56109e60624d826e4a80d648208eed7c392f932bdf7d75adf3e9d99c65293a94

Resubmissions

10/09/2026, 18:27

260910-w33yysthjf3

10/09/2026, 16:33

260910-t2kd4svvby4

10/09/2026, 16:01

260910-tgfkest1ev8

Analysis

user interaction
yes
max time kernel
1799s
max time network
1800s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 16:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Applerefund.html
Size 3KB
Sample260910-tgfkest1ev
SHA256 56109e60624d826e4a80d648208eed7c392f932bdf7d75adf3e9d99c65293a94
MD5 9f588bdb23e3eaa8ad9e514bf4783f11
SHA1 7b59758f2ceb0fee1d149a8dcef05744342ce3aa
SHA512 8b7540bf3df9d4b510586c76b4f86fcb8fa38539e5f363584c41cfd1cc03d96d9e592eaed158c102279ea851bbdc6c021f616e413fcfa0ac9e5be33b27821d39
TLSH
T19C71725DDAC0050BA07761B4AFB68395EF654D93C30246F479AC32678FB4828D1BBACC
MD5 SHA1 SHA512 TLSH

Score

8^/10

adware discovery persistence ransomware spyware

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	explorer.exe
File opened for modification	C:\Users\Public\desktop.ini	explorer.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	explorer.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	explorer.exe
File opened (read-only)	\??\E:	explorer.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4576	chrome.exe

Checks SCSI registry key(s) 3 TTPs 62 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	explorer.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Internet Explorer\Main	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134335297075622385"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\NodeSlot = "2"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{43FED747-B357-468E-AE70-EE0CB0F46508}\GroupByKey:FMTID = "{30C8EEF4-A832-41E2-AB32-E3C3CA28FD29}"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{43FED747-B357-468E-AE70-EE0CB0F46508}\Rev = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{43FED747-B357-468E-AE70-EE0CB0F46508}\Mode = "6"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{43FED747-B357-468E-AE70-EE0CB0F46508}\LogicalViewMode = "2"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\WFlags = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3611646547-550105268-947503007-1000\{07DD5C7B-DDE9-4482-9ABA-E87E82B5C268}	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{43FED747-B357-468E-AE70-EE0CB0F46508}\GroupByKey:PID = "2"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2 = 3a001f0005398e082303024b98265d99428e115f260001002600efbe11000000db6bc4a8ad0fdd0190f411d8b50fdd0190f411d8b50fdd0114000000	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\KnownFolderDerivedFolderType = "{885A186E-A440-4ADA-812B-DB871B942259}"	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{24ad3ad4-a569-4530-98e1-ab02f9417aa8}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchHost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{43FED747-B357-468E-AE70-EE0CB0F46508}\Sort = 0000000000000000000000000000000003000000f4eec83032a8e241ab32e3c3ca28fd29030000000100000030f125b7ef471a10a5f102608c9eebac10000000ffffffff30f125b7ef471a10a5f102608c9eebac0a00000001000000	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs	SearchHost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 14001f400e3174f8b7b6dc47bc84b9e6b38f59030000	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{43FED747-B357-468E-AE70-EE0CB0F46508}\GroupView = "4294967295"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3dfdf296-dbec-4fb4-81d1-6a3438bcf4de}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{43FED747-B357-468E-AE70-EE0CB0F46508}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "1"	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{43FED747-B357-468E-AE70-EE0CB0F46508}\Vid = "{65F125E5-7BE1-4810-BA9D-D271C8432CE3}"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\WorkFolders	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs	SearchHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3611646547-550105268-947503007-1000\{C32B4C55-8BC3-4BCF-B4C9-B9BC60D9F618}	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{f86fa3ab-70d2-4fc7-9c99-fcbf05467f3a}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{43FED747-B357-468E-AE70-EE0CB0F46508}\FFlags = "1092616193"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{43FED747-B357-468E-AE70-EE0CB0F46508}\FFlags = "1092616209"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 020000000100000000000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\NotificationData	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\MuiCache	SearchHost.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2524	explorer.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2968	chrome.exe
2968	chrome.exe
2968	chrome.exe
2968	chrome.exe
5312	chrome.exe
5312	chrome.exe
2524	explorer.exe
2524	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2524	explorer.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 20 IoCs

pid	Process
2968	chrome.exe
2968	chrome.exe
2968	chrome.exe
2968	chrome.exe
2968	chrome.exe
2968	chrome.exe
2968	chrome.exe
2968	chrome.exe
2968	chrome.exe
2968	chrome.exe
2968	chrome.exe
2968	chrome.exe
2968	chrome.exe
2968	chrome.exe
2968	chrome.exe
2968	chrome.exe
2968	chrome.exe
2968	chrome.exe
2968	chrome.exe
2968	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2968	chrome.exe
Token: SeCreatePagefilePrivilege	2968	chrome.exe
Token: SeShutdownPrivilege	2968	chrome.exe
Token: SeCreatePagefilePrivilege	2968	chrome.exe
Token: SeShutdownPrivilege	2968	chrome.exe
Token: SeCreatePagefilePrivilege	2968	chrome.exe
Token: SeShutdownPrivilege	2968	chrome.exe
Token: SeCreatePagefilePrivilege	2968	chrome.exe
Token: SeShutdownPrivilege	2968	chrome.exe
Token: SeCreatePagefilePrivilege	2968	chrome.exe
Token: SeShutdownPrivilege	2968	chrome.exe
Token: SeCreatePagefilePrivilege	2968	chrome.exe
Token: SeShutdownPrivilege	2968	chrome.exe
Token: SeCreatePagefilePrivilege	2968	chrome.exe
Token: SeShutdownPrivilege	2968	chrome.exe
Token: SeCreatePagefilePrivilege	2968	chrome.exe
Token: SeShutdownPrivilege	2968	chrome.exe
Token: SeCreatePagefilePrivilege	2968	chrome.exe
Token: SeShutdownPrivilege	2968	chrome.exe
Token: SeCreatePagefilePrivilege	2968	chrome.exe
Token: SeShutdownPrivilege	2968	chrome.exe
Token: SeCreatePagefilePrivilege	2968	chrome.exe
Token: SeShutdownPrivilege	2968	chrome.exe
Token: SeCreatePagefilePrivilege	2968	chrome.exe
Token: SeShutdownPrivilege	2968	chrome.exe
Token: SeCreatePagefilePrivilege	2968	chrome.exe
Token: SeShutdownPrivilege	2968	chrome.exe
Token: SeCreatePagefilePrivilege	2968	chrome.exe
Token: SeShutdownPrivilege	2968	chrome.exe
Token: SeCreatePagefilePrivilege	2968	chrome.exe
Token: SeShutdownPrivilege	2968	chrome.exe
Token: SeCreatePagefilePrivilege	2968	chrome.exe
Token: SeShutdownPrivilege	2968	chrome.exe
Token: SeCreatePagefilePrivilege	2968	chrome.exe
Token: SeShutdownPrivilege	2968	chrome.exe
Token: SeCreatePagefilePrivilege	2968	chrome.exe
Token: SeShutdownPrivilege	2968	chrome.exe
Token: SeCreatePagefilePrivilege	2968	chrome.exe
Token: SeShutdownPrivilege	2968	chrome.exe
Token: SeCreatePagefilePrivilege	2968	chrome.exe
Token: SeShutdownPrivilege	2968	chrome.exe
Token: SeCreatePagefilePrivilege	2968	chrome.exe
Token: SeShutdownPrivilege	2968	chrome.exe
Token: SeCreatePagefilePrivilege	2968	chrome.exe
Token: SeShutdownPrivilege	2968	chrome.exe
Token: SeCreatePagefilePrivilege	2968	chrome.exe
Token: SeShutdownPrivilege	2968	chrome.exe
Token: SeCreatePagefilePrivilege	2968	chrome.exe
Token: SeShutdownPrivilege	2968	chrome.exe
Token: SeCreatePagefilePrivilege	2968	chrome.exe
Token: SeShutdownPrivilege	2968	chrome.exe
Token: SeCreatePagefilePrivilege	2968	chrome.exe
Token: SeShutdownPrivilege	2968	chrome.exe
Token: SeCreatePagefilePrivilege	2968	chrome.exe
Token: SeShutdownPrivilege	2968	chrome.exe
Token: SeCreatePagefilePrivilege	2968	chrome.exe
Token: SeShutdownPrivilege	2968	chrome.exe
Token: SeCreatePagefilePrivilege	2968	chrome.exe
Token: SeShutdownPrivilege	2968	chrome.exe
Token: SeCreatePagefilePrivilege	2968	chrome.exe
Token: SeShutdownPrivilege	2968	chrome.exe
Token: SeCreatePagefilePrivilege	2968	chrome.exe
Token: SeShutdownPrivilege	2968	chrome.exe
Token: SeCreatePagefilePrivilege	2968	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2968	chrome.exe
2968	chrome.exe
2968	chrome.exe
2968	chrome.exe
2968	chrome.exe
2968	chrome.exe
2968	chrome.exe
2968	chrome.exe
2968	chrome.exe
2968	chrome.exe
2968	chrome.exe
2968	chrome.exe
2968	chrome.exe
2968	chrome.exe
2968	chrome.exe
2968	chrome.exe
2968	chrome.exe
2968	chrome.exe
2968	chrome.exe
2968	chrome.exe
2968	chrome.exe
2968	chrome.exe
2968	chrome.exe
2968	chrome.exe
2968	chrome.exe
2968	chrome.exe
2968	chrome.exe
2968	chrome.exe
2968	chrome.exe
2968	chrome.exe
2968	chrome.exe
2968	chrome.exe
2968	chrome.exe
2968	chrome.exe
4540	sihost.exe
2524	explorer.exe
2524	explorer.exe
2524	explorer.exe
2524	explorer.exe
2524	explorer.exe
2524	explorer.exe
2524	explorer.exe
2524	explorer.exe
2524	explorer.exe
2524	explorer.exe
2524	explorer.exe
2524	explorer.exe
2524	explorer.exe
2524	explorer.exe
2524	explorer.exe
2524	explorer.exe
2524	explorer.exe
2524	explorer.exe
2524	explorer.exe
2524	explorer.exe
2524	explorer.exe
2524	explorer.exe
2524	explorer.exe
2524	explorer.exe
2524	explorer.exe
2524	explorer.exe
2524	explorer.exe
2524	explorer.exe
2524	explorer.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2968	chrome.exe
2968	chrome.exe
2968	chrome.exe
2968	chrome.exe
2968	chrome.exe
2968	chrome.exe
2968	chrome.exe
2968	chrome.exe
2968	chrome.exe
2968	chrome.exe
2968	chrome.exe
2968	chrome.exe
2968	chrome.exe
2968	chrome.exe
2968	chrome.exe
2968	chrome.exe
2524	explorer.exe
2524	explorer.exe
2524	explorer.exe
2524	explorer.exe
2524	explorer.exe
2524	explorer.exe
2524	explorer.exe
2524	explorer.exe
2524	explorer.exe
2524	explorer.exe
2524	explorer.exe
2524	explorer.exe
2524	explorer.exe
2524	explorer.exe
2524	explorer.exe
2524	explorer.exe
2524	explorer.exe
2524	explorer.exe
2524	explorer.exe
2524	explorer.exe
2524	explorer.exe
2524	explorer.exe
2524	explorer.exe
2524	explorer.exe
2524	explorer.exe
2524	explorer.exe
2524	explorer.exe
2524	explorer.exe
2524	explorer.exe
2524	explorer.exe
2524	explorer.exe
2524	explorer.exe
2524	explorer.exe
2524	explorer.exe
2524	explorer.exe
2524	explorer.exe
2524	explorer.exe
2524	explorer.exe
2524	explorer.exe
2524	explorer.exe
2524	explorer.exe
2524	explorer.exe
2524	explorer.exe
2524	explorer.exe
2524	explorer.exe
2524	explorer.exe
2524	explorer.exe
2524	explorer.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2356	StartMenuExperienceHost.exe
4372	SearchHost.exe
2524	explorer.exe

Suspicious use of WriteProcessMemory 57 IoCs

description	pid	Process	procid_target
PID 2968 wrote to memory of 1344	2968	chrome.exe	89
PID 2968 wrote to memory of 3296	2968	chrome.exe	90
PID 2968 wrote to memory of 3296	2968	chrome.exe	90
PID 2968 wrote to memory of 4576	2968	chrome.exe	91
PID 2968 wrote to memory of 3824	2968	chrome.exe	92
PID 2968 wrote to memory of 3824	2968	chrome.exe	92
PID 2968 wrote to memory of 360	2968	chrome.exe	94
PID 2968 wrote to memory of 360	2968	chrome.exe	94
PID 2968 wrote to memory of 260	2968	chrome.exe	95
PID 2968 wrote to memory of 260	2968	chrome.exe	95
PID 2968 wrote to memory of 1952	2968	chrome.exe	96
PID 2968 wrote to memory of 4412	2968	chrome.exe	98
PID 2968 wrote to memory of 4572	2968	chrome.exe	99
PID 2968 wrote to memory of 4412	2968	chrome.exe	98
PID 2968 wrote to memory of 4572	2968	chrome.exe	99
PID 2968 wrote to memory of 688	2968	chrome.exe	102
PID 2968 wrote to memory of 688	2968	chrome.exe	102
PID 2968 wrote to memory of 4428	2968	chrome.exe	103
PID 2968 wrote to memory of 4428	2968	chrome.exe	103
PID 2968 wrote to memory of 1644	2968	chrome.exe	104
PID 2968 wrote to memory of 1644	2968	chrome.exe	104
PID 2968 wrote to memory of 1776	2968	chrome.exe	105
PID 2968 wrote to memory of 1776	2968	chrome.exe	105
PID 2968 wrote to memory of 1476	2968	chrome.exe	106
PID 2968 wrote to memory of 1476	2968	chrome.exe	106
PID 2968 wrote to memory of 1260	2968	chrome.exe	107
PID 2968 wrote to memory of 1260	2968	chrome.exe	107
PID 2968 wrote to memory of 1800	2968	chrome.exe	108
PID 2968 wrote to memory of 1800	2968	chrome.exe	108
PID 2968 wrote to memory of 4844	2968	chrome.exe	109
PID 2968 wrote to memory of 4844	2968	chrome.exe	109
PID 2968 wrote to memory of 1840	2968	chrome.exe	111
PID 2968 wrote to memory of 2456	2968	chrome.exe	112
PID 2968 wrote to memory of 4520	2968	chrome.exe	113
PID 2968 wrote to memory of 5312	2968	chrome.exe	114
PID 2968 wrote to memory of 2516	2968	chrome.exe	115
PID 2968 wrote to memory of 2516	2968	chrome.exe	115
PID 2968 wrote to memory of 2472	2968	chrome.exe	116
PID 2968 wrote to memory of 2472	2968	chrome.exe	116
PID 2968 wrote to memory of 4324	2968	chrome.exe	117
PID 2968 wrote to memory of 4324	2968	chrome.exe	117
PID 2968 wrote to memory of 492	2968	chrome.exe	118
PID 2968 wrote to memory of 492	2968	chrome.exe	118
PID 2968 wrote to memory of 4060	2968	chrome.exe	119
PID 2968 wrote to memory of 4060	2968	chrome.exe	119
PID 4540 wrote to memory of 2524	4540	sihost.exe	125
PID 2968 wrote to memory of 5412	2968	chrome.exe	136
PID 2968 wrote to memory of 5412	2968	chrome.exe	136
PID 2968 wrote to memory of 5620	2968	chrome.exe	137
PID 2968 wrote to memory of 2320	2968	chrome.exe	138
PID 2968 wrote to memory of 2320	2968	chrome.exe	138
PID 2968 wrote to memory of 4560	2968	chrome.exe	141
PID 2968 wrote to memory of 4560	2968	chrome.exe	141
PID 2968 wrote to memory of 5420	2968	chrome.exe	146
PID 2968 wrote to memory of 5420	2968	chrome.exe	146
PID 2968 wrote to memory of 3256	2968	chrome.exe	147
PID 2968 wrote to memory of 3256	2968	chrome.exe	147

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\Applerefund.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0x104,0x138,0x7ffc27d7c728,0x7ffc27d7c734,0x7ffc27d7c740
  2⤵
  PID:1344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1604,i,1754981512776742113,685838145261610202,262144 --field-trial-handle=1888,i,16604993510502604326,6879530140119303035,262144 --variations-seed-version --mojo-platform-channel-handle=1884 /prefetch:2
  2⤵
  PID:3296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2128,i,14314407367578620191,14413334061934750552,524288 --field-trial-handle=1888,i,16604993510502604326,6879530140119303035,262144 --variations-seed-version --mojo-platform-channel-handle=2188 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4576
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2308,i,3190795600632391718,1512468678571207632,524288 --field-trial-handle=1888,i,16604993510502604326,6879530140119303035,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:13
  2⤵
  PID:3824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3192,i,10344819728525214050,10218382569756573317,2097152 --field-trial-handle=1888,i,16604993510502604326,6879530140119303035,262144 --variations-seed-version --mojo-platform-channel-handle=3204 /prefetch:1
  2⤵
  PID:360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3212,i,11561859361954153301,1271614169351626847,2097152 --field-trial-handle=1888,i,16604993510502604326,6879530140119303035,262144 --variations-seed-version --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5208,i,1764737860119807883,7686452137685295042,524288 --field-trial-handle=1888,i,16604993510502604326,6879530140119303035,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:14
  2⤵
  PID:1952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=5304,i,13803092915969475893,16187081092049081804,2097152 --field-trial-handle=1888,i,16604993510502604326,6879530140119303035,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:1
  2⤵
  PID:4412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5328,i,9134302771923093934,17898783380264847804,2097152 --field-trial-handle=1888,i,16604993510502604326,6879530140119303035,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:1
  2⤵
  PID:4572
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5796,i,16206099878741996788,1420596082339723220,2097152 --field-trial-handle=1888,i,16604993510502604326,6879530140119303035,262144 --variations-seed-version --mojo-platform-channel-handle=5576 /prefetch:1
  2⤵
  PID:688
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5788,i,10681472322341643751,12347109905059379549,2097152 --field-trial-handle=1888,i,16604993510502604326,6879530140119303035,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:1
  2⤵
  PID:4428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5888,i,2775766462470947264,10666272854000179730,2097152 --field-trial-handle=1888,i,16604993510502604326,6879530140119303035,262144 --variations-seed-version --mojo-platform-channel-handle=5748 /prefetch:1
  2⤵
  PID:1644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5768,i,4512883316323758326,9500751711506525982,2097152 --field-trial-handle=1888,i,16604993510502604326,6879530140119303035,262144 --variations-seed-version --mojo-platform-channel-handle=5956 /prefetch:1
  2⤵
  PID:1776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5860,i,17251015933606583328,2693598710931761844,2097152 --field-trial-handle=1888,i,16604993510502604326,6879530140119303035,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:1
  2⤵
  PID:1476
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5844,i,12144644221612643858,7425255843270371376,2097152 --field-trial-handle=1888,i,16604993510502604326,6879530140119303035,262144 --variations-seed-version --mojo-platform-channel-handle=5764 /prefetch:1
  2⤵
  PID:1260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5260,i,1175638020081628860,7519449792170374829,2097152 --field-trial-handle=1888,i,16604993510502604326,6879530140119303035,262144 --variations-seed-version --mojo-platform-channel-handle=3368 /prefetch:1
  2⤵
  PID:1800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=3884,i,9423815014460676139,5782530245635751509,2097152 --field-trial-handle=1888,i,16604993510502604326,6879530140119303035,262144 --variations-seed-version --mojo-platform-channel-handle=5384 /prefetch:1
  2⤵
  PID:4844
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5944,i,3883509582536306562,773498671287633078,524288 --field-trial-handle=1888,i,16604993510502604326,6879530140119303035,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:14
  2⤵
  PID:1840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5840,i,6858112065453509571,18418910910260175339,524288 --field-trial-handle=1888,i,16604993510502604326,6879530140119303035,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:14
  2⤵
  PID:2456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5524,i,8028647068474272850,11059008585631872765,524288 --field-trial-handle=1888,i,16604993510502604326,6879530140119303035,262144 --variations-seed-version --mojo-platform-channel-handle=5604 /prefetch:14
  2⤵
  PID:4520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5724,i,12474828081698391223,2880566965945230121,262144 --field-trial-handle=1888,i,16604993510502604326,6879530140119303035,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=1124,i,1079433781650943539,18079527195772689767,524288 --field-trial-handle=1888,i,16604993510502604326,6879530140119303035,262144 --variations-seed-version --mojo-platform-channel-handle=1520 /prefetch:14
  2⤵
  PID:2516
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=5560,i,8309171752350310849,16759646539098658101,2097152 --field-trial-handle=1888,i,16604993510502604326,6879530140119303035,262144 --variations-seed-version --mojo-platform-channel-handle=5872 /prefetch:1
  2⤵
  PID:2472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=3228,i,13789569863483394440,1275749090017407967,2097152 --field-trial-handle=1888,i,16604993510502604326,6879530140119303035,262144 --variations-seed-version --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:4324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=5816,i,1227151099827750450,16032997620915962852,2097152 --field-trial-handle=1888,i,16604993510502604326,6879530140119303035,262144 --variations-seed-version --mojo-platform-channel-handle=3168 /prefetch:1
  2⤵
  PID:492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=5224,i,6319479857459107000,14939072207474831659,2097152 --field-trial-handle=1888,i,16604993510502604326,6879530140119303035,262144 --variations-seed-version --mojo-platform-channel-handle=6172 /prefetch:1
  2⤵
  PID:4060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=5904,i,4258428829717683449,17509048342649861945,2097152 --field-trial-handle=1888,i,16604993510502604326,6879530140119303035,262144 --variations-seed-version --mojo-platform-channel-handle=5564 /prefetch:1
  2⤵
  PID:5412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5208,i,3346174649418724851,3959210054378539184,524288 --field-trial-handle=1888,i,16604993510502604326,6879530140119303035,262144 --variations-seed-version --mojo-platform-channel-handle=3352 /prefetch:14
  2⤵
  - Modifies registry class
  PID:5620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=5228,i,9790916090364871910,13000961228738048441,524288 --field-trial-handle=1888,i,16604993510502604326,6879530140119303035,262144 --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:12
  2⤵
  PID:2320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --metrics-shmem-handle=5772,i,12761530227764931445,12118266815924731339,2097152 --field-trial-handle=1888,i,16604993510502604326,6879530140119303035,262144 --variations-seed-version --mojo-platform-channel-handle=6416 /prefetch:1
  2⤵
  PID:4560
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --metrics-shmem-handle=6644,i,1027153585356596962,18190853251204682868,2097152 --field-trial-handle=1888,i,16604993510502604326,6879530140119303035,262144 --variations-seed-version --mojo-platform-channel-handle=6636 /prefetch:1
  2⤵
  PID:5420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --metrics-shmem-handle=6752,i,7038688774261497988,15768404374717606357,2097152 --field-trial-handle=1888,i,16604993510502604326,6879530140119303035,262144 --variations-seed-version --mojo-platform-channel-handle=6772 /prefetch:1
  2⤵
  PID:3256

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4640

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4668

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:5604

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4540
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Drops desktop.ini file(s)
  - Enumerates connected drives
  - Checks SCSI registry key(s)
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:2524

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4372

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Suspicious use of SetWindowsHookEx
PID:2356

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1964

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:4516

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1244

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2224

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000018

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000018
Size 346KB
SHA256 06fb30c34e3d7cb64ec821dd7d1eee69613b4a84c3841c081dee7143c151555e
MD5 e4bc0d7ecc0b43b6b8bd71ed0d8e894a
SHA1 27776f4cfd2ff01e98221769cb4aa554a2670e6a
SHA512 4c0956fb89b264ceb8dcc20a8cf905a4ae784195e78c306d2c0577d2e4c0548b6058ecda0516a089dc97570864728ab60503bffd804af5d0934e5f9c8b1fa475
SSDEEP 6144:ZPNyy2q1x/xjj1YO1RKSXVSFAsamiA6r/dsaRDDQ9fSoA9pT1c/i:qy2qhGORKNARmiRRDkJIpv
TLSH
T1EB7423DE4C0A0C9960EAE1034BDF477B3A4A44E7E0C5EC52987C1DD26D9F2627CED688
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 5733ab42b506ed1f0b02859843e7a28d763efa85ec4280a402db0cde23b92628
MD5 e2add6bd89bed8587fa51777ee9dda72
SHA1 189668449fd69ed3bac0fd7f95f7793190ac0d6a
SHA512 62b4c1d17357b9808e8feadc4dda7a716a1160363462fbee3324a630226a4ce927fd921f6fb0d3dcabdb0e9623c889155867f5987c1db9f75fd499a315d3bb81
TLSH
T13A21ADC639C2816DF7C0837244F83C52B6640638864B3A7A44B0D87C78977BBB357658
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 192B
SHA256 92a831a4c658d3ab86fb6e6969d654590c8db0618d4050a928c6ac1368b5719f
MD5 31f976484ba952a868f3c9d99e320ef6
SHA1 fe4757d0cdd414a387a5542babec1256da926543
SHA512 2a7754221e6775702f16fab47b60b363824e551689955555d8ba23a40f76cae484e7db649f04da7b9df5d6981d21df3784e6537b752c6b6921c2764ace0fe552
TLSH
T148C08CE836E0002AEF51203511C17C42B401273B0220074FCA40E1DC9A0BBAAA101011
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 9406ff78a16b07401fd7b8e175e54e2d21bb063381467113c4d9956f536804eb
MD5 8f9d11af0094e1fdf429e6ca25aab0a5
SHA1 6804bace5b60e9fb58e464d464d47590952048d3
SHA512 ea55d1a7b05458742846e657b17ee562ca1c90eefbf42508c95c4ad274ef4c05baa020f6999473be9de82cf2f20a16b37c39e69726a8d3f76688714b35c299c8
TLSH
T1E221CEC639D1926DF3C0833241F83C5175A40238458A3E7E44F0D47C2897B3BB317654
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 264B
SHA256 175061464bca3044ec61c87d7b08d6242c8163908f8cf90fb8fe9f0ccb90a601
MD5 2b86311845866f282b04113224c64b93
SHA1 26431d58d62d9554cbb016fd7c6d465c0f1f1d3c
SHA512 015a943e097a0549585dbf90b25d185907271cd5ba359ede1ac33b483daa34a343ec4931423aca3ca9cbb40c7f4f7e30d46b164894929118431f227c16103dfb
TLSH
T1BBD022E939C0906AFF90003810D07CA1F0F12F3B03A24F4B88E0D08CAC47BA8A002080
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 faa3cd3d930f8e5acc0193e69e4de0429f83e09131a85cb830c806b995672cc9
MD5 408d7a57e4c6a4720ef845eb0d58a672
SHA1 f478a830909e72642a26ad78bf85b0d1d4d00e13
SHA512 d4a2340c36b77b4194c4beeabcf9d0779419f9e5edc10109b322994566ae88fa1cf9b8160f4574bff45dd68509c6eb6273cd901234430df67f5d356f264e5d92
TLSH
T1E551A9F797B48A7D891196F4EA15AE1FCE6D0624431C7C7188D4AE1B83E39B2D20079F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 9426f7c369f7dea9409e0f95c22741b9c65cea7555b32f68d601c7f600d49781
MD5 08f7ab098d2dfd6998694dd1be216b7a
SHA1 a7e1548d0963f6298797c4e25b65032842b74f37
SHA512 9df5e6175d81f23ff45d0b22e8fd9afd4a3067cd4d743eaaafdcc5a999af20337c4faeaab5c602273da0e191d57207599ed39d531c3a7bb31614b4a31594b64f
SSDEEP 192:D0uFNAxBY9+2UHaI5EdA1pw9N4usC0abzbF6wA/x:D0uFNAxBY9+2UHaI5EdA1pw9N4usC0aC
TLSH
T1EAF1ACF7C3E8862DC91156F49B15AF1FCE290A28432C3C66C8D8AF5B93E2871D21575E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 446021bd19416c142dd125b46f2a3a3878bf1ade2c4bff51d290330a62d80dfb
MD5 67c94d1a218515f0bb05600af995df1e
SHA1 301ca2900129522a8a2d8876ecbcc291a411f87d
SHA512 9643d98f6d2595998f4c6a0ff8ac486977aac763d119357ebc72dbe2c8f8c7f529cbfd831d36e4cf2af62fbce38d3fc6f0e9bdf18c76566fff272c7dc3cc37d3
SSDEEP 192:D0uFNlWGtHHlJJaI5EdA1pw2PqKuZaNcF6zA/C4W:D0uFNlWGtHHlJJaI5EdA1pw2PqKuZaNH
TLSH
T193D1BBF783E9C62D890196F4D715AF1FCE290624432C3C76C8D4AE1B93E2572D21575E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 b76f602ecb93179eabebdbaee4e057c6092226f62a4378bc0d09a05fa904b07f
MD5 a7edc2ef83f2456de927f11b12ed35e3
SHA1 6bf5753790334fa965c1c7f75347cc103ed2f6de
SHA512 3f4c2ece2c6a05ba76bac6c643c101794e6d9d809905cf828b572aaa56dc5eca9eaa0a7aaa08652d25ee0670c71f7148e3e2863b16985cea196e9cc4633c681f
TLSH
T15481ADF783E4CA2D891156F4EB15AF1FCE2D0924531C3C66C8D4AE5B93E2972D21178E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 f28116c7c12ace1ea253459e0a9cba72139b964533ebaa5b97f8e0ce342a1210
MD5 956891b7575918346958439d16a2e8e3
SHA1 21424a9e18dff6786d9613a343618cc66b575a8b
SHA512 0435be2db576fe107478e58471af3175e252a3ab8dfd2218af820e82c5b070ca883a9742009e2bbd41b71784ab1a768de34fc699a615758dd2be89b4512ac577
TLSH
T1045198F797F48A6D891192F4EA11AE1FCE6D0624131C7C7588D4AE1B83E29B2D20079F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 aeb1813785983adf606fd09a1bf0444496075697b8fc11a45b1940394bbfa859
MD5 8f2864365c09e645b8dc0c8eacb42ae2
SHA1 ec104874781fb7b6183cca9a62cc38ddae38823b
SHA512 97959584f2e3f6acc72be7cd0a7ce20469a16f793438d616883c58e0cff66ec090b9079236a3e70eaec2c3aa5eedf2e0ede901a36176aa8077e4bbc262474b71
SSDEEP 192:D0uFNAxBY9+2AaI5Ed7V/671PVw9N4usC0Lj4R:D0uFNAxBY9+2AaI5Ed7V/671PVw9N4ur
TLSH
T17FE18AF7C3E8862DC91156F49B15AF1FCE290A28432C3C66C8D8AF5B93E2871D21575E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 9ddcee963d810c742e1db60ad8597c486a4cbf40f53c4eda84942e6e65d3ede5
MD5 3f99335dfc94c00946c694359aaec286
SHA1 c1f5e98306d6e89ea9f350b4321d17fcb2ae9e3f
SHA512 c49fa5b810afbe88440356bdadc109e7dcbf278be7a6791302a3d906b0c2be6481613a6fbfa1a27a9d06dafc1025bb19cdded99cdf6c583fbb96114b2d0a4ef0
TLSH
T16951ACF3D3E4867DC81152F4DB21AE1FCD3D0A24121C3C6289D8AE5B53E2972D21178E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 eda224ac214b13fd427d8f246be2cb3d5a57a0cad042ae4e76c74653b7194435
MD5 778a6ca4190fcfaa43d0083ccbe22e1a
SHA1 4549c03bd639c86d9b918f826447988e16597766
SHA512 88bf321a03f77bf8c2fe95b16c36bb683c31a97027ff1acca5dcb74ac8360bb2e445ba82eb7c27b9d39703fdb29c5b364f0bffdf8bf6b4f109bf97265054172f
TLSH
T192317CA385BF786B512949EB0E057C091ABDA8325251A8F8DF67C37CB0C15F70A2B462
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 a7f5016faa94956bdadbd12166267c97ae21504d0e8113c129a287042ab28af1
MD5 7c71c4bc104a582904340fca0453bb36
SHA1 6da8fc2fb6fdd7dbcae5aa119b68c1256ec7243f
SHA512 eff0d5e9fa2ac6c7a7be02b2503fda6ffdb069fb5a5c5621bf76b668470ff0da0f78b3e37923fe87d8816b12dd5cc6c22e228160503de0d8d3498938ed5e15e4
TLSH
T107217967C1BF7927102989AB0F05BA055EBAE8334150E8F8DF67C37C64865F74B1A493
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 8d64a77b242f20885bb9af9fc8221698bb307b8ba84f2d553f901ed5c6b3a9d4
MD5 1606fc300189b50580d3961e79359616
SHA1 b9473eac9f2c73447cc03fa8912ff50f26b4eeb7
SHA512 62c48c9f9a046ae56c4440d396fc14ddf955c9fbe5f997b6af3297a10ac65e85a1cf1b790dd49304d95fb39f4408611300d35d670dbfb0e1081c079a3a6acccc
SSDEEP 192:cRQk7tpv7+TAPRp2cl9pHsb+WNnO00JBe22jaZ/GF7VyIsnAUge:cRQkxp3XDTwJ0L2jaZ/c9e
TLSH
T13142D73EAA14693B6DDFD219F9667B93E6F5102232902E80E7FC892C15E79CC2317417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 53af75b978d2430011e61f00709c1c34e702278802b4743b13544f41b2b5bf69
MD5 cb8d83f162831f2c96cdebb86740da95
SHA1 62e4ec1ca7c5cccb1f012fdcb825c58cbc9a6e80
SHA512 b0a890fd5cb608b4af151b79923947c1a005bfc4811714dbe07ef33e51c48241b0086960c62de2418086cba3416378069d8bf52ce94239377b3cc3a0bd407504
SSDEEP 192:cRQk7tjv7+TUPRpEctj9pHbDHsb+WN+jeK4t9Be22jaZ/GH7VyIsnAUgvy:cRQkxbDXpfrww4tv2jaZ/o9vy
TLSH
T1BA42C62FA910693B6DDBD219F9657B97E2F5102232D02E84EBFC8D2C15E79CC2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 83ec42f2823860d002bd209386d36eb0935fff88d4c0074ddf9d61217a802ab9
MD5 8e66fdc97b5d900010d04aff64c8c571
SHA1 cd5542b5009db4ba65da5f0254fba861c8d7a26e
SHA512 b0275ff7cf798b1bd3750779bb21ec6fc680488cbf35e18c5fe6e9fee6512ccb2c8b01c139931fc9d729b4fed1470479eaa486ef6de954c917cce93e597d2798
SSDEEP 192:cRQk7tEv7+TUPRpEcl9pHsb+WNneK4t9Be22jaZ/GH7VyIsnAUgE:cRQkxgDX5Twr4tv2jaZ/o9E
TLSH
T13B42C62FA910693B6DDBD219F9667B93E6F5103232912E84E7FC892C15E79CC2317017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 a3d3d4a6b9f40677496b267fd902cf509345952c6eedff108d2ad741cccfea49
MD5 fd10027a2ac022d75eb5d41fd26a2bc4
SHA1 e0bda34ecf4d5856d3bbc5f004bb99bd4ee92427
SHA512 17919d614d6013ddc6afd8e477d450a548af984395be197fdcc6e8e86347ffd0ee2a56cc4ff80ac5535295585dec37646b11397429eed99eb947798aea42cc0a
SSDEEP 192:cRQk7tRBv7+TUPRpEcl9pHsb+WNnO00JBe22jaZ/GH7VyIsnAUgE:cRQkxjDX5TwJ0L2jaZ/o9E
TLSH
T1B842D62EA9146A3B6DDFD219F9667B93E6F5103232902E84E7FC892C15E79CC2317017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 aecb7fa621e56c9c5b7c1602c812fcedd40879e818461803f6d330bf65ec5996
MD5 5f18c1af2d1b1ec8ffd89f209add4045
SHA1 c95e518ceca8cfce3c51cc2d2011694f039ba6a3
SHA512 4257b0477ed0df190e796a14988b6e85d35f09b2d2e06121b39043e8b939c4f9d6ab37430ba0a1ab142f7fe43513c51409e0c7f47f087f0df8bf8865bd71fa04
SSDEEP 192:cRQk7uDv7+TUPRpEctj9pHbDHsb+WN+j2ThpBe22jaZ/GH7VyIsnAUgvy:cRQkS7DXpfrw5hr2jaZ/o9vy
TLSH
T12052C52FA910693B6DDBD219F9667B97E2F5102222D02E84EBFC8D2C15E79CC2313017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 708a3fbe79afd3136943abc2fb27d33bc9cc42f0328feb85cc473428bbb02daf
MD5 fda8d26218c8d0c458f548cfc2a491c9
SHA1 2c46bdf585a835e522952343e4567553e55051c0
SHA512 78b6abc4631497f3b93d065172f5e89f0f666e58d1dd67932225ab3663bb5f943a5dcd3356d8940164351734a451ca8cefca001697a8471a8883c3021c423d41
SSDEEP 192:cRQk7tJv7+TUPRpEctj9pHsb+WN+jeK4t9Be22jaZ/GH7VyIsnAUgvy:cRQkxJDXpTww4tv2jaZ/o9vy
TLSH
T1B942C62FA910693B6DDBD219F9657B93E6F5102232D02E84EBFC8D2C15E7ACC2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 16KB
SHA256 a9137c95ea708796e0497eebb8b57a7afd484ebbc4664ebbeff269e132744837
MD5 8712d442b50993940813522b04a564f5
SHA1 9abc80f843716df2e3aed35b1a286348f1fb8f4e
SHA512 c37cffe22719ea44f4a3e4a77afe9af9c63a9ac2f59a1664a1471a2620d9090697a6971524f07839abd24e91b94fd54cf332ccd7b281ac5989fa3470e81d631b
SSDEEP 192:cR4cBhc8SZ7/9v7HT37lPRpEAY8X9Dr9pHbDHsb+WNo0ld2T/5uE8VBe22jaZ/GO:cR4mhczb9/ZXhfrwGcE832jaZ/o91y
TLSH
T1AA72C56FA4246A7B6DDBC229F925BFA7D3F5502225942D84EBFC8D2C10E79CC2213413
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 b1fd585cb329d7a79be1a9a69fa351bc22496d400897833ae7f14428e3e9c625
MD5 d129c874b4a511bbcab7f0e1e818b059
SHA1 2cbda0d672236f0d7da42dac146da94f8e36ff44
SHA512 b9e33f7eb5dbb00c2cb0f9d248765b7677027499c54a7474020d5ace0a722979d262a5145b0bf4b4307cf99903acbb6c86d788735df39e42e7b59088ad028155
SSDEEP 192:cR4cBhk7/Yv7+TUPRpEArWXtD19pHbDHsb+WN+ld2T/5uEaBe22jaZ/GH7VyIsnR:cR4mhkbEDXefrwlcEK2jaZ/o9vy
TLSH
T1EA52D76BA9206A7B6DDBD219F8157B97E2F1502221D42E84EBFC8D3C15E79CC2213417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 88ea6ca1ae52a2ad2b0ffbee3efb79458a9eb5512d054dbbf9f4c56224d2323f
MD5 3f0fb84385b6a97cc0b5c984134af8ed
SHA1 9bed575a64fc424f62665881a4cad1e5ce797fb1
SHA512 b53f901d27fcc15bd81fd885dd18cf1930f02f706a33c30b5f01012c1bd7145a4139a3ef9b10ad6985e021a3aad7538f857c8bda0b31bb918007f36c7bc66b0e
SSDEEP 192:cR4cBhk7/Yv7HTUPRpEAY8XtDr9pHbDHsb+WNo0ld2T/5uEaBe22jaZ/GH7VyIst:cR4mhkbEeXJfrwGcEK2jaZ/o91y
TLSH
T13562E86FA9206A7B6DDBD219F8157B97E2F1502225D42E80EBFC8D3C15E7ACC2213407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 c0ab399a35ef22c8e10dba5efea637715ecd94e7a693c23ac022f15308c833c0
MD5 f74d40c3d609835f55dcd30d010428ac
SHA1 fd8addc58a44c88e8bd2809c7fe990181ea3879a
SHA512 22d9db5af4268877f878bb7a6735dbfda81a3ae0b47edd56e428aa62776caf6cd17a9528056b99e513e7d77fd2ece16f56b3f29811ffc73e2dd02a1b3d2e125f
SSDEEP 192:cRQk7tQv7+TUPRpEcfj9pHsb+WNneK4t9Be22jaZ/GH7VyIsnAUgE:cRQkxMDXXTwr4tv2jaZ/o9E
TLSH
T13342C62FB910693B6DDBD219F9667B93E6F5103232912E84E7FC892C15E79CC2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 15KB
SHA256 63db621158c443abcb297cd6a9d1235f84f279b0c2c6081f2c9c5f93e2333a8b
MD5 7cde754799daf40b1c1fa53bdbe9e81d
SHA1 30f71d5b318006ffae135767b147b06877337db1
SHA512 617eba18edf0c4b2148f4457995fae70a9d35f235c7b19d4aea925e97eeee863ca82967c2f00e2ce62d403baf4a582c1f54300c731ce33f282c156891bc9921d
SSDEEP 192:cR4cBhk7/9v7HT37lPRpEAY8X9Dr9pHbDHsb+WNo0ld2T/5uE8VBe22jaZ/GH7V8:cR4mhkb9/ZXhfrwGcE832jaZ/o91y
TLSH
T10962C76BA9206A7B6DDBC229F815BB97E3F1502225D42E84E7FC8D3C15E79CC2217407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 3ca90db932e6876ff58c1b4748d9b09ccf893b97282d26efb785fb313d04f428
MD5 515d3447e5f2a5a6a288e430620b48c2
SHA1 c34fb6d43a982c05b07873be3c34f823fa7e0ace
SHA512 e3614dc009018d6297a84f1a376e8dbaaf3a0c3eccb2ea7dcb03c0866b3cc6a5c0e003dadb0d08899c97327fc6f03ce91f938f7ea2c348b9a8938e424fc875d4
SSDEEP 192:cRQk7/uv7+TUPRpE/ZtDJ9pHbDHsb+WN+j2T/Vy2qBe22jaZ/GH7VyIsnAUgvy:cRQkbKDXmfrw5M262jaZ/o9vy
TLSH
T10552E62FA9106A3B6DDBD219F9557BA7E2F5102232D02E80EBFC8D2C14E79CC2213417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 c115ac0b1319b83e80883302a188060d031f71202a176d30136d30a9c23b7986
MD5 843364afa426df1f20789f7c73e46932
SHA1 e9d4b2cfceb5ba41de0bcc1914e1d32ad256d778
SHA512 6ab66d96c3fc5860e32f4726f21f57c8f4c5ae102e23bb9931e68aca9eff9ce7d3cf242a7c89d8e279c6b749ef10a2707fb6695cd8afc35433e0674017271b6f
SSDEEP 192:cRQk7tRBv7+TAPRp2cl9pHsb+WNnO00lBe22jaZ/GF7VyIsnAUgE:cRQkxj3XDTwJ0n2jaZ/c9E
TLSH
T1F642C63EA914693B6DDFD219F9667B93E6F5102232902E80EBFC892C15E79CC2317417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 fb377604f2eff03c4677a647c8c94a33496bb6a03f2ca3b617f73d6d02079dca
MD5 c879080c9ba72d4bd02fa06950d0d4da
SHA1 51eeebb8e8d90b5930e9e2aca5c65a6a5e11bd40
SHA512 b3049b1fedf12cf8e69c46588916533fc10ffee805ef2066c1e5abada55bbd8178d890f43ff726bdcb387c44a2df1d11d1ba3d3d6ee4537f088d19751b4a55f8
SSDEEP 192:eLE4K6Xn7KxkXqK4I40pUZNCgVLHrKHfFKslEiTtXzKD/ML+ErUkKNxn50i4S+h:uEjEn7KxkXqKf/pUZNCgVLH2HfgslLth
TLSH
T11532C727A48E9E7F4FD8E51CDC477F4B6CB502567378082896FB9C0403AA78A214A1A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 96B
SHA256 9168e9bba7fb3a5596815bcf569ebf99a287c413a0d6f064e60ecc44f3d0cd3c
MD5 64676ad0246bf7ddebf21c4f238d22ea
SHA1 0bc2269e61f2ea933962e47108b3846dc06e70f2
SHA512 aa5238080154600899147ac0cf8baed7cfb795a796586d928f4a76c3b9d635fd1b40e7ccebd13ec9c39c9511ff6b7270dbd4b425f79b8be84ca748eac1d71b24
TLSH
T191B002A9244A2653EE155BB0F2D51DF073317F15538B9A1354F18465CF27B8B4301285
MD5 SHA1 SHA512 TLSH

Submit Download

a46e6587-98c8-450e-94a2-4fb3f74ce566.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\a46e6587-98c8-450e-94a2-4fb3f74ce566.tmp
Size 13KB
SHA256 b826627fe0dadc21527358cefe237038a954678ce96d9598b22b1a8b3db35355
MD5 ed46b0b346c2dd985edf7d25cff4f96d
SHA1 fb1ee0373c4d3253fc137058e97a971d4018a52f
SHA512 10bc5b2da3bb3fc9402f658e947c99883c0e73e7320a1cae46f2ab4941bf8733f4b5a57115c52e5532c7b29b1e7a7b033ae62cf0ed3c9685bf95e145c776789d
SSDEEP 192:cRQk7/3v7+TUPRpEctj9pHbDHsb+WN+j2ThpBe22jaZ/GH7VyIsnAUgvy:cRQkbfDXpfrw5hr2jaZ/o9vy
TLSH
T12F52C52FA910693B6CDBD219F9667B97E2F5502222D02E84EBFC8D2C15E79CC2317017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 4201e486638739319efcb684ba41633f94ce0815debc4946474c54d978aa7c6b
MD5 adec6c964e4dbb74409001ff2273dbd0
SHA1 483910487329bd9cd9ebe41b38b96a0f21d8efab
SHA512 0ec62bfee1859af15b348b774dd271bc310ed539e1330ae062a2807c5ec0a0f9699a8201369c7444e05cc25c12e2fcc94a274d638416ffeaadeea11353176037
SSDEEP 96:DbJod+Ar2aetJRxW2rgj0+f+U+/EheznSl8h4otop5SEDvB6mGGfvTNcopLQf99u:DtoNr7OJRPrL9/EuiU23ZXvRcoyfDy9f
TLSH
T134C10971A46E6CAB4DF3A44AB0433E47CDA8617B6925BE18EEE92E0D01934DC13C3523
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 846d84e48d2f76d93a8b133ab49fe314ed001b4b1b7dadaa5ae4968c3a944f7c
MD5 6d932be9a431b2ae4fd621608ed89a2c
SHA1 95ab069f180e5f73e5d2188d5c2b96e9fc104406
SHA512 a3c9a13725e174f27e01c588748a025635bd16d8a2eb393c7db3503dbabeacc7bc6fb7792e854dbf4fb94c095616b8abab98b4d1b137c1e3a6a93e63c55e7a61
SSDEEP 96:DbJ0d+Ar2aetJRxW2rgj0+f+U+/EheznSl8h4otop5SEDvB6mGGfvTNcopLQf99u:Dt0Nr7OJRPrL9/EuiU23ZXvRcoyfDy9f
TLSH
T155C10A71A46E6CAB4DF3A446B1033E47CDA8617B6925BE58FEE91E0D01974DC1383523
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 8fc7decf2428759f6a0e98bda5a09d254e47fa4253c7a80be4004cfe5a31cfe8
MD5 0e1ac63a940981b538508311cfeeee3c
SHA1 d17444864a40dd5f1357b6777efec49425510da9
SHA512 e330f7682ec2aaa610d2e3a3ac9020f714ecf3c916de3d1b2d6958ab2fb545e3f867463ad59fcef1a29ed0fe648e3ed20ab9fe7cede2d5033c196a937b8daf9f
SSDEEP 96:DbJod+Ar2aetJRxW2rgj0+f+U+/EheznSl8h4otop5StDvB6uGovTNcopLQf99yV:DtoNr7OJRPrL9/EuiU2MZeCcoyfDy9f3
TLSH
T176C10A71A46E6CAB4DF3A44AB0433E47CDA8617B6925BE58EEE92E0D01D34DC13C3523
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 a3cf69e7e354f2227ac831cd6d3e0c4f93b23f5512419f07c7fae26f49341f57
MD5 447bd81d8e47dcd6961f5f1647511d32
SHA1 61e098143c2cd67b4267577bc4e2ed5fe4563f49
SHA512 a313fcf22397c55fb779f0139b702991c9e1b37d5e882ef1532fecc79ac49c368b96fc8eeca3befde7bcbee46e9e52bf1414bf0155050b5a580ae8a796d1a1d0
SSDEEP 96:mC0d+Ar2aetJRxW2rgj0+f+U+/EfezeRDotok5SVDvB6JGyvTNm6zj9+PEhiv4a:mC0Nr7OJRPrL9/EtDUD0Z9Imgj9+shM
TLSH
T13BA10872A47EACB749B3C545F5563B47CFA4B17B5A21EF44A9DD2B0C10A70DC1382A23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 6KB
SHA256 47025e98158dc164a6547b85471acd101e7374fdad9456e16a97af437c15f2ff
MD5 b8bda5bb32eb5356fa583c3772a1ef52
SHA1 78bb73a3b70fd18ef2d6d21b4c633ae6dea4c7e2
SHA512 ff3fe594a9d7bc2689b0172664971a85c8e4d1deb2a0d225da6e6df772d85045d57d564a45569a67e96ec0d4dd198b329c8ca24cfc44deb095d49ce24cc1ed8f
SSDEEP 192:DtoNr7OJRPrL9/EuiU2M8eCcoyfDyzfuHVxK:DtU7Ixd/EuSsoy2zfu1xK
TLSH
T124D10A71A86D6CAB4DF3A54AB0433D43CDA4617B6A19BE58EEE91F0C01974DC1383527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 56c0f3de20bf26a889b95d31e7829e3b99301e6a01e32e65cd1872a8a2a52644
MD5 bff69a37927d690071c4e99b83a8199e
SHA1 8d739558ab23c8fe285d28dc59b72d040b2de4dc
SHA512 58f634408844c379877ba072c4f71181c2d1d197f2475d3cf06d6906f862ca051e79238892d71ea54391fa178b006a5364d906976b8496d942090b44f0a32413
SSDEEP 96:DbJ0d+Ar2aetJRxW2rgj0+f+U+/EheznSl8h4otop5SEDvB6mGGfvTNchCzb39Qd:Dt0Nr7OJRPrL9/EuiU23ZXvRcMnOfRyE
TLSH
T1CDC128B2A87DACB35DF3D456B0433687CEA4A1BB5920EE14DAE91F0C01E74DC1386623
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 74302d4d5f8cce81a9bf417f002b95b381c86fae147c1abc22a71fb183227b7a
MD5 27596277d1c1052f419443c494a67a97
SHA1 fd9562d770d0c3d6e4d4876b922039b4a1e0418d
SHA512 35d6b0a0dcd64e92205d1c3266ba9c6872cdd17409423e53dd6c8781f2f485f0fe53eb3246c479a673474f58508270f9defc23f29c1f580a1566f8225366a76d
SSDEEP 96:DC0d+Ar2aetJRxW2rgj0+f+U+/EheznSl8h4otop5SEDvB6mGGfvTNchCzb39QfF:DC0Nr7OJRPrL9/EuiU23ZXvRcMnOfRyE
TLSH
T1E6C118B2A87DACB35DF3D416B0433687CEA4A1BB5920EE54DAE91E0C01D74DC1386523
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 607B
SHA256 be6b74e52e5eef1f1c27c0976bf3bf1bfa99958c00bbef2898a602f691be6dae
MD5 76b78ed7ff6273215b134d6a6488035d
SHA1 9e7a11ffb68d027036302eccd4c22315054843a9
SHA512 9919504cd4d8c0757abff8da4bbad1c4b6532f81d290c736fc5624ef66de45e6a9e29a8290854ae554d5bdfc5291f1ea81ae62d1b25846bfbcf1515e2ec3e4f1
TLSH
T174F0DC53CBD6536BD527223CC8E207E1FA70E2719E81212386106F2D6CB77241E474B4
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4372-323-0x00000130001E0000-0x00000130002E0000-memory.dmp

Download

memory/4372-331-0x0000013013D90000-0x0000013013E90000-memory.dmp

Download

memory/4372-341-0x0000013003B90000-0x0000013003BB0000-memory.dmp

Download

memory/4372-330-0x0000013003950000-0x0000013003970000-memory.dmp

Download

memory/4372-369-0x0000013015610000-0x0000013015630000-memory.dmp

Download