hxxps://bom[.]so/RKgaee

Resubmissions

08/09/2026, 09:04

260908-k1kttaed673

08/09/2026, 09:03

260908-k1hdpaed63

08/09/2026, 01:18

260908-bpbbkayhnd10

Analysis

user interaction
yes
max time kernel
1799s
max time network
1794s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/09/2026, 01:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://bom.so/RKgaee
Sample260908-bpbbkayhnd

Score

8^/10

adware discovery persistence ransomware spyware

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5696	chrome.exe

Checks SCSI registry key(s) 3 TTPs 62 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	explorer.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Internet Explorer\Main	explorer.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134333039570723735"	chrome.exe

Modifies registry class 42 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3611646547-550105268-947503007-1000\{4019D905-6E91-42C7-85FF-5763856939C0}	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\MuiCache	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	StartMenuExperienceHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	StartMenuExperienceHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3611646547-550105268-947503007-1000\{41FF74BA-95EF-4996-AC75-B40ACA3577A3}	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs	SearchHost.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
1448	chrome.exe
1448	chrome.exe
1152	explorer.exe
1152	explorer.exe
1152	explorer.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 19 IoCs

pid	Process
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2716	chrome.exe
Token: SeCreatePagefilePrivilege	2716	chrome.exe
Token: SeShutdownPrivilege	2716	chrome.exe
Token: SeCreatePagefilePrivilege	2716	chrome.exe
Token: SeShutdownPrivilege	2716	chrome.exe
Token: SeCreatePagefilePrivilege	2716	chrome.exe
Token: SeShutdownPrivilege	2716	chrome.exe
Token: SeCreatePagefilePrivilege	2716	chrome.exe
Token: SeShutdownPrivilege	2716	chrome.exe
Token: SeCreatePagefilePrivilege	2716	chrome.exe
Token: SeShutdownPrivilege	2716	chrome.exe
Token: SeCreatePagefilePrivilege	2716	chrome.exe
Token: SeShutdownPrivilege	2716	chrome.exe
Token: SeCreatePagefilePrivilege	2716	chrome.exe
Token: SeShutdownPrivilege	2716	chrome.exe
Token: SeCreatePagefilePrivilege	2716	chrome.exe
Token: SeShutdownPrivilege	2716	chrome.exe
Token: SeCreatePagefilePrivilege	2716	chrome.exe
Token: SeShutdownPrivilege	2716	chrome.exe
Token: SeCreatePagefilePrivilege	2716	chrome.exe
Token: SeShutdownPrivilege	2716	chrome.exe
Token: SeCreatePagefilePrivilege	2716	chrome.exe
Token: SeShutdownPrivilege	2716	chrome.exe
Token: SeCreatePagefilePrivilege	2716	chrome.exe
Token: SeShutdownPrivilege	2716	chrome.exe
Token: SeCreatePagefilePrivilege	2716	chrome.exe
Token: SeShutdownPrivilege	2716	chrome.exe
Token: SeCreatePagefilePrivilege	2716	chrome.exe
Token: SeShutdownPrivilege	2716	chrome.exe
Token: SeCreatePagefilePrivilege	2716	chrome.exe
Token: SeShutdownPrivilege	2716	chrome.exe
Token: SeCreatePagefilePrivilege	2716	chrome.exe
Token: SeShutdownPrivilege	2716	chrome.exe
Token: SeCreatePagefilePrivilege	2716	chrome.exe
Token: SeShutdownPrivilege	2716	chrome.exe
Token: SeCreatePagefilePrivilege	2716	chrome.exe
Token: SeShutdownPrivilege	2716	chrome.exe
Token: SeCreatePagefilePrivilege	2716	chrome.exe
Token: SeShutdownPrivilege	2716	chrome.exe
Token: SeCreatePagefilePrivilege	2716	chrome.exe
Token: SeShutdownPrivilege	2716	chrome.exe
Token: SeCreatePagefilePrivilege	2716	chrome.exe
Token: SeShutdownPrivilege	2716	chrome.exe
Token: SeCreatePagefilePrivilege	2716	chrome.exe
Token: SeShutdownPrivilege	2716	chrome.exe
Token: SeCreatePagefilePrivilege	2716	chrome.exe
Token: SeShutdownPrivilege	2716	chrome.exe
Token: SeCreatePagefilePrivilege	2716	chrome.exe
Token: SeShutdownPrivilege	2716	chrome.exe
Token: SeCreatePagefilePrivilege	2716	chrome.exe
Token: SeShutdownPrivilege	2716	chrome.exe
Token: SeCreatePagefilePrivilege	2716	chrome.exe
Token: SeShutdownPrivilege	2716	chrome.exe
Token: SeCreatePagefilePrivilege	2716	chrome.exe
Token: SeShutdownPrivilege	2716	chrome.exe
Token: SeCreatePagefilePrivilege	2716	chrome.exe
Token: SeShutdownPrivilege	2716	chrome.exe
Token: SeCreatePagefilePrivilege	2716	chrome.exe
Token: SeShutdownPrivilege	2716	chrome.exe
Token: SeCreatePagefilePrivilege	2716	chrome.exe
Token: SeShutdownPrivilege	2716	chrome.exe
Token: SeCreatePagefilePrivilege	2716	chrome.exe
Token: SeShutdownPrivilege	2716	chrome.exe
Token: SeCreatePagefilePrivilege	2716	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
4540	sihost.exe
1152	explorer.exe
1152	explorer.exe
1152	explorer.exe
1152	explorer.exe
1152	explorer.exe
1152	explorer.exe
1152	explorer.exe
1152	explorer.exe
1152	explorer.exe
1152	explorer.exe
1152	explorer.exe
1152	explorer.exe
1152	explorer.exe
1152	explorer.exe
1152	explorer.exe
1152	explorer.exe
1152	explorer.exe
1152	explorer.exe
1152	explorer.exe
1152	explorer.exe
1152	explorer.exe
1152	explorer.exe
1152	explorer.exe
1152	explorer.exe
1152	explorer.exe
1152	explorer.exe
1152	explorer.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
2716	chrome.exe
1152	explorer.exe
1152	explorer.exe
1152	explorer.exe
1152	explorer.exe
1152	explorer.exe
1152	explorer.exe
1152	explorer.exe
1152	explorer.exe
1152	explorer.exe
1152	explorer.exe
1152	explorer.exe
1152	explorer.exe
1152	explorer.exe
1152	explorer.exe
1152	explorer.exe
1152	explorer.exe
1152	explorer.exe
1152	explorer.exe
1152	explorer.exe
1152	explorer.exe
1152	explorer.exe
1152	explorer.exe
1152	explorer.exe
1152	explorer.exe
1152	explorer.exe
1152	explorer.exe
1152	explorer.exe
1152	explorer.exe
1152	explorer.exe
1152	explorer.exe
1152	explorer.exe
1152	explorer.exe
1152	explorer.exe
1152	explorer.exe
1152	explorer.exe
1152	explorer.exe
1152	explorer.exe
1152	explorer.exe
1152	explorer.exe
1152	explorer.exe
1152	explorer.exe
1152	explorer.exe
1152	explorer.exe
1152	explorer.exe
1152	explorer.exe
1152	explorer.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2912	StartMenuExperienceHost.exe
1152	explorer.exe
3216	SearchHost.exe
2716	chrome.exe
2716	chrome.exe
1152	explorer.exe

Suspicious use of WriteProcessMemory 60 IoCs

description	pid	Process	procid_target
PID 2716 wrote to memory of 6044	2716	chrome.exe	88
PID 2716 wrote to memory of 5608	2716	chrome.exe	90
PID 2716 wrote to memory of 5608	2716	chrome.exe	90
PID 2716 wrote to memory of 5696	2716	chrome.exe	92
PID 2716 wrote to memory of 5764	2716	chrome.exe	93
PID 2716 wrote to memory of 5764	2716	chrome.exe	93
PID 2716 wrote to memory of 4368	2716	chrome.exe	94
PID 2716 wrote to memory of 4368	2716	chrome.exe	94
PID 2716 wrote to memory of 3776	2716	chrome.exe	95
PID 2716 wrote to memory of 3776	2716	chrome.exe	95
PID 2716 wrote to memory of 2336	2716	chrome.exe	96
PID 2716 wrote to memory of 2336	2716	chrome.exe	96
PID 2716 wrote to memory of 5852	2716	chrome.exe	97
PID 2716 wrote to memory of 3840	2716	chrome.exe	99
PID 2716 wrote to memory of 4156	2716	chrome.exe	100
PID 2716 wrote to memory of 3840	2716	chrome.exe	99
PID 2716 wrote to memory of 4156	2716	chrome.exe	100
PID 2716 wrote to memory of 1320	2716	chrome.exe	101
PID 2716 wrote to memory of 1320	2716	chrome.exe	101
PID 2716 wrote to memory of 1820	2716	chrome.exe	104
PID 2716 wrote to memory of 2544	2716	chrome.exe	105
PID 2716 wrote to memory of 2544	2716	chrome.exe	105
PID 2716 wrote to memory of 1820	2716	chrome.exe	104
PID 2716 wrote to memory of 2116	2716	chrome.exe	106
PID 2716 wrote to memory of 2116	2716	chrome.exe	106
PID 2716 wrote to memory of 5988	2716	chrome.exe	107
PID 2716 wrote to memory of 5988	2716	chrome.exe	107
PID 2716 wrote to memory of 5928	2716	chrome.exe	108
PID 2716 wrote to memory of 5928	2716	chrome.exe	108
PID 2716 wrote to memory of 6024	2716	chrome.exe	110
PID 2716 wrote to memory of 6024	2716	chrome.exe	110
PID 2716 wrote to memory of 5884	2716	chrome.exe	111
PID 2716 wrote to memory of 5744	2716	chrome.exe	112
PID 2716 wrote to memory of 716	2716	chrome.exe	113
PID 2716 wrote to memory of 2208	2716	chrome.exe	114
PID 2716 wrote to memory of 2208	2716	chrome.exe	114
PID 2716 wrote to memory of 3720	2716	chrome.exe	115
PID 2716 wrote to memory of 3720	2716	chrome.exe	115
PID 2716 wrote to memory of 1448	2716	chrome.exe	116
PID 2716 wrote to memory of 5324	2716	chrome.exe	117
PID 2716 wrote to memory of 5324	2716	chrome.exe	117
PID 2716 wrote to memory of 2108	2716	chrome.exe	118
PID 2716 wrote to memory of 2108	2716	chrome.exe	118
PID 2716 wrote to memory of 5940	2716	chrome.exe	120
PID 2716 wrote to memory of 5940	2716	chrome.exe	120
PID 2716 wrote to memory of 244	2716	chrome.exe	121
PID 2716 wrote to memory of 244	2716	chrome.exe	121
PID 2716 wrote to memory of 4088	2716	chrome.exe	122
PID 2716 wrote to memory of 4088	2716	chrome.exe	122
PID 2716 wrote to memory of 4020	2716	chrome.exe	123
PID 2716 wrote to memory of 4020	2716	chrome.exe	123
PID 2716 wrote to memory of 3904	2716	chrome.exe	124
PID 2716 wrote to memory of 3904	2716	chrome.exe	124
PID 2716 wrote to memory of 5752	2716	chrome.exe	125
PID 2716 wrote to memory of 5752	2716	chrome.exe	125
PID 2716 wrote to memory of 3368	2716	chrome.exe	126
PID 2716 wrote to memory of 3368	2716	chrome.exe	126
PID 2716 wrote to memory of 1872	2716	chrome.exe	127
PID 2716 wrote to memory of 1872	2716	chrome.exe	127
PID 4540 wrote to memory of 1152	4540	sihost.exe	133

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://bom.so/RKgaee
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7fff2a03c728,0x7fff2a03c734,0x7fff2a03c740
  2⤵
  PID:6044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1608,i,7300074279987813913,10137668503325998609,262144 --field-trial-handle=1952,i,3001349341053940589,18108276309423259464,262144 --variations-seed-version --mojo-platform-channel-handle=1948 /prefetch:2
  2⤵
  PID:5608
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1464,i,12670080104610665692,18120916665926534984,524288 --field-trial-handle=1952,i,3001349341053940589,18108276309423259464,262144 --variations-seed-version --mojo-platform-channel-handle=2112 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5696
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2296,i,488110169884821119,6997063462730703488,524288 --field-trial-handle=1952,i,3001349341053940589,18108276309423259464,262144 --variations-seed-version --mojo-platform-channel-handle=3336 /prefetch:13
  2⤵
  PID:5764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3064,i,321497575964218858,12777792544716949111,2097152 --field-trial-handle=1952,i,3001349341053940589,18108276309423259464,262144 --variations-seed-version --mojo-platform-channel-handle=3372 /prefetch:1
  2⤵
  PID:4368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3068,i,10625207056361767307,2341404366343725799,2097152 --field-trial-handle=1952,i,3001349341053940589,18108276309423259464,262144 --variations-seed-version --mojo-platform-channel-handle=3444 /prefetch:1
  2⤵
  PID:3776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4656,i,16666068605496889313,2373758096080225506,2097152 --field-trial-handle=1952,i,3001349341053940589,18108276309423259464,262144 --variations-seed-version --mojo-platform-channel-handle=4680 /prefetch:1
  2⤵
  PID:2336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5172,i,17930134817910652218,1285457970351031859,524288 --field-trial-handle=1952,i,3001349341053940589,18108276309423259464,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:14
  2⤵
  PID:5852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5264,i,13261021791457282215,988046678680621025,2097152 --field-trial-handle=1952,i,3001349341053940589,18108276309423259464,262144 --variations-seed-version --mojo-platform-channel-handle=5272 /prefetch:1
  2⤵
  PID:3840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5304,i,6020164347378989851,1447349798953141041,2097152 --field-trial-handle=1952,i,3001349341053940589,18108276309423259464,262144 --variations-seed-version --mojo-platform-channel-handle=5300 /prefetch:1
  2⤵
  PID:4156
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5596,i,16048738301383140879,4006449550006228372,2097152 --field-trial-handle=1952,i,3001349341053940589,18108276309423259464,262144 --variations-seed-version --mojo-platform-channel-handle=5264 /prefetch:1
  2⤵
  PID:1320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5652,i,4652789061003249019,9603832815364838528,2097152 --field-trial-handle=1952,i,3001349341053940589,18108276309423259464,262144 --variations-seed-version --mojo-platform-channel-handle=4932 /prefetch:1
  2⤵
  PID:1820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5332,i,5732620712985169996,4034897988306983161,2097152 --field-trial-handle=1952,i,3001349341053940589,18108276309423259464,262144 --variations-seed-version --mojo-platform-channel-handle=5596 /prefetch:1
  2⤵
  PID:2544
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5628,i,15488716745304472282,8661998211834513465,2097152 --field-trial-handle=1952,i,3001349341053940589,18108276309423259464,262144 --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:1
  2⤵
  PID:2116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5320,i,7800648359704553558,11178386403122296503,2097152 --field-trial-handle=1952,i,3001349341053940589,18108276309423259464,262144 --variations-seed-version --mojo-platform-channel-handle=5332 /prefetch:1
  2⤵
  PID:5988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5176,i,1170015120695640073,6909866222498342369,2097152 --field-trial-handle=1952,i,3001349341053940589,18108276309423259464,262144 --variations-seed-version --mojo-platform-channel-handle=5448 /prefetch:1
  2⤵
  PID:5928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5708,i,13805180476780096974,6397961300441826868,2097152 --field-trial-handle=1952,i,3001349341053940589,18108276309423259464,262144 --variations-seed-version --mojo-platform-channel-handle=6012 /prefetch:1
  2⤵
  PID:6024
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4676,i,5231797161972315899,17624767540456142325,524288 --field-trial-handle=1952,i,3001349341053940589,18108276309423259464,262144 --variations-seed-version --mojo-platform-channel-handle=5732 /prefetch:14
  2⤵
  PID:5884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5208,i,7940790625957732574,12496210747572355030,524288 --field-trial-handle=1952,i,3001349341053940589,18108276309423259464,262144 --variations-seed-version --mojo-platform-channel-handle=4736 /prefetch:14
  2⤵
  PID:5744
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4732,i,12512399144224969632,9313589141646854808,524288 --field-trial-handle=1952,i,3001349341053940589,18108276309423259464,262144 --variations-seed-version --mojo-platform-channel-handle=4728 /prefetch:14
  2⤵
  PID:716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=5400,i,1813608173507064972,13853162857899016003,2097152 --field-trial-handle=1952,i,3001349341053940589,18108276309423259464,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:1
  2⤵
  PID:2208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=5480,i,5304515263999172997,12284306657296184525,2097152 --field-trial-handle=1952,i,3001349341053940589,18108276309423259464,262144 --variations-seed-version --mojo-platform-channel-handle=5824 /prefetch:1
  2⤵
  PID:3720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5656,i,12652304001424004080,6703880992895540524,262144 --field-trial-handle=1952,i,3001349341053940589,18108276309423259464,262144 --variations-seed-version --mojo-platform-channel-handle=4704 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=4460,i,16158310505789267296,17189205566354990624,524288 --field-trial-handle=1952,i,3001349341053940589,18108276309423259464,262144 --variations-seed-version --mojo-platform-channel-handle=1516 /prefetch:14
  2⤵
  PID:5324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=5504,i,16242688804704378798,10649173828266003294,2097152 --field-trial-handle=1952,i,3001349341053940589,18108276309423259464,262144 --variations-seed-version --mojo-platform-channel-handle=5276 /prefetch:1
  2⤵
  PID:2108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=5776,i,16474908135682627554,12475692460960154294,2097152 --field-trial-handle=1952,i,3001349341053940589,18108276309423259464,262144 --variations-seed-version --mojo-platform-channel-handle=5668 /prefetch:1
  2⤵
  PID:5940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=5712,i,11354190195872538176,3069248720743800155,2097152 --field-trial-handle=1952,i,3001349341053940589,18108276309423259464,262144 --variations-seed-version --mojo-platform-channel-handle=4772 /prefetch:1
  2⤵
  PID:244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5932,i,10083785008231376837,13637811561182364906,524288 --field-trial-handle=1952,i,3001349341053940589,18108276309423259464,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:14
  2⤵
  PID:4088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6192,i,15533053617957106605,15564303725776826464,524288 --field-trial-handle=1952,i,3001349341053940589,18108276309423259464,262144 --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:14
  2⤵
  PID:4020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --metrics-shmem-handle=6200,i,12260334354731528720,7881456611772464715,2097152 --field-trial-handle=1952,i,3001349341053940589,18108276309423259464,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:1
  2⤵
  PID:3904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --metrics-shmem-handle=5436,i,13419788594666210509,9535150069574908451,2097152 --field-trial-handle=1952,i,3001349341053940589,18108276309423259464,262144 --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:1
  2⤵
  PID:5752
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5688,i,17819120153927325641,1046524114767273218,524288 --field-trial-handle=1952,i,3001349341053940589,18108276309423259464,262144 --variations-seed-version --mojo-platform-channel-handle=6028 /prefetch:14
  2⤵
  PID:3368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6548,i,1214255132938388831,1286763116869760791,524288 --field-trial-handle=1952,i,3001349341053940589,18108276309423259464,262144 --variations-seed-version --mojo-platform-channel-handle=6528 /prefetch:14
  2⤵
  PID:1872

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4500

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3964

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:3388

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5712

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4540
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Enumerates connected drives
  - Checks SCSI registry key(s)
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:1152

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2912

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3216

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:5936

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_00000c

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000c
Size 52KB
SHA256 325625631b9a3b641938c3ca9215337600418fb61c7f85214c70a66074079835
MD5 e4786c35946ef3e3c6fd49f1c1a0cb48
SHA1 6adb46f1ecc30bcac18c4f4f624d68d01c775836
SHA512 bbe75670a637a92dc0a79b5c1a4f64ba8150b99f6ad10aeb5d9814ed1169c9372d421e770d3011d31026647d4d7a6f185302a4fe88d5cb60dae63a55759c04de
SSDEEP 1536:I/AclhA09oj3zPOvjG7LWSj+NX3pVLKlWueWNtY:WlhloHej6LBj+Z8Hy
TLSH
T19833F1681C15AAF18CD0AB520E56BA9D1C7BF3B1F16D3D013AF350FD322487655AA8F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000015

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000015
Size 53KB
SHA256 96d1a3c871c4cc683b75639d9950b3577e0951954230a1740ac841bd46e429aa
MD5 d029c0e7fbab4c7b243a03725fbb64e0
SHA1 035d6fd9ed6562542e29be5b68d7c333354f3470
SHA512 8423146765ef51afcb79b1700a2b2603823761536486235094b7690a47b3228109d7fb24dd14ba52950a24798b1b72feb6667d4312f48a809c1162bf55f8ebd6
SSDEEP 1536:9EhCFHsIFoh/UZdVtUtPPax47rx4zLWejoD7FnYi:C82ByZntW3xJ4zCesD7FnZ
TLSH
T1AE33F1902F5AE0574CD60D2C1BF273A8C7F6A82564DCD1A7CD478B01AD1D3D99184EEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000016

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000016
Size 17KB
SHA256 9978118341d0752a5eb1bdc20cc31756838ab04b903e0d812c39148f1e49af3d
MD5 39ba69d91d34539b89fdcb025c11ed16
SHA1 f66e55a65c5d5d12adadcbf16f2945fdab4783c3
SHA512 59a7849f6fa17bcf2e3cdb7730ec8fda1d01ca73af3e0855967cadb80caecd3ea8caa2f05e2558c42aa57c7a5b50ea1e393b1ed0523fe8ff126125dee98953b7
SSDEEP 384:b6m7NK1WUbh+pXxqFOQYIhTwe0iw4vh+fgrKYIFTCEQSvHKn9XQrtaF:OmxK8UbCXxq5YIhTiitZ+fgIFcSPeXeg
TLSH
T1CE82BEFFC006B4E9922E18FE356CC9D3442E53334ED94EDA1FC974960B52018AB0C979
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000017

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000017
Size 51KB
SHA256 bd94712eeb7a37d46209ec49d5085f76b380dc1c25b976e1ce1ccc63eed89f59
MD5 1f1b883c578a953ffa9683f747d6fb96
SHA1 182dcc5c55c07ed1a56cd57b197c6f65c7befa6a
SHA512 c04fb7bdfcff385f5b7b44441c3a57c89e7eaf96be5304adf4d0b521ef492b65f3c21c8eaf89de346b952fd142104e5d2f3235908dd60f72f60a1814c7076608
SSDEEP 1536:62+f8tAzzCdiRYXIsrJTE8gxs579DCXfTEA:99szDmFJvpkl
TLSH
T16733027CC8FFE6B4F5841E388915C4B1C0C62174BADAAE0B57431586226C1DF7EB126E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000025

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000025
Size 33KB
SHA256 958a0f07ec4a86b6f2e587a76bd7a251fbc745f53878eaba4794c312121dec1d
MD5 ac69da9ee423f09e04936e167276f511
SHA1 6b72c25bddf0a57d869151bb993359dce75df84e
SHA512 8cbc29ce4df77e4c83ed29b4439682b6b62be29242773c4cf05c4af58c9322c7eb055997959bed9d0be8e31a0aefe049a8d66d120be4408ea64559d13d338fe4
SSDEEP 768:a9BC+9vG5FnDcYnjs7PQOUFd6p1sPoAfjwmTMu9D/tJCB8JVLiwD:0boF9nSYP6jsPDjf/ti8mE
TLSH
T1D5F2E14F2125B8CB9C722B77C09814E841EBF8C1E6C74BF849A4F51BEE1642DBAA5705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000026

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000026
Size 44KB
SHA256 336a602767c0eceee1978f902d766e8948d8f06f26bb81469343a2e5763ccccd
MD5 e0befde202ca1fc9f61350a708a83505
SHA1 36d139f3664ccaf04381e86c7af59a9af361b82c
SHA512 0ca24cf6f70b03feabddf8f9d45c13feaa1e96a63260a41b20dd37f283bf2bc0f3da56ff428cb89816406de575558dd568cbf80d9c33375838132cfd3538abc5
SSDEEP 768:f4lNu8sZluFxFTvhnw+seQ2VIhPVWNfh4WhtUt8CUF3JOvTgDy3doCXFHZIeZIIs:f4lNuz6Dv1W2V0PVWN5biiCw83tTXnIX
TLSH
T10B23027B35384855CEE51C08513641422D53C9AA9B41BFA0DEE1D7A6F227797FC02CB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00002a

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00002a
Size 50KB
SHA256 1275db68bab8e339e537dfabc7327d3f9ad5993cca2d66c34ad3130f035f2b70
MD5 0379ddf588d4ca6952239accc12926fe
SHA1 5a6af77c47d17c6cc6652ec82442d9ce0409f5d5
SHA512 4811cd4ab5eafe1bd0d3474ba4a8cbd1feb9117383a9035e84009e0951ab5e6937bd471f1c95ed95034c570c47e34257d456a44a486f7fe1f07f44b733e83d34
SSDEEP 1536:8/1BwBy/qnFBXCShIVehBSCZU16khcSGDk/3PoZ:8dBqo2XCShSehYCZuXRHO
TLSH
T1B4330209F57F46A86B8F87E36815FB2403E5E558D722204BB12EB5D5168F28E18C17CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 5e4d0ca4f39328344c74ada22d809d1cfbb9afae11f27be4a04bfa28b1abd2f6
MD5 89f56272a29829d3236ee2a8d2662cd4
SHA1 81bc49bd8a50849303ede26d1c371457d912dcde
SHA512 596b9fe532fc07585f17d69c9c3bab4ef2161c594b56efac67ddb0cee0c543daff02945d0001906b9830b0f7422204d8f5e5d26491871d139f7c1141e940ac6e
TLSH
T108B0240D13C07417C30043343051040033751D30CF0141C574C0D15DFDC33704301035
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 120B
SHA256 32ea814e7d2b7a1311a07dc211ea5ecadfa6a290696e6d12ccb9a45c38f7ea98
MD5 172840880930d2a37f7e0fd4f248d5e1
SHA1 80578422671944071d062aca0a45e8792fb655f0
SHA512 67f44106c363bca8aec6eb56fdac80aebd92986c7891cc121e94b1c46b97a75e6d9773e06202f1579e170c7736f4baf3f936dd3fbf806e98ef6fab82342ae925
TLSH
T1E2B0120512D07531DFC1C2B725E70C40337556340131174BB4C8D24CAF477F2A101095
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 2e8bf84b4ee8a63e3577cecfbc901ffa4635a6fb4627ab4c3cce69470580a129
MD5 b479892d52179f14dd21e8aed2c95650
SHA1 c1e2c6a5c94cd83c0e98de18fa7f639e1efa6d66
SHA512 4abdd3b4149926b5b81a27ed6017e15ae6ac09a7f14b6cab63ffce71ec2369cdba885fd9c0758a0c1db83b07e9a952477286e34f183db82264ebac20cd6214b5
SSDEEP 48:M+lMXgzlz6BBCRxjVBZSOJO+oRnmtvc5aOKdBUJSOE0p2OZWx7OJZeYeQ/Ix:M+lzzlkBaVBZC+wnmt0q8NABewYeQQx
TLSH
T109A1C6F4D1C8C1A1FF896675D9EACF6B7D36447501978B1B09AED372190B7CAC88A0B0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 9e7acaacdd4dcb16491805ac4a9db37ba4c744d0f1912307b21abcf635694b30
MD5 a5d912f18615e74baf3d30d9840d7b48
SHA1 5b342147907c1a0d8ec1a3992daba78d32822adf
SHA512 5f5deab5cdfeed5528b6499538d7d31ba85527f72ecc1163b246f473e0dea1f88377f121e2369490b8cab1d544d6487660119b8842b0dc7d057b38bef050ddc8
TLSH
T18571CDF7C3F8892E86156AF4BB196E1BCE590518431C3C6B89E46E0B67F1861D284B4F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 95fe4930192fdb4aaf7a95e365dc453186ba64353a58cabecede03873bc949b8
MD5 dee5e2882307560439c378e164fb0243
SHA1 7df4846ee313eea769316cca5cc555aed7e29ac4
SHA512 52ef8f4337409c716433630eb14dde0f25d7695fb958b66a32a1c7739760944fce6f07ee7ef85dbe489f6626f79d2063eb80b2e6c861ddf31b7bc584faa2f90a
SSDEEP 192:DLvFk0uj1GkMHaIaaIa5sVbyqEd7VtmDvbtH2jCQplICHe0jPemMEEVK:DLvFk0uj1GkMHaIaaIa5sVbyqEd7Vtmw
TLSH
T1D6F18CF743B4952DEA2557F49A08AE2FCF991524437C3C7AC9D06D0793B2562E240B8B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 9KB
SHA256 489b3c3ab5ca3a284558543383dc363099756e63db54959d390d1e222ff22799
MD5 c216c99b21b8f90ec58d0c1dafdd197f
SHA1 2f64d1b1ead94408e07a1b7503820c88897291f9
SHA512 c5725f43b154c5d162da44dcd86858ca05bac73880153fef87e60b19479d5f6cfb67d742db86a550c20961ca318536c84951004cd8953942c986d1fe43293662
SSDEEP 192:DLmv3dUjEpioraIaaIa5HsV4mqLj7VetmmDvbtH2jCQplHrxEjP6SEEM9:DLmv3dUjEpioraIaaIa5HsV4mqLj7Vec
TLSH
T1AC128CF783F4952DD92557F59A18AE2FCF591528432C3C3AC9E4AE0B93F2462D240B4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 9KB
SHA256 1772bfffe6dbcb52635b214fda67d25aa7c426b708423d2115da11e39cb92c39
MD5 72a86a5797925229f79ccc4edb04fddb
SHA1 402b8846acc63078ff607fe5debf02b105b92766
SHA512 0244171f48f40a3f518c6599199ff32257fdb9f2b36e4405d127edebc870e9317c432fa692f88ca31cc686451297c446f727fe831cd420ab00295190ea7991f4
SSDEEP 192:DLmv3dUjEpioraIaaIa5sV4mqLj7VtmDvbtH2jCQpltAcKHC0jPeHHGEEV:DLmv3dUjEpioraIaaIa5sV4mqLj7Vtmd
TLSH
T191129CF783F4952DD92557F59A18AE2FCF591528433C3C2AC9E0AE0B93F2461D240B4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 e2a5beb755d06d2fb257bacbc95ded5efc67de9460e4b71f3c82860a0d52fcfc
MD5 59041c9e209eb404494abf1f32e8f732
SHA1 7b3403ede28580ae2d02584c91325f91d841cb04
SHA512 04ec98ee8a6d076f0e0840ffb5a1db69308875adaeaf97fe299928736fc5a0cdeead2575b5cd327524532c6f7aafd08466b3df3273810f65eac4c834c86bddff
TLSH
T10971CCF7C3F8892E86156AF5BB196E1BCE590518031C3C6B8DE46E0B67F1861D284B4F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 633284026f05e45ab2be1c7dc348264d6f9569cc2b8efb35729c85ce6c4ba6af
MD5 45541998bd4faadaa29969d21d4b78b2
SHA1 c66bb2144872a13ebe741c85749ef09b75aa9e1e
SHA512 2587aaaefac3d576137878a9de19e522d7617d72d3b4c74fe3686b5564a4e0dd9eaffc5b1d7e0b710f92a0e207053eb044b7be597bd8d6b2d3c6c03d2ff0bf99
TLSH
T1C731AD67DBBFB46B103A48F72E48B80D5976B830464264F5EA9AC27CB0824B70706067
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 81d0622b98221bb1821bdfa53012d480a872b6f08a4f6cbe54f70592bd6b280e
MD5 c481a02e5f32564d5f42e0662dee6f1c
SHA1 8096c1b7d346359a4ad39b762c36ca9c1261d800
SHA512 22314742bdc78e3936c2d4c62544bf527a459f94f175c747af55d82f139842839f107cf48b907438885c06dfe641fddf6fc10ad34e732f0263a781215d1afce9
SSDEEP 192:5RshNFV7skv7+qvAPRp2th9pHsb+WNnuEpqx2kB22Skwt6VyIsnAUge:5RY5IAV6XSTwxK2422SN6e
TLSH
T15042A42EA910793B9CDFD319F9667757E2F6102162952E84EBFC892C14E79CC221740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 d9fa038af2d487345f6d74d4f051ec2e769ad2189ba92ba21d718d380202a830
MD5 b4f6f96cbb629b3a810f9ab0d5cf5aeb
SHA1 da6028cc7cb82c4e7fd41ae4854e4b816e071438
SHA512 fb93d82ead13de1a895b8468a684a71112a9e29fbac0aa26edc79c9970f57c626fee9258d1ace2b53a36023f2b2aa415174567ab8794f43850cb76f8aba8995d
SSDEEP 192:5RshNo8eOkIHV7sFv7+qvrPRpNPth9pHsb+WNnuEpLoY5B22SkwC6VyIsnAUgE:5RYuMI1V7XtTwxeYj22Si6E
TLSH
T17B62B62FA814797B9CDBD32DFA657F63E2E6102222902D8897FD892C10E79DC3217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 ac7f67d56e918835ee856b5eea1d975bcf7fd7ae98b365c898aeed06cde43a3a
MD5 532a565056f6c036752b4534c337fccb
SHA1 24d6bbc87d91dd9d9e0ffe438884eb76149d18c0
SHA512 88f0e96ea9a32783e61e09663bf44757a4df35459ae26a6184da7dd33bf0d09d98c67d202c921c1e3b9e78199a0502bea367f1a6271cad6054eb06ef55b530fe
SSDEEP 192:5RshNo8ZOkIjV7sFv7+qvrPRpNPth9pHsb+WNnuEpLoY5B22SkwC6VyIsnAUgE:5RYuJI1V7XtTwxeYj22Si6E
TLSH
T15052B52FA914797B9CDBD329FA657F63E2E6102222902D88D7FD892C10E79DC3217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 e159b66ce8984bb3b3e5814b80ed22d1dbcfe31eed97a2f16b1210e260425192
MD5 fea2dca77337ba4205ba6719f8ab1818
SHA1 f2ca1eb46db8672986580378dd4a9ed8f9c68b04
SHA512 4b2d9ba732cf1bf6712df55ddae0db9d3abce33d5b3ce79c1d06abf24ca562ac61637d0b6e1f16b19b4e9c2d1c84a8697467bb35be1e47bbcfe4dd4fe46d8f46
SSDEEP 192:5RshNK85OkIWV7syv7+qvrPRpNPth9pHsb+WNnuEpmtUYB22SkwC6VyIsnAUgE:5RYYWIeV7XtTwxSUU22Si6E
TLSH
T1D062A52FA914697BACDBD32DFA657F63E2E5102222902D88D7FC892C14E79DC3217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 1ba0a74df3be90c0bd352924d356de4505a0a2efcd99932f6f475d0ea50a5a60
MD5 8d54ccd4e96c1511a25f6ccb0f1a25a3
SHA1 f7168344fc682863b804db92c21d14735e6ae65b
SHA512 cea84ddac2bbea7e632453ffed0552f749947b2bc057ccdcfd8402c8b38008bd68c656e91f4f6cda08fa2ad82cc6f17e0e0ea80b45b73ecb484afdf6ec2414de
SSDEEP 192:5RshNR8jOkIHV7sJv7+qvrPRpNPth9pHsb+WNnuEpulg0B22SkwC6VyIsnAUgE:5RY/tIJV7XtTwx+go22Si6E
TLSH
T12E62B52FA914797B9CDBD32DFA657F67E2E6102222902D8897FC892C10E79DC3217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 f9a8e9215ad7aaf84231aba7daa5fad390cb0862dc0dfd85da9e4b71d56436dc
MD5 cfef62966d97219db58a8da8503455d3
SHA1 ae02ed62fbfe9554a700be2c7ca6b275b6741dcf
SHA512 357649ab3177597e743f6957c11e2f67e434da2cb89e3ac01ed1d1d1b7d5105196ce215fdf730c0f1470e8e4ac90e1bf3e4fac4964856a7848c4e67638baa34b
SSDEEP 192:5RshNo8SOkIhV7sFv7+qvrPRpNPth9pHsb+WNnuEpLoY5B22SkwC6VyIsnAUgE:5RYuwI1V7XtTwxeYj22Si6E
TLSH
T15252B52FA914797B9CDBD329FA657F63E2E6102222902D8897FD892C10E79DC3217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 5676384e39471adfb4d49a94a8585861442f843ac972a30b17e783a4a09aa142
MD5 08febfce2446c9c92e18c199a2e262ec
SHA1 3d55ae174cc8d5018287bb474737e57b57684c34
SHA512 875303a2ec22f078d89ece9fe4ccd4a2473a660f8cd4b8892becd080c7a5ea9a653eccf7e73cbba3e0c6707b79f945203a09124ec338cc8ab0489b08c4656d2f
SSDEEP 192:5RshNo8jOkIHV7sjv7+qvrPRpNPth9pHsb+WNnuEpJuETB22SkwC6VyIsnAUgE:5RYutIbV7XtTwxmE122Si6E
TLSH
T15862A52FA914797B9CDBD32DFA657F63E2E6102222902D8897FC892C10E79DC3217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 16KB
SHA256 bc7b5e04e2d1e051305c22784342b814a46a1c77de2b5977ae170bf17a64b27f
MD5 ca6d7903eae42681bff57d84674359d4
SHA1 7027304cbb1cc377e9e5c8d2a26687dd32edba43
SHA512 914ca28e3d816dd1a6cc38e1e74c4a97c0a5e571009221280fb141730787756654948bc99b58fa1593ee3f27f13d0721217e6182aa5b1b4b10583ee556ec61f6
SSDEEP 192:yRs+NK85OkIWV7oNv7+UrPRpNPXuAbrb69pHsb+WNQuIuG6KNipbwgfsFKH5u28A:yR9YWkttXtqTwQCTTDVc2lo22SidE
TLSH
T12772C86FA4246A7B9CDBD32DF965BF67E2E5102226945E8897FC891C10E39DC3217803
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 a876dea180445bf6629bb2defdd62576fb038a2f5e49739ce9e9414a472baa69
MD5 c5a7e16751c34377524f34dbbb98f253
SHA1 5ea189a1f67a1fcb2dc1000fa8fefed3eadf6ff0
SHA512 3e9b0945de91960f8c7a023d1d595654a62db1b1e4932ae5ee34470df3e66e5d11eb43493082613c9ecc448aa30a53100ae0a2c8dce34ff6bdc0a61702d9435e
SSDEEP 192:5RshNt8SHV7sFv7+qvAPRp2th9pHsb+WNnuEpROeQB22SkwY6VyIsnAUgE:5RYTHI1V6XSTwxqes22S46E
TLSH
T16D52B62EA914793B9CDBD329FA657F63D2F6102226902E44DBFD892C10E79DC3213417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 2a2e9b7b2cab7392b291ca0350a55514f5218f300fdb2421b01d85923ba0dfcc
MD5 92abe0b1047d841748905825f36ef833
SHA1 f4111f0e752fe74e9a52a6ef67ca3dffdd91d1d1
SHA512 979bb1c2cc752a723efbb73c127425ef8d455da899dfaa964e182e1d0857e42273926ae22fc68b7961c11bf0a80c1eef3367b996aa9c897b0bf02e8657703108
SSDEEP 192:yRshNK85OkIWV7oOv7+UrPRpNPt69pHsb+WNnuG62gfUR5B22SkwC6VyIsnAUgE:yRYYWkqtXGTwuTRURj22Si6E
TLSH
T17662B62FA8146A7BACDBD32DFA657F67E2E5102226942D8897FC891C10E79DC3217407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 f774963f81084b999400a4741d08c010a8ec97923491d89c55f0d242d0733742
MD5 bc8913ed53caf26e771f109d54f09c52
SHA1 79b1f8e3bc0220e9e3dc5b41cc5d60f17cc1f54e
SHA512 ab70fbb5ace1a6b53384307c6bd0b106b1662249475db9f93ee469cbcee559ad8cd64720120af14db2e3e0b77ad11240e7d618cded7b5e46c4a6e7fb62b5b6c8
SSDEEP 192:5RshNt8SOkIpV7sFv7+qvAPRp2th9pHsb+WNnuEpROeQB22SkwY6VyIsnAUgE:5RYTWI1V6XSTwxqes22S46E
TLSH
T1EF52B52EA914797B9CDBD329FA657F63D2F6102226902D88DBFD892C10E79DC3213417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 16KB
SHA256 a3a7306f6cb5d5c00ad3ad958d17db169cba72459795431c38ac9674076e860b
MD5 48d76ca6a2b5e3f5ef4b4bb98a4b194f
SHA1 1e0c1392e6b115d21e56199b95194f08ec542b3a
SHA512 a35d8383f760d49d7c050b4dfe4b7bce4a0905b5677f6441c3d97d50e1d924d6e6769730fe505de2e12bb768187b8912168b6e183d76072e45cf74fcfd0c4b02
SSDEEP 192:yRsz9NK85OkIWV7oNv7+UrPRpNPXuAbrb69pHsb+WNQuIuG6KNipbwgfsFKH5u23:yR49YWkttXtqTwQCTTDVc2lo22SidE
TLSH
T14772C86FA4146A7B9CDBD32DF965BF67E2E5102226945D889BFC891C10E39DC3317803
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 7e8caaa517d2afaafc6631ded76d107f5c8204ef99ed13692d1438085d350634
MD5 c5c2d905c312ecb89f5474e5384b2094
SHA1 fc047ef99c8f30f24f49e93a494b1c4fe7cede6a
SHA512 19f2536487f617ad8eae4523e9c9bf248259862f39f525088c3229d1b900032564f2c3de13fabf7a6b1be9f2273d06a73b3470f1a05b71bd375ccef4a98a2ed5
SSDEEP 192:5RshNK8jOkIcV7snv7+qvrPRpNPth9pHsb+WNnuEp21UkB22SkwC6VyIsnAUgE:5RYYCIvV7XtTwx2U422Si6E
TLSH
T1EE62A52FA814797BACDBD32DFA657F63E2E6102226902D8897FD891C14E79DC3217407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 e7fec50588e5650bdba11db66782b2d1e370cf823d84acabc3cab5fdb0a616ae
MD5 5e95195da5b666705deeadcd5b907813
SHA1 08215c25dfde9530c9241c7b9b6b967ee93317be
SHA512 4f73d073f7bb74098c8341410bc04708f0cd1be7e005af76fc3bce80dd45ec20a3e05fa8002d02618ee403286f4980065f768531230aa64d4162491bdb5f9ddf
SSDEEP 192:5RshNK8QgOkIWV7snv7+qvrPRpNPth9pHsb+WNnuEp21UkB22SkwC6VyIsnAUgE:5RYYsIvV7XtTwx2U422Si6E
TLSH
T15D62A52FA814797BACDBD32DFA657F63E2E6102226902D8897FD891C14E79DC3217407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 42c6dbb3f4702b5614d0028f9210349cc9c9437a97195897437cd6521250525b
MD5 103ff60005385e37091adcfe9bc6a256
SHA1 01aca567e8fec49780df30a8018ee0b744d63367
SHA512 81c29eda35d5076123991b741b7ca7c3da4f63c5ba63079569b95d1ee79c5ef3e3597e48ad71a65f7c692aa3950b8949f173da1623a60d6beab9326d4664d319
SSDEEP 192:5RshNK8jOkIHV7snv7+qvrPRpNPth9pHsb+WNnuEpofmiB22SkwC6VyIsnAUgE:5RYYtIvV7XtTwxamu22Si6E
TLSH
T11C62B62FA814797B9CDBD32DFA657F63E2E6102226902D4897FD892C10E79DC3217407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 d3c883e824e1dfd907406ed310131a8e7301675587496a8543fd2b72385d9791
MD5 779931daa876d30123f32a866f273240
SHA1 545cda48d9f3385e4487965eda334be5d03b627b
SHA512 a7058477be8a735326b7884b913a7b899402a855b61950e66bacdfd656fbb862a26ab31ed975e9ecccc8585a9fa81752b1f2b4233182ffc5853fc5a92d3f6aba
SSDEEP 192:5RshNK8jOkIWV7snv7+qvrPRpNPth9pHsb+WNnuEp21UkB22SkwC6VyIsnAUgE:5RYYwIvV7XtTwx2U422Si6E
TLSH
T11F62A52FA814797BACDBD32DFA657F63E2E6102226902D8897FD891C14E79DC3217407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 f8b6fab951ed2fa6df21a1f71243f6592fa50c4526064a0087eb796baf560360
MD5 9ca0c43162ea1b5036bed4972da09025
SHA1 3b0db2aac16eab73d0c35a275961a846bad9ac93
SHA512 732da7f328c2bea276b38b9f90eadc26b6da6c37238ffcce04fe4a595d13a375ee56d07e14444fd841ecfe07fafad167382dddfc86c1ece8ee4f0fd701ba837e
SSDEEP 192:5RshNK8QUxOkIWV7s0v7+qvrPRpNPth9pHsb+WNnuEp5OyTB22SkwC6VyIsnAUgE:5RYYSZIwV7XtTwxKy122Si6E
TLSH
T1E962B62FA914797BACDBD32DFA657F63E2E5102222902D8897FD892C14E79DC3217407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 fb377604f2eff03c4677a647c8c94a33496bb6a03f2ca3b617f73d6d02079dca
MD5 c879080c9ba72d4bd02fa06950d0d4da
SHA1 51eeebb8e8d90b5930e9e2aca5c65a6a5e11bd40
SHA512 b3049b1fedf12cf8e69c46588916533fc10ffee805ef2066c1e5abada55bbd8178d890f43ff726bdcb387c44a2df1d11d1ba3d3d6ee4537f088d19751b4a55f8
SSDEEP 192:eLE4K6Xn7KxkXqK4I40pUZNCgVLHrKHfFKslEiTtXzKD/ML+ErUkKNxn50i4S+h:uEjEn7KxkXqKf/pUZNCgVLH2HfgslLth
TLSH
T11532C727A48E9E7F4FD8E51CDC477F4B6CB502567378082896FB9C0403AA78A214A1A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 61KB
SHA256 749f1229abc2d007ae7d865049f6c999d4c66a8396d20d574af11e7a15764b28
MD5 2e907a18e30ef2505328a66aec3d82ca
SHA1 7cdcdeb6e52bcb1fc781ae91b8ada58fc72e32eb
SHA512 6e8adc6a6832b1cc292787744c2167546c3d16dac4a075cb672aed4246cc9cd8574fd858ab6b23b46e04f29310dff09212fb3192e615c76bafdb5ef341d5717e
SSDEEP 1536:47EdYG36vNyw5JOToQ9ravFPuwdFLrLPqeaQP4GjD63A8t:vml5JpQR4/FLrLPqeaQPPqvt
TLSH
T1FA53F122C9FF6EB30EAE27547126500ADDB420575524BC288BF92D5C889F1DE52C372F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 3300b1062bc4973c27f5b32ecf5ff6dc662f22bc55e485ecc0d3669047516da1
MD5 bde00fdd245b9f8a52373074c73d64fd
SHA1 8a74f972c3ce95438a43eb6574f7d269f7034d4c
SHA512 94b7d99298c30070f22cc2e923b6ddf38f8d569d2876fd44163c8a8573b0c8a3ddae1d7f6540cbf6b9f8b708035a6a38924a758b0be28e95da0193274cf98a52
SSDEEP 96:TVbJ0d+Ar2aetJRxW2rgj0+f+U+/EHezLSl8h4otop5/3DH6B6cGyvTNchCzb3FN:TVt0Nr7OJRPrL9/E6iU2rKoIcMnGfRyP
TLSH
T169C128B1687DACB35DF39606B1073647CEA4707B6960AE50DAEA2B0C00D71EC1787A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 6KB
SHA256 7b5ef863588ef026068577cd61eed70b8f014a1c9b3e9d02211afbfdbb892dfc
MD5 aefaedd2f4417c2a810424355b6ed8a3
SHA1 9f8407f4386ed4bc732402a5beae0812d3064622
SHA512 cfb5eb32ee15e8fbb9dd58168117027e4456d10b2ea70c1cbf88450699ff6ffbfaf80c0e28f03aca14a24631d8063f4de02ad739cee2bb469ad33d81dbef846f
SSDEEP 192:TVtoNr7OJRPrL9/E6iU2q53vRcgfDyIouHVxn:BtU7Ixd/E6x3Sg2Iou1xn
TLSH
T1C2D1F971A46E6CBB4DF3A546B1033E47CDA4716B6928BE54EDEE2E0C00974DC1383627
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 6KB
SHA256 3f5f9d7cb0b1e8b70af8fade6355746f5ce8b5b36c62ba465960327df0078236
MD5 6d4ab078a3ef4e7b1aeaaa63fc8ae1b0
SHA1 ceb8388c9f202b631340982ab00937a2f5d49e0b
SHA512 fe7f5f49dc3be05f26175140f183d09437bbabb8bd0c59aeb9a345a84679846802171f7ccfc5d2b96c91b67fa89cca7060f2125bdb08710e83cbe46ea1e6ecd2
SSDEEP 192:TVtoNr7OJRPrL9/E6iU2N5+CcgfDyIouHVxn:BtU7Ixd/E62Mg2Iou1xn
TLSH
T178D1F971A46E6CBB4DF3A546B1033E47CDA4716B6928BE54EDEE2E0C00974DC0383627
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 56d2f7252520b08a8919d1c6c8582e7ec9d067856365108fa08275f1b5045ec5
MD5 58ebbd44946ee73467d394c12c8824ea
SHA1 ccb9c5bf090fdd3e8f396015feedb1ddd7bf93f9
SHA512 f5a0a854fea3770a9f2e253364b883d69388bb3431edf3ef980819425baaee858cb576c4b8f8f1ebce3c63ecf64a7d2ae6349051a505cdd25abb4ce9f8e8c2ee
SSDEEP 96:mC0d+Ar2aetJRxW2rgj0+f+U+/EfezeRDotok5/VDFB6JGyvTNm6zjI+PEhiv4a:mC0Nr7OJRPrL9/EtDUDF79ImgjI+shM
TLSH
T13DA11932A47E5CB749B38549F5563B07CFA4B16B6A21FF44D9DD2B0C10A70DC1382A23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 16b68a201e645628075513a76f0de41374ecb3451556c4cf99427f2080e7ccb1
MD5 4a1f8e6e76dfbd9d6842f8b6683f517a
SHA1 0772df52f400aad4be86241eac1b242e4ed325ed
SHA512 6516e669c871840ae614028ac879bc08179eb2268bbedbd9757f303777f299c8294a89223531260c0491b24e1d68eed1a4f84eca8f48bb2158cf2cbd44b65ba1
SSDEEP 96:TVC0d+Ar2aetJRxW2rgj0+f+U+/EHezLSl8h4otop5/3DFB6cGyvTNchCzb3FQfi:TVC0Nr7OJRPrL9/E6iU2r7oIcMnGfRyP
TLSH
T1CAC129B1687DACB35DF39656B1033647CEA8717B6960AE54DAEA2B0C00D70EC13C7627
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 6KB
SHA256 8c6064e3f6ff9e3e26ca5b889168d44fc62644fefac0a876c8e84e0cfedd36bb
MD5 d5eb83e2844c9717f67c045609513c74
SHA1 aa189a13d32d08b45422792bfb34d69dbbee675d
SHA512 4481375d77702fa89b4377e7fe7e57fafce7bab3e45d534edb0a7d225bb9de7989c51304cfe2b341b9e5bcedcd20839385614b10077f69b2f49ff900da59faf9
SSDEEP 192:TVtoNr7OJRPrL9/E6iU2c5+JcgfDyIouHVxn:BtU7Ixd/E6HHg2Iou1xn
TLSH
T181D1F971A46E6CB74DF3A546B1033D47CDA4716B6928BE54EDED2E0C00974DC1383627
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 6KB
SHA256 0bbb0f5a413a79d1c590905b99cd74b9602910cc09b07f105f555bd60b5d1f10
MD5 f73a8fb3d5f0dd9bdaf67cf059a87078
SHA1 af81cd367c1ded28113dee77ae1db90d38ddd957
SHA512 c5e551cb0e4fa76614794f16037bed7a01c1fbd46add18d0388b2f1c8b1dbc7b757bc244dd85d9fef69476079e8d088f23f213e22de7b67949f28a3b5bb4dbf4
SSDEEP 192:TVtoNr7OJRPrL9/E6iU2r5oIcgfDyIouHVxn:BtU7Ixd/E6QYg2Iou1xn
TLSH
T124D1F971A46E6CBB4DF3A546B1033E47CDA4716B6928BE54EEEE2E0C00975DC0383627
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 603B
SHA256 b346273b0f3e13afaa9f07d97248343c45a667a5e097d1198a449a4de187aebb
MD5 2510ff22aab74c2ba735738716005a2f
SHA1 306d676ad05de19254b82e221f183ff918e4902b
SHA512 b06c9137817610963efc14c36895253ac8c2eb5af5c9c5e3bdfa59fef8050d9827e4d250b571051c52d7141b4d69702cb0e23a14a114c3e163b1b5bdb2911f1f
TLSH
T1BEF0DC53D3E25125E023023D88A61BD27A33DB596FC7262B4540AE6C3E3B3002F494BC
MD5 SHA1 SHA512 TLSH

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 599B
SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
MD5 658ab8c32d4cc5deb36ac5f63da4658b
SHA1 30c12cd871ff0c2c4098d794e9ae4f2540586813
SHA512 a73030c008ef3c2e274f11c90bfe79fa8ae402f76801c710bed8cc1ab1218a84858ea566b772be4bade8ef639a019c57d297028df15b64b3753482cf0f3c8f85
TLSH
T12AF05C83EB6A1B72C456123DC8EE56E47B31D1846EC11367A2107B1D3C2B7192D174BD
MD5 SHA1 SHA512 TLSH

Submit Download

default.exc

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.exc
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

memory/3216-1240-0x0000018B83BD0000-0x0000018B83BF0000-memory.dmp

Download

memory/3216-1230-0x0000018B80150000-0x0000018B80250000-memory.dmp

Download

memory/3216-1231-0x0000018B80150000-0x0000018B80250000-memory.dmp

Download

memory/3216-1229-0x0000018B80150000-0x0000018B80250000-memory.dmp

Download

memory/3216-1261-0x0000018B83D50000-0x0000018B83D70000-memory.dmp

Download

memory/3216-1275-0x0000018B941E0000-0x0000018B94200000-memory.dmp

Download

memory/3216-1242-0x0000018B93E60000-0x0000018B93F60000-memory.dmp

Download

memory/3388-189-0x00000256A9000000-0x00000256A90C3000-memory.dmp

Download

memory/3388-402-0x00000256A9000000-0x00000256A90C3000-memory.dmp

Download