377856b598aa69d4d556083e59b9eb452988a16787469506b8e8a955059bfc13

Analysis

user interaction
yes
max time kernel
485s
max time network
511s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/09/2026, 07:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bruteforcer.bat
Size 152B
Sample260913-h94beagf39
SHA256 377856b598aa69d4d556083e59b9eb452988a16787469506b8e8a955059bfc13
MD5 b8cdea557fcdf65b7b595e640ac84baa
SHA1 0d8b8611a45bb98551f7ac5fbaeef7cca140406d
SHA512 f4a6dc287577d98fc84a748d4cf124d635be6b4bfba805e817af45b00af82f6a1dfdb53b679a2d56effe060fb6203119d7c58adb8e8b3b5a4a7e04d915d38477
TLSH
T1AEC08C00658A4C0100F60391E4890A4A3F04E0820B52B9E434ED9A9071FA2A088087A0
MD5 SHA1 SHA512 TLSH

Score

8^/10

adware discovery execution persistence phishing ransomware spyware

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

A potential corporate email address has been identified in the URL 64 IoCs

phishing

description	flow	ioc	pid	Process	stream
Email address	40	[email protected]	5604	chrome.exe	43
Email address	40	[email protected]	5604	chrome.exe	45
Email address	40	[email protected]	5604	chrome.exe	47
Email address	40	[email protected]	5604	chrome.exe	49
Email address	40	[email protected]	5604	chrome.exe	51
Email address	40	[email protected]	5604	chrome.exe	53
Email address	40	[email protected]	5604	chrome.exe	55
Email address	40	[email protected]	5604	chrome.exe	57
Email address	40	[email protected]	5604	chrome.exe	59
Email address	40	[email protected]	5604	chrome.exe	61
Email address	40	[email protected]	5604	chrome.exe	63
Email address	40	[email protected]	5604	chrome.exe	65
Email address	40	[email protected]	5604	chrome.exe	67
Email address	40	[email protected]	5604	chrome.exe	69
Email address	40	[email protected]	5604	chrome.exe	71
Email address	40	[email protected]	5604	chrome.exe	73
Email address	40	[email protected]	5604	chrome.exe	75
Email address	40	[email protected]	5604	chrome.exe	77
Email address	40	[email protected]	5604	chrome.exe	79
Email address	40	[email protected]	5604	chrome.exe	81
Email address	40	[email protected]	5604	chrome.exe	83
Email address	40	[email protected]	5604	chrome.exe	85
Email address	40	[email protected]	5604	chrome.exe	87
Email address	40	[email protected]	5604	chrome.exe	89
Email address	40	[email protected]	5604	chrome.exe	91
Email address	40	[email protected]	5604	chrome.exe	93
Email address	40	[email protected]	5604	chrome.exe	95
Email address	40	[email protected]	5604	chrome.exe	97
Email address	40	[email protected]	5604	chrome.exe	99
Email address	40	[email protected]	5604	chrome.exe	101
Email address	40	[email protected]	5604	chrome.exe	103
Email address	40	[email protected]	5604	chrome.exe	105
Email address	40	[email protected]	5604	chrome.exe	107
Email address	40	[email protected]	5604	chrome.exe	109
Email address	40	[email protected]	5604	chrome.exe	111
Email address	40	[email protected]	5604	chrome.exe	113
Email address	40	[email protected]	5604	chrome.exe	115
Email address	40	[email protected]	5604	chrome.exe	117
Email address	40	[email protected]	5604	chrome.exe	119
Email address	40	[email protected]	5604	chrome.exe	121
Email address	40	[email protected]	5604	chrome.exe	123
Email address	40	[email protected]	5604	chrome.exe	125
Email address	40	[email protected]	5604	chrome.exe	127
Email address	40	[email protected]	5604	chrome.exe	129
Email address	40	[email protected]	5604	chrome.exe	131
Email address	40	[email protected]	5604	chrome.exe	133
Email address	40	[email protected]	5604	chrome.exe	135
Email address	40	[email protected]	5604	chrome.exe	137
Email address	40	[email protected]	5604	chrome.exe	139
Email address	40	[email protected]	5604	chrome.exe	141
Email address	40	[email protected]	5604	chrome.exe	143
Email address	40	[email protected]	5604	chrome.exe	145
Email address	40	[email protected]	5604	chrome.exe	147
Email address	40	[email protected]	5604	chrome.exe	149
Email address	40	[email protected]	5604	chrome.exe	151
Email address	40	[email protected]	5604	chrome.exe	153
Email address	40	[email protected]	5604	chrome.exe	155
Email address	40	[email protected]	5604	chrome.exe	157
Email address	40	[email protected]	5604	chrome.exe	159
Email address	40	[email protected]	5604	chrome.exe	161
Email address	40	[email protected]	5604	chrome.exe	163
Email address	40	[email protected]	5604	chrome.exe	165
Email address	40	[email protected]	5604	chrome.exe	167
Email address	40	[email protected]	5604	chrome.exe	169

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5956	cmd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5604	chrome.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	explorer.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Internet Explorer\Main	explorer.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134337580696549389"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe

Modifies registry class 42 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4280978039-528710165-233981602-1000\{6C03628E-460B-41B8-9B22-2580E608620A}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4280978039-528710165-233981602-1000\{04B214A1-49BE-4C5F-A793-D750782EE292}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	StartMenuExperienceHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\MuiCache	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchHost.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
3008	chrome.exe
3008	chrome.exe
1276	explorer.exe
1276	explorer.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 32 IoCs

pid	Process
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeCreatePagefilePrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeCreatePagefilePrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeCreatePagefilePrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeCreatePagefilePrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeCreatePagefilePrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeCreatePagefilePrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeCreatePagefilePrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeCreatePagefilePrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeCreatePagefilePrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeCreatePagefilePrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeCreatePagefilePrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeCreatePagefilePrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeCreatePagefilePrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeCreatePagefilePrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeCreatePagefilePrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeCreatePagefilePrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeCreatePagefilePrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeCreatePagefilePrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeCreatePagefilePrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeCreatePagefilePrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeCreatePagefilePrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeCreatePagefilePrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeCreatePagefilePrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeCreatePagefilePrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeCreatePagefilePrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeCreatePagefilePrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeCreatePagefilePrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeCreatePagefilePrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeCreatePagefilePrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeCreatePagefilePrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeCreatePagefilePrivilege	2396	chrome.exe
Token: SeShutdownPrivilege	2396	chrome.exe
Token: SeCreatePagefilePrivilege	2396	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
1100	sihost.exe
1276	explorer.exe
1276	explorer.exe
1276	explorer.exe
1276	explorer.exe
1276	explorer.exe
1276	explorer.exe
1276	explorer.exe
1276	explorer.exe
1276	explorer.exe
1276	explorer.exe
1276	explorer.exe
1276	explorer.exe
1276	explorer.exe
1276	explorer.exe
1276	explorer.exe
1276	explorer.exe
1276	explorer.exe
1276	explorer.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
2396	chrome.exe
1276	explorer.exe
1276	explorer.exe
1276	explorer.exe
1276	explorer.exe
1276	explorer.exe
1276	explorer.exe
1276	explorer.exe
1276	explorer.exe
1276	explorer.exe
1276	explorer.exe
1276	explorer.exe
1276	explorer.exe
1276	explorer.exe
1276	explorer.exe
1276	explorer.exe
1276	explorer.exe
1276	explorer.exe
1276	explorer.exe
1276	explorer.exe
1276	explorer.exe
1276	explorer.exe
1276	explorer.exe
1276	explorer.exe
1276	explorer.exe
1276	explorer.exe
1276	explorer.exe
1276	explorer.exe
1276	explorer.exe
1276	explorer.exe
1276	explorer.exe
1276	explorer.exe
1276	explorer.exe
1276	explorer.exe
1276	explorer.exe
1276	explorer.exe
1276	explorer.exe
1276	explorer.exe
1276	explorer.exe
1276	explorer.exe
1276	explorer.exe
1276	explorer.exe
1276	explorer.exe
1276	explorer.exe
1276	explorer.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
2396	chrome.exe
2396	chrome.exe
3492	StartMenuExperienceHost.exe
828	SearchHost.exe
1276	explorer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2396 wrote to memory of 5108	2396	chrome.exe	91
PID 2396 wrote to memory of 1612	2396	chrome.exe	92
PID 2396 wrote to memory of 1612	2396	chrome.exe	92
PID 2396 wrote to memory of 5604	2396	chrome.exe	93
PID 2396 wrote to memory of 3412	2396	chrome.exe	95
PID 2396 wrote to memory of 3412	2396	chrome.exe	95
PID 2396 wrote to memory of 1124	2396	chrome.exe	96
PID 2396 wrote to memory of 1124	2396	chrome.exe	96
PID 2396 wrote to memory of 2424	2396	chrome.exe	97
PID 2396 wrote to memory of 2424	2396	chrome.exe	97
PID 2396 wrote to memory of 4928	2396	chrome.exe	98
PID 2396 wrote to memory of 4928	2396	chrome.exe	98
PID 2396 wrote to memory of 1104	2396	chrome.exe	99
PID 2396 wrote to memory of 1104	2396	chrome.exe	99
PID 2396 wrote to memory of 2688	2396	chrome.exe	100
PID 2396 wrote to memory of 3284	2396	chrome.exe	101
PID 2396 wrote to memory of 3284	2396	chrome.exe	101
PID 2396 wrote to memory of 4176	2396	chrome.exe	102
PID 2396 wrote to memory of 4176	2396	chrome.exe	102
PID 2396 wrote to memory of 5464	2396	chrome.exe	106
PID 2396 wrote to memory of 3588	2396	chrome.exe	107
PID 2396 wrote to memory of 5464	2396	chrome.exe	106
PID 2396 wrote to memory of 3588	2396	chrome.exe	107
PID 2396 wrote to memory of 1484	2396	chrome.exe	108
PID 2396 wrote to memory of 1484	2396	chrome.exe	108
PID 2396 wrote to memory of 696	2396	chrome.exe	109
PID 2396 wrote to memory of 2008	2396	chrome.exe	110
PID 2396 wrote to memory of 696	2396	chrome.exe	109
PID 2396 wrote to memory of 2008	2396	chrome.exe	110
PID 2396 wrote to memory of 4104	2396	chrome.exe	111
PID 2396 wrote to memory of 4104	2396	chrome.exe	111
PID 2396 wrote to memory of 5512	2396	chrome.exe	112
PID 2396 wrote to memory of 5860	2396	chrome.exe	113
PID 2396 wrote to memory of 5524	2396	chrome.exe	114
PID 2396 wrote to memory of 5512	2396	chrome.exe	112
PID 2396 wrote to memory of 5860	2396	chrome.exe	113
PID 2396 wrote to memory of 5524	2396	chrome.exe	114
PID 2396 wrote to memory of 3984	2396	chrome.exe	115
PID 2396 wrote to memory of 3984	2396	chrome.exe	115
PID 2396 wrote to memory of 4324	2396	chrome.exe	116
PID 2396 wrote to memory of 4324	2396	chrome.exe	116
PID 2396 wrote to memory of 5852	2396	chrome.exe	117
PID 2396 wrote to memory of 5852	2396	chrome.exe	117
PID 2396 wrote to memory of 4320	2396	chrome.exe	118
PID 2396 wrote to memory of 4320	2396	chrome.exe	118
PID 2396 wrote to memory of 1372	2396	chrome.exe	119
PID 2396 wrote to memory of 1372	2396	chrome.exe	119
PID 2396 wrote to memory of 3304	2396	chrome.exe	120
PID 2396 wrote to memory of 3304	2396	chrome.exe	120
PID 2396 wrote to memory of 4156	2396	chrome.exe	121
PID 2396 wrote to memory of 4156	2396	chrome.exe	121
PID 2396 wrote to memory of 948	2396	chrome.exe	122
PID 2396 wrote to memory of 948	2396	chrome.exe	122
PID 2396 wrote to memory of 3468	2396	chrome.exe	123
PID 2396 wrote to memory of 4404	2396	chrome.exe	124
PID 2396 wrote to memory of 800	2396	chrome.exe	125
PID 2396 wrote to memory of 2756	2396	chrome.exe	126
PID 2396 wrote to memory of 2756	2396	chrome.exe	126
PID 2396 wrote to memory of 2452	2396	chrome.exe	127
PID 2396 wrote to memory of 2452	2396	chrome.exe	127
PID 2396 wrote to memory of 2324	2396	chrome.exe	128
PID 2396 wrote to memory of 2324	2396	chrome.exe	128
PID 2396 wrote to memory of 1768	2396	chrome.exe	129
PID 2396 wrote to memory of 1768	2396	chrome.exe	129

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\bruteforcer.bat"
1⤵
- Executes a command shell one-liner
PID:5956

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffda343c728,0x7ffda343c734,0x7ffda343c740
  2⤵
  PID:5108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1716,i,5633219709563873139,3108524595935669958,262144 --field-trial-handle=1940,i,7268362950889687503,8158968923213969238,262144 --variations-seed-version --mojo-platform-channel-handle=1932 /prefetch:2
  2⤵
  PID:1612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2184,i,4222434516338496376,12769200784296071320,524288 --field-trial-handle=1940,i,7268362950889687503,8158968923213969238,262144 --variations-seed-version --mojo-platform-channel-handle=2252 /prefetch:11
  2⤵
  - A potential corporate email address has been identified in the URL
  - System Time Discovery
  PID:5604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2360,i,16596398234511935226,11062003716789594923,524288 --field-trial-handle=1940,i,7268362950889687503,8158968923213969238,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:13
  2⤵
  PID:3412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3276,i,1807478548888791898,9101213408531856385,2097152 --field-trial-handle=1940,i,7268362950889687503,8158968923213969238,262144 --variations-seed-version --mojo-platform-channel-handle=3404 /prefetch:1
  2⤵
  PID:1124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3280,i,7423910105653673870,4883730086762584519,2097152 --field-trial-handle=1940,i,7268362950889687503,8158968923213969238,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:2424
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4724,i,4271797990357069699,15834041777160278501,2097152 --field-trial-handle=1940,i,7268362950889687503,8158968923213969238,262144 --variations-seed-version --mojo-platform-channel-handle=4744 /prefetch:1
  2⤵
  PID:4928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4908,i,15194596024637871899,11709361169447571326,524288 --field-trial-handle=1940,i,7268362950889687503,8158968923213969238,262144 --variations-seed-version --mojo-platform-channel-handle=4896 /prefetch:14
  2⤵
  PID:1104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5372,i,4961216466353967492,18016306006037506050,524288 --field-trial-handle=1940,i,7268362950889687503,8158968923213969238,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:14
  2⤵
  PID:2688
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5476,i,7872947812319987270,17873500130009930135,2097152 --field-trial-handle=1940,i,7268362950889687503,8158968923213969238,262144 --variations-seed-version --mojo-platform-channel-handle=5512 /prefetch:1
  2⤵
  PID:3284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5488,i,7437580681086035753,993662393230448459,2097152 --field-trial-handle=1940,i,7268362950889687503,8158968923213969238,262144 --variations-seed-version --mojo-platform-channel-handle=5532 /prefetch:1
  2⤵
  PID:4176
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5560,i,18425743657874528287,17611217307513380721,2097152 --field-trial-handle=1940,i,7268362950889687503,8158968923213969238,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:1
  2⤵
  PID:5464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5832,i,6999219533267749266,1815237071362845309,524288 --field-trial-handle=1940,i,7268362950889687503,8158968923213969238,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:14
  2⤵
  PID:3588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5936,i,5604146708514410184,7405339039333211929,2097152 --field-trial-handle=1940,i,7268362950889687503,8158968923213969238,262144 --variations-seed-version --mojo-platform-channel-handle=5488 /prefetch:1
  2⤵
  PID:1484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5856,i,18145585984081541114,4456751566519065292,524288 --field-trial-handle=1940,i,7268362950889687503,8158968923213969238,262144 --variations-seed-version --mojo-platform-channel-handle=5820 /prefetch:14
  2⤵
  PID:696
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5744,i,5923938894068599293,13004646562167341392,2097152 --field-trial-handle=1940,i,7268362950889687503,8158968923213969238,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:1
  2⤵
  PID:2008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5844,i,4845737812447354568,14068111323837066015,2097152 --field-trial-handle=1940,i,7268362950889687503,8158968923213969238,262144 --variations-seed-version --mojo-platform-channel-handle=5524 /prefetch:1
  2⤵
  PID:4104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6256,i,15769445801797082511,11070451565150825459,2097152 --field-trial-handle=1940,i,7268362950889687503,8158968923213969238,262144 --variations-seed-version --mojo-platform-channel-handle=5560 /prefetch:1
  2⤵
  PID:5512
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=5680,i,10432096559293109254,16772235355777765185,2097152 --field-trial-handle=1940,i,7268362950889687503,8158968923213969238,262144 --variations-seed-version --mojo-platform-channel-handle=5844 /prefetch:1
  2⤵
  PID:5860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5732,i,16969671176401923790,18135649885957281314,524288 --field-trial-handle=1940,i,7268362950889687503,8158968923213969238,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:14
  2⤵
  PID:5524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6424,i,5151363534116600682,11079217542109764196,2097152 --field-trial-handle=1940,i,7268362950889687503,8158968923213969238,262144 --variations-seed-version --mojo-platform-channel-handle=5480 /prefetch:1
  2⤵
  PID:3984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6420,i,14494478534232363762,12770750014243201529,2097152 --field-trial-handle=1940,i,7268362950889687503,8158968923213969238,262144 --variations-seed-version --mojo-platform-channel-handle=6460 /prefetch:9
  2⤵
  PID:4324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=5696,i,4272475322023841393,216202639381691181,2097152 --field-trial-handle=1940,i,7268362950889687503,8158968923213969238,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:1
  2⤵
  PID:5852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=4788,i,5713269443231909177,6339172548950402318,2097152 --field-trial-handle=1940,i,7268362950889687503,8158968923213969238,262144 --variations-seed-version --mojo-platform-channel-handle=5612 /prefetch:1
  2⤵
  PID:4320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=3532,i,17499715076637617044,16451543607130690266,2097152 --field-trial-handle=1940,i,7268362950889687503,8158968923213969238,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:1
  2⤵
  PID:1372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=3628,i,2149647329608147004,10625942813473497610,2097152 --field-trial-handle=1940,i,7268362950889687503,8158968923213969238,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:1
  2⤵
  PID:3304
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=6792,i,2989634450191704283,5257523359943554647,2097152 --field-trial-handle=1940,i,7268362950889687503,8158968923213969238,262144 --variations-seed-version --mojo-platform-channel-handle=6508 /prefetch:1
  2⤵
  PID:4156
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=6716,i,9638029793921810341,14274803143913484012,2097152 --field-trial-handle=1940,i,7268362950889687503,8158968923213969238,262144 --variations-seed-version --mojo-platform-channel-handle=6248 /prefetch:1
  2⤵
  PID:948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5672,i,14705766158661977976,11140094377576855744,524288 --field-trial-handle=1940,i,7268362950889687503,8158968923213969238,262144 --variations-seed-version --mojo-platform-channel-handle=6628 /prefetch:14
  2⤵
  PID:3468
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5840,i,8143062257265327969,3123833891824464456,524288 --field-trial-handle=1940,i,7268362950889687503,8158968923213969238,262144 --variations-seed-version --mojo-platform-channel-handle=5728 /prefetch:14
  2⤵
  PID:4404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5656,i,3551732816014088264,13358717325958811171,524288 --field-trial-handle=1940,i,7268362950889687503,8158968923213969238,262144 --variations-seed-version --mojo-platform-channel-handle=5996 /prefetch:14
  2⤵
  PID:800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --metrics-shmem-handle=5840,i,17389756423716108937,2955703011345635154,2097152 --field-trial-handle=1940,i,7268362950889687503,8158968923213969238,262144 --variations-seed-version --mojo-platform-channel-handle=5512 /prefetch:1
  2⤵
  PID:2756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --metrics-shmem-handle=6400,i,15826760288148426267,15220032467041911569,2097152 --field-trial-handle=1940,i,7268362950889687503,8158968923213969238,262144 --variations-seed-version --mojo-platform-channel-handle=6564 /prefetch:1
  2⤵
  PID:2452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --metrics-shmem-handle=6220,i,1316938517771152218,2638242819702828836,2097152 --field-trial-handle=1940,i,7268362950889687503,8158968923213969238,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:1
  2⤵
  PID:2324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --metrics-shmem-handle=6676,i,3516995418688446963,9426424436065364611,2097152 --field-trial-handle=1940,i,7268362950889687503,8158968923213969238,262144 --variations-seed-version --mojo-platform-channel-handle=6048 /prefetch:1
  2⤵
  PID:1768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --metrics-shmem-handle=5824,i,18084012234339171050,15690994108905296488,2097152 --field-trial-handle=1940,i,7268362950889687503,8158968923213969238,262144 --variations-seed-version --mojo-platform-channel-handle=6628 /prefetch:1
  2⤵
  PID:3392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --metrics-shmem-handle=6296,i,6317744551662710844,2746213168063482819,2097152 --field-trial-handle=1940,i,7268362950889687503,8158968923213969238,262144 --variations-seed-version --mojo-platform-channel-handle=6608 /prefetch:1
  2⤵
  PID:5424
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5576,i,1787571731079338314,17535440057971423948,262144 --field-trial-handle=1940,i,7268362950889687503,8158968923213969238,262144 --variations-seed-version --mojo-platform-channel-handle=6272 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=3636,i,11724695514599032457,14101361262371939047,524288 --field-trial-handle=1940,i,7268362950889687503,8158968923213969238,262144 --variations-seed-version --mojo-platform-channel-handle=3404 /prefetch:14
  2⤵
  PID:2328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --metrics-shmem-handle=4832,i,12754659758396488818,12735228068098788811,2097152 --field-trial-handle=1940,i,7268362950889687503,8158968923213969238,262144 --variations-seed-version --mojo-platform-channel-handle=4748 /prefetch:1
  2⤵
  PID:2452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --metrics-shmem-handle=6444,i,5847604303302037539,6618218773170184922,2097152 --field-trial-handle=1940,i,7268362950889687503,8158968923213969238,262144 --variations-seed-version --mojo-platform-channel-handle=6640 /prefetch:1
  2⤵
  PID:3368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --metrics-shmem-handle=6368,i,2231988195868819862,9094398027672320586,2097152 --field-trial-handle=1940,i,7268362950889687503,8158968923213969238,262144 --variations-seed-version --mojo-platform-channel-handle=4756 /prefetch:1
  2⤵
  PID:4092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --metrics-shmem-handle=6676,i,8478993388475396345,4259192757900488804,2097152 --field-trial-handle=1940,i,7268362950889687503,8158968923213969238,262144 --variations-seed-version --mojo-platform-channel-handle=6432 /prefetch:1
  2⤵
  PID:1568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --metrics-shmem-handle=6188,i,9520381343228271476,12045985359361442536,2097152 --field-trial-handle=1940,i,7268362950889687503,8158968923213969238,262144 --variations-seed-version --mojo-platform-channel-handle=3984 /prefetch:1
  2⤵
  PID:4356
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --metrics-shmem-handle=4500,i,11451847682402299484,5665181331741292503,2097152 --field-trial-handle=1940,i,7268362950889687503,8158968923213969238,262144 --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:1
  2⤵
  PID:868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --metrics-shmem-handle=3752,i,16828544467647631149,8710813969897863008,2097152 --field-trial-handle=1940,i,7268362950889687503,8158968923213969238,262144 --variations-seed-version --mojo-platform-channel-handle=6908 /prefetch:1
  2⤵
  PID:2172

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5428

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1956

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:3316

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3328

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
PID:1100
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Enumerates connected drives
  - Checks SCSI registry key(s)
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:1276

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:828

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3492

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 95156e85b10bb169669ac3a8fd229cfc0fca67c83c351ee5fb76ca8d89d5e1be
MD5 0e3d1285ddae06a225fe04ae6af82b07
SHA1 8b978c7f8232dd442e11dfffef2c83ca59b28c38
SHA512 80afb4af262e2c48dbaf6a132572df5f508b1bc75b767aa0e1c3120174946162fe57cb5e4d27adf119ed9d8b08b5a29cfdf85d6351217ffc2219bdda998e30cf
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000014

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000014
Size 107KB
SHA256 64fa5d5f5a52e99b7f2e4fc0a52f8ba357ce6d82f2b0eec4b463c174a9347f39
MD5 7175e4fa2810ba0925c78c0e007c7435
SHA1 bb0db58321da61e7258836a54717a463d86c64cd
SHA512 4ff1412d65c153b135f78b4f2ad7660bf4683cc8c3469ebf4df9c0461932692b99d0d011a4d2134d62652a91b573d50b8673db1e776e7dcf39f43e92c617bd60
SSDEEP 3072:rK6ZJY4ghe7GygPCOR3gSkbawM4z8s2B5UQyUiWwij9:W6ZSd5ygPCHaBBIWwi5
TLSH
T1E2B302B7F10DF850895D29614CB2113C3B26DA6E27394128B784383FFF972795AC1BA2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 912B
SHA256 3e2b365377db547cbbb2accdaade5d244c547db5a4263c08aef183bf3996aa20
MD5 f803c9ab10808f5b2be004a8902486a0
SHA1 590e18d50be995ab0409c34c0aaa82f95d1e34c0
SHA512 a169cde9a39b60d5969cb2f2b86fb77ecb3f5d9134339efdf2c52c2a5450c5cae2e537b16d30cb87527c71e1727b0d6e1f53eda29dd59e5461e159397f686dcf
TLSH
T15611EB8C06421942E7B40B324BC53E43FAB85B278AC37E6281E0DD705023FA7924683C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 204f0ec093acbdb758e90c40aa8c9dd3511c5e0d699014be0d94a80b4086e291
MD5 39abcdb5e669577558c09b3346f8feab
SHA1 489d6085ee2a789fc1fe5c5a365798a32a018f10
SHA512 f6a919d9e28e4988245918e93b0b45709efe0e36a7995cd0fb379173dac2ccc73cae091cbf71dc7cd5e88865a4ee9f3bf9819cb4a7394f38523d7695e712ac69
SSDEEP 96:+0XOenSSCwEuHXsbE50XIyG+bDVFi1qicx1Pp1NQ+oSlRkW97Ho/i7:nXNny0cbE50e+bDVFi1qiczTNjhlRkK7
TLSH
T1B491A6ED69816D51EB6633B0EFE5A983B13F1A0149473E7644B4CC382DE3BA1B1131B8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 912B
SHA256 f70385e9d06cd04aff16c0221e4e928ccdb00139290b82b3e95c0ac3fbc381cb
MD5 a68dc487707a6a2a0a3a5e088dc8fe8c
SHA1 7c50c4ea690014d60784dd73001b9f5bee21fb80
SHA512 40d1d6fb86763e96c69edeb0ef245947989de90b38a5e501fdf76a4067ea1000cac9c425755d3649533a2ef305a1d479080875a6454ef57ad40272080d9cd79e
TLSH
T1AB1178CC5AC12541FFB40B36ABD53E43B5A45B1B86837B6380D4DD702523FE65186878
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 a526f3e4fc73895ad3ce3903ea81bcd7b9af8bf78a02ee4c3e2c1ecb3eab4785
MD5 029aa5a692d8b63de9acd50c36cb487e
SHA1 8023e7334acde427233874fa979031d846ef6cb3
SHA512 cbed70b2ddc6527995a4a46696bbb981a24cba9ed450624435222b9d34d1934895e96f5f3829eb3561a048071a5b7eb5a12482ccb11d33bbcbd975c31f6b300b
SSDEEP 96:ZiKXIdAIemhggSeUeKW8Gd9wQ9di3z/ks2ZhqFmsDtE6CF9mtBJnIX/9An/aOgXu:QKXIdA3mhggfUV/GdJ9di3z/72Zhums5
TLSH
T1C2B1C5DF55816D51FB2532B4DFD6AB43E47E060046CB3E6E1DA4CC3C1893BA5A0523B8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 888B
SHA256 48d86f16305ef1afa72be0635a82d06af2013a47e1c829c3a113068b926fa9ea
MD5 05d25a2af1ecca6a69e823d80c90b951
SHA1 de37e393803e7e08dd58fb5abe3277a49b4b255a
SHA512 364203a48bb430338cd9260a5e386bd9664c46c0d1df6ba9133c308fd07b697f9487d2af08074b4a40c8b55385c1703546b95cb2a2629d79b815ccd5f2adc9d5
TLSH
T1D4118BDC16011901EBB00B320BC53A83FAB95B274AC37E6281E0DD745023F67414583C
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_github.com_0.indexeddb.leveldb\000003.log
Size 31KB
SHA256 8c684452ff21174fe6f6602c248941c058e35c789db659a8f4a2c5fc3ea09100
MD5 1884bfdc0683c9345b240804693c3fa7
SHA1 9f4e799f43733499fe9b26a77fd48c810b1c644f
SHA512 8195ed2298bdbd3ffe39a3c5cb7bd4cec58d57918d1485d7b74cc67dd71e1981f9e871fd24933d83dee55772286eef6fe1c9f03e2de023e5af3ee783e40560ae
SSDEEP 384:VcE7a3WcbcucocYcfcZactBIMzvZ1act2act3actract+actoGactVYac1MEtacF:6Fr5gTnYoQOTMwcLdeguN8a
TLSH
T1F5E2DD48B6FE1550FAF78B3F65BA18689DB1BE203C08CD9D00A45DAD0A73BC01965B77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_github.com_0.indexeddb.leveldb\LOG
Size 339B
SHA256 074873ca2919466b414f56d472b1c8f2d5f72ab965e442c40e9979e586ce94e5
MD5 e4e02f3b22d6b134292b6555f02f2e8a
SHA1 981daf63a835e579fc9e42ce393b355bab9ce4a5
SHA512 ca35291aaa5a8fded04613c27c88e8a9513ba35212146b23281bb7e997ea1d48e3057f41e074fce160d8c843369ac0d439b9ae618c41b3ddc828d9e7e845333d
TLSH
T12EE0C01855CA8A5F0584C1769530BB0ECAE3620CE7CCAD890FC2D41470C640880AC311
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_github.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 12KB
SHA256 04c4a6dd9fa554515a7a93e4780b9982e08da33cb335022cc068997889dd5a3e
MD5 b3f2943537c119902b4e17ed47b03fa8
SHA1 3f3ee9616bdc12eea18c3e9d38b3f32486c6d928
SHA512 2060b32ca52d59d2c3af3255514aa80d078746978574baeb1c00b768533ece3180d365c0c8732a074dedccabfceb22f1bdb7f550e3cb378db28e12b74e58dc73
SSDEEP 384:Dh1mCnMb6ZEFb5YJB7+mJeBJmHgmD6vabghCEd7X7ZnwddSCaDSfDnNaygmSE+YB:reYp0ahoqjx4SH
TLSH
T1D742AFF7C3E5862DC81156F4AB24AE2FCE291A24431C3D36C9E5AF5B93E2471E21174E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 653ed5c512930d7f39c3644852c04e38c6cdf571a25931f27274b27376d61e64
MD5 c8f4965cc8a2f34afa1a44eb06bbc7cc
SHA1 a05ed2bbaa4e49d62ccb05f69d190731bbee5fcb
SHA512 13801824835d70144344fd3ffcbe9afe06f71b1e132a788e89b7e33563d645df75554a5eb64d8a7b180dff6856d859711e339ec3783386e194581a9929f7673f
SSDEEP 192:DwhPJ0Ce569sEFb+56vaK7fU7qRTX7ZqbVuwGXpv:DwhPJ0Ce569sEFbO6vaK7fU7qRTX7Zqa
TLSH
T116F18EF3C3E9862DC81252F59B646E2ECE2D0E2442283D26C9D5EF5F93E15B1E21174E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 d7393d1362b668f313d6d7a5d70b06632fa6346040e91f817d98738f9ef2f53f
MD5 7580a82e472dde5c809b23b424946095
SHA1 82c44502afb8beb31839692ad80b61fe2322ebdb
SHA512 dac6ac2819f75dc382e86406582205311bb7cf0c5d004ea698b7471e75d8f0d288f27a7489696e78f3c84a96d997d06a32031a5fe4ac9d412a935647042c3d2b
SSDEEP 96:DwpD+Uu20uxTubuyuHu0Y6vauX3uDOu8fu2uFueu80uwGuCo7qR2:DwhPJ0Ce56y6vaeaO7fKpb0spo7qR2
TLSH
T16AC16EF7C3E5862DC81152F5AB646E2ECE2D0E24421C3D26C9E5AF1F93E14B1E21574E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 fa16a68a375669b32c480e31c15749a62e1e31c0e732b370026a07ba6171dd83
MD5 af8282a3ee35ceba7fc963b8aab1009b
SHA1 24216e488ade6dbf7110ba9f32946d17788e39e8
SHA512 5f4e2ded7bea4d79cc39431c9b9753c2f867e654f18baa8526d2412ae5fd11d04cb985056521202ef166acdb747b0a97559a0dae8e3cbc446573440787715083
SSDEEP 192:DwhPJ0Ce569sv6vaK7fU7qRPfXhbsJ7p6UM2J:DwhPJ0Ce569sv6vaK7fU7qRPfXhAJ7pN
TLSH
T123E17FF7C3E9862DC81252F56B646E2ECE2D0E2442183D26C9D5AF5F93E14B1E21174E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 12KB
SHA256 b5c31dd29527f558ee6636885acd054c4f63a81f2ed5fd4c252d5780bc95842d
MD5 e3b822d78ecf9db39f81bb099425d527
SHA1 5d1e18e1f019b22a38f3cc6b0ba3d1c6ed1f03e1
SHA512 3fb49fce7f27374d5ddea0483e271186f480f62ffbe1f105d347942f927f141332f108fbf9443369883c3d67415e8c3793e51e7af7aaedd74c296bc2d94a546c
SSDEEP 384:Dh1mCnMb6ZgNS5YJB7+mJeBJmHgmD6vabghUNPZnwddSCaDSfDnNaygmosHmrmym:8eYpHahKqjxXeS
TLSH
T1F342AEF7C3E5862DC81156F4AB24AE2FCE290A24431C3D36C9E5AF5B93E2471E21174E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 9dde3b6a9478ece3bbaeffc651fd3802713b487cea6ddd431f7abc70a4c14d3f
MD5 c95436839241c2281bf99b60222e2ea3
SHA1 baab2100f8e6bb99cafc9451b53d5bc24635892e
SHA512 6b7aa668417dfb4556925e4151eda5a7009cdeb3b860f3a4b20049c304cad64c3b872b2572e5112b266451090405002db9d092f0bde2ac7f5d07ad7830fee585
SSDEEP 192:ebRs3D73UIv7xAPRp2s9xHsb+WNnpm0xFlePVyIsnAUge:ebRs3/UUYXrDwg0Qe
TLSH
T13C32742EBE64797F5CDBC21AFA257B53D6F5202221E02E84EAF8897C11E75CC2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 15KB
SHA256 e8a771c10a0b8ebdd42acdf28e36e784e901911ed34275147cab87b96265e67e
MD5 7acb532bc8ad978608080f3c0e7df894
SHA1 ad6f7396b8de35c2eeeab81d02762059eb4a7eeb
SHA512 2d9250096cf33d9c2836781b69186330060c2fc632682f5adf7a56d539c2bc8da6543ede24e2312e515f30d250619d6bd72c31c0c5cae2db32b3c3e44b344519
SSDEEP 384:nR6cmI3CiUYXKQQjcDwmPCTDCP5LwA4EXXg3e5g/f:YcmI3CSDwmPCTDC3r5e
TLSH
T1B962845BB9602D7FADDAC229F915BB57E2F5202166D06E84EAFC8D2D10D76CC2217C03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 dfa9433a9b38cd3af1627e9378414ffcc8d6c9212a0d5439f128b29e82198193
MD5 831fbd634ee0d90f5b292c3641de3fa7
SHA1 0730518ab3bd5f42bb211b382808bb2051adeedc
SHA512 58fc48a8ba844ec323f38739956446ea93de3c855e53212d08281061c2fa8089fd2043a6b5a1413dfdfbc61d911e8551351bdf9be6654b8638d400c46c527ec6
SSDEEP 192:PRs3D7uUIv7SAPRp27nQxJv9xHsb+WNnheen3ElL42nFlePVyIsnAUge:PRs3WUUvX8QHDwYeUC26e
TLSH
T1E542732ABE607E7F5CDAC21AF9257B57E6F5102161E02E80EAFC897C11D76CC2117817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 673e71812f90b517c7ab0c397baf3485a0160a002e3a7833ed08981a69629404
MD5 6fa55a420e077fc2918b0661ab276ca5
SHA1 f191b9b1372fcd729f612c55225c94ab6268523f
SHA512 68f4ea0a859c1c5124ba8cacbb174e3376d3ccea3cce0ba670cc3a4f9d548464b6dc90a90029312b88c951988a37e48f0e4d7590be038fc79cd7c9a628eb92d7
SSDEEP 192:WRs3D7eCv7z+PRpc7nQG1Mv9xHsb+WNnyfXn3gA8IWyqFleB8yIsnAUgE:WRs32OYXKQ1DwgXwAyygE
TLSH
T1A242A52ABD607D7F6CDAC229F9257B57E6F5202121E02E84EAFC8A3D11D75CC2217817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 22dbf4a0949aa6294cbb02d772e8c43af2fcba80c80e7b8ad396e87095ca94ff
MD5 c9ea6ea582648e253a4ee497e530b657
SHA1 24137c40be6d1741791719856532f8852ef354f6
SHA512 86ef294a0085ca5c8fc871926bedd3d7544e4721bf566e278c6d550d43b409d7a3bc7d570b5065390db72f3b5646ef6526be83b64cc567d670e9e8773084b862
SSDEEP 192:WRs3D7euv7z+PRpc7nQG1Mv9xHsb+WNnyfXnszti/gEFleB8yIsnAUgE:WRs32KYXKQ1DwgXESg6E
TLSH
T1A942942ABD607D7F5CDAC21DF9257B57E6F5202125E02E80EAFC8A2D11E75CC2217817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 0f7c86abd0a0c0b098e436c78c9157adb2aa1b8b264ce56d89c9dab73d0e6d79
MD5 401819ed838609d62bb658e277e0adca
SHA1 cb8984ac7fbcf2f754213fa3c6f390ecd449eec4
SHA512 2d6a93740090cce235aaddc1eb7c035251d60ef74bb75985f157da2e91b2ce63fc697774e65091ff0f0c4caf1416c9411d2d72449c4e1e1c289603326ca3f909
SSDEEP 192:WRe3D7e3v7z+PRpc7nQG1Mv9xHsb+WNnyfXn3gA8d6UfFleB8yIsnAUgE:WRe32fYXKQ1DwgXwAjUpE
TLSH
T13A42A52ABD607D7F5CDAD21AF9257B53E6F5202221E02E80EAFC8A2D11D75CC2217817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 270b3358b45145e16426f25ea00d2f2c5150680631835510c6fa8c181a1f7bbf
MD5 6ab6d4b3e3445141bfcd9af14f26211a
SHA1 e91111cff6d20081b86a0d2c1fbd6d7d3c28dadc
SHA512 a361c1afa10985d692b6da72ead865ecac14deace3bd82dc93e0da5c9069ec5e1c98b5c68af0099cffde4d6b70ee6e2705927a5fa0cd8e23c246087725c9062a
SSDEEP 192:WR6ccBz3D7ahv7z+PRpc7nQGC/MHW9xHsb+WNpvyfXn3gA83mzo8D2aFleB8yIsm:WR6cmz3CxYXKQbDwmXwA4En2Q/f
TLSH
T1CD52941ABD603D7F5DDAC22AF9257B57E2F5202165E02E84EAFC8D2D11E76CC2217807
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 60772841599bf645598b7d81405a9bab90dee79971841ced418ba860c3c25762
MD5 503bf3dc22310d053b9b018c72a10516
SHA1 acbd81a02fa700aa888f0d8cc1c42f289a0551d1
SHA512 4035b5ae96b2b4c011229943dd3ca99a1894f9185d8fdd8f403a3236f757acdb4f2c39814997870348a784e9f96eadba8bfc9eaac580e1e70a6c6fb5827aeb7e
SSDEEP 384:WR6cmI3CfUYXKQQjcDw7+CKDC+XwA4E+3e/g/f:hcmI3CNDw7+CKDCwJ/e
TLSH
T1A462941BBD602D7BADDAC229F915BB57E2F5202166D02E84EAFC8D2D11D76DC2217C03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 a6ee90b0114f560f28023d41c5ecbaaed69246580d0c4328281b0345601809bc
MD5 452b063043227546d92b18d79bfd0d73
SHA1 8425debdd039b6709211f40373ab75b57509de53
SHA512 a0fdf60dd2a8d7c3d651b5a2db9a3bbfe67b0d87e24a8a9824c1a99b53a47974f10da6d5580cb25d857a1814d7c4529292be26cc16a83181abf8cabccce69477
SSDEEP 192:WRs3D7eUIv7z+PRpc7nQG1Mv9xHsb+WNnyfXnsztsLY0FleB8yIsnAUgE:WRs32UUYXKQ1DwgXE6YqE
TLSH
T11442A62ABD607D7F5CDAD219F9257B57E6F5202221D02E84EAFC8A3C11D76CC2217817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 e79efb8717bfcf61b14925981975f07c623d683158e55ec64ca9cd49aee2068b
MD5 eb5d8f9e567c56410343a9c26af45dbb
SHA1 f32df1421583f2005219fb010dfd5183373bacf3
SHA512 164d3af99e6bda16236df92a23925d7d6cd14549b4fac66cdb4806a386b51a116e2f09a1757edd2dec34911244f82bc97baf95fffd6ecb7695348a4bb47f1731
SSDEEP 192:WRJ3D7erv7z+PRpc7nQG1Mv9xHsb+WNnyfXn3gA83mzE1qFleB8yIsnAUg/f:WRJ32TYXKQ1DwgXwA4EE1g/f
TLSH
T11752842ABD603D7F6DDAC219FA257B53E6F5202125D02E84EAFC893D11D75CC2217817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 575488ae74b99d3a8a56c7f1a308dd11a181591a01386d33a86e54cd269cab74
MD5 2efdb65dd4b94411c1a267b021795432
SHA1 90ce708d910cb46aa10cf8baec2099cefc8d284b
SHA512 026edc562f582909de24b1e9513dc72eb06d8020c768837a2d20bfc0a3d307731de25481684c77d27809f0c887b66842cbd230fa026af72c8fde6afb260739df
SSDEEP 192:WRs3D7ebv7z+PRpc7nQG1Mv9xHsb+WNnyfXn3gA8KAcsFleB8yIsnAUgE:WRs32jYXKQ1DwgXwAycCE
TLSH
T18A42942ABD607D7F6CDAC219F9257B57E6F5202121E02E84EAFC8E2D11D76CC2217817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 5157ef82032ceaf9db7573c191649584a3e11a69622ea5c694b6fb5d1fffc646
MD5 b9b95e2ed0712db4438229a2c7bb6440
SHA1 cf5d6c0643c13aa260c7b07da81d1f3ed09aee65
SHA512 f68a999d8378bd58123eeb095dee65adba1bb07d36167de2cdb05eb65fc7ae53512bf3608cce216100163b3e1ee5c224fa555c05b42f83035a1c4bfaeb1d56a0
SSDEEP 192:WR6ccBI3D7ahv7z+PRpc7nQGUN/MXES6P9xHsb+WNpBLSCBM/yfXn3gA83mzo8DN:WR6cmI3CxYXKQecDw7+CZXwA4En2Q/f
TLSH
T19962941ABD602DBF9DDAC229F915BB57E3F5202265D02E84EAFC8D2D11D76DC2217803
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 ff43be3d44f5a268f75ccd01d294e84866efe381c30926b618c3d096e0156085
MD5 2efd174964a61b323936565b97a6a1eb
SHA1 3477ab9ee8d9c4a40b75e73063f8edca396e04d6
SHA512 0d5103d4a73e34ea889a93b37dd975e0534ed3c0750f9dedc78f25cb874f346ca22212c721ed0908a90eb3e9cf6f4d2e22b058f51200b942c52c48da75714709
SSDEEP 192:WRJ3D7eQuv7z+PRpc7nQG1Mv9xHsb+WNnyfXn3gA8J41zyf0FleB8yIsnAUgE:WRJ32zYXKQ1DwgXwAAczyfqE
TLSH
T13042A52ABD607D7F6CDAC219F9257B57E6F5202121E02E84EAFC8E2D11D76CC2217817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 8a17e99a288d5baa59593a32a73d452639119e63363c9811991e8d11754b419d
MD5 53f6507f6b8c1be7d479bd334651bca3
SHA1 1626b3338f39e728ff824791362d15e8a48f87c3
SHA512 12a837aa60b5582e1c961b016bae6cdbbe218447aeacdc0d78e2a00e0905af56f071c990362934bf126cbdaf2782d02a45fa76ce2d7ac96bff5659b7c8d23c52
SSDEEP 384:GsjSN7KxkXqKf/pUZNCgVLH2HfgsloFXODSN+ErU3KXHGL7vLaBsS0:GgSN7KxkXqKf/pUZNCgVLH2HfgsiBO+a
TLSH
T1D0521A67684C9A3F0FD8D94CCC167F4FADB6025666684D2853FBAC0803957CB120A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 96B
SHA256 ec7d051e88968b27d166887fa18e310884150515fb8bc02ee234cb8fc79df4b6
MD5 4243eb56c578f2a8f4866557d07485ea
SHA1 7b47d4c34114f6f846d657b11b7ccfe970fe563f
SHA512 dfc5295b4ea964ca2e2bd45b34df4465aa4728a04d831c4e876c9e47ef03f771649dfa3cc5eedb1da810ca6e7d79bc9142bce06ec6a75ba4f5d44426c3f56822
TLSH
T14EB022000820AA02C8C00BB003C80CC833B08E3C2F8BCC0B02A2C22C83832038BC02C3
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 70b0f36356501be66136c58feaef7b6dfb1923346a0215c397545ce22ff87094
MD5 43087b5742185001281c6e1e08c48e30
SHA1 a40fe099338f9d594fe57f0eb86a042dd4862905
SHA512 b0ef54dfe76b0f25eeb3beeee129ff6d47c9224634e83d41052ad0aebba6ba1e1927cf53c6ca4f0f12d5d4d74a25865bb3e7efa4eff249e8510f6044c937b535
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 2fd4835eae094ac25eb602a9ae38e2ce46b78f98f1ab5b9560e8cf9941891a79
MD5 5590d6d70b51c1ef28247835e53f0c63
SHA1 f1ca6568c09d59a0099ca58bf9b951f7fc83ccf6
SHA512 c0942c976e7f1df2032d56200e8da69ac8b3a028fd08af8dd1ca693abd809c00f12e129db1300d01608f1b7ce14d15bb3ca8751f2cf139f0a461893ebd0edbf2
TLSH
T12EA00294A6C00821DE12627076E50D812AD65D5519555347559D9C46896B1C18319E04
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 134KB
SHA256 924b49ef8059fd00782e986a931e9236b1d49a9c04b14f715be91966ac9e3aee
MD5 48d17892874f342fe4097f4094c4072f
SHA1 65119004814ab7277076a2bf62b2ec5ee9db5a5e
SHA512 2c2e62e8c588ce708c29c5e55e331f8632b42788a212b127b5ff828dcf8f2489930377bff54bc2fe3fed20cf47330601c799a57e526c4beb1211b05b2bea525d
SSDEEP 3072:sAh4di2XC4pU/jejEChAIeRsXSFSKWm7GGeQHo3qxmvwIZ:paG4pEejPhAIuNWmTETIIZ
TLSH
T1D8D312362E6D9279CEEE9239915719261C584CBBC88A1F8C1DCC1F8F54DB5C85E2AF30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 133KB
SHA256 7a698b0750468cb9f906855c100544dfab88d15548552602a81ce3a51775ac19
MD5 2789fc2e910b0fa9c7b106e8c1313747
SHA1 5c26e7ad28d58812add62494c36d46d1132054c2
SHA512 2ab9bfc6ee91296105f3ec4a5797d81f6a5574af04e763366b0c5a11f737657435583ad3085708d13fd9833fbe3f5537367ff32b7165d60c57a406737c59f3be
SSDEEP 3072:FFh4di2XC4pU/jejEChAIeRsXSFSKWm7GGeQHo3qxmvwIZ:zaG4pEejPhAIuNWmTETIIZ
TLSH
T132D312262F7DD639CEDED23DA157152A281808B6C48A0BD81ACD1E9F54DB5C85B3AF30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 134KB
SHA256 82a6c1a5ea853c1ea289b7dd76f440782c94fac43915d5e435445756a537c5e0
MD5 d2672f3410310823e8e120d7d950098d
SHA1 aba613c78c1cfc0e27d9f2aca2921ee8c3cb325c
SHA512 f9bae660872da183ef078fcd2d5bf3af212accb106fe1b5313146594469dc8c1b45b1e87c0b4110120844c062170f2c132ad2f90239e4c494f7e4fc17356b178
SSDEEP 3072:oBh4di2XC4pU/jejEChAIeRsXSFSKWm7GGeQHo3qxmvwIZ:8aG4pEejPhAIuNWmTETIIZ
TLSH
T101D312362E6D9279CEEE9239915719261C584CBBC88A1F8C1DCC1E8F54DB5C85E2AF30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 134KB
SHA256 81fea0220e1a9a2510e855f7c199e6b4bbddc4df5c5365049db540b5a1492caa
MD5 f6d46f01d23bd3215b61063795eb654f
SHA1 2dddf96a08424a3c44393a6a80006a3f93408a81
SHA512 0c74af78d1d8b58e79976c1ba7ef6650bf8e2774c18f9dc9fb25846d0c76fef78823b6b5df14771bad53c7fe283364d88426ef3bfeb8c58b49448fb44adeefb1
SSDEEP 3072:sah4di2XC4pU/jejEChAIeRsXSFSKWm7GGeQHo3qxmvwIZ:naG4pEejPhAIuNWmTETIIZ
TLSH
T170D312362E6D9279CEAE9239915719261C584CBBC88A1F8C1DCC1E8F54DB5C85E2AF30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 473ac49dcb44ba8aa3a20baaad3ff63ec4294e8112b0047772965623da768469
MD5 1d72eba64b6b31e0cf9dbf93db25228a
SHA1 4433afa39749455ddb7c9b12b40d7e568d815b39
SHA512 85ff552867e8aa9995854e7813258fa8e6ec85c62785b497c9ea7b3f1528f9a577e9bc2bcf69a8a653a1802f7f5d7015028824441389ae2981f4c9d0b3cfec91
SSDEEP 96:fC6wd+7N0X7jVYVfGTVnsERDotok5XAhDdjB6FGyvoD3Emwm+Tbv4v4a:fCTESKkdDUDXkd9Bp4mwm+Tbvi
TLSH
T133A1F731B8B99C7B55FAD888B8522E43CFA4307BD562AE94E9DD5F0C14E70EC1341927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 134KB
SHA256 d9671d148f8670a5fa1cb6135721f968eb6a55d1b9533b1750858e62cb7962d3
MD5 e718f1b1c894e7eea6f76e377aa3e131
SHA1 9805188a3020d3471cbcb407a04d9d60ca5385e6
SHA512 3e9c1116c394f85e5984aaf6b2a06bd3503485b609b8951b792b7d83eeaf3aaceb906298190c84187507b1bdaddddf92cb255bf22bb6e45218cbb6a41ec0040b
SSDEEP 3072:orh4di2XC4pU/jejEChAIeRsXSFSKWm7GGeQHo3qxmvwIZ:6aG4pEejPhAIuNWmTETIIZ
TLSH
T1CAD312362E6D9279CEEED239915719261C584CBBC88A1F8C1DCC1E8F54DB5C85E2AF30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 133KB
SHA256 af926b5085af6ba1b31017697085b22433db71f752cbaf5ec5a81f946829e16e
MD5 766935ea82fd517c28eacef266d3235b
SHA1 42b994a79f2be58dfeaedb14e2aace9dbc0d5897
SHA512 308de03aa84600b95f545e0f958670a5ad4ceae6350a9d5a27fe1dde6be52ca89f303cc0fc0b69227238c0ceb2c79dad23fa6c0159c8a649369c7b09d5be7f20
SSDEEP 3072:oFh4di2XC4pU/jejEChAIeRsXSFSKWm7GGeQHo3qxmvwIZ:KaG4pEejPhAIuNWmTETIIZ
TLSH
T1C4D312262F7DD639CEDED23DA157153A281808B6C48A0BD81ACD1E9F54DB5C85B3AF30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 134KB
SHA256 aeea52465453ad13f3901eedf48c7d0d209c2a18e0558f97fc6ec60284730fd9
MD5 fbfa439e1d23f24f5c8a0aa7bd142d82
SHA1 1d95ae895a2f15c8a3968dcb62cbeb33907c8b7c
SHA512 dc2fb5398be460c71a8f59bdf8d6e030aef59c2bc9f757f9cf19f723509e23b8ea60761a50160d8e7c695a81cccbde06589f7d879ba89a2615d4aac463846ee7
SSDEEP 3072:sBh4di2XC4pU/jejEChAIeRsXSFSKWm7GGeQHo3qxmvwIZ:IaG4pEejPhAIuNWmTETIIZ
TLSH
T1DED312362E6D9279CEEE9239915719261C584CBBC88A1F8C1DCC1F8F54DB5C85E2AF30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 133KB
SHA256 87df31958baf258178408e34e5db72298b20843aa0953a6034b56553c6e93832
MD5 fae530ff8324d4a0c599ac440f03e839
SHA1 764505a05f7ddb383cf4648a22f1ab07334155a2
SHA512 14e856e59098d2eec14e86197eedb3fca45785a37ba565d2b0e85d7b8114fa27f6bdd10a386e80895229d3c75268649426f91dc6b1ffc4908087dc9b1d3873ca
SSDEEP 3072:F8h4di2XC4pU/jejEChAIeRsXSFSKWm7GGeQHo3qxmvwIZ:GaG4pEejPhAIuNWmTETIIZ
TLSH
T1E6D312262F7DD639CEDED23DA157152A28180CB6C48A0BD81ACD1E9F54DB5C85B3AF30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 591B
SHA256 dc216c11d6381abdcb6a4b927fd9ea68d336ff63c88639e4a242acf037f90c68
MD5 03c08670d283322f0e61ee3d5dcb7bad
SHA1 c82040e59df0159f5cc0fd8cc795d4b73c1bf5e2
SHA512 173493c828071e601a1d823c4c0f325c638aec3166c071a8b39dbb7ce57d84903415b051a5effc6bdd5ea4d2f9dcf8471bcb380a37133ede15ab2017cb2b1986
TLSH
T19BF09707E7A55221C0222638888116F02B25D5D68ECB227381016B5E7EB33002B008B4
MD5 SHA1 SHA512 TLSH

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 599B
SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
MD5 658ab8c32d4cc5deb36ac5f63da4658b
SHA1 30c12cd871ff0c2c4098d794e9ae4f2540586813
SHA512 a73030c008ef3c2e274f11c90bfe79fa8ae402f76801c710bed8cc1ab1218a84858ea566b772be4bade8ef639a019c57d297028df15b64b3753482cf0f3c8f85
TLSH
T12AF05C83EB6A1B72C456123DC8EE56E47B31D1846EC11367A2107B1D3C2B7192D174BD
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2396_1876351502\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

default.exc

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.exc
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

memory/828-1539-0x000002A794490000-0x000002A7944B0000-memory.dmp

Download

memory/828-1508-0x000002A794130000-0x000002A794230000-memory.dmp

Download

memory/828-1507-0x000002A781A50000-0x000002A781A70000-memory.dmp

Download

memory/828-1520-0x000002A781D70000-0x000002A781D90000-memory.dmp

Download

memory/828-1493-0x000002A7801E0000-0x000002A7802E0000-memory.dmp

Download