabled --metrics-shmem-handle=6096,i,3821787302635301851,4668236378371958177,524288 --field-trial-handle=1972,i,2240095331801306893,2307059576379361942,262144 --variations-seed-version=20260730-090050.054000-production --mojo-platform-channel-handle=6100 /prefetch:8
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:1392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6008,i,12352642087494720819,11124318548276731323,2097152 --field-trial-handle=1972,i,2240095331801306893,2307059576379361942,262144 --variations-seed-version=20260730-090050.054000-production --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:1496
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5912,i,10618966188787141803,9593386108329381653,2097152 --field-trial-handle=1972,i,2240095331801306893,2307059576379361942,262144 --variations-seed-version=20260730-090050.054000-production --mojo-platform-channel-handle=4572 /prefetch:1
  2⤵
  PID:3788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=3916,i,10060085419427355033,1371823268180465202,2097152 --field-trial-handle=1972,i,2240095331801306893,2307059576379361942,262144 --variations-seed-version=20260730-090050.054000-production --mojo-platform-channel-handle=5836 /prefetch:1
  2⤵
  PID:1708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6216,i,333596593489330314,11621427473450734998,2097152 --field-trial-handle=1972,i,2240095331801306893,2307059576379361942,262144 --variations-seed-version=20260730-090050.054000-production --mojo-platform-channel-handle=6232 /prefetch:1
  2⤵
  PID:2312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6372,i,10817625146064972159,14176789523097598785,524288 --field-trial-handle=1972,i,2240095331801306893,2307059576379361942,262144 --variations-seed-version=20260730-090050.054000-production --mojo-platform-channel-handle=5984 /prefetch:8
  2⤵
  PID:364
- C:\Users\Admin\Downloads\winver_arkheos.exe
  "C:\Users\Admin\Downloads\winver_arkheos.exe"
  2⤵
  - Executes dropped EXE
  PID:1020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5532,i,10686198619820219001,4019856762677744441,262144 --field-trial-handle=1972,i,2240095331801306893,2307059576379361942,262144 --variations-seed-version=20260730-090050.054000-production --mojo-platform-channel-handle=5788 /prefetch:8
  2⤵
  PID:1476
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=5892,i,2971576703872393491,15431606626773510793,524288 --field-trial-handle=1972,i,2240095331801306893,2307059576379361942,262144 --variations-seed-version=20260730-090050.054000-production --mojo-platform-channel-handle=5564 /prefetch:8
  2⤵
  PID:2640

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3108

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5096

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:3164

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

GenuineTicket

Path C:\ProgramData\Microsoft\Windows\ClipSVC\GenuineTicket\GenuineTicket
Size 1KB
SHA256 5cf3ae9ca793d9a8517d05864eacca525ae8b4db3d13943edcc4bf3f2131dab4
MD5 5e22ef25ec6bdbe63cedfbdf75011316
SHA1 d828c721daf6c630960838dd3a9391d2ec62e88f
SHA512 8599d461fbe166906bc42d2ac6235d32a0f32ea247dbf1bad76ca72233df7b5907c7ebb57b943a3e51d0dae8825baca396f2dd79a34b00197f9dcaa8d6a37714
TLSH
T1381123B4D5356C10221C67F086713BD3BB1C314BC6935D29FB41579835AA2823B57029
MD5 SHA1 SHA512 TLSH

Submit Download

56968e42-0064-46fd-a006-5e3e46692ec9.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\56968e42-0064-46fd-a006-5e3e46692ec9.tmp
Size 126KB
SHA256 58c58f2031570e00be8cafc0f042b19a4674885978615c4a7966011f0278fc61
MD5 917e134120f963b367504fa7eaf531f8
SHA1 ef8e54b39e399c5456507bf6de1a709beee157cb
SHA512 f7f917b45f6253487cab7eb889ff26420099f4cce775b3797f383a617b42228136edcc11853e600dbab88fb1bb856c28afd0f49c329d8ed49aabb119a6657ed3
SSDEEP 3072:+malrOqhrZ5gY7ZULkZDk9AjKdujbVMUG5Z4Lk:+5hZ3ZDk9AjKIbVk5Z4I
TLSH
T10CC312107C7EED789D8E44197454971B87F1D8BFA99C38A64EEC2B05138BCDA2781829
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\CrashpadMetrics-active.pma
Size 1024KB
SHA256 ae1bddb9e2cc97b0c9cd78ef3cd17553be6e5204677bd67e0b8f7fa27007f189
MD5 b0366599d64b0fc1adb2a712dcd02ee1
SHA1 b7a1c09ccd2846664cab5f76bd80b8e9f107acb0
SHA512 d7de6d48285018f8b709c81ca01688126db7893ce9f48829524ee3122aa6f2200c7f78186b5a558d0b1ecf8157ee78a20064b63b45ab89f7aa0835b8409435d0
SSDEEP 12:bHCsEXhVMMBKEKSCemJKlkQyYVhYJ0I+pPK6BsyW1inP6:biPROMMBS+MkIYWIE1BtXP
TLSH
T117252786A30815EFC54288B589AE03602374F9E55F52079B2E2DAA1F2E271D80F45164
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 934e8a2dd0b8fc2347eea4a5fcd1e0271ad9d5a2afa5dffa8aef017283231eb4
MD5 f0d9cdb92f2136d897525d63ed1a375f
SHA1 ef4e84f76ab149db1d7def9088d5e039eac018fe
SHA512 df19c50bb58e85cdd1b10d5ef14c6e5b0a2d4cb19e1a0fa5c4162ed9647256cdf4b62690daf9898df15c607728b24f1f1b75426cd85f7748ba211368898599ce
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 515363514bd8bad2ebff0148f4a0b59180a1a83d16705f7ebe3a268c8639c4f2
MD5 9d5aed2c64767144673d54d7a030d867
SHA1 646447687b49361e938770e6a01e16daf2d9c88d
SHA512 53d642b54324afbe59bf1f280365def7d797e0eae04b630643e49372229b6e56291e9908096e2e9aa0c65d6c1bd302b85c14825d594497d255faa3bd4e4ed1fa
TLSH
T1A7E02BA9C9209D2B0CFD071DA4594786E75423573B41856F3A3CD60D8FB96371986C1C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000006

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000006
Size 331KB
SHA256 db4ffbf0ec662620013dc14bc1268bdad6256d19d7d511ec7eff8446887e6900
MD5 05ef8155cf66131654d3bb9c9cba5853
SHA1 e79d53fcb604921222dd1dbc2f1c10c631ff6075
SHA512 ee38793245d91683ddb1f847e5b56a09864fd32ec059055459b3ebe101abed79683ee59c80f30b8f6249d2bbd83fbf7bca83dafb4ef2b634ceff6969c80fed23
SSDEEP 6144:FljUD58FLTW53eaLkNv+Ps0dj1fpqaGjYf0NIcB3bM1rJZ24:FDm5uaLcv+PFj7ajJNImbM1rD
TLSH
T1247423A9B50E3C8AC94F9473827EAFD2A4356FF38D47BAA3634241F401874342E4676D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 c78518497324366e3d86b184de7f923a8f7dd17fb2d67766e9766c0f21d57aec
MD5 d4c4c51d8f930f0577b5f837d2d95373
SHA1 098bef6833ad413a4817d0e24927a409005026b2
SHA512 09cf389d23d71b6bc92ff7c181b7d64dfcc95ee4f77ce32aa432cb5bc2401be2d686a73ce8fe0c0e395d61ef5812cf6cd7c8e46c45e8b3758a4edd92ebb47788
TLSH
T10341BAC5E5D27539FFD2AAB201BFCC5227B9A06004861753053FD560B64FBE614B3E0A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 696B
SHA256 e268f3a729caf86657b4120888ed72c4b8b7ffd80a856e4ccab02a62d624980b
MD5 f29a7ce560c510e17b38e3572d004e30
SHA1 779f3a440316866056277cb5b6bfe8482abe4df5
SHA512 7f14daf0d9e19e46d4f21e7d1f2bcd895391ce715996557f4d45782c9fd546f49c9ef91591b1a1d7314ffc31550e0da1e9e94543615bb5cfb6c07c6c3067a59f
TLSH
T1C10184C814918430DFC6FEB053F0CC20297A826208821AE3036B54B2E29B3EB304B58B
MD5 SHA1 SHA512 TLSH

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Favicons
Size 32KB
SHA256 c84075233d1ae6ef87597ea65fe0f78cb4c9fdb341a79544ae8a7172039c1afb
MD5 d436bb4a8f00fa2a7f99964f967d2f36
SHA1 6928f54fd9c009ecdacfa570879389f077c293a5
SHA512 d00d07d912ab3d2a171637581254f070082949c20673c78351e70ca567597a7c88fdfea03e3b4ee6155a629cb4ffbb6c847d005b1dc48f0759b2960d68cc378a
SSDEEP 192:+czDTtDKFAADen+0uCDKFAADGD/nAzsu4JycmzizRqQRhUAlOPA1P8vTHL9ubr:75KbmKZ4ACu2hUu8KP8e
TLSH
T1A6E25BD77E747C73EF2A9576102CA61CEE33D19D9DEA4CC8345148222CB4956017DBE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\File System\Origins\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Google Profile.ico

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Google Profile.ico
Size 192KB
SHA256 87e933966804aefee5b77abdae95b1a7f72c298b148190d7d20fe6a77c239f3b
MD5 010ec79a1098823a764aca5c4adfcbef
SHA1 ee77b3b4682e7b05075d7713f354162fe02555bb
SHA512 3ca45c2be2a916e19c5d9c467e1cdfac64b9243c29c9ac79dcde1342cc0cb9203d3f6ffe1b9ca1257799f6c70237e12019908e2c5091dd77d40134a0ae25d6f8
SSDEEP 3072:2Xm/EXUfaL6MV8nbsFXdFVgQAU6v4v62PV2Ey28nr6dOQriQWe4gMg3cdrqZByGk:2XUMCm4U6q62MEBi99g9sdIJZpVhA
TLSH
T1BA143B265EEEE940EEB11A753E7E4381D6B5B80689FD21E45AE23C112B7FCF505B9003
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\History
Size 160KB
SHA256 3e8e26bec233012b6e5bb5f464f8772bb03f131ae672cea2d9a9b53c99ad6431
MD5 01d12c6a4efdc54adcfe976a426fd5a9
SHA1 2ef421104cca5eb6bc93781e3f932065ea0e9975
SHA512 3fb4761ea7b713a6855af6246f0a301510ec30d0b9e0bb6a2caa52b712d17598c663b4eeb6eef165fb0a17483d3cd99c078d802fbcdea24b5007c2a01fd13d1d
SSDEEP 384:FKSevarr/tIkUI3ijVYWNkqpanMYDH0qmNPt+1UIKbYy:FKSevarj64idkqdYDH0qmNPt+1UIKbYy
TLSH
T119F3C5DF6F64B922DEB9D27A18FAC35A1D3EF0AB8B8615C95C200425CDF1A63101C7B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.dropbox.com_0.indexeddb.leveldb\000003.log
Size 869KB
SHA256 958ba5d8985dc6a34ab565b2167a81cd5d37f4e5298077593da3f655682bc1bc
MD5 5f2112a3dc0a2ab6982f98f86887449f
SHA1 71d847d3facf288dfbe5ee952697febd4d6de82e
SHA512 847c39f46c76f983bfdd32e9e40cbe0bd5192392098ddc224d41b6f3e2deb4a6deca77b35bf5ec18fd8f44a63e9284033392354030f5ae7e5919612033d7c7ed
SSDEEP 3072:aul9TQDgYUWLybRtkMnNqogDTBvJi/LzIwqpqXP00y0NyU+UeJxA34hWHIRcsjlj:R70EaCF5F3Np6
TLSH
T1CB15DCE1B5E86469F3B73A35693C1B98593FBCCD9C40A11F26E8EA4C0475F409AE0763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.dropbox.com_0.indexeddb.leveldb\LOG
Size 351B
SHA256 2bab8f6315a874e218f37977a4503d64aed06bbef5898a97c7528b8f13883624
MD5 6f4dd3dd8e76cd41c02a9abb2bce303b
SHA1 32cde8840d08489528b199ad44d43ef2e480fdbb
SHA512 fd0510df97561876d2048d90a82e93d5d7657a81bb17234fb235736549c327bdecf14cf256edc23d94f1ccb36c6a2d2843bca289fbfe103193898cdb31b700ef
TLSH
T1C7E0D86855CAC55F319480A76965774E9AEF251CA6CD68461F82D81C70C940C557D370
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG
Size 329B
SHA256 5fcf36419816cf641b0837338369763a78c04e23385fcec9113adf018d90dd62
MD5 3eb5e0f734f7663bb700491ea9b86c02
SHA1 fddff403da948b2bfa3285ca478b8bed3ffe6aea
SHA512 5b291cafd8b99f1a053d0426d7fdbfaf09dd599f70df8be343b2b4e1f9965538039c2f9c8cec50ab53a5d03a008a9a6bfe6d40c3bd7efa475b0bb60fe64dbf99
TLSH
T1EAE0265365ADD9EE2185806BC32EB74CCBF03405EBCE2A069B09A444B1C6408E3E9EC5
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 cb9fb5868af35517a320432c82d03714415eaebb187ad161187bd8f48d74ff02
MD5 0a6f95607cde90a465b0393fc6c47881
SHA1 db3461b85c090cd4beba4fce02cb4f3656e64e12
SHA512 223bd656e70d986aad526fd9e1fb22c00b6d6ecec5b5bae6ebb53e3d140bd703467488ac501faa47d8641ef709560c12e57c5e2dcf485ee5fa7c2ad2b208fa3e
SSDEEP 192:DGhWqK1gDPWTaI7tlcVI5UgsmbXe9IQK7zCGIsmjlzZH1lifD:DGhWqK1gDPWTaI7tlcVI5UgsmbXsIQK5
TLSH
T1B102BCF7C3E4C62DD95156F4AB256E2FCE690924532C3C66C8D8BE1B93E2432E24174E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 a45af24d9cc4b2382bc88e8acee1e9ee52118b8744be9514c83177e86df8b45f
MD5 990e0316f0b7a569a8a391425b1b8c72
SHA1 90fd5e623b68f1c3bd5b44361951cd998d8a7bb5
SHA512 e31b49d3078da166f44a52e47c6e89cb17c41b4880012a69eeaf427a4866eeeb136718e6d7856575ecfab1cbb79cd624106693ce13678aeab19dc97cd2d4aa17
SSDEEP 48:YALlhyhQhMhMqehFaXYfo7d7fs0qzsZ/tsOJzsv/gmzsyIFsyPsHcsXm4sM7zsNP:DwOuObjaIad7N5/lS/VI5+iMMMbJHe1
TLSH
T154B19DF7C3E8C52D895156F4EB256E2FCE2A0528532C3C6AC8D4AE5B93E2871D20475E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 9KB
SHA256 503a9db23e0302dada80be412be795d658cc5757b63ba86002bbff3263efbdc4
MD5 9672aca9f4702971a7dc7e386791eaf6
SHA1 f3e4bff4c2ebff5335dd7c9acf718d9ec30415be
SHA512 20405c551f465de25a0331b4f2da79fc421cf4bbfb9faf0629e5da6117111ce2273c941cae02400d29e427fe05c4cbdb21f393ddc54d3678a3e13a33913d31da
SSDEEP 192:DGhWqK1gDPWvyZaI7tlcVI5UgsmbXe9IQK37IajlzZH1lhjh24wNMK:DGhWqK1gDPWvyZaI7tlcVI5UgsmbXsIW
TLSH
T17712BDF7C3E4C62DD95156F4AB256E1FCE690924532C3C66C8D4AE1F93E2432E24174E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 858B
SHA256 a78e1a241dce61668c11101177c12d842cd6ab0a09673e8c29b01021ac1ffd10
MD5 e7f82e8571a6413de84e9bab972bc8bf
SHA1 9d4c582b14e7da11c71a78ccac293b0595b73d9b
SHA512 1656d14fbc6f769b813aa5b3f3ec5d16f162fd98f2852491c80920dca6088bc238fdf1063763cacc07e7e4aab9eeb799ed7c668f83bb6c890d3dcd5973c9fca5
TLSH
T1D0116FDB66BD7427217D5DAB1D047C0516BEB83543816CF8DE9B822CA0899F71F12873
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 a5752e226702ca2be7f636e8a0b0413973f095130d1312e22b6a786d396d1ea8
MD5 3dcc7fc1156827ac0e01ce2e9447758f
SHA1 f523c5b0b4f3e9900fe5886d2eef7f5a030a2346
SHA512 9e76cffe917b6db94fdd4f5dfd710226c1fa4cdce9dd569e33e2ac5344e27e6850bb3b19e1d871165de9b4d164d2a8d3ca123a921a18c0f3b0b3f8fb5d0999f3
SSDEEP 192:cRKcBzyPZ5ohxUv72ympAPRp2Mqb2195Hsb+WNGlLdN7r3ec/s2WiEkIsVyIsnAq:cRKmzyiQQUXV7wsPneas2WiGIe
TLSH
T15C52A55FFA14297B9CDBC22AF916BB27D7F5102265842E84E6FC8A1C18EB5CC2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 a71bfe13bea869c72c7cf5b3c895937abaf282c8ca041a03f884f722e61c0a35
MD5 4544b99e943312ca033d34966e54a5a0
SHA1 fa5a1ad3bc5d4b6a095568975efe83a980d7d982
SHA512 4066e85033b357faab205063dcf37e4c696d92db9ff596cca76e5ba66e1968d5325f6950aaeabd5cbb83840db9043423261bca3283f97a4955c283e0dce9e524
SSDEEP 192:cRKO/3zhxUv72ympAPRp2MoT95Hsb+WNndN7rf2H/s2WiEkhVyIsnAUgtaJ:cRKOXQQUXc7wjX2fs2WiB8
TLSH
T16952B51FF914657B5CDBC22AF912BB17D7F5102265942E84EAFC8A1C18EB5CC321741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 b5112ef4aeafaecb9aa4381ff49375b2cd63d6b40346c90c6770976cceff7eb0
MD5 f5b4e2f61b85bd0cadf2c84aa1d709e1
SHA1 1fef629bdf3e8ebc40bed8d295181e7eaf26ac70
SHA512 b5a7fa37c288f659e53cfdace9dd6b8a2f9daebc3f12517fd96990662aa6d2aaee047349dc6d65ac15fbdbb5bd424e0464c72f945cbb20492d10ba27471a1786
SSDEEP 192:DRKcBzyPZ5ohiRv72ymhAPRp2MxAb2195Hsb+WNYAu+0lLaKT3X+r3eI/s2WiEkU:DRKmzyRBQ8Xx7wt3yTTeeus2WiGV2e
TLSH
T16B62A41FF920197B9CDBC22AF916B727E7F5106665842E84EAFC8A1C18E79CC3217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 4dc7012f9c5e8e8a0e14cf5fb5e1e789e8df349ad11682dbc1afd75fc04d95e7
MD5 fecbaaa227252bd4cb5f07554aaa8b83
SHA1 01b2ccce659475adc413b8b9341d7d8379d54eb3
SHA512 1c7c777696869619aecb5dfa78d428501ac697bd8a79c61025ed65cfe1613c1030de35e4e6835a6071a73df99b910a46ec12b0512696c0e82e635bdcaa48cc61
SSDEEP 192:DRKcBz/PZ5ohiRv72ymhAPRp2MxAb2195Hsb+WNYAu+0lLaKT1ZWr3eK/s2WiEkU:DRKmz/RBQ8Xx7wt3yTDWeEs2WiGV2e
TLSH
T11E62955FF920197B9CDBC22AF916B727E7F5106265841E84EAFC8A1C18E75CC3217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 9662b21124f6815bd43aeb4121734c3b9d80149f4bb23141928835115ef862b3
MD5 15ff5f8283197921b49ce7ac114b77da
SHA1 1e4ec595e11f031638dd2b99dfab7f600ac44514
SHA512 44dd710a124eb41039a12a5eecfa09ffb9ee9c79f1db874fe2292d2a708408f9da70b8dfa4b7a233eb4f59911ff70f58b686b9790fb83c69cc2b3a9a449403ca
SSDEEP 192:cRKcBzyPZ5ohxUv72ympAPRp2Mqb2195Hsb+WNYAu+0lLdN7r3e//s2WiEkIBPyr:cRKmzyiQQUXV7wt3yPneHs2WiGVe
TLSH
T12A52A55FF910197B9CDBC32AF916BB27D7F5102265842E84E6FC8A1C18EB9CC2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 cbd2a7fc9e174b470121d4bf48ad4cd7a9cf1cc472adef132372b5c2e5b0b419
MD5 5a7d0da3181754feed877d8a69299e5b
SHA1 f7c680b2a2b3b1bf8557bf0aca1bcb5b709c4ef6
SHA512 1eb4ee72c7c72d1780da74b0ffc2b0a838efe524122b7e3511d5649e2ea5fea149cbc160c4ddca6442e495b8e934f23d71186aed77cafb9fde67a0dfaac6e3a5
SSDEEP 192:DR9cBz/PZ5ohiRv72ymhAPRp2MxAb2195Hsb+WNYAu+0lLaKT1ZWr3eK/s2WiEkU:DR9mz/RBQ8Xx7wt3yTDWeEs2WiGV2e
TLSH
T19A62955FF920197B9CDBC22AF916B727E7F5106265841E84EAFC8A1C18E75CC3217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 b40c2453ec1689b7cca3cc5a3c63880e83af0d28fc1c65e5062039848e683a5c
MD5 6c21b2861c6f22a1ce33d6a3224da106
SHA1 ba45af83e733ca9cb20750194994d886584cbbfe
SHA512 cf65cab7d278dc1ca4e2a88d493ff9e3006b6806b97c55600c8628ab776c5d30ba02fa4de4e5cc40ff86edbe25941f0fac0a0327f0ff05876b97d25d5f4b99d2
SSDEEP 192:DR9cBz/PZ5ohiRv72ymhWPRpcMxAb2195Hsb+WNYAu+0lLaKT1ZWr3er/s2WiEkg:DR9mz/RBQuXH7wt3yTDWebs2WiSV2e
TLSH
T1B562845FF920197B9CDBC22AF916B727E7F5106265841E84EAFC8A1C18E76CC321741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 87ed83f9cef10540383969a1ddd48a04df50222c6ab280d4c2d59372a67585cc
MD5 825a081b4bda727e9e3cbfa5fcb70940
SHA1 bd5595fc8b4c89187fe568af7d17b33d269a3111
SHA512 bdcf3d0fac63cdeb0175c52ce292752a07038e81e132003fefa59026ff7bfe8ab3ce94a756b912839a876aabc6d4f5206b2ebfba39cce3a3acb7f5c07a6a56a0
SSDEEP 192:DRKcBzyPZ5ohdGv72ymhAPRp2Mqb2195Hsb+WNYAu+0lLaKKr3eJ/s2WiEkIqM+M:DRKmzyOyQ8XV7wt3yTCeVs2WiGV2e
TLSH
T1B252951FF910197B9DDBC32AF916B767E7F5102265842E84EAFC8A1C18EB9CC2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 93a969d5494520a313d59c847d3ee10e51ce49e2c8cea4f6ea38850cfab527d0
MD5 65eaa0a57fc2a07c6f5f8e9c22429ba6
SHA1 83b5d3c038efb456e4191e45a08c6c1cf8b7d43f
SHA512 2f69609ebf02ccda7dd197a901863ecdf075cd94dce3ddcaf8f69f28aa522eed4a257c71ee04de563d2d250a18b8f7b4dfd5e90247d3586bee22fe519ccbce35
SSDEEP 384:Q+jM77KxkXqKf/pUZNCgVLH2HfgslAG7pLuLcSjW3XODM3+ErU3oPHGqkkpLtE:QOM77KxkXqKf/pUZNCgVLH2HfgsSG7pu
TLSH
T136720A67684C9A370F94CACCDC16BF4FACB5025B65ED886492FA5C1503D5ACF110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\000003.log
Size 4KB
SHA256 fcd62ae34016ae1fc088339a3d5319e6df986d70a2194f4e7599accc3479b442
MD5 fa1dfab4cf76375c310039b8e0fa4357
SHA1 211438958c9ded9abf070cede2ae0128309e9def
SHA512 b46ba459099c23bfa68b66d80630abb0a4225a9edf71ab4cdba2e3a291cec056559dd8a09982e34ea50141bb34e24bb5a5ac26d810f43964d09d7c16ae3671b0
SSDEEP 96:F1mKIMiRwcnDh1JZx6LXbXFXKXT1FXSXTaXFXKXTcxhXsXK0XbXNXKXTuuZXIGXa:F13ldmDhRwL1ajbCja1ajq8tL9ajh4Gq
TLSH
T1DAA17D6EB50A184EE4AD4936CD78571B6F69CF0C27FE3767A9DF8A0405B0A5701086F3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\LOG
Size 336B
SHA256 5e29b239593f256d2aa6a4b3eb45b2e6b327574949ae26e0987f4e3d873420f6
MD5 1684fd045471ca02ef84ddccef9dc36a
SHA1 72f6dc517b89bb55f7862370b848bbade0d89086
SHA512 53a524e6ede558c5d195a9778d2c46766eb66c3b7d5f08999461ecc52cff8c4d0e99142075c25e5d6ac953f3ad1d8990404cfacab58a6547d48fbef5d06b2f87
TLSH
T131E0866226FDC5FD309581538361A34CCBE87406DBCD78061F41E9A931C690872A96D4
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 5681a1ef52baa49bb50f1e1376a1ca03b6031af4f3f8faf956a75397bf75d63a
MD5 e9c4d3d10f7bc27b000cf208aa4e5ed0
SHA1 0130b2f3d093338e4c3648ce8bdeab51a1bc131d
SHA512 e3fde48f2468d94c9a31e825f80734a9747bc55046a656817f1353d96fc53f5087f7862ff2c1972a4e0ced609093fe5635ac6fc9ddc14dd89efddef9d98326c4
TLSH
T1D1B0128190025501C4070AF8124654887154DF12D60A278143F47922C8355508414050
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58f652.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58f652.TMP
Size 96B
SHA256 72ae58523b07cebe45037a3d74354c38758d1cd84cd7b14ce4820b7cb6e30c5a
MD5 579041567cb6d7abcde154cd68a2b1cd
SHA1 e0377c6da40e57f2bc641c27104ce7e66831fba7
SHA512 afea3957d75b25f05a36b1cac45647859f4ed58cdd99d30afe4a01dd435a0f4dc7cb487f5e3e26315884592fa25809bcfbe7a823339cafdd49553f5808bd9f8a
TLSH
T1BBB00256D1BB6212C05283F52A9995E875A0DF39C603165A93F01E7BDC256608D355A0
MD5 SHA1 SHA512 TLSH

Submit Download

Tabs_13429929608452231

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sessions\Tabs_13429929608452231
Size 13KB
SHA256 6a82de94d286ebb6fbb0955e7c4a27183f3f215cdfcf7cbf0517816e63ef8398
MD5 e0ad855f717deca4547fc565ffe37432
SHA1 a3b947253c8da6190ba8b73648ac79cea67a43e3
SHA512 e3642055b398882f6dd6713c62ed7d9e82e9e035f9ecd51c2c2b1c29aea4504b450ac29ab51016276700a65906ec34a102a63776cb486fdbc868843aae38d496
SSDEEP 192:30Fshr8nE7spBv/hJ7sY73Y8QQm7XJGb67eQu4gtLTDunHGo0DCDVDB+7s1Bv/hW:Osh1s3Z1sq2Qmzlu9DQCENesrZJmT
TLSH
T15A5243612AFD402EF177DD759BF872EAEE36F66329458CAE005103050922E42DE65F3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 96B
SHA256 7c92405603d6599d24bc9a4c7bb2e2558ee54b9610b28dadd9547b302564aee6
MD5 4a972e7dcc6e47fb0291fe560c484e0c
SHA1 06d2484982274f3bf62c999ca04e27f5151c6445
SHA512 db7b7e27fdc41848d7241de72f7389ff818326cae90d117e233cad9836436f077b8e561fd99d8db7865c1ab51ea31cf9f322aef0c2c539e7d584956570f704fa
TLSH
T12AB0029494505851CB4883B4F2D28E983F210F6013C585AFA2FD1056CA21B525313753
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000003.log
Size 172B
SHA256 c0b181541a7149127f1f7f860e8f525e0f9fac91690f53df9fe9a11abedd8556
MD5 3e8cdda125f1baf01eb354d5f470a02a
SHA1 9fc3d5de985ccc3490716766145bd2af9b9c79e2
SHA512 1733cbe316616630536fc9098e7313378e18d2b7ae84915ef5be2cfd8dfde882018eb4c15348b29e6d1eac6c4eaa8cbb4698514e42e652573b0576a674c4743b
TLSH
T110C08C087B24960AE8C8223005992748AB50F022106084B3C89CAB04480B3A4AEE6EC2
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG
Size 348B
SHA256 7e847ea61d0a4f3d000f3570983270ee99f97d6f6a7aea65b4c8f2659342fa9b
MD5 a63cd613ba1933466806bf48b0f4702d
SHA1 6cf2049c03a85f5a888f4c21c1004396a53390ef
SHA512 5fb13a825ab48b422b26e335d7fd40ac28936aa391045f3221680f6166d89201449bdb41722ac0bca6b11de76fbf1db7e72bde8a45b69a1fafc95554596632a5
TLSH
T11AE020622AEDCBAF30C54157D311F34CC6F17401DBDE64151F05E5D9728640472996C0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG
Size 324B
SHA256 4f0ad3719b2ad239a9970185cbb20a89605c5184458c3ebb6b9dc1003c99d83f
MD5 1bb712888b537dd1df720cd39cd09f5f
SHA1 bf2187723cdc86cbbc17be80bb720dd54eb50212
SHA512 c6e63994d87df5b3fd6bf414e81fe6f22780cd87b7901de86ec1b1dfd1d52daf48cd455b3fbf86fce856c5d4570466e1520f84bc4fe14da33680e735559f5024
TLSH
T184E086B366EDCAFD2088C093C361B39DC7F47805D7CE355A57049494B58651463BCAD4
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\4\IndexedDB\indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version
Size 13B
SHA256 e5efa9eb104cd0b25149c2e789bec8d9aa4ba95678831b657eef7780a281c391
MD5 43ef949d3c6e9956545979ace65d0085
SHA1 63f2b2de8727854597e49a1216e8e74c68117c07
SHA512 313a5ab7ac9b5efd955beba4615784bdc2a9058ddaa804d85fb2d0c651dd3de07e382d61a1bb482499520a80e0b64c004ff2af03459cbc1daef47f540f0a6905
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 e72d8c28f52f48cfcef5d6aad1262c63e9753305d6d6ba26007ef1f66fdcb1e0
MD5 b61f7aee1eb59a77ba300c19fca9d696
SHA1 956bfe7181e8e0c0a8c2617e7ca38ca449dec8e4
SHA512 0e594f0dade42b3b9bdace64219568101eccdaab78cf82f22656dbaa793dfb0b67d1f8d5f1702b1eb910db4ff2e9287c9dd8dd50eb00eeeaa586d6413ade0a33
SSDEEP 3072:H+alrOqhrZ5gY7ZULkZDk9AjKdujbVMUG5Z4L4qfd7NtZL8cHQRZEQ6SpsS:HxhZ3ZDk9AjKIbVk5Z4sqZ/ZLW3ExS
TLSH
T119342332BF97AE359D8E8A3475124B5B83F188BF947851015FEC37972A83CD6398185C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 33bd30a80a37de108e02bcca079368b88b064a9d837e4214796541b893487d1e
MD5 be28fbaaaea8cb985d409f13691ac97d
SHA1 f519485328172c251a1a0023074ac7a492c2684c
SHA512 ff10f8fa1d16b5a055da8321fce6cbd64de919051709edb1f20a6672ab9d3e6acbac06f3a08ec14f7856d06d466b9579c3e248bc1cab3c05d5e8d8a191403b64
SSDEEP 1536:TPQyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbjf:uqfd7NtZL8cHQRZEQ6Spsk
TLSH
T19AC30237EBC21F339D96CB60B9530FD697B644A59034D301AAAD77EF6C8389174428AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 0395509f8e0ca7c48b55e34bd2387a80a203e7a8ec1a719d93e643790fc8de31
MD5 f7aa26cbe50b53f3f3836a2f71c21309
SHA1 9d6f948ac3ca5bf29a4281c414d104969d061e40
SHA512 b287e4410dbcb1fc14f752ba440ae6a57d19616fddb0ff9fc3971d7d1074ba7ab519ab3de6cccc0d8190eb12226fca286365a418796ba2ec327fe2e166f7a43b
SSDEEP 3072:ZualrOqhrZ5gY7ZULkZDk9AjKdujbVMUG5Z4L4qfd7NtZL8cHQRZEQ6SpsS:ZhhZ3ZDk9AjKIbVk5Z4sqZ/ZLW3ExS
TLSH
T1D2342332BF97AE359D8E8A3475124B5B83F188BF947891015FEC37972A83CD6394185C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 127KB
SHA256 151417a61e88a1edb0a509e91d71289be3901d4cdc091e069ba7fbafc622519c
MD5 0ab885c21f9aaffe96cd31eebe2c0842
SHA1 6bc502b9014f8d87a0d96f0efdb3e13c5188a902
SHA512 3a7ae6a3dbcd48339bae967e5ce754310740dd0b76592b462a6edde830576d109887f83a99128d41c06e58023a7750dfa7a3afd0d32a484d73038eb70cdab99b
SSDEEP 3072:PnalrOqhrZ5gY7ZULkZDk9AjKdujbVMUG5Z4Lk:PahZ3ZDk9AjKIbVk5Z4I
TLSH
T16BD31230BC2AAD749D9E081D6404B31B8BF1D9BFAD9C68956DDC3B05138FCDA2B46819
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 127KB
SHA256 50a1df4cfd0587a8630522fec9faaef4a1ebdf994db516753033c36f60d0b5c4
MD5 811d891d39008216004f2c48572a87a8
SHA1 5cca07f31924b076b7e283c5b4e0cb70d7ab6987
SHA512 9baf9096984fa618a849b8ec3ba7508d213a365cdde8cc1c467d9a5f09ee122101d25d9c5503c6161882aec4de76ebecd3c6a5f7caa7f45d8004428e4184e8e5
SSDEEP 3072:3UalrOqhrZ5gY7ZULkZDk9AjKdujbVMUG5Z4Lk:3HhZ3ZDk9AjKIbVk5Z4I
TLSH
T170D31230BC2AAD349D9E081D6414B31B8BF1D9BFAD9C68956DDC3B05138FCDA2B46819
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1
Size 264KB
SHA256 c39b8fd66cdf366da8ac390c069ae7b70a758fe2de589b87de6e0cdf8eebd1da
MD5 cee65c7a150398be4294aa274091b193
SHA1 7c9f5caf230754ad04c1fdd6018742f090b6d27d
SHA512 ba02afc076da406c575255eebd779ac54f0ec328d51141a62e882972813ad7fdf91535bf6e5483d534bb621d9711bf906a97225c44661e94c5816490e1fc7974
SSDEEP 3:MsEllllkEthXllkl2zEklnUl:/M/xT02znn8
TLSH
T17A440444FFD00447C54110304151C3510370D4140D1157C335510C13DCC77400C04000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Variations
Size 85B
SHA256 b26da4f8c7e283aa74386da0229d66af14a37986b8ca828e054fc932f68dd557
MD5 bc6142469cd7dadf107be9ad87ea4753
SHA1 72a9aa05003fab742b0e4dc4c5d9eda6b9f7565c
SHA512 47d1a67a16f5dc6d50556c5296e65918f0a2fcad0e8cee5795b100fe8cd89eaf5e1fd67691e8a57af3677883a5d8f104723b1901d11845b286474c8ac56f6182
TLSH
T1F2A0120384738407E4144051C45C1341287C84570119C0012068931304240CB039643A
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\component_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

ukm_db

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\segmentation_platform\ukm_db
Size 48KB
SHA256 b8eaf7b5e6ed3912fe3d7afa470c62c0cb877baf6f6b86af88bc2ed691361795
MD5 840c3669e21811a4f5f5dffc05e00d3d
SHA1 37507ced904bfc3e432b387d1a1e8f30b86de3bb
SHA512 b55efa4e6d0a1c45068a8bb80ea7e9b687d3f09fa343d7b8eac077fefb4ef90abb4ce12fb504aac819153748d88954b4a6f9ad682b709bae6a17479275b0e7d1
SSDEEP 48:TkkhCU2QB2zbBxxtQHo6AD9CrC0bL/SyJq6AD9ZLLttyNUCADMEOM:QUcfsIDDKBCyADDfSm7DMw
TLSH
T1B523638F1A1864EAE591493DFDE28F543C7E6F988A5B18CA05E00C761CE14AE402E6FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
TLSH
T1CE51EE323375B1E888167F071E681A8053BF4355EA94AF1CB698621ED93641B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download