4683fbf97c008f8d08d72dbe8233018f24b9d35ce65761facf854d1fe0de950a

Analysis

geolocation tags

cacanadananorth-americatoronto
user interaction
yes
max time kernel
900s
max time network
902s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 20:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
cs2.dll
Size 4.7MB
Sample260804-y7jf8adq21
SHA256 4683fbf97c008f8d08d72dbe8233018f24b9d35ce65761facf854d1fe0de950a
MD5 244e17cd89df94f00de8991cd9b51835
SHA1 feb9bded593937256cf09aceab1b51d6dc5278de
SHA512 0a3f78f8057bddf9d3d0bd90db0c352d95d1af01e6464d31371aa09669fcb2a63abedaa093e3465cd635cf87323c31704f3bd028c4b85651a9eb98f2aacaa444
SSDEEP 98304:5p/+iTzTRn3XXMKi17WUuBXOyPtyTjg83j/:1XXMKiYbO6tKjLz/
TLSH
T10A36BE13F74151AEC52AD43886AB93227331B8465B2257CB76482F35ADD73E02F3ABC5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware discovery persistence ransomware spyware

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4100	chrome.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Main	explorer.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134303488986125700"	chrome.exe

Modifies registry class 43 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1738198120-2966725515-3980530802-1000\{67558447-9A59-4C8F-B464-3E1D71D3BDD4}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\MuiCache	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	StartMenuExperienceHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56"	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23"	SearchHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1738198120-2966725515-3980530802-1000\{75984092-9846-4767-98D5-394404A7C096}	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs	SearchHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1738198120-2966725515-3980530802-1000\{8FBF1E0C-651E-4FE5-A557-D36B85A6CEE8}	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	StartMenuExperienceHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23"	SearchHost.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1064	chrome.exe
1064	chrome.exe
1064	chrome.exe
1064	chrome.exe
3800	chrome.exe
3800	chrome.exe
3388	explorer.exe
3388	explorer.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 25 IoCs

pid	Process
1064	chrome.exe
1064	chrome.exe
1064	chrome.exe
1064	chrome.exe
1064	chrome.exe
1064	chrome.exe
1064	chrome.exe
1064	chrome.exe
1064	chrome.exe
1064	chrome.exe
1064	chrome.exe
1064	chrome.exe
1064	chrome.exe
1064	chrome.exe
1064	chrome.exe
1064	chrome.exe
1064	chrome.exe
1064	chrome.exe
1064	chrome.exe
1064	chrome.exe
1064	chrome.exe
1064	chrome.exe
1064	chrome.exe
1064	chrome.exe
1064	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1064	chrome.exe
Token: SeCreatePagefilePrivilege	1064	chrome.exe
Token: SeShutdownPrivilege	1064	chrome.exe
Token: SeCreatePagefilePrivilege	1064	chrome.exe
Token: SeShutdownPrivilege	1064	chrome.exe
Token: SeCreatePagefilePrivilege	1064	chrome.exe
Token: SeShutdownPrivilege	1064	chrome.exe
Token: SeCreatePagefilePrivilege	1064	chrome.exe
Token: SeShutdownPrivilege	1064	chrome.exe
Token: SeCreatePagefilePrivilege	1064	chrome.exe
Token: SeShutdownPrivilege	1064	chrome.exe
Token: SeCreatePagefilePrivilege	1064	chrome.exe
Token: SeShutdownPrivilege	1064	chrome.exe
Token: SeCreatePagefilePrivilege	1064	chrome.exe
Token: SeShutdownPrivilege	1064	chrome.exe
Token: SeCreatePagefilePrivilege	1064	chrome.exe
Token: SeShutdownPrivilege	1064	chrome.exe
Token: SeCreatePagefilePrivilege	1064	chrome.exe
Token: SeShutdownPrivilege	1064	chrome.exe
Token: SeCreatePagefilePrivilege	1064	chrome.exe
Token: SeShutdownPrivilege	1064	chrome.exe
Token: SeCreatePagefilePrivilege	1064	chrome.exe
Token: SeShutdownPrivilege	1064	chrome.exe
Token: SeCreatePagefilePrivilege	1064	chrome.exe
Token: SeShutdownPrivilege	1064	chrome.exe
Token: SeCreatePagefilePrivilege	1064	chrome.exe
Token: SeShutdownPrivilege	1064	chrome.exe
Token: SeCreatePagefilePrivilege	1064	chrome.exe
Token: SeShutdownPrivilege	1064	chrome.exe
Token: SeCreatePagefilePrivilege	1064	chrome.exe
Token: SeShutdownPrivilege	1064	chrome.exe
Token: SeCreatePagefilePrivilege	1064	chrome.exe
Token: SeShutdownPrivilege	1064	chrome.exe
Token: SeCreatePagefilePrivilege	1064	chrome.exe
Token: SeShutdownPrivilege	1064	chrome.exe
Token: SeCreatePagefilePrivilege	1064	chrome.exe
Token: SeShutdownPrivilege	1064	chrome.exe
Token: SeCreatePagefilePrivilege	1064	chrome.exe
Token: SeShutdownPrivilege	1064	chrome.exe
Token: SeCreatePagefilePrivilege	1064	chrome.exe
Token: SeShutdownPrivilege	1064	chrome.exe
Token: SeCreatePagefilePrivilege	1064	chrome.exe
Token: SeShutdownPrivilege	1064	chrome.exe
Token: SeCreatePagefilePrivilege	1064	chrome.exe
Token: SeShutdownPrivilege	1064	chrome.exe
Token: SeCreatePagefilePrivilege	1064	chrome.exe
Token: SeShutdownPrivilege	1064	chrome.exe
Token: SeCreatePagefilePrivilege	1064	chrome.exe
Token: SeShutdownPrivilege	1064	chrome.exe
Token: SeCreatePagefilePrivilege	1064	chrome.exe
Token: SeShutdownPrivilege	1064	chrome.exe
Token: SeCreatePagefilePrivilege	1064	chrome.exe
Token: SeShutdownPrivilege	1064	chrome.exe
Token: SeCreatePagefilePrivilege	1064	chrome.exe
Token: SeShutdownPrivilege	1064	chrome.exe
Token: SeCreatePagefilePrivilege	1064	chrome.exe
Token: SeShutdownPrivilege	1064	chrome.exe
Token: SeCreatePagefilePrivilege	1064	chrome.exe
Token: SeShutdownPrivilege	1064	chrome.exe
Token: SeCreatePagefilePrivilege	1064	chrome.exe
Token: SeShutdownPrivilege	1064	chrome.exe
Token: SeCreatePagefilePrivilege	1064	chrome.exe
Token: SeShutdownPrivilege	1064	chrome.exe
Token: SeCreatePagefilePrivilege	1064	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1064	chrome.exe
1064	chrome.exe
1064	chrome.exe
1064	chrome.exe
1064	chrome.exe
1064	chrome.exe
1064	chrome.exe
1064	chrome.exe
1064	chrome.exe
1064	chrome.exe
1064	chrome.exe
1064	chrome.exe
1064	chrome.exe
1064	chrome.exe
1064	chrome.exe
1064	chrome.exe
1064	chrome.exe
1064	chrome.exe
1064	chrome.exe
1064	chrome.exe
1064	chrome.exe
1064	chrome.exe
1064	chrome.exe
1064	chrome.exe
1064	chrome.exe
1064	chrome.exe
1064	chrome.exe
1064	chrome.exe
1064	chrome.exe
1064	chrome.exe
1064	chrome.exe
1064	chrome.exe
1064	chrome.exe
1064	chrome.exe
2536	sihost.exe
3388	explorer.exe
3388	explorer.exe
3388	explorer.exe
3388	explorer.exe
3388	explorer.exe
3388	explorer.exe
3388	explorer.exe
3388	explorer.exe
3388	explorer.exe
3388	explorer.exe
3388	explorer.exe
3388	explorer.exe
3388	explorer.exe
3388	explorer.exe
3388	explorer.exe
3388	explorer.exe
3388	explorer.exe
3388	explorer.exe
3388	explorer.exe
3388	explorer.exe
3388	explorer.exe
3388	explorer.exe
3388	explorer.exe
3388	explorer.exe
3388	explorer.exe
3388	explorer.exe
3388	explorer.exe
3388	explorer.exe
3388	explorer.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
1064	chrome.exe
1064	chrome.exe
1064	chrome.exe
1064	chrome.exe
1064	chrome.exe
1064	chrome.exe
1064	chrome.exe
1064	chrome.exe
1064	chrome.exe
1064	chrome.exe
1064	chrome.exe
1064	chrome.exe
1064	chrome.exe
1064	chrome.exe
1064	chrome.exe
1064	chrome.exe
3388	explorer.exe
3388	explorer.exe
3388	explorer.exe
3388	explorer.exe
3388	explorer.exe
3388	explorer.exe
3388	explorer.exe
3388	explorer.exe
3388	explorer.exe
3388	explorer.exe
3388	explorer.exe
3388	explorer.exe
3388	explorer.exe
3388	explorer.exe
3388	explorer.exe
3388	explorer.exe
3388	explorer.exe
3388	explorer.exe
3388	explorer.exe
3388	explorer.exe
3388	explorer.exe
3388	explorer.exe
3388	explorer.exe
3388	explorer.exe
3388	explorer.exe
3388	explorer.exe
3388	explorer.exe
3388	explorer.exe
3388	explorer.exe
3388	explorer.exe
3388	explorer.exe
3388	explorer.exe
3388	explorer.exe
3388	explorer.exe
3388	explorer.exe
3388	explorer.exe
3388	explorer.exe
3388	explorer.exe
3388	explorer.exe
3388	explorer.exe
3388	explorer.exe
3388	explorer.exe
3388	explorer.exe
3388	explorer.exe
3388	explorer.exe
1064	chrome.exe
1064	chrome.exe
1064	chrome.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
5992	StartMenuExperienceHost.exe
5320	SearchHost.exe
3388	explorer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1064 wrote to memory of 5892	1064	chrome.exe	93
PID 1064 wrote to memory of 2096	1064	chrome.exe	94
PID 1064 wrote to memory of 2096	1064	chrome.exe	94
PID 1064 wrote to memory of 4100	1064	chrome.exe	95
PID 1064 wrote to memory of 1864	1064	chrome.exe	97
PID 1064 wrote to memory of 1864	1064	chrome.exe	97
PID 1064 wrote to memory of 1536	1064	chrome.exe	98
PID 1064 wrote to memory of 6092	1064	chrome.exe	99
PID 1064 wrote to memory of 1536	1064	chrome.exe	98
PID 1064 wrote to memory of 6092	1064	chrome.exe	99
PID 1064 wrote to memory of 5424	1064	chrome.exe	100
PID 1064 wrote to memory of 5424	1064	chrome.exe	100
PID 1064 wrote to memory of 240	1064	chrome.exe	101
PID 1064 wrote to memory of 240	1064	chrome.exe	101
PID 1064 wrote to memory of 4224	1064	chrome.exe	102
PID 1064 wrote to memory of 4600	1064	chrome.exe	104
PID 1064 wrote to memory of 1116	1064	chrome.exe	103
PID 1064 wrote to memory of 4600	1064	chrome.exe	104
PID 1064 wrote to memory of 1116	1064	chrome.exe	103
PID 1064 wrote to memory of 2036	1064	chrome.exe	108
PID 1064 wrote to memory of 2036	1064	chrome.exe	108
PID 1064 wrote to memory of 4204	1064	chrome.exe	109
PID 1064 wrote to memory of 4204	1064	chrome.exe	109
PID 1064 wrote to memory of 1240	1064	chrome.exe	110
PID 1064 wrote to memory of 1240	1064	chrome.exe	110
PID 1064 wrote to memory of 5200	1064	chrome.exe	112
PID 1064 wrote to memory of 3172	1064	chrome.exe	111
PID 1064 wrote to memory of 5200	1064	chrome.exe	112
PID 1064 wrote to memory of 3172	1064	chrome.exe	111
PID 1064 wrote to memory of 4580	1064	chrome.exe	114
PID 1064 wrote to memory of 4288	1064	chrome.exe	113
PID 1064 wrote to memory of 4580	1064	chrome.exe	114
PID 1064 wrote to memory of 4288	1064	chrome.exe	113
PID 1064 wrote to memory of 3140	1064	chrome.exe	115
PID 1064 wrote to memory of 3140	1064	chrome.exe	115
PID 1064 wrote to memory of 3920	1064	chrome.exe	116
PID 1064 wrote to memory of 3920	1064	chrome.exe	116
PID 1064 wrote to memory of 5428	1064	chrome.exe	117
PID 1064 wrote to memory of 5428	1064	chrome.exe	117
PID 1064 wrote to memory of 548	1064	chrome.exe	118
PID 1064 wrote to memory of 548	1064	chrome.exe	118
PID 1064 wrote to memory of 556	1064	chrome.exe	119
PID 1064 wrote to memory of 4460	1064	chrome.exe	120
PID 1064 wrote to memory of 4104	1064	chrome.exe	121
PID 1064 wrote to memory of 2236	1064	chrome.exe	122
PID 1064 wrote to memory of 2236	1064	chrome.exe	122
PID 1064 wrote to memory of 8	1064	chrome.exe	123
PID 1064 wrote to memory of 8	1064	chrome.exe	123
PID 1064 wrote to memory of 3800	1064	chrome.exe	124
PID 1064 wrote to memory of 2620	1064	chrome.exe	125
PID 1064 wrote to memory of 2620	1064	chrome.exe	125
PID 1064 wrote to memory of 3284	1064	chrome.exe	132
PID 1064 wrote to memory of 3284	1064	chrome.exe	132
PID 1064 wrote to memory of 1016	1064	chrome.exe	134
PID 1064 wrote to memory of 1016	1064	chrome.exe	134
PID 1064 wrote to memory of 5020	1064	chrome.exe	135
PID 1064 wrote to memory of 5020	1064	chrome.exe	135
PID 2536 wrote to memory of 3388	2536	sihost.exe	141
PID 1064 wrote to memory of 3140	1064	chrome.exe	148
PID 1064 wrote to memory of 3140	1064	chrome.exe	148
PID 1064 wrote to memory of 960	1064	chrome.exe	150
PID 1064 wrote to memory of 5840	1064	chrome.exe	149
PID 1064 wrote to memory of 960	1064	chrome.exe	150
PID 1064 wrote to memory of 3988	1064	chrome.exe	151

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cs2.dll,#1
1⤵
PID:4836

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffc2d2ec728,0x7ffc2d2ec734,0x7ffc2d2ec740
  2⤵
  PID:5892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1620,i,5424657339111899829,14604257205042055958,262144 --field-trial-handle=1876,i,4300995383441027820,11460852683225416130,262144 --variations-seed-version --mojo-platform-channel-handle=1868 /prefetch:2
  2⤵
  PID:2096
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1492,i,11153778484112282037,13135692730650400045,524288 --field-trial-handle=1876,i,4300995383441027820,11460852683225416130,262144 --variations-seed-version --mojo-platform-channel-handle=2204 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2348,i,17232563391952759032,11380963508407129606,524288 --field-trial-handle=1876,i,4300995383441027820,11460852683225416130,262144 --variations-seed-version --mojo-platform-channel-handle=2256 /prefetch:13
  2⤵
  PID:1864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3248,i,15455085816054545828,15350303669572345489,2097152 --field-trial-handle=1876,i,4300995383441027820,11460852683225416130,262144 --variations-seed-version --mojo-platform-channel-handle=3456 /prefetch:1
  2⤵
  PID:1536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3316,i,5996928118858413258,14170661808898073322,2097152 --field-trial-handle=1876,i,4300995383441027820,11460852683225416130,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:6092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4672,i,3542272817677180122,18014875139889016694,2097152 --field-trial-handle=1876,i,4300995383441027820,11460852683225416130,262144 --variations-seed-version --mojo-platform-channel-handle=4748 /prefetch:1
  2⤵
  PID:5424
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4908,i,6926027072529982876,7157130165161706043,524288 --field-trial-handle=1876,i,4300995383441027820,11460852683225416130,262144 --variations-seed-version --mojo-platform-channel-handle=4940 /prefetch:14
  2⤵
  PID:240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5028,i,17529783831365269338,12938000167132099188,524288 --field-trial-handle=1876,i,4300995383441027820,11460852683225416130,262144 --variations-seed-version --mojo-platform-channel-handle=4904 /prefetch:14
  2⤵
  PID:4224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5500,i,10163562858468764777,3875027058326460392,2097152 --field-trial-handle=1876,i,4300995383441027820,11460852683225416130,262144 --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:1
  2⤵
  PID:1116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5512,i,9779417130903067410,14944569535758429438,2097152 --field-trial-handle=1876,i,4300995383441027820,11460852683225416130,262144 --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:1
  2⤵
  PID:4600
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5812,i,15853673798219207619,16333828667396785578,2097152 --field-trial-handle=1876,i,4300995383441027820,11460852683225416130,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:1
  2⤵
  PID:2036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=6064,i,7417397533049254971,874915175894021832,2097152 --field-trial-handle=1876,i,4300995383441027820,11460852683225416130,262144 --variations-seed-version --mojo-platform-channel-handle=5700 /prefetch:1
  2⤵
  PID:4204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5944,i,2161061435722264154,3751048296515278766,2097152 --field-trial-handle=1876,i,4300995383441027820,11460852683225416130,262144 --variations-seed-version --mojo-platform-channel-handle=5832 /prefetch:1
  2⤵
  PID:1240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5732,i,1630589313786001245,13380577635396707110,524288 --field-trial-handle=1876,i,4300995383441027820,11460852683225416130,262144 --variations-seed-version --mojo-platform-channel-handle=5692 /prefetch:14
  2⤵
  PID:3172
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5656,i,7063126844084388137,12139589053581033669,2097152 --field-trial-handle=1876,i,4300995383441027820,11460852683225416130,262144 --variations-seed-version --mojo-platform-channel-handle=5720 /prefetch:1
  2⤵
  PID:5200
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5548,i,3447362652574878130,3705479866724549958,524288 --field-trial-handle=1876,i,4300995383441027820,11460852683225416130,262144 --variations-seed-version --mojo-platform-channel-handle=6344 /prefetch:14
  2⤵
  PID:4288
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6048,i,14800075071967646809,10372064433421573277,2097152 --field-trial-handle=1876,i,4300995383441027820,11460852683225416130,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:1
  2⤵
  PID:4580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6448,i,15139778927303459923,1896428482590986566,2097152 --field-trial-handle=1876,i,4300995383441027820,11460852683225416130,262144 --variations-seed-version --mojo-platform-channel-handle=4764 /prefetch:1
  2⤵
  PID:3140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5564,i,18002786493186242889,5724275532900038512,524288 --field-trial-handle=1876,i,4300995383441027820,11460852683225416130,262144 --variations-seed-version --mojo-platform-channel-handle=4760 /prefetch:14
  2⤵
  PID:3920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=5672,i,954771086826770298,13207513380454292923,2097152 --field-trial-handle=1876,i,4300995383441027820,11460852683225416130,262144 --variations-seed-version --mojo-platform-channel-handle=6016 /prefetch:1
  2⤵
  PID:5428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=5536,i,12712166871557249121,3540257357278052828,2097152 --field-trial-handle=1876,i,4300995383441027820,11460852683225416130,262144 --variations-seed-version --mojo-platform-channel-handle=5820 /prefetch:9
  2⤵
  PID:548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6216,i,16132213439173408609,1315575119414103493,524288 --field-trial-handle=1876,i,4300995383441027820,11460852683225416130,262144 --variations-seed-version --mojo-platform-channel-handle=5028 /prefetch:14
  2⤵
  PID:556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6272,i,6918840740128888467,15146884906258601251,524288 --field-trial-handle=1876,i,4300995383441027820,11460852683225416130,262144 --variations-seed-version --mojo-platform-channel-handle=5756 /prefetch:14
  2⤵
  PID:4460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5920,i,15466773276190248364,5889197028551278088,524288 --field-trial-handle=1876,i,4300995383441027820,11460852683225416130,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:14
  2⤵
  PID:4104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=5984,i,1936193206341636492,4230133435483356864,2097152 --field-trial-handle=1876,i,4300995383441027820,11460852683225416130,262144 --variations-seed-version --mojo-platform-channel-handle=5052 /prefetch:1
  2⤵
  PID:2236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=3704,i,10830223929080951723,18035669002875724175,2097152 --field-trial-handle=1876,i,4300995383441027820,11460852683225416130,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:1
  2⤵
  PID:8
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4440,i,10329591106210836920,1694269535982210017,262144 --field-trial-handle=1876,i,4300995383441027820,11460852683225416130,262144 --variations-seed-version --mojo-platform-channel-handle=4836 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=6264,i,17428306909715587417,5723244150131031579,2097152 --field-trial-handle=1876,i,4300995383441027820,11460852683225416130,262144 --variations-seed-version --mojo-platform-channel-handle=5636 /prefetch:1
  2⤵
  PID:2620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=2248,i,3787037169367622883,10746863396348550743,524288 --field-trial-handle=1876,i,4300995383441027820,11460852683225416130,262144 --variations-seed-version --mojo-platform-channel-handle=4600 /prefetch:14
  2⤵
  PID:3284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --metrics-shmem-handle=5644,i,3056128841752234226,1282846195588978790,2097152 --field-trial-handle=1876,i,4300995383441027820,11460852683225416130,262144 --variations-seed-version --mojo-platform-channel-handle=5700 /prefetch:1
  2⤵
  PID:1016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --metrics-shmem-handle=3652,i,13574060352523070553,16658407491700235498,2097152 --field-trial-handle=1876,i,4300995383441027820,11460852683225416130,262144 --variations-seed-version --mojo-platform-channel-handle=5708 /prefetch:1
  2⤵
  PID:5020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --metrics-shmem-handle=6136,i,16006106736886544534,15434539361891182077,2097152 --field-trial-handle=1876,i,4300995383441027820,11460852683225416130,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:1
  2⤵
  PID:3140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5424,i,6615934150916341049,8672197059010700667,524288 --field-trial-handle=1876,i,4300995383441027820,11460852683225416130,262144 --variations-seed-version --mojo-platform-channel-handle=4828 /prefetch:14
  2⤵
  - Modifies registry class
  PID:5840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=4792,i,13881598008194795659,10831461559357614529,524288 --field-trial-handle=1876,i,4300995383441027820,11460852683225416130,262144 --variations-seed-version --mojo-platform-channel-handle=3900 /prefetch:12
  2⤵
  PID:960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --metrics-shmem-handle=6812,i,11583893646021967664,14414857335659772913,2097152 --field-trial-handle=1876,i,4300995383441027820,11460852683225416130,262144 --variations-seed-version --mojo-platform-channel-handle=6792 /prefetch:1
  2⤵
  PID:3988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --metrics-shmem-handle=3556,i,984607836605192708,4383040748076503053,2097152 --field-trial-handle=1876,i,4300995383441027820,11460852683225416130,262144 --variations-seed-version --mojo-platform-channel-handle=6852 /prefetch:1
  2⤵
  PID:5920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --metrics-shmem-handle=4752,i,5559231274580587122,1438064011427790000,2097152 --field-trial-handle=1876,i,4300995383441027820,11460852683225416130,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:1
  2⤵
  PID:1816
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --metrics-shmem-handle=6348,i,1233896258404228989,5550640272543902890,2097152 --field-trial-handle=1876,i,4300995383441027820,11460852683225416130,262144 --variations-seed-version --mojo-platform-channel-handle=5612 /prefetch:1
  2⤵
  PID:5484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --metrics-shmem-handle=6844,i,12896847829307549107,16497887728900305347,2097152 --field-trial-handle=1876,i,4300995383441027820,11460852683225416130,262144 --variations-seed-version --mojo-platform-channel-handle=6208 /prefetch:1
  2⤵
  PID:5624
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --metrics-shmem-handle=7116,i,2244954243720048374,5563583313980463559,2097152 --field-trial-handle=1876,i,4300995383441027820,11460852683225416130,262144 --variations-seed-version --mojo-platform-channel-handle=6776 /prefetch:1
  2⤵
  PID:5912

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3476

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5624

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:3616

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:920

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2536
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Enumerates connected drives
  - Checks SCSI registry key(s)
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:3388

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5992

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5320

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:3332

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 a46870a4f28554c5509a47642c26ea22c1a78e05fb0f2dc74fed97e95994a6d9
MD5 506af1388af22dbe29616f39ea82bc4f
SHA1 9cff40cb637867de4dc78249328adafda4abf41e
SHA512 866f5b5c612958f2c3ed7dad6f23775e511c08b2d1dea6ee850f4c0aabca1ff7f59dfdc560fb41ed601c52c6436ffef557f055f81a1bd5cd77066bfe003fe327
MD5 SHA1 SHA512

Submit Download

9b4e68ea-a4be-4c6f-84cc-bec054dab32c.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\9b4e68ea-a4be-4c6f-84cc-bec054dab32c.tmp
Size 13KB
SHA256 adf536c597ff521f83045d37cb337e7d451cd0462254311efba15f65bfdd9ef8
MD5 787eadfa98e58b447c487591e9bbf0c8
SHA1 320d0754657ae3e4ad6de78d99b0d7f39c405199
SHA512 d189a1fe97039078adeb13ef75c5a3f81f664b6f37af58948fb17e727f5b67bc69b28e87b4cc4be8652f7a50800d08adad719c64de4fff9a4bf77afbe6bdc3e4
SSDEEP 192:1RicBzZc922wv7oJPRpltrTzO9XxHsb+WNnX8Ku19gfEQaesKoVyIsnAUgE:1RimzZC22seXmfws1KE5E
TLSH
T13952B82ABD106A375ED6C229F9627797E7F6102121D52E84F7FC8A6C10E76CC2117407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000004

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000004
Size 71KB
SHA256 99ff0be776dea84eaa37ec69b52f6304cd4b37a60677782d9b505b70183b8de4
MD5 9cabca241ae51db3e05f219326a7f445
SHA1 7242a774a9abca60ad895da8e88691b963bc9a43
SHA512 f121a88d2869d4ecb7c3daa69938d7116f237060ff4126e9f9eb3a7ef2f2e8e041a6b1399f8042e9c3560fc1930249add9662d56088e32c739e8210489094b14
SSDEEP 1536:4W7XKPClEZFrypihpDlvQ3Q1WIk4Yfzea3ajKp7FJlcvyPy1:4W7aayl1Wf4SOj1KPy1
TLSH
T1056302C496F6CB8AE7F320CFC84802A6FF045BEEDDD434A9BA791894E990605FF85145
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000019

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000019
Size 331KB
SHA256 db4ffbf0ec662620013dc14bc1268bdad6256d19d7d511ec7eff8446887e6900
MD5 05ef8155cf66131654d3bb9c9cba5853
SHA1 e79d53fcb604921222dd1dbc2f1c10c631ff6075
SHA512 ee38793245d91683ddb1f847e5b56a09864fd32ec059055459b3ebe101abed79683ee59c80f30b8f6249d2bbd83fbf7bca83dafb4ef2b634ceff6969c80fed23
SSDEEP 6144:FljUD58FLTW53eaLkNv+Ps0dj1fpqaGjYf0NIcB3bM1rJZ24:FDm5uaLcv+PFj7ajJNImbM1rD
TLSH
T1247423A9B50E3C8AC94F9473827EAFD2A4356FF38D47BAA3634241F401874342E4676D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 1KB
SHA256 7ad5172a3c3f07d9af641cbf240cf02847450feb3786d8f48bce72a453b5575e
MD5 602405bd53c388a57e77c6401f027b60
SHA1 cf730227bd827a560536b6540ce3f12e0d3f6092
SHA512 78f936a9000b0688d11055cfac05c994badf582604c77368201d2116ee881e523b7623ff78f26637dda3765e7d6cfb039ae9e45b5f2888bdb74f4e2d669498c0
TLSH
T1AF310E0BB5838F62CFF84677709F0E103DB886C9C8B75ACAA9CC1965E727DF04181624
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 864B
SHA256 74c6cd6e26bb2f486f79282eae58daf640709334554aa43cdcc7de141e424174
MD5 91136f23694e90a6964941bc8b16cb4c
SHA1 766239439191e586c4ea72b4634e2e6c2d0930e8
SHA512 b0bf19a9a5f82ade3a753f33f67ede0135392630810e9b3873832cc21756160c672e644acc5a8bdff5b6661a4523d9dbeaa816ce348fee9860a08162ea10cb53
TLSH
T1F211CB0662D39F63CF45433B81EF0B213F348648C8B36ECAB48C4472271BAA05543AA8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 768B
SHA256 5a42f510f3b88c6765122c03c77bca3b5538468c7823e8e1320a0e0a77cbdcc0
MD5 49fd996f68b6aa459b1cc6ba5b89431d
SHA1 21a4fd88bd0c8a8f937923512de9617c87b49239
SHA512 49628dc85a824a69742c1e774f5ddc44bd569d658b5c9d939b3f8eefff4a0b8ba22d022af83b089339e20d6eb9af80ed38df528d80aec9df747d1c5850133189
TLSH
T1DA01445BA2975F50CF55417B82AF08142F3146824833AACE8484C9F27927AA06CC3AA8
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 16KB
SHA256 ec0f42ce052e2ea9e8c10d47cd17864135d25ba16b94797d2613039c35fe0516
MD5 d3ca405c1e1df595c3d69dac93ddf674
SHA1 be38e5ff8aa7c248e7a3c5f5ddab44ca38087773
SHA512 11b26a1f131065ccb7b2c887d0844b6cfd2feb2390e96aa98ca8c6e17863cc0e3391c31a3de755f7e63f1b65f211cee9c553a08bf0828881684ab50b1e4ec591
SSDEEP 384:DOhumYQfdB+xZGH98hOTylEIyW7gJfJBJLY554V/UkVAHYHezh4xVxYmmsA4V4GA:o1TdWSe2y4euvs
TLSH
T1C872BCF3C3D9C52E891156F49B15AE1BCE1D0A28432C3C26C8D5EE4BE3E2472D25964F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 16KB
SHA256 2263ce7ab658f5cf99c80b8a21318184a843adf80dda2b25726e59bc42bfbda1
MD5 ab32281b308289a9f1facee9e244a3f3
SHA1 a595d557b322a09767bcdae1ca4e76c3f7afc201
SHA512 b3f3ee4beee9eaf93c341dfb64042ce194f35f3779cd89c94d09abc9192fe351905f02184eca563cfdc17d47246ca1d4c3acb5d93a009fe6b450482cbb1817a2
SSDEEP 384:DOhumYQfdB+xZGH9GhOTylEIyW7gJfJBJLY554V/UkVA4YHezh4xVxYmmsA4V4Gl:a1TAWSe2y4euf5
TLSH
T1BA72BCF3D3D9C52E891156F49B15AE1BCE1D0A28432C3C26C8D5EE4BE3E2472D26964F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 10KB
SHA256 ef365f1512c6a41dd46e168c838501aa9289097a5d8cb2163c721e950cb24972
MD5 94de9979be365ee9f14903947e37634d
SHA1 e2a7efe0290c77bcc1b1bd52d2bfa209fc6fc7db
SHA512 c8257d269960ccb7eec091038250723b7787b019c86ab282511dc7bcef6f15d057aab9f6af8654bb01770c09ea19ada48be3929f89be0662f4ed755ec9dab444
SSDEEP 192:DgLfCR9W4zG4vUGPkLJLb7CVm5jh+/7zh4VY3+Mxn4Ve6wYfVVYi9EZ:DgLfCR9W4zG4vUGPkLJLb7sm5g/7zh4w
TLSH
T1C7229AF3D3D9C62EC91156F49B10AE1BDE1D0B1883293C1688D5EE8BE3E2472D25964F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 10KB
SHA256 517aca424c6a2316e0795f686f0ed39c247dcfa0a7ed0c265becd1ffe470922f
MD5 7f1f67d32898b16473450d747cab2343
SHA1 238fe09baa95cfb1944dc7bc857804ce4ddcc5a8
SHA512 75f73b065ea504d27475783f9175eaf38d9213bda17e46daf0fe61f6ee9aaa3a9118e5a35c35ae85984ada1c8bede590cb80fc8c027a0698906b92d7c1c1f312
SSDEEP 192:DTOhum9W4zG4vUGPkCudfJLYjhbzh4VY3+Mxn4Ve6HfVVYi94a7b4jNEd2:DTOhum9W4zG4vUGPkCudfJLYtzh4VY3V
TLSH
T1B9228AF3D3D9C66E891157F49714AE1BCE1D0B2843283C2588D5EE8BE3E2432D25964F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 15KB
SHA256 0545380d2e9e2a810e66a57035df8b332a507486d03e8ca3b3268b3b385b8460
MD5 8f34b39cc43482a8018e23ecf43c174a
SHA1 e1dcabd1d2e524fd3c98db0120e1a76e5e567d1b
SHA512 a24e00e094c27c33c8b61a9408c1961707f89db126e5cdc384fc964feea4cdfffb6bda4100679bca8412b55617c64c25dbeca248214d603e97a3452904ce6043
SSDEEP 384:DOhumYQfdB+xZGH9EGhOTylEIyW7gJfsJLY554V/UkVA4YHezh4xVxYmCbsA4V48:P1OAWae2ysDiud
TLSH
T1FF62BBF3D3D9C52E891156F49B15AE1BCE1D0A28432C3C26C8D5EE4BE3E2432D26964F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 10KB
SHA256 8c880a440d711659c87f8bec4f69d604835918b71e4572258a7264f252bce67f
MD5 30fa7858a569b00b89eb51c03fe1efaf
SHA1 43f7911d4f1d392ad9c388b49da8e779689e802a
SHA512 25e6d56d4fd9143354a0feeae153bfb98927e3030c00d830184558f9948db4ad4fe094cfb83f5fba9f3bdb43186dab337a1afe56736bec6d152265bca83f53f4
SSDEEP 192:DgLfCR9W4zG4vUGPkCuQJLb7CVm5jhbzh4VY3+Mxn4Ve6HfVVYi94a7tRO:DgLfCR9W4zG4vUGPkCuQJLb7sm5tzh4A
TLSH
T178329AF3D3D9C66E891156F49B10AE1BDE1D0B1843293C1688D5EE8BE3E2432D25964F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 9140fb6d147c6eef869490387ede3e12781b3ca3e152e075cefc3c7ffbdfa08b
MD5 d14078cc8aa1d6ae36c24035220f6c4d
SHA1 1fccf75e21f8021b8a39b863ae359b62af0ae1cc
SHA512 3d7c849ac458da29c28e36473d08c2e831dae1b7de27794048471c444cc0495c045cac409f6a541014ccaa89245cb96ef35587b75ebf1239d0e91af62d011aca
TLSH
T1E9517DB3D7D88A6EC51562E4DB21BA1FDD2D0A18121D3C26C8D5AF4B53E2472D21174E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 2KB
SHA256 4bdd802c5a7d87d03ed990e5f3354449056e172f616dfddfb34dc0b0ae8a9c37
MD5 214b4213da2983a83c01621a89880e63
SHA1 3de203620915b1a9518c29094ffe3998ab126ccd
SHA512 614f2be329e8cad48e37bc7ce815ca8d37792a0f7bf3b45316e5990adc51c518ff0c5276966cc58847ea5493ed9d21d519d0882bd5cdb8f97f92a8212df57efc
TLSH
T12941A1979BBFB81B10285A7F1D847C05297AB436134168FCEE97C17CB0854F70F12426
MD5 SHA1 SHA512 TLSH

Submit Download

f27fcaa4-e171-4741-afaa-bada5553c83b.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\f27fcaa4-e171-4741-afaa-bada5553c83b.tmp
Size 8KB
SHA256 9fa20f6a0198cfa10191db16b3921dbacb9bbd80fa4607b9a9789ba700906f24
MD5 e2a350a81d096ed443a32116266b58d3
SHA1 a97621f63bc8784d14c8de2d8ab355e819bd375f
SHA512 3fd58cbb368a2e3aa201d2ff631a564022146c19e974fb235bcb6d98957c0599f40c075c2e2902890b6e2f83fcbe36660db99103c182267dd1860ef9d2677302
SSDEEP 192:DTOhumbMYQfdB+xZGH9dfJLYjhbzhYmsHin4Ve6UmVakVAo+4jNEdgebB:DTOhumbMYQfdB+xZGH9dfJLYtzhYmsHm
TLSH
T10B0289F793E5D56E89119BF49614AE1BCE2C0628432C3C2588D5EE87E3E2033D16A74F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 59579d569cd697abdc5cff7dde8f28b0f7184151f8633915dcd5e31fd19cdbb2
MD5 18eba8561b3005afda42c430c8ea966d
SHA1 f8218de17d0768e0888dcd6818e5dc4f14f1b79f
SHA512 8e4c7efefb02c805301257e3cd36a17d8100602f29b041df9c836aa196109411e073e73a17805a3784b019c4c58e7afac3528791926f30c79fe214b70532bf1e
SSDEEP 192:KRqZa9X2qzv7FAPRp2o9XxHsb+WNnGqd6aesKqVyIsnAUge:KRqZgX2qLsXjfwndHe
TLSH
T1E1329729BE11693B6DCAD22DFA667793D7F6102121D52E40E7FC9A2C11EB6CC2227407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 e06ac05c5faf5dd4d9388f0f3688fd6b5b68f01fb5e510665841443f7baeb56e
MD5 2675187091675f78fecbc5bf1f29f46b
SHA1 e050af24b537e0dbf1e938090fb7d9bb97f90406
SHA512 70f04546146e1443d4842507437d6794d953019bc4d513e31f1edbd8142b9b8e569a9bbfa2a4a596dece701a0645364a5da2ae3f724d061f9d8a6de926149577
SSDEEP 192:QRqZc9T2wv7hJPRplLN9XxHsb+WNn/YEgfECaesKoVyIsnAUgE:QRqZCT2svXjfwwXE/E
TLSH
T1F342962ABD10693B6ED7D229F9667B93E7F6102121D52E40F7FC8A6C11E76CC2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 f74a56d7b5f6c6d99f5bc3ee31ccfffc6f5178a665605383a20f00cd6e6c5c25
MD5 f18be33bc8f641f6a5f9d73d29b6cf14
SHA1 250fb962c8984233412d8da25d45fd76e324a27a
SHA512 0987ea3362d2ec71432ddc0aa6c55c3c9ebdfc28b501203ded9dbc25cae5b463e1c5db5bd1a832f13d1f867fee81d10eda3b86a37b3895478986dce7ba3cebb9
SSDEEP 192:KRqZc9K2Dv7FJPRplo9XxHsb+WNn/bltaesKoVyIsnAUgE:KRqZCK27zXifwTl2E
TLSH
T13642A72ABE14693B6DC6D32DF9667B93D7F6102121D52E40E7FC8A2C11EB6CC2227017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 42d0823dce137506a46bfe70edf749daddd91071be8082e01c5216b37f177c9d
MD5 e17b88ccceb64a29083e1e23425acebd
SHA1 b13a431e59ba8fcadfab7be2c30eb9f23af31360
SHA512 7453b6a165c75972001303b6f6d2924d3609b5713c318fa3afc42954243bb6afc764d820a03609ef2f4b382f38bfc18df993314a9c77c89b58523924cba04eb9
SSDEEP 192:QRqZc9O2wv7hJPRplLN9XxHsb+WNn/YEgfECaesKoVyIsnAUgE:QRqZCO2svXjfwwXE/E
TLSH
T1D042A62ABD10693B6EC7D229F9667B93E7F6102121D52E40F7FC8A6C11E76CC2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 e85cf6100b48c23b06f79b15f4d6811f72fab0e246cd77f9abebde966285d1c0
MD5 06ca3a4d886602064d82556bf2042559
SHA1 9d9b8b009393e4b1e5031558fe8e3579282a9627
SHA512 06e0c337e98116d7baf374be8969e5df1cb2b4f5e349a0daa26216907e3802a6731dd8210cbaebf3209a20799f70a4878db321135862c0eb0c062bde6469f188
SSDEEP 192:1ReZc922wv7oJPRplt7iN9XxHsb+WNnX8Ku19gfEQaesKoVyIsnAUgE:1ReZC22seX6fws1KE5E
TLSH
T15A52C82ABD106A3B6ED7C229F96277A7E7F6102121E52E44F7FC8A6C11E76CC2117017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 d01d208dc9b3d2eb2e7192eac98bd58820b4517895bac945c191536918aa4bf4
MD5 04a933404dda55c881fa476fc773bdac
SHA1 4283eed26c0f0a3e0ba350f05c296c2729aceb90
SHA512 e2810b85a745028ee7df6c3a9f15fe09629c1be6bc9302587b3776592a93f8f796afff011f45ae58ef2fe4de33de6128a9e4eb9126c29a3f8c721a126cee8138
SSDEEP 192:KRqZc9D2tv7FJPRplL49XxHsb+WNnoXSm92IaesKoVyIsnAUgE:KRqZCD2NzXGfwwx2BE
TLSH
T18442A72ABE14693B6EC7D22DF9667B93D7F6102121D52E40E7FC8A6C11E76CC2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 b84e6aebeb24bd551d2cc72471e9e04600305a126838fa52b21374602efaf055
MD5 42e8887cf267775d9dd320c5cf3c9d96
SHA1 06c23f0b64caef28b5afaa7a3c6fdbb3e51b9dea
SHA512 e013f1b0b1959e17526646c30563a177b5f2ad62d59ae6e522260f9d4562e9fe23de1c0d2ebba976bbca4d17ea3c8435f3c9a9a7225b108dcb93c41149ab03cc
SSDEEP 192:1RicBzZc922izv7oJPRpltrTzO9XxHsb+WNnX8Ku19gfEQaesKoVyIsnAUgE:1RimzZC22iLeXmfws1KE5E
TLSH
T12252B82ABD106A375ED7C229F9627797E7F6102121D52E84F7FC8A6C11E76CC2117407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 aef29ef4c63495292c50e5c26338c4bda946eb7617b8e816ee26a8d09aa8eb11
MD5 a0e19bfc5c1926a495c3bdf656e7929b
SHA1 261c082f95f0f09141c3181877d44c1622dc9d26
SHA512 f102ef1cb89d76b83439066b6ef92db77cd7242ddfeb99d2e3d8fa60bd1a06a13c3867933efa0b8288e34ced7c7d5b8addab9e221f9f1205552a6fd0a6bdf124
SSDEEP 192:QRqZc9H2av7yJPRplLA9XxHsb+WNned/UFaewaesKoVyIsnAUgE:QRqZCH22IXufw4TeZE
TLSH
T1F542A72ABD10693B6DC7D229F9667B93D7F6102121E52E84F7FC8A6C11E76CC2117017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 5469cbfcee002d630e3f72aaa1a7bf11a42eb1e63b14433e30ecf9d2f1c23c71
MD5 b1af312680e750d5760d76a17cb592c5
SHA1 1ddadfb6bad825108a19660d57e31c7d58b0e83a
SHA512 555521fc18f97bdc6b3cce20e9f790608160f27164a852096b8b003a38a634d0ee5eef0010267ad13af5187332cf5724283cd62aae1df349dde135225b896f61
SSDEEP 192:KRqZa9X2bv7FAPRp2o9XxHsb+WNn/blRaesKmVyIsnAUgE:KRqZgX2jsXjfwTlEE
TLSH
T1D732A82EBE15693B6DC6D22DFA667793D7F6102121D52E40E7FC8A2C11EB6CC2227017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 79321bf2ff0d35e875b06d1aec67f5c5d0369a52733971e4cf5caedd08915488
MD5 cc2f3a3b480b45bbb1bed752be151c86
SHA1 8481b1fce95891d4bbe215666d75d691ae1ce488
SHA512 332f4489909135ae1fdbe98d388df27016109bb43a041591c7f1f255e5aa250d489fd425d205d3db58cd1f1cf52afc16d80b0299bc839bc77a6429d0adae1b94
SSDEEP 192:QRqZc9O2wv7yJPRplLA9XxHsb+WNn/YEFae9aesKoVyIsnAUgE:QRqZCO2sIXufwwbeGE
TLSH
T1F842962ABD10693B6EC7D229F9667B93E7F6102121D52E44F7FC8A6C11E76CC2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 f660e6a2c6ce47e350f2c07f296b14b513caa6aa0628137acb5cb2154d068d28
MD5 9ef924dba6a7026a73b706874f1e40bb
SHA1 a63873f1f8a596c48b455a08f33dec509ff53cd8
SHA512 487a10b40cbb0b8629f81dc2d9ad1b79fcd407c8385c700ac6e49a53d04365755f2afa72332a2b7c2ee2a267da6ecf5e4314884c925244328f461cd2599dec19
SSDEEP 192:QRqZc9N2Mv7yJPRplLA9XxHsb+WNn/YEFae9aesKoVyIsnAUgE:QRqZCN2YIXufwwbeGE
TLSH
T1A942962ABD10693B6EC7D229F9667B93E7F6102121E52E44F7FC8A6C11E76CC2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 c62ef683397675f825e7b224c47e0e3f1d0361c9aff713cc1f1ab7a9a7711d93
MD5 0366cca5515f2e82d67fecbe1ad094f4
SHA1 d76ba7a1da46fbaf4c99efcb5ed9b7a527054ad4
SHA512 2aaaad257d305217c098e000f9e56e69efafe8b095b373379ca7b1cd65dbf6e5fbc296aa047942b1611e047d8c1fc2a0f92994dfc0872089b741fffbe869b2c4
SSDEEP 192:QRqZc9y2Mv7yJPRplLA9XxHsb+WNn/YEFae9aesKoVyIsnAUgE:QRqZCy2YIXufwwbeGE
TLSH
T18E42962ABD10693B6EC7D229F9667B93E7F6102121E52E44F7FC8A6C11E76CC2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 772d73a6dcdf6c583a34ac875238963cb6dd221b38dd23b34c5916d3e54f6a3a
MD5 667af576d2c4b8d732c497c72a6dac77
SHA1 382057bbae4ba603c064765412b685acfa780448
SHA512 a3d2503bbd1062623a9a39471abcf3d22291c2cfdcee410e2149c538fca88bf22858ef21348988b3d707ff5e2b4014c144c97c89d9ebe36660da02864944d8fc
SSDEEP 192:1RicBzZc922cv7oJPRpltrTzO9XxHsb+WNnX8Ku19gfEQaesKoVyIsnAUgE:1RimzZC22IeXmfws1KE5E
TLSH
T14152B82ABD106A375ED7C229F9627B97E7F6102121D52E84F7FC8A6C10E76CC2117407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 565116ecde1590c3ec48902573a3619511d50675deeb1c91791a2f3629933c38
MD5 b01e9752c611b279dfdb8db5636dfc78
SHA1 919d2ab93972ae808a1cec8daac33b4afe3f26f2
SHA512 439545b3a9cca34f4c47e2981cfcd984a49b444aacf1c3b36bb188744ceda57a33eac617d391096ae5ddc5d6ec35fe113bee5f66392a579d1ad47e4a8e68bd32
SSDEEP 192:KRqZc9X2tv7FJPRplo9XxHsb+WNnoX5qaesKoVyIsnAUgE:KRqZCX2NzXifww53E
TLSH
T18E42A72ABE14693B6DC7D22DF9667B93D7F6102121D52E44E7FC8A2C11EB6CC2227017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 ee6eb927156e08596668ee92f3c9eb5630d4680da2e41768efb23f8ba5deab48
MD5 a2a8f0cc053854bf9067089292f84952
SHA1 25510318275546e8593082ff055492df40014492
SHA512 3efbbb9c6e7a71c7b1cc8e24c3945b465f9c295ab8aca8dd28a9e3e77662679803bd4d6c5bc195c3776c0d175fc47b7e7d770e228e0a1c0c94d3dffbbc93921c
SSDEEP 384:/9j0X7KxkXqKf/pUZNCgVLH2HfgslNTXOD0b+ErU3PfHGSEM8m:/d0X7KxkXqKf/pUZNCgVLH2Hfgs77O4g
TLSH
T16C52F827684D9A3B0FD8D64CDC166F8FADF6014666784D2497FA5D0803A97CF110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 120B
SHA256 23fba409a0fa349ea1f4a5a756e53acb2fe297f9bf020416b938fa37646c39c1
MD5 0042a810b6b3f9a429e884dcec5a05d3
SHA1 ba9d1feab0d5fccce75498622f12cf7f0f200af0
SHA512 a241e705c49b0d28ffec54caef1a7019aa1684009dff8026eac531075bb658b2d99672a7d862d242e0f829e4d035f96b68406879708f450d832d6564170baa8a
TLSH
T1EAB012E1A1C01F85CC9D337010C5204013A02905001A8143A0918114C2D344488E021F
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 c056774c8cf5b7831898fee27b0966c85eb036e04d8c27b9f90104307158a8cc
MD5 7dc1efc4458c9116d3c7520bf509baa8
SHA1 9e4b47dcd43a5583a3843573caa21c80c52aafea
SHA512 71ac0438e278f3c7ac1cd07ddbf99d6f2cd4882dd323ab981b8e2a2dbdb424d748924dd9b80776d5e3e326dc2432562a276efaa5db0298b718f55faf3b27b104
TLSH
T1CBA0021043C40651DD4047B5606219C5EE55CC145FA38B9398A244C88C9F1D27206148
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5c097d.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index~RFe5c097d.TMP
Size 48B
SHA256 5bc6415659047ad5838807916a437d30eb07da61cb2b49a7706b1da7978560a1
MD5 11e34efa0aafb03754006c1e7c1cbacd
SHA1 1c760ec56d9444eac281db76879348984b079c22
SHA512 74ba93111809fd62f2c52d22b9cbfe55cd27a84bd1c73f587ae6bb5c04cc184aaa4f78efef4c03b3b2a7879d76dd79f80fc1c71cfde679b3fe1097718be72161
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network\Network Persistent State
Size 59B
SHA256 c257f929cff0e4380bf08d9f36f310753f7b1ccb5cb2ab811b52760dd8cb9572
MD5 78bfcecb05ed1904edce3b60cb5c7e62
SHA1 bf77a7461de9d41d12aa88fba056ba758793d9ce
SHA512 2420dff6eb853f5e1856cdab99561a896ea0743fcff3e04b37cb87eddf063770608a30c6ffb0319e5d353b0132c5f8135b7082488e425666b2c22b753a6a4d73
TLSH
T1D2A0026ADA612D881B4A839026187553807B0445130982FDE43877A841561AE582C865
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe629cf6.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network\Network Persistent State~RFe629cf6.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 160KB
SHA256 a0cdd2174f31cf7c448ef057d15da5736add4150aa92da8ec95ddb1ddca303d7
MD5 b74e87ba92a3c4a4ec197caea3f867ba
SHA1 5d1c07792016ecbbe8154650d53a178b8dc7754e
SHA512 17db780560cc45ddedfbead76f603c9a01440e70a7655a40055ffa1f0b29ac24021ffc5ac5841c7fe7ee2bdc050a7c6a55a6a8360475e48626303c1262f50078
SSDEEP 3072:maJrqHiCajGjTcR34VhBkaITupmQwi90EZqsE38JBrk7NGEM:NJrqCCCCTVVUaITEmQhw38JBrkBjM
TLSH
T1EBF312B2DF550D9708E098727A161A03EFDD7A8ED8A5FB404C9A6702620ACF3F7165D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 125KB
SHA256 a7ab2221ddf69922d2087f3dbca6a71116bbfdd36edd07e07a687464da20e5ba
MD5 5f2a6b877000dae264aa7bd3bb5e3aaa
SHA1 82a4acd4114dff5dcebd562032fac93fc11aecc4
SHA512 f5574fa4afd20b3b46a5880346b704ece78a1f62252883275d2653a8d661d5169ebc674bdf83ca426585a1966bc649f0cf117e53fff4fc7fe6c215378da3ac66
SSDEEP 3072:ccR34VhBkaITupmQwi90EZqsE38JBrk7NGEM:cVVUaITEmQhw38JBrkBjM
TLSH
T155C31276DD965C9608E08CB76A121F07FF996A4ED5A5FF848C961B03530ACE3F7024A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 125KB
SHA256 18e6a7b1bb04a6b0be3c1debac89416558d22f1c7eb02d54cdfb284a77636424
MD5 e725f89a92749438b736ef58d52a32ed
SHA1 7f2321b296e5420cfc4d32f020f3c0a739d63f3c
SHA512 92f1ab80b4348031513a457afa8358b51b0529f0bcee4910225b7dbdda0d51e9a3491da2e2e0346811e745ae475cf526ac4cfa4d8b8a67e0e8ef956d6dcb8f06
SSDEEP 3072:fcR34VhBkaITupmQwi90EZqsE38JBrk7NGEM:fVVUaITEmQhw38JBrkBjM
TLSH
T1C2C31276DD964C9608E08C776A121F07FF996A4ED5A5FF848C951B03530ACE3F7024A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 125KB
SHA256 9b802da3cfb1fc35b256291a771ed0cd29a8277a94cf41cf879cb4badca2801b
MD5 8b4adcc6e5800de64dfa568df308f245
SHA1 aeb10e72bc886655d0f8bb2636f102a5d6ede111
SHA512 2fa2101ef9a78fb0fcb1baf9bc4ca5f28ae9ff6d71205d35d5091d2506cda12eb12732f0535fc78d1dca773e4b44dcd949bd13f5d571241716bd03b0595255d0
SSDEEP 3072:ocR34VhBkaITupmQwi90EZqsE38JBrk7NGEM:oVVUaITEmQhw38JBrkBjM
TLSH
T142C31276DD964C9608E08CB76A121F07FF996A4ED5A5FF848C961B03530ACE3F7024A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 124KB
SHA256 cfb358d1af52dd54673643668d8f93c66b65cff30920c2935acfa1f678fc528c
MD5 4ab74ea3ab549be7526d83fbc4ceae55
SHA1 b8b910cf70033a33e783ea46492a7b75eee011a3
SHA512 6648bba8653223e8968a3dee5c5252bd3c54355c93e03c80cc70e1aab36bac5d798069e9830147aaece8323e48b9ef86509d31b440ede521c034e14221279f1f
SSDEEP 3072:G4cR34VhBkaITupmQwi90EZqsE38JBrk7NGEM:G4VVUaITEmQhw38JBrkBjM
TLSH
T1DCC312A5DEA74D6648D088776A231F0BF76A2B4CD0A5FF808C965B03634ACF3B351193
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 9c848e8c4ccdb25fa85f9656366f8f5c7a2792cd871aed3f738f5096973abb34
MD5 97d5e4d6aca924d2aad66dd4a174f91a
SHA1 08d0371cde8d315eed9cbf062b48dd32ecd9e138
SHA512 3b176439e7a78f89a22c8720bf273548ee2bb933673a4e224b492b31d50614d35ad71e3497bb87463dd9b2a04a33ce8158aa47ac221096a3ec3ff682c4b2681c
SSDEEP 96:xC0d+r2io+TJ/E0f6m934zM4RDotok5wOmDwUB6nGyvn0b4T8z2ybJv4a:xC0ITo+TQ0InDUDI5PPb4T8qybl
TLSH
T198A1F835A0284DB74476D486B1626A83CFB97067E972AFA0EAD90E0D25F70EC1351A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 124KB
SHA256 f7c6c40421b2a884d8e9e9094f41dc11009bd3db9a6c8bfcf959385850d953da
MD5 e5b38f1d42a65435808856193efa090d
SHA1 30e0f723a4304c9a222319c436bab22fb70779de
SHA512 81f5896e9e1468fac89ec95cb74923de637be862d5fb75836eaa8fee294672c100ae5f652765bc32ac679eed7519969be97bba40f3383c0ce067fb6283985c8b
SSDEEP 3072:X4cR34VhBkaITupmQwi90EZqsE38JBrk7NGEM:X4VVUaITEmQhw38JBrkBjM
TLSH
T12CC312A5DEA74D6648D088776A221B07F76A2B4CD0A5FF808C965B03674ACF3B351193
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 125KB
SHA256 a3134f1a21a447c54988080fe5b4d90bff15262739b598b4808cc270583e00af
MD5 2806650def337fa6819aa816ad57007d
SHA1 37d61e3032da7a57e3cb0aa0eaa0377383cfa208
SHA512 1925f0c8b4558d10ee65ce99c188a82587da0bee07a2416a5ee7904788130232e517a45524448e32a7eccfe6089c37c7e2500376707962573afb81251b8e5567
SSDEEP 3072:zcR34VhBkaITupmQwi90EZqsE38JBrk7NGEM:zVVUaITEmQhw38JBrkBjM
TLSH
T106C31276DD965C9608E08CB76A121F07FF996A4ED5A5FF848C961B03530ACE3F7024A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 599B
SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
MD5 658ab8c32d4cc5deb36ac5f63da4658b
SHA1 30c12cd871ff0c2c4098d794e9ae4f2540586813
SHA512 a73030c008ef3c2e274f11c90bfe79fa8ae402f76801c710bed8cc1ab1218a84858ea566b772be4bade8ef639a019c57d297028df15b64b3753482cf0f3c8f85
TLSH
T12AF05C83EB6A1B72C456123DC8EE56E47B31D1846EC11367A2107B1D3C2B7192D174BD
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1064_790279215\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5320-783-0x0000025584240000-0x0000025584260000-memory.dmp

Download

memory/5320-749-0x0000025582A40000-0x0000025582A60000-memory.dmp

Download

memory/5320-769-0x0000025582E00000-0x0000025582E20000-memory.dmp

Download

memory/5320-738-0x00000255801E0000-0x00000255802E0000-memory.dmp

Download

memory/5320-737-0x00000255801E0000-0x00000255802E0000-memory.dmp

Download

memory/5320-739-0x00000255801E0000-0x00000255802E0000-memory.dmp

Download

memory/5320-750-0x0000025582E80000-0x0000025582F80000-memory.dmp

Download