a362afb7859675118b24afd7d0667d9b8b68d3ab17d5a5d50299c996226534f9

Analysis

geolocation tags

nanew-jerseynorth-americaunited-statesususa
user interaction
yes
max time kernel
901s
max time network
915s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/09/2026, 03:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SSORIG/SecretServiceOriginalOffline.exe
Size 62.1MB
Sample260928-dr286steqd
SHA256 a362afb7859675118b24afd7d0667d9b8b68d3ab17d5a5d50299c996226534f9
MD5 c443cb5e6adf1bd8fcfb457ecc364013
SHA1 ebc95ea0315c9dfc8771e3738a8956aa96d99552
SHA512 fa93959f9cd3eacf1707ac88569c5d2b8f6686c3c0894209ba467b39e75912108c660adac8205fc06efebb7b81976437916ae31bf315a0ac943b246f4ce6502b
SSDEEP 393216:UmNYgUw6pz9uRq/QahhdIUcq9gqS4SzWUw6pz9uRq/QahhdIUch9gqS4SzrUw6pe:h1q984H1h984sF4Nw4
TLSH
T16FE77BD276E5D098C126D1B9CE02E6EFD66F7C298F2069DB36D0375F5A33990263A700
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware discovery persistence ransomware spyware

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
95	4804	chrome.exe

Executes dropped EXE 1 IoCs

pid	Process
5768	Portmaster_2.2.3_x64-setup.exe

Loads dropped DLL 2 IoCs

pid	Process
5768	Portmaster_2.2.3_x64-setup.exe
5768	Portmaster_2.2.3_x64-setup.exe

Enumerates connected drives 3 TTPs 4 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe
	\??\F:\	explorer.exe
	\??\E:\	explorer.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Portmaster_2.2.3_x64-setup.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4804	chrome.exe

Checks SCSI registry key(s) 3 TTPs 62 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	explorer.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000\Software\Microsoft\Internet Explorer\Main	explorer.exe

Modifies data under HKEY_USERS 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe

Modifies registry class 45 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1262770251-41185387-1005173349-1000\{62FFC770-42E1-4B7A-8705-543E13012368}	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1262770251-41185387-1005173349-1000\{D21EA8B1-4A24-4A7A-8637-0C9EFCCA905F}	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23"	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23"	SearchHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1262770251-41185387-1005173349-1000\{5924A88F-D526-4D01-801D-8251CD2282E0}	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	StartMenuExperienceHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56"	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Local Settings	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	StartMenuExperienceHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Local Settings\MuiCache	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe

Suspicious behavior: EnumeratesProcesses 56 IoCs

pid	Process
5988	SecretServiceOriginalOffline.exe
5988	SecretServiceOriginalOffline.exe
5988	SecretServiceOriginalOffline.exe
5988	SecretServiceOriginalOffline.exe
5988	SecretServiceOriginalOffline.exe
5988	SecretServiceOriginalOffline.exe
5988	SecretServiceOriginalOffline.exe
5988	SecretServiceOriginalOffline.exe
5988	SecretServiceOriginalOffline.exe
5988	SecretServiceOriginalOffline.exe
5988	SecretServiceOriginalOffline.exe
5988	SecretServiceOriginalOffline.exe
5988	SecretServiceOriginalOffline.exe
5988	SecretServiceOriginalOffline.exe
5988	SecretServiceOriginalOffline.exe
5988	SecretServiceOriginalOffline.exe
5988	SecretServiceOriginalOffline.exe
5988	SecretServiceOriginalOffline.exe
5988	SecretServiceOriginalOffline.exe
5988	SecretServiceOriginalOffline.exe
5988	SecretServiceOriginalOffline.exe
5988	SecretServiceOriginalOffline.exe
5988	SecretServiceOriginalOffline.exe
5988	SecretServiceOriginalOffline.exe
5988	SecretServiceOriginalOffline.exe
5988	SecretServiceOriginalOffline.exe
5988	SecretServiceOriginalOffline.exe
5988	SecretServiceOriginalOffline.exe
5988	SecretServiceOriginalOffline.exe
5988	SecretServiceOriginalOffline.exe
5988	SecretServiceOriginalOffline.exe
5988	SecretServiceOriginalOffline.exe
5988	SecretServiceOriginalOffline.exe
5988	SecretServiceOriginalOffline.exe
5988	SecretServiceOriginalOffline.exe
5988	SecretServiceOriginalOffline.exe
5988	SecretServiceOriginalOffline.exe
5988	SecretServiceOriginalOffline.exe
5988	SecretServiceOriginalOffline.exe
5988	SecretServiceOriginalOffline.exe
5988	SecretServiceOriginalOffline.exe
5988	SecretServiceOriginalOffline.exe
5988	SecretServiceOriginalOffline.exe
5988	SecretServiceOriginalOffline.exe
5988	SecretServiceOriginalOffline.exe
5988	SecretServiceOriginalOffline.exe
5988	SecretServiceOriginalOffline.exe
5988	SecretServiceOriginalOffline.exe
5508	chrome.exe
5508	chrome.exe
5508	chrome.exe
5508	chrome.exe
4184	chrome.exe
4184	chrome.exe
2784	explorer.exe
2784	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5988	SecretServiceOriginalOffline.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 19 IoCs

pid	Process
5508	chrome.exe
5508	chrome.exe
5508	chrome.exe
5508	chrome.exe
5508	chrome.exe
5508	chrome.exe
5508	chrome.exe
5508	chrome.exe
5508	chrome.exe
5508	chrome.exe
5508	chrome.exe
5508	chrome.exe
5508	chrome.exe
5508	chrome.exe
5508	chrome.exe
5508	chrome.exe
5508	chrome.exe
5508	chrome.exe
5508	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5508	chrome.exe
Token: SeCreatePagefilePrivilege	5508	chrome.exe
Token: SeShutdownPrivilege	5508	chrome.exe
Token: SeCreatePagefilePrivilege	5508	chrome.exe
Token: SeShutdownPrivilege	5508	chrome.exe
Token: SeCreatePagefilePrivilege	5508	chrome.exe
Token: SeShutdownPrivilege	5508	chrome.exe
Token: SeCreatePagefilePrivilege	5508	chrome.exe
Token: SeShutdownPrivilege	5508	chrome.exe
Token: SeCreatePagefilePrivilege	5508	chrome.exe
Token: SeShutdownPrivilege	5508	chrome.exe
Token: SeCreatePagefilePrivilege	5508	chrome.exe
Token: SeShutdownPrivilege	5508	chrome.exe
Token: SeCreatePagefilePrivilege	5508	chrome.exe
Token: SeShutdownPrivilege	5508	chrome.exe
Token: SeCreatePagefilePrivilege	5508	chrome.exe
Token: SeShutdownPrivilege	5508	chrome.exe
Token: SeCreatePagefilePrivilege	5508	chrome.exe
Token: SeShutdownPrivilege	5508	chrome.exe
Token: SeCreatePagefilePrivilege	5508	chrome.exe
Token: SeShutdownPrivilege	5508	chrome.exe
Token: SeCreatePagefilePrivilege	5508	chrome.exe
Token: SeShutdownPrivilege	5508	chrome.exe
Token: SeCreatePagefilePrivilege	5508	chrome.exe
Token: SeShutdownPrivilege	5508	chrome.exe
Token: SeCreatePagefilePrivilege	5508	chrome.exe
Token: SeShutdownPrivilege	5508	chrome.exe
Token: SeCreatePagefilePrivilege	5508	chrome.exe
Token: SeShutdownPrivilege	5508	chrome.exe
Token: SeCreatePagefilePrivilege	5508	chrome.exe
Token: SeShutdownPrivilege	5508	chrome.exe
Token: SeCreatePagefilePrivilege	5508	chrome.exe
Token: SeShutdownPrivilege	5508	chrome.exe
Token: SeCreatePagefilePrivilege	5508	chrome.exe
Token: SeShutdownPrivilege	5508	chrome.exe
Token: SeCreatePagefilePrivilege	5508	chrome.exe
Token: SeShutdownPrivilege	5508	chrome.exe
Token: SeCreatePagefilePrivilege	5508	chrome.exe
Token: SeShutdownPrivilege	5508	chrome.exe
Token: SeCreatePagefilePrivilege	5508	chrome.exe
Token: SeShutdownPrivilege	5508	chrome.exe
Token: SeCreatePagefilePrivilege	5508	chrome.exe
Token: SeShutdownPrivilege	5508	chrome.exe
Token: SeCreatePagefilePrivilege	5508	chrome.exe
Token: SeShutdownPrivilege	5508	chrome.exe
Token: SeCreatePagefilePrivilege	5508	chrome.exe
Token: SeShutdownPrivilege	5508	chrome.exe
Token: SeCreatePagefilePrivilege	5508	chrome.exe
Token: SeShutdownPrivilege	5508	chrome.exe
Token: SeCreatePagefilePrivilege	5508	chrome.exe
Token: SeShutdownPrivilege	5508	chrome.exe
Token: SeCreatePagefilePrivilege	5508	chrome.exe
Token: SeShutdownPrivilege	5508	chrome.exe
Token: SeCreatePagefilePrivilege	5508	chrome.exe
Token: SeShutdownPrivilege	5508	chrome.exe
Token: SeCreatePagefilePrivilege	5508	chrome.exe
Token: SeShutdownPrivilege	5508	chrome.exe
Token: SeCreatePagefilePrivilege	5508	chrome.exe
Token: SeShutdownPrivilege	5508	chrome.exe
Token: SeCreatePagefilePrivilege	5508	chrome.exe
Token: SeShutdownPrivilege	5508	chrome.exe
Token: SeCreatePagefilePrivilege	5508	chrome.exe
Token: SeShutdownPrivilege	5508	chrome.exe
Token: SeCreatePagefilePrivilege	5508	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
5508	chrome.exe
5508	chrome.exe
5508	chrome.exe
5508	chrome.exe
5508	chrome.exe
5508	chrome.exe
5508	chrome.exe
5508	chrome.exe
5508	chrome.exe
5508	chrome.exe
5508	chrome.exe
5508	chrome.exe
5508	chrome.exe
5508	chrome.exe
5508	chrome.exe
5508	chrome.exe
5508	chrome.exe
5508	chrome.exe
5508	chrome.exe
5508	chrome.exe
5508	chrome.exe
5508	chrome.exe
5508	chrome.exe
5508	chrome.exe
5508	chrome.exe
5508	chrome.exe
5508	chrome.exe
5508	chrome.exe
5508	chrome.exe
5508	chrome.exe
5508	chrome.exe
5508	chrome.exe
5508	chrome.exe
5508	chrome.exe
5508	chrome.exe
5508	chrome.exe
5508	chrome.exe
5508	chrome.exe
5508	chrome.exe
5508	chrome.exe
5508	chrome.exe
5508	chrome.exe
5508	chrome.exe
5508	chrome.exe
5508	chrome.exe
5508	chrome.exe
5508	chrome.exe
5508	chrome.exe
5508	chrome.exe
5508	chrome.exe
5508	chrome.exe
5508	chrome.exe
5508	chrome.exe
5508	chrome.exe
5508	chrome.exe
5508	chrome.exe
5508	chrome.exe
5508	chrome.exe
5508	chrome.exe
5508	chrome.exe
5508	chrome.exe
5508	chrome.exe
5508	chrome.exe
5508	chrome.exe

Suspicious use of SendNotifyMessage 61 IoCs

pid	Process
5508	chrome.exe
5508	chrome.exe
5508	chrome.exe
5508	chrome.exe
5508	chrome.exe
5508	chrome.exe
5508	chrome.exe
5508	chrome.exe
5508	chrome.exe
5508	chrome.exe
5508	chrome.exe
5508	chrome.exe
5508	chrome.exe
5508	chrome.exe
5508	chrome.exe
5508	chrome.exe
2784	explorer.exe
2784	explorer.exe
2784	explorer.exe
2784	explorer.exe
2784	explorer.exe
2784	explorer.exe
2784	explorer.exe
2784	explorer.exe
2784	explorer.exe
2784	explorer.exe
2784	explorer.exe
2784	explorer.exe
2784	explorer.exe
2784	explorer.exe
2784	explorer.exe
2784	explorer.exe
2784	explorer.exe
2784	explorer.exe
2784	explorer.exe
2784	explorer.exe
2784	explorer.exe
2784	explorer.exe
2784	explorer.exe
2784	explorer.exe
2784	explorer.exe
2784	explorer.exe
2784	explorer.exe
2784	explorer.exe
2784	explorer.exe
2784	explorer.exe
2784	explorer.exe
2784	explorer.exe
2784	explorer.exe
2784	explorer.exe
2784	explorer.exe
2784	explorer.exe
2784	explorer.exe
2784	explorer.exe
2784	explorer.exe
2784	explorer.exe
2784	explorer.exe
2784	explorer.exe
2784	explorer.exe
2784	explorer.exe
2784	explorer.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
932	StartMenuExperienceHost.exe
2540	SearchHost.exe
2784	explorer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5508 wrote to memory of 5516	5508	chrome.exe	92
PID 5508 wrote to memory of 6056	5508	chrome.exe	93
PID 5508 wrote to memory of 4804	5508	chrome.exe	94
PID 5508 wrote to memory of 6056	5508	chrome.exe	93
PID 5508 wrote to memory of 3160	5508	chrome.exe	96
PID 5508 wrote to memory of 3160	5508	chrome.exe	96
PID 5508 wrote to memory of 3884	5508	chrome.exe	97
PID 5508 wrote to memory of 6048	5508	chrome.exe	98
PID 5508 wrote to memory of 3884	5508	chrome.exe	97
PID 5508 wrote to memory of 6048	5508	chrome.exe	98
PID 5508 wrote to memory of 2108	5508	chrome.exe	99
PID 5508 wrote to memory of 2108	5508	chrome.exe	99
PID 5508 wrote to memory of 3452	5508	chrome.exe	100
PID 5508 wrote to memory of 3452	5508	chrome.exe	100
PID 5508 wrote to memory of 6080	5508	chrome.exe	101
PID 5508 wrote to memory of 6080	5508	chrome.exe	101
PID 5508 wrote to memory of 2368	5508	chrome.exe	102
PID 5508 wrote to memory of 2368	5508	chrome.exe	102
PID 5508 wrote to memory of 3092	5508	chrome.exe	103
PID 5508 wrote to memory of 4432	5508	chrome.exe	104
PID 5508 wrote to memory of 4344	5508	chrome.exe	105
PID 5508 wrote to memory of 4432	5508	chrome.exe	104
PID 5508 wrote to memory of 4344	5508	chrome.exe	105
PID 5508 wrote to memory of 3736	5508	chrome.exe	106
PID 5508 wrote to memory of 3736	5508	chrome.exe	106
PID 5508 wrote to memory of 2424	5508	chrome.exe	107
PID 5508 wrote to memory of 2424	5508	chrome.exe	107
PID 5508 wrote to memory of 4216	5508	chrome.exe	109
PID 5508 wrote to memory of 4216	5508	chrome.exe	109
PID 5508 wrote to memory of 1432	5508	chrome.exe	110
PID 5508 wrote to memory of 1432	5508	chrome.exe	110
PID 5508 wrote to memory of 5000	5508	chrome.exe	111
PID 5508 wrote to memory of 5000	5508	chrome.exe	111
PID 5508 wrote to memory of 2612	5508	chrome.exe	112
PID 5508 wrote to memory of 2612	5508	chrome.exe	112
PID 5508 wrote to memory of 3568	5508	chrome.exe	113
PID 5508 wrote to memory of 3568	5508	chrome.exe	113
PID 5508 wrote to memory of 2716	5508	chrome.exe	116
PID 5508 wrote to memory of 2716	5508	chrome.exe	116
PID 5508 wrote to memory of 2064	5508	chrome.exe	117
PID 5508 wrote to memory of 2064	5508	chrome.exe	117
PID 5508 wrote to memory of 5024	5508	chrome.exe	118
PID 5508 wrote to memory of 5024	5508	chrome.exe	118
PID 5508 wrote to memory of 1744	5508	chrome.exe	119
PID 5508 wrote to memory of 1744	5508	chrome.exe	119
PID 5508 wrote to memory of 4560	5508	chrome.exe	120
PID 5508 wrote to memory of 4560	5508	chrome.exe	120
PID 5508 wrote to memory of 2432	5508	chrome.exe	121
PID 5508 wrote to memory of 2432	5508	chrome.exe	121
PID 5508 wrote to memory of 5620	5508	chrome.exe	122
PID 5508 wrote to memory of 5620	5508	chrome.exe	122
PID 5508 wrote to memory of 5000	5508	chrome.exe	123
PID 5508 wrote to memory of 1208	5508	chrome.exe	124
PID 5508 wrote to memory of 1208	5508	chrome.exe	124
PID 5508 wrote to memory of 3876	5508	chrome.exe	125
PID 5508 wrote to memory of 3876	5508	chrome.exe	125
PID 5508 wrote to memory of 1612	5508	chrome.exe	126
PID 5508 wrote to memory of 1612	5508	chrome.exe	126
PID 5508 wrote to memory of 5060	5508	chrome.exe	127
PID 5508 wrote to memory of 5060	5508	chrome.exe	127
PID 5508 wrote to memory of 6120	5508	chrome.exe	128
PID 5508 wrote to memory of 5276	5508	chrome.exe	129
PID 5508 wrote to memory of 5556	5508	chrome.exe	130
PID 5508 wrote to memory of 204	5508	chrome.exe	131

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\SSORIG\SecretServiceOriginalOffline.exe
"C:\Users\Admin\AppData\Local\Temp\SSORIG\SecretServiceOriginalOffline.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
PID:5988

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0xa4,0x134,0x7ff8b741c728,0x7ff8b741c734,0x7ff8b741c740
  2⤵
  PID:5516
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1636,i,8647531571454617789,14034147148213576625,262144 --field-trial-handle=1932,i,7758791949650906711,13344112598482615073,262144 --variations-seed-version --mojo-platform-channel-handle=1928 /prefetch:2
  2⤵
  PID:6056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1864,i,5145962700349510375,16241687032748160522,524288 --field-trial-handle=1932,i,7758791949650906711,13344112598482615073,262144 --variations-seed-version --mojo-platform-channel-handle=1984 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:4804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2312,i,10531429228688538775,11490183557626546600,524288 --field-trial-handle=1932,i,7758791949650906711,13344112598482615073,262144 --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:13
  2⤵
  PID:3160
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3256,i,1153872559855414660,210822531109154951,2097152 --field-trial-handle=1932,i,7758791949650906711,13344112598482615073,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:3884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3320,i,4736680468097782982,827356477109184567,2097152 --field-trial-handle=1932,i,7758791949650906711,13344112598482615073,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:6048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4684,i,7440653462199857830,11678961270378834898,2097152 --field-trial-handle=1932,i,7758791949650906711,13344112598482615073,262144 --variations-seed-version --mojo-platform-channel-handle=4700 /prefetch:1
  2⤵
  PID:2108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4864,i,4858664441005634887,4002067097911154213,524288 --field-trial-handle=1932,i,7758791949650906711,13344112598482615073,262144 --variations-seed-version --mojo-platform-channel-handle=4848 /prefetch:14
  2⤵
  PID:3452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4888,i,11388674448230160061,13967519238576431978,524288 --field-trial-handle=1932,i,7758791949650906711,13344112598482615073,262144 --variations-seed-version --mojo-platform-channel-handle=4856 /prefetch:14
  2⤵
  PID:6080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5044,i,12970885723375963812,10655319877292594525,524288 --field-trial-handle=1932,i,7758791949650906711,13344112598482615073,262144 --variations-seed-version --mojo-platform-channel-handle=5056 /prefetch:14
  2⤵
  PID:2368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5400,i,6453768426615646034,11640627605465509402,524288 --field-trial-handle=1932,i,7758791949650906711,13344112598482615073,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:14
  2⤵
  PID:3092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5492,i,15783461632841655310,2382117685936504098,2097152 --field-trial-handle=1932,i,7758791949650906711,13344112598482615073,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:1
  2⤵
  PID:4432
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5504,i,4352850293810025079,7782194678640595364,2097152 --field-trial-handle=1932,i,7758791949650906711,13344112598482615073,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:1
  2⤵
  PID:4344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5804,i,4343599225714512803,10731964459026830472,2097152 --field-trial-handle=1932,i,7758791949650906711,13344112598482615073,262144 --variations-seed-version --mojo-platform-channel-handle=5492 /prefetch:1
  2⤵
  PID:3736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5816,i,11778775701154640111,7271228606952335374,2097152 --field-trial-handle=1932,i,7758791949650906711,13344112598482615073,262144 --variations-seed-version --mojo-platform-channel-handle=5484 /prefetch:1
  2⤵
  PID:2424
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6104,i,15592736202708540387,3529332980494794502,2097152 --field-trial-handle=1932,i,7758791949650906711,13344112598482615073,262144 --variations-seed-version --mojo-platform-channel-handle=5804 /prefetch:1
  2⤵
  PID:4216
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6248,i,13121778599288329546,16552116038149089545,2097152 --field-trial-handle=1932,i,7758791949650906711,13344112598482615073,262144 --variations-seed-version --mojo-platform-channel-handle=6260 /prefetch:1
  2⤵
  PID:1432
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6332,i,13268905279854809374,371827661768124678,2097152 --field-trial-handle=1932,i,7758791949650906711,13344112598482615073,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:1
  2⤵
  PID:5000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=5488,i,12170134010612504149,16225196555538656101,2097152 --field-trial-handle=1932,i,7758791949650906711,13344112598482615073,262144 --variations-seed-version --mojo-platform-channel-handle=6248 /prefetch:1
  2⤵
  PID:2612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6452,i,13522671497395219073,314493481023562615,524288 --field-trial-handle=1932,i,7758791949650906711,13344112598482615073,262144 --variations-seed-version --mojo-platform-channel-handle=6352 /prefetch:14
  2⤵
  PID:3568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6632,i,8290874949863486303,7252963850855476705,524288 --field-trial-handle=1932,i,7758791949650906711,13344112598482615073,262144 --variations-seed-version --mojo-platform-channel-handle=6812 /prefetch:14
  2⤵
  PID:2716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6592,i,945537740677446419,15650889936375209876,2097152 --field-trial-handle=1932,i,7758791949650906711,13344112598482615073,262144 --variations-seed-version --mojo-platform-channel-handle=6916 /prefetch:1
  2⤵
  PID:2064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6452,i,10831313292633470596,4649436754103618943,524288 --field-trial-handle=1932,i,7758791949650906711,13344112598482615073,262144 --variations-seed-version --mojo-platform-channel-handle=6588 /prefetch:14
  2⤵
  PID:5024
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=6692,i,11483455958241022095,3518278072372632817,2097152 --field-trial-handle=1932,i,7758791949650906711,13344112598482615073,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:9
  2⤵
  PID:1744
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=3504,i,16512282792065356309,17059131380733348777,2097152 --field-trial-handle=1932,i,7758791949650906711,13344112598482615073,262144 --variations-seed-version --mojo-platform-channel-handle=4712 /prefetch:1
  2⤵
  PID:4560
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=6996,i,11457885985365732472,11056618720393267651,2097152 --field-trial-handle=1932,i,7758791949650906711,13344112598482615073,262144 --variations-seed-version --mojo-platform-channel-handle=6972 /prefetch:1
  2⤵
  PID:2432
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=6916,i,11931832975057041656,4304650594694101603,2097152 --field-trial-handle=1932,i,7758791949650906711,13344112598482615073,262144 --variations-seed-version --mojo-platform-channel-handle=6696 /prefetch:1
  2⤵
  PID:5620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3948,i,2170366191712560455,2490256149042241803,524288 --field-trial-handle=1932,i,7758791949650906711,13344112598482615073,262144 --variations-seed-version --mojo-platform-channel-handle=4744 /prefetch:14
  2⤵
  - Modifies registry class
  PID:5000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=4788,i,7688461334387074842,11151611109172139607,524288 --field-trial-handle=1932,i,7758791949650906711,13344112598482615073,262144 --variations-seed-version --mojo-platform-channel-handle=4764 /prefetch:12
  2⤵
  PID:1208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --metrics-shmem-handle=6244,i,15308842498862706730,10903690318689485755,2097152 --field-trial-handle=1932,i,7758791949650906711,13344112598482615073,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:1
  2⤵
  PID:3876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --metrics-shmem-handle=6428,i,16583133665610146994,6823927697988977109,2097152 --field-trial-handle=1932,i,7758791949650906711,13344112598482615073,262144 --variations-seed-version --mojo-platform-channel-handle=6844 /prefetch:1
  2⤵
  PID:1612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --metrics-shmem-handle=5588,i,1151282181154666708,13526839483122291793,2097152 --field-trial-handle=1932,i,7758791949650906711,13344112598482615073,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
  2⤵
  PID:5060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6152,i,6778331638453765851,2675147728239563480,524288 --field-trial-handle=1932,i,7758791949650906711,13344112598482615073,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:14
  2⤵
  PID:6120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6164,i,539259630462656240,4262498348224790216,524288 --field-trial-handle=1932,i,7758791949650906711,13344112598482615073,262144 --variations-seed-version --mojo-platform-channel-handle=6012 /prefetch:14
  2⤵
  PID:5276
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6176,i,12091969905180131428,13138046275032714878,524288 --field-trial-handle=1932,i,7758791949650906711,13344112598482615073,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:14
  2⤵
  PID:5556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6056,i,17308636358786083321,824570726107516622,524288 --field-trial-handle=1932,i,7758791949650906711,13344112598482615073,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:14
  2⤵
  PID:204
- C:\Users\Admin\Downloads\Portmaster_2.2.3_x64-setup.exe
  "C:\Users\Admin\Downloads\Portmaster_2.2.3_x64-setup.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:5768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5708,i,1736924650027667818,6296425900216543112,262144 --field-trial-handle=1932,i,7758791949650906711,13344112598482615073,262144 --variations-seed-version --mojo-platform-channel-handle=6796 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=1532,i,13181227507990175045,7807885446940786896,524288 --field-trial-handle=1932,i,7758791949650906711,13344112598482615073,262144 --variations-seed-version --mojo-platform-channel-handle=1224 /prefetch:14
  2⤵
  PID:1484

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3556

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2136

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:5128

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3576

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:3132
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Enumerates connected drives
  - Checks SCSI registry key(s)
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:2784

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:932

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2540

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:4084

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_00002b

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00002b
Size 384KB
SHA256 1a41fdc28f66f79440cbe93a2de1b16e3d23030f38e02d391322150761a4cc44
MD5 fdf08c43e0acbbd29ec447f28421c1f7
SHA1 ed0e4b7a0f063a6962198e04eab67996f1b6a87b
SHA512 1f9b4e7081886ba58d671dc6076fa9f25a609cb4ced2af4cad91e49beeb16378ab6b0e5c2531769062ca4e688b90ebedf091c0edbfbc01e9cf989b447c6dc0c9
SSDEEP 12288:LYcCPpUA9KwSk7ipaN2oPc7s832fh6Ud6:LYNUA9Kw3+j3Q6U0
TLSH
T1C98423AE2679C9C0B6877FAA31CDA18F49FC2119397B45717943B6F81043BA3D5023CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 0e640e97b83fba0455b9cccbecd46780fdbf841017795c7a026edc39f7e8485a
MD5 a757cf337448c1ae1cde9b95df21d6ac
SHA1 79b0443202400a75849c5d07a52ff70d6c2ee723
SHA512 e661619b30a7b3386bef7c7eaecfa09837dc52335e1baa2b40516f07c87a3400c300603244f94e5c3ae8d39e30b625d23cbe7ad70dfeb588372804074e33961c
TLSH
T18C41BBA560F4B0E1C798A37B1B90C7956CECC75E45217E1E0374D9683EEE1E27B04465
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 10KB
SHA256 09d7b6c195570b48639bd8df78c3a08817f941f74edd23f765328eb762444d79
MD5 f5d069ebe080546161af961c4e51f2b8
SHA1 84060a8143a829710905c9966f04ab0e9546d787
SHA512 c88b7044a2f5f5b1e3fa27f9862c7c43585e80055e6db55b8b2ebdcbd29237c4670e01a3a5cdda0ae45427c37840442f04889404688399cdba8f856e6e953f7e
SSDEEP 192:DB01mttZHHMk6JJ7ex5J9JMT9Gz+aEdCDIpaPidAi5DrR1R0OkLSvqfPiNPiIzIA:DB01mttZHHMk6JJ7ex5JLMT9Gz+aEdCM
TLSH
T1A2229CF7C3E8C62D891156F49B25AF1FCE290928032C3C7689D8BE16D3E2472E25575E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 11KB
SHA256 ab366325bb759bbaf9e1f4280a4122a2014f77fe7082855d9cd1bcdaa448b3a7
MD5 a587380ee1a25f15d34c5bf685a264b0
SHA1 e80310732887a4b0cf2c83035539afb25149833c
SHA512 f9edf2fda0612289733d8881556bcbbd086b6d6c152cb84aedce881a847f5780ab448a7325a678918e991c8589be090f64c8f2830712d8c663cbe4ea978e4165
SSDEEP 192:Dt1/guFBLf3jBRJ2e7fJAJGuz+QcbCuIpaPudAi5Dre1ieOALivVfPRNPfI/IhGl:Dt1/guFBLf3jBRJ2e7fJMGuz+QcbCuII
TLSH
T1AB42ACF7C7ECC52DC91256F49B25AF1FCE190A28432D3C2688D8AE5BE3E2471D25524E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 12KB
SHA256 f052a7056ad7d68e7e9bfacaed922670bf63c2e13a430d2f448ae7e7ef6d00f9
MD5 6decd8bdbb5bb1f862d2d5ea9cdca8da
SHA1 a298c81618e48291e567e21fab2b85d47298b8f9
SHA512 85b07a543a2e8f33f07ebb70245bb7a799124f4d1bcd9b165e3bfbd00bd730a2cbd6a5a8ad218d64b0ccd457b6d8c933f1d06b891d1ab87f0252d7afa828e03c
SSDEEP 384:Dt1/guFBLf3jBRJ2e7fJMGPdz+QcbCuIpaWdAi5Dre1ieOALiNf5NnI/IhGTBOzo:Vl1kqlrIw16
TLSH
T13D42ACF7C7ECC52D891256F49B25AF1FCE190A28432D3C2688D8AE5BE3E2471D25524E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 9KB
SHA256 ea58b5c52967196b200292c86c507b46b800bcd977757f7970d04ce41ae17d90
MD5 cb31494d659ca0912f32a7310add84b4
SHA1 41a9be5e6fbab305f3af451ca6aecc2d694ef767
SHA512 6777c3470ab2f49978c3b1b78b55d55da777fa12b54a40811be60dac284c4434fd938592fdaa4961b139b9cbf93dde74a431ab2554f5d234b84dce2e77e65f7c
SSDEEP 192:DB01mttZHHMk6JJ7ex5J9JMTgGz+aEdCDIpaPidAi5DrR1R0OkLSvqfPiNPiIzIx:DB01mttZHHMk6JJ7ex5JLMTgGz+aEdCV
TLSH
T16D22ACF7C3E8C62D891156F49B25AF1FCE290928032C3C7689D8BE16D3E2472E25575E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 cd8a0a35a8225de11983425b5257fc771bd7116a151f8d04a9708b56691e95e4
MD5 b723eb46ed8a98a98088ef1ca5d6fe88
SHA1 ac5998a7d72adb26bfc3a3af6c949c32f5977756
SHA512 b43b6e1b2850cee5e116eeec783ea73586909e917d28fd3ab440529464391d8519835ce9de2da977ced12ae1f5b2a8763763664bae18a17720a75fc794bb628c
TLSH
T17F117FAFAB7D7427607D49675D0CB44918FAA43112E268E4DAD782BCB0855F71B02042
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 8cd1ab3dcfa9e15acb0a19de166a74d0f42a0058e0705b7d381c00bb6228071c
MD5 bb61aac946bcc85d8b1e5014f5d60525
SHA1 41d333f9a077f37bf5fa6bc3c08c6af3f35960d5
SHA512 da607d75ef6709e55f67fa76f41baff24f4ca7a6d6565f14c44eb19b81b6fe90401f1d493e34023120e9f4adf9c2aea3acc9dc2f1040a5e41eef88dc476c27b4
SSDEEP 192:ERvcBzi3a+zv7EIAPRp2WaR97Hsb+WNnrj77D2GehkwkRtVyIsnAUge:ERvmzi7L+XaVwvT2dEle
TLSH
T1AB42A42EAE10367B5CDBD22AFA257BA7D7F5102160957F84E6FC8A2C14E79DC2217007
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 5627555a282dea989edc1a867fff793fb81dedf5377e066c785b7cb43e379990
MD5 87260b50f97a310397fe4afd1affc9d6
SHA1 84f17f15cbda6cb33bdf6fae6d5cec77e2931dc4
SHA512 ec85c6a81e3949898cd76cabce5461d802e43f12dabde782f7f5ee3680af70368f47375c6c35e32821e22739e5bd5dda7410659ed3044fa85325d2c44c87034f
SSDEEP 192:ERvcBXs3a+Av7WIAPRp2Wk8l697Hsb+WNnrj74Vepehkw4RtVyIsnAUgE:ERvmXs7coXAVwvqegYlE
TLSH
T13642A42EED1036BB5CDBD229FA257BA7D7F5102160956F84E6FC8A2C14E79DC2217007
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 f1cdeeba810efaa815018f9bb8d0c601d2b36228258c4c3a3eedadf073036573
MD5 741f10bdfc10e795457d96dc937de717
SHA1 ba99e6b82c020d357e9b1f405c86898944fb4fa6
SHA512 51fb07940cbf0e3eedf47aa688c2aac0c078b172cbf2e8fe16e7a480f65573c2bcd08640a60d33bed39f07943e34711709f6f5a87d185dacbb6d8cebf862a1da
SSDEEP 192:ERvcBXs3a+Av7WIzPRpTWk8l697Hsb+WNnrj74Vepehkw0RtVyIsnAUgE:ERvmXs7cNX7VwvqegUlE
TLSH
T15442B42AED1036BB5CDBD229FA257BA7D7F5103160956F84E6FC8A2C14E79DC2217007
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 8e7ae95ceeb0a466af7d2d295060ea5803f71827aa62a56bbaf71e1419d03fbc
MD5 c6851e0fa348284d424284140532c9ee
SHA1 39a8d0ee01e0c987ea12b6620aa597424acb8afd
SHA512 8a1eeac3a92de2226675e9f04112664a93f8d26fac02950d9edd6cce3fc0cc9883c8c5f11f99872bd47ee8ddb44a2a593e7f28674dc1321162a8b1b360f45578
SSDEEP 192:ERvcBXi3a+zv7WIAPRp2Wkw97Hsb+WNnrj74VeaehkwkRtVyIsnAUge:ERvmXi7LoXhVwvqexEle
TLSH
T12D42A32AED10367B9CDBD22AFA257BA7D7F5102160957F84E6FC8A2C14E79DC2217007
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 b7525e10d16a72c797d0f28f66c53a4b7e5885cc803da4d041c68023905ef18c
MD5 0d867bdef01cca3919596869073774cf
SHA1 cc35652ac30863ae26dfe16c5a656bb6a34dff65
SHA512 af583fe37add855fabd34c30d193c277fa94cc83f0704702f6d5365a5461121bd7fed5eafab52187e25d9c8af04af9a52f60d188a5ed727772d718ceb91876f4
SSDEEP 192:ERvcBXsHa+Av7WIzPRpTWk8l697Hsb+WNnrj74Vepehkw0RtVyIsnAUgE:ERvmXsrcNX7VwvqegUlE
TLSH
T17E42B42AED1036BB5CDBD229FA257BA7D7F5103160956F84E6FC8A2C14E79DC2217007
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 1748158f5fb3016247f604f4c3add2216111ae5e14fca320421db5b97a870159
MD5 158f1ea4a7a80d11667feef55555b006
SHA1 a75e3ff035e339eff0ec42bdca916f039ea28352
SHA512 51a335bf6f503617cda983db2e6e2c5369f303e7a9ceff9b6b4aefef12e2fd21362414be773e5b9cb36c6562eaa9f5eb557e08609d8bed6efef7b3b0c01e7380
SSDEEP 192:ERvcBXs3a+zv7WIAPRp2Wk8l697Hsb+WNnrj74VepehkwkRtVyIsnAUgE:ERvmXs7LoXAVwvqegElE
TLSH
T1E142A42AED1036BB5CDBD229FA257BA7E7F5102160957F84E6FC8A2C14E79DC2217007
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 fe35d5c2f2341a869bbcae90dabdbdb55d08057f71d66375f92986653eb15f04
MD5 3b44cabadcdc8fae02676842ddf82b38
SHA1 64ed9eca611ed95cb66425710a259da68d3e4541
SHA512 19e5463cf10adc91965d4570ef5790775d75cf1c786f1e00c839c42b7bf9a48db2c18dd3093f46854f094106f383806c173b95a9c41e05dd1ae1091effec795c
SSDEEP 384:vBjNU7KxkXqKf/pUZNCgVLH2HfgslGmXODNc+ErU3CgHGq+LS/hZnCYkG:vBNU7KxkXqKf/pUZNCgVLH2HfgswsOZf
TLSH
T125520A27A88CA67B0FD8D64DDC12AF8FADF5015761A8582453FB5C0903D57DB120A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 96B
SHA256 9837909d9f7a5048faf4be5c953305cfa78f16d52989563a4b5b24d69ea32634
MD5 954269054cf66954cd8d03b51c15871e
SHA1 f27ed7f953f0aa71aca069617bb02367f4918034
SHA512 195d3e6368745dbd99ecf47934a21bc973b03d3eaf9d0b552b223f68a7e191fe5fd597a74cc8739cafb5c265f4f90f71f3f88745fef9956647c8d848b92f149d
TLSH
T1A3B0128800407045C224037087C014E073544D558303150580A001657C1B3310387900
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 ca6c255bc0ed8224c96647ed954c6782f4e60533e452f90af5ec69a2c0dacc7a
MD5 59c9e0b6f7704074ad52c0946a53005c
SHA1 ce76a3d8d4f2857307b59d2a0659ed3c6a5733fe
SHA512 78ab8862a47f051c2b0f66dc3b96af19fb2be20d5f3a33ea6f2edc790683bb853aeb8743c38de844b77c9f03d9e4d270eba7e13d5f350448574c22e6c88ac2a4
TLSH
T1E2A0021542E3181ACE0177B662664A8532D16C1935624B0365924864BCAF2C15101716
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5b100a.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index~RFe5b100a.TMP
Size 48B
SHA256 ea4f504d85ae2c4e6e6861c7d70aa0af1b08f081465a5119f2d638368fbb80a2
MD5 a2b81dbe29a09e72da248a219b6b7fbe
SHA1 5b6fceec37bea6dad527c14bf5b3a4b9828678b2
SHA512 f08571d4013676be73074ed81a68f7f71089ed11521566bbe9757521c7a075a46c32686c68a6dde978af696567f1a943f0b233f802bc374216f2bdd21c9ecea4
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 150B
SHA256 5ea61e4067668e3d14b535f1e373d87ed53123e97953682a0f0b0e3921d203f8
MD5 acd9646ccbd842059eb034b966bffddf
SHA1 25ff134d5f29afe73730402e0230db15f6944ccc
SHA512 c2f75e64436ab4b6e2974cbda4af87de86173125b5960a0f5cce9a3a2e7de58d1785991265c7a4da2b4c99782b7a712b19d288570af9b606e008478537afd204
TLSH
T1B0C04CE71414466B47789DD924287A2DD557824C4CD8DCECD44450562478A338502679
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5b2622.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\2\CacheStorage\index.txt~RFe5b2622.TMP
Size 157B
SHA256 feedced51a0a4b7ac9d28f19a5abc0f0fe7823ca05158cb0f8e52342f6025aa4
MD5 c6e728b9e0835c45614c9a66d14a5ead
SHA1 2ced2effb1fc74f12c5868c19b488e9136aa0fa4
SHA512 f531fc837a1466d638cf018718dc5f01561164f315de4b10880fd214cb874270a0f853bd5734d718c29c23e755b0629ceb5f7bfeba17d0dbb38a7a94a7a3b18b
TLSH
T14AC02BF70414066707349CC520287B1DD51BCE4C4CC8DCFCE40530423038A33C401539
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 137KB
SHA256 f539281641575f5575986baa54c493e9a15081419d5c82ce94e2e26b7d3077cf
MD5 5cb53cbef52eb22bcdcc1fbebb712240
SHA1 b21aa2a4e5389178269cad13260c72e0fc6dd007
SHA512 21c6b0bd7c29bc25f1678cc12ea4abe5a45dfd7bc4e4ace0b0a6c869b3a31423615f4ecc7c58b6d1ccc16192e21c0bf0421470c0be774ded4d6642e7aebf3ffa
SSDEEP 3072:p8dw/ipBjz4dnqAoddorDfM9OExz6LXiBpKOV0+8KG39:pfOB2oddWExz6LXitV0+8KG39
TLSH
T1C0D3122359DE2E2BF8DD802DB85718A2DF95B9348C85DEC5E0EB63597D90BD103B6700
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 137KB
SHA256 6ab6c6d644909a2140011bf2b7812f1bd9ec178275fa4e4e7e8fa1eca9fba6de
MD5 8c36cf025d22be30c86adb1b7cd619cf
SHA1 13a6414df558e33be5ffa8399ff4026a79d84ae6
SHA512 c47363bbbb1cc1ef56d76d05e17a43f49a3fbf5859ed13d0b6796036380ec1504fdd04af43859119dfc28b47beab87376c0da87ad7de89514a7509137a267d03
SSDEEP 3072:r8dw/ipBjz4dnqAoddorDfM9OExz6LXiBpKOV0+8KG39:rfOB2oddWExz6LXitV0+8KG39
TLSH
T137D3122319DE2E2BF8DD802DB8571862DF95B8348C85DEC5E0EB63597C90BD103A6700
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 138KB
SHA256 a0ff5a28b3d16f27c86f74ce88b320065664e69ccd86c2d467b5b40230db4c8e
MD5 d68862b96530bce8696087e737af8fe1
SHA1 5bb60cfd5d50e1469e4b06f02d7aeae9726c824d
SHA512 ff1af795cf2302377a3090ab38b7095a1e610a57d25378a12574b7242157f04062e22e62692567dedbc094d92235625543dd18fc2198f898f524f22c67fe46b5
SSDEEP 3072:jfw/ipBjz4dnqAoddorDfM9OExz6LXiBpKOV0+8KG39:MOB2oddWExz6LXitV0+8KG39
TLSH
T1A3D312331DDE3E2BF8AA4029B8571C52CF84F839CD85EE89E4E633596C907D607A7641
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 825e580ba7672f3a6184a0ff348ecb0bfcce905aa83e8c7f31ce34b864e2acbf
MD5 a6a5a8fa15693d06070ead1ab0a59e77
SHA1 66ee0304779e61b62ba9f9bf6dbc717dc51e50a9
SHA512 1530aca5e7f1d6381cea546533ab6ec5b4973a299ad48f9a1e768070f0aafef5d5b11953a76513eb24a68a2c67147a97b9132a89b89ec9bf73a5fae8177ccaf3
SSDEEP 96:eIlC0d+pK242KafJf1OIu5fksRDotok5ysDeB6qpGyv+7hh20bZv4a:ZlC0bt8OI8lDUD7ePUhhh20bV
TLSH
T11DA10870E96C99B728B5C584B6062F43DFB822676162EFC4DCDD5A1D20E71F80382613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 138KB
SHA256 a74214230671fb83e1497dbf881b4d8e4305d692222ae3183ac9846a95e59661
MD5 3814180ece48f713c50f6434ede75ded
SHA1 42c5deb4f3eaa2c9c6596828b20fe39ba59c2230
SHA512 6166b882a24524673deaf1b0bbf2d2be661b8a367fe67734156ee83bc76d87999ba1fa314bf811676059457e1f3947661cdcba31748560df87382215c3f94df8
SSDEEP 3072:bfw/ipBjz4dnqAoddorDfM9OExz6LXiBpKOV0+8KG39:UOB2oddWExz6LXitV0+8KG39
TLSH
T186D312331DDE3E1BF8AE4029B8571C52CF84F8398D85EE89E4E633596C507D607A7641
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 595B
SHA256 d4e60617c2afab8263febabe7f14f18595715078d71307a8cefe0707dae76dee
MD5 4454c8e578515db43fadd90604ae7675
SHA1 3912ffa00c3a5c86fae6500a0074284d9f668976
SHA512 b17559d466cb6954554c4f879b396ff8431c730f837205547ab46329c6517cd35a719378efa55d78c01b739414dd320157f120feb12e28e1ae90ce7c53a0c75c
TLSH
T117F0DC47E7B15216C926123CC89724E1B730F5917DD1162341056F5D2C373101F17CB8
MD5 SHA1 SHA512 TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsv801B.tmp\System.dll
Size 12KB
SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
MD5 cff85c549d536f651d4fb8387f1976f2
SHA1 d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
SHA512 531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
SSDEEP 192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
TLSH
T126426B129BB089F2F591583814667F2A6FBE9C5D27F50563CFE304D63D212CB983A283
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nsv801B.tmp\nsDialogs.dll
Size 9KB
SHA256 56b96add1978b1abba286f7f8982b0efbe007d4a48b3ded6a4d408e01d753fe2
MD5 6c3f8c94d0727894d706940a8a980543
SHA1 0d1bcad901be377f38d579aafc0c41c0ef8dcefd
SHA512 2094f0e4bb7c806a5ff27f83a1d572a5512d979eefda3345baff27d2c89e828f68466d08c3ca250da11b01fc0407a21743037c25e94fbe688566dd7deaebd355
SSDEEP 96:o0svUu3Uy+sytcS8176b+XR8pCHFcMcxSgB5PKtAtgt+Nt+rnt3DVEB3YcNqkzfS:o0svWyNO81b8pCHFcM0PuAgkOyuIFc
TLSH
T17012F992E6A450B3C5D6533B35AA2F2DCBBD5325B0926C00C7738E4D39395B66E38353
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5508_2102675035\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2540-910-0x0000022C81A30000-0x0000022C81A50000-memory.dmp

Download

memory/2540-928-0x0000022C81DF0000-0x0000022C81E10000-memory.dmp

Download

memory/2540-942-0x0000022C942B0000-0x0000022C942D0000-memory.dmp

Download

memory/2540-898-0x0000022C801E0000-0x0000022C802E0000-memory.dmp

Download

memory/2540-912-0x0000022C81E50000-0x0000022C81F50000-memory.dmp

Download

memory/2540-896-0x0000022C801E0000-0x0000022C802E0000-memory.dmp

Download