7b5658a97bff0a3ce30285ca64b79aa92034ba4e76655b60ce0e047b9de91137

Analysis

user interaction
yes
max time kernel
1039s
max time network
1044s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/10/2026, 22:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Collect your.txt
Size 203B
Sample261006-182ejagg92
SHA256 7b5658a97bff0a3ce30285ca64b79aa92034ba4e76655b60ce0e047b9de91137
MD5 b725d3cb53faac1af7fa69e8c62859e7
SHA1 afbcc9a629f511c5c4fa78aa2b6a5345bb425032
SHA512 a70c64c3f36037e04a589848aca0002ec097ab3d16ac9ce76300675aaafe72c2933922b73a05064523b5ef32f2aba147a4a643c51c4b353ca8fa56edc4ea805f
TLSH
T1FDD022E3F3848EA74A74C9B0338215A889D7858E8CCC8E18A121453F8C8D6B37806083
MD5 SHA1 SHA512 TLSH

Score

9^/10

adware discovery execution persistence ransomware spyware

Malware Config

Signatures

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Loads dropped DLL 26 IoCs

pid	Process
5000	TQX V5 LITE.exe
5000	TQX V5 LITE.exe
5000	TQX V5 LITE.exe
5000	TQX V5 LITE.exe
5000	TQX V5 LITE.exe
5000	TQX V5 LITE.exe
5000	TQX V5 LITE.exe
5000	TQX V5 LITE.exe
5000	TQX V5 LITE.exe
5000	TQX V5 LITE.exe
5000	TQX V5 LITE.exe
5000	TQX V5 LITE.exe
5000	TQX V5 LITE.exe
5000	TQX V5 LITE.exe
5000	TQX V5 LITE.exe
5000	TQX V5 LITE.exe
5000	TQX V5 LITE.exe
5000	TQX V5 LITE.exe
5000	TQX V5 LITE.exe
5000	TQX V5 LITE.exe
5000	TQX V5 LITE.exe
5000	TQX V5 LITE.exe
5000	TQX V5 LITE.exe
5000	TQX V5 LITE.exe
5000	TQX V5 LITE.exe
5000	TQX V5 LITE.exe

Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
9	api.gofile.io
9	discord.com
29	api.gofile.io
24941	discord.com

Enumerates connected drives 3 TTPs 4 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe
	\??\F:\	explorer.exe
	\??\E:\	explorer.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Executes a command shell one-liner 1 TTPs 9 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3212	cmd.exe
4216	cmd.exe
2604	cmd.exe
896	cmd.exe
3160	cmd.exe
3908	cmd.exe
1676	cmd.exe
700	cmd.exe
2480	cmd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1516	chrome.exe

Checks SCSI registry key(s) 3 TTPs 62 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000\Software\Microsoft\Internet Explorer\Main	explorer.exe

Modifies data under HKEY_USERS 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe

Modifies registry class 45 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "876"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1262770251-41185387-1005173349-1000\{A0D3EF68-9681-446F-88C4-E13ABAD1180E}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	StartMenuExperienceHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "843"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "843"	SearchHost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202020202	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	StartMenuExperienceHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	StartMenuExperienceHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1262770251-41185387-1005173349-1000\{E179C4FC-AD68-49F6-82FC-48D5A90625A1}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Local Settings\MuiCache	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "876"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "876"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "843"	SearchHost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 010000000200000000000000ffffffff	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchHost.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4180	chrome.exe
4180	chrome.exe
5000	TQX V5 LITE.exe
5000	TQX V5 LITE.exe
4180	chrome.exe
4180	chrome.exe
1924	chrome.exe
1924	chrome.exe
4244	explorer.exe
4244	explorer.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
4180	chrome.exe
4180	chrome.exe
4180	chrome.exe
4180	chrome.exe
4180	chrome.exe
4180	chrome.exe
4180	chrome.exe
4180	chrome.exe
4180	chrome.exe
4180	chrome.exe
4180	chrome.exe
4180	chrome.exe
4180	chrome.exe
4180	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4180	chrome.exe
Token: SeCreatePagefilePrivilege	4180	chrome.exe
Token: SeShutdownPrivilege	4180	chrome.exe
Token: SeCreatePagefilePrivilege	4180	chrome.exe
Token: SeShutdownPrivilege	4180	chrome.exe
Token: SeCreatePagefilePrivilege	4180	chrome.exe
Token: SeShutdownPrivilege	4180	chrome.exe
Token: SeCreatePagefilePrivilege	4180	chrome.exe
Token: SeShutdownPrivilege	4180	chrome.exe
Token: SeCreatePagefilePrivilege	4180	chrome.exe
Token: SeShutdownPrivilege	4180	chrome.exe
Token: SeCreatePagefilePrivilege	4180	chrome.exe
Token: SeShutdownPrivilege	4180	chrome.exe
Token: SeCreatePagefilePrivilege	4180	chrome.exe
Token: SeShutdownPrivilege	4180	chrome.exe
Token: SeCreatePagefilePrivilege	4180	chrome.exe
Token: SeShutdownPrivilege	4180	chrome.exe
Token: SeCreatePagefilePrivilege	4180	chrome.exe
Token: SeShutdownPrivilege	4180	chrome.exe
Token: SeCreatePagefilePrivilege	4180	chrome.exe
Token: SeShutdownPrivilege	4180	chrome.exe
Token: SeCreatePagefilePrivilege	4180	chrome.exe
Token: SeShutdownPrivilege	4180	chrome.exe
Token: SeCreatePagefilePrivilege	4180	chrome.exe
Token: SeShutdownPrivilege	4180	chrome.exe
Token: SeCreatePagefilePrivilege	4180	chrome.exe
Token: SeShutdownPrivilege	4180	chrome.exe
Token: SeCreatePagefilePrivilege	4180	chrome.exe
Token: SeShutdownPrivilege	4180	chrome.exe
Token: SeCreatePagefilePrivilege	4180	chrome.exe
Token: SeShutdownPrivilege	4180	chrome.exe
Token: SeCreatePagefilePrivilege	4180	chrome.exe
Token: SeShutdownPrivilege	4180	chrome.exe
Token: SeCreatePagefilePrivilege	4180	chrome.exe
Token: SeShutdownPrivilege	4180	chrome.exe
Token: SeCreatePagefilePrivilege	4180	chrome.exe
Token: SeShutdownPrivilege	4180	chrome.exe
Token: SeCreatePagefilePrivilege	4180	chrome.exe
Token: SeShutdownPrivilege	4180	chrome.exe
Token: SeCreatePagefilePrivilege	4180	chrome.exe
Token: SeShutdownPrivilege	4180	chrome.exe
Token: SeCreatePagefilePrivilege	4180	chrome.exe
Token: SeShutdownPrivilege	4180	chrome.exe
Token: SeCreatePagefilePrivilege	4180	chrome.exe
Token: SeShutdownPrivilege	4180	chrome.exe
Token: SeCreatePagefilePrivilege	4180	chrome.exe
Token: SeShutdownPrivilege	4180	chrome.exe
Token: SeCreatePagefilePrivilege	4180	chrome.exe
Token: SeShutdownPrivilege	4180	chrome.exe
Token: SeCreatePagefilePrivilege	4180	chrome.exe
Token: SeShutdownPrivilege	4180	chrome.exe
Token: SeCreatePagefilePrivilege	4180	chrome.exe
Token: SeShutdownPrivilege	4180	chrome.exe
Token: SeCreatePagefilePrivilege	4180	chrome.exe
Token: SeShutdownPrivilege	4180	chrome.exe
Token: SeCreatePagefilePrivilege	4180	chrome.exe
Token: SeShutdownPrivilege	4180	chrome.exe
Token: SeCreatePagefilePrivilege	4180	chrome.exe
Token: SeShutdownPrivilege	4180	chrome.exe
Token: SeCreatePagefilePrivilege	4180	chrome.exe
Token: SeShutdownPrivilege	4180	chrome.exe
Token: SeCreatePagefilePrivilege	4180	chrome.exe
Token: SeShutdownPrivilege	4180	chrome.exe
Token: SeCreatePagefilePrivilege	4180	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4180	chrome.exe
4180	chrome.exe
4180	chrome.exe
4180	chrome.exe
4180	chrome.exe
4180	chrome.exe
4180	chrome.exe
4180	chrome.exe
4180	chrome.exe
4180	chrome.exe
4180	chrome.exe
4180	chrome.exe
4180	chrome.exe
4180	chrome.exe
4180	chrome.exe
4180	chrome.exe
4180	chrome.exe
4180	chrome.exe
4180	chrome.exe
4180	chrome.exe
4180	chrome.exe
4180	chrome.exe
4180	chrome.exe
4180	chrome.exe
4180	chrome.exe
4180	chrome.exe
4180	chrome.exe
4180	chrome.exe
4180	chrome.exe
4180	chrome.exe
4180	chrome.exe
4180	chrome.exe
4180	chrome.exe
4180	chrome.exe
4180	chrome.exe
4180	chrome.exe
4180	chrome.exe
4180	chrome.exe
4180	chrome.exe
4180	chrome.exe
4180	chrome.exe
4180	chrome.exe
4180	chrome.exe
4216	sihost.exe
4244	explorer.exe
4244	explorer.exe
4244	explorer.exe
4244	explorer.exe
4244	explorer.exe
4244	explorer.exe
4244	explorer.exe
4244	explorer.exe
4244	explorer.exe
4244	explorer.exe
4244	explorer.exe
4244	explorer.exe
4244	explorer.exe
4244	explorer.exe
4244	explorer.exe
4244	explorer.exe
4244	explorer.exe
4244	explorer.exe
4244	explorer.exe
4244	explorer.exe

Suspicious use of SendNotifyMessage 60 IoCs

pid	Process
4180	chrome.exe
4180	chrome.exe
4180	chrome.exe
4180	chrome.exe
4180	chrome.exe
4180	chrome.exe
4180	chrome.exe
4180	chrome.exe
4180	chrome.exe
4180	chrome.exe
4180	chrome.exe
4180	chrome.exe
4180	chrome.exe
4180	chrome.exe
4180	chrome.exe
4180	chrome.exe
4244	explorer.exe
4244	explorer.exe
4244	explorer.exe
4244	explorer.exe
4244	explorer.exe
4244	explorer.exe
4244	explorer.exe
4244	explorer.exe
4244	explorer.exe
4244	explorer.exe
4244	explorer.exe
4244	explorer.exe
4244	explorer.exe
4244	explorer.exe
4244	explorer.exe
4244	explorer.exe
4244	explorer.exe
4244	explorer.exe
4244	explorer.exe
4244	explorer.exe
4244	explorer.exe
4244	explorer.exe
4244	explorer.exe
4244	explorer.exe
4244	explorer.exe
4244	explorer.exe
4244	explorer.exe
4244	explorer.exe
4244	explorer.exe
4244	explorer.exe
4244	explorer.exe
4244	explorer.exe
4244	explorer.exe
4244	explorer.exe
4244	explorer.exe
4244	explorer.exe
4244	explorer.exe
4244	explorer.exe
4244	explorer.exe
4244	explorer.exe
4244	explorer.exe
4244	explorer.exe
4244	explorer.exe
4244	explorer.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
5876	StartMenuExperienceHost.exe
4244	explorer.exe
4460	SearchHost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4180 wrote to memory of 3392	4180	chrome.exe	92
PID 4180 wrote to memory of 1516	4180	chrome.exe	93
PID 4180 wrote to memory of 3192	4180	chrome.exe	94
PID 4180 wrote to memory of 3192	4180	chrome.exe	94
PID 4180 wrote to memory of 1084	4180	chrome.exe	96
PID 4180 wrote to memory of 1084	4180	chrome.exe	96
PID 4180 wrote to memory of 2452	4180	chrome.exe	97
PID 4180 wrote to memory of 2452	4180	chrome.exe	97
PID 4180 wrote to memory of 2008	4180	chrome.exe	98
PID 4180 wrote to memory of 2008	4180	chrome.exe	98
PID 4180 wrote to memory of 2840	4180	chrome.exe	99
PID 4180 wrote to memory of 2840	4180	chrome.exe	99
PID 4180 wrote to memory of 4496	4180	chrome.exe	100
PID 4180 wrote to memory of 4496	4180	chrome.exe	100
PID 4180 wrote to memory of 2640	4180	chrome.exe	101
PID 4180 wrote to memory of 2640	4180	chrome.exe	101
PID 4180 wrote to memory of 2032	4180	chrome.exe	102
PID 4180 wrote to memory of 2032	4180	chrome.exe	102
PID 4180 wrote to memory of 5488	4180	chrome.exe	103
PID 4180 wrote to memory of 5488	4180	chrome.exe	103
PID 4180 wrote to memory of 4544	4180	chrome.exe	104
PID 4180 wrote to memory of 3196	4180	chrome.exe	105
PID 4180 wrote to memory of 3196	4180	chrome.exe	105
PID 4180 wrote to memory of 3336	4180	chrome.exe	106
PID 4180 wrote to memory of 3336	4180	chrome.exe	106
PID 4180 wrote to memory of 2804	4180	chrome.exe	110
PID 4180 wrote to memory of 2004	4180	chrome.exe	111
PID 4180 wrote to memory of 2804	4180	chrome.exe	110
PID 4180 wrote to memory of 2004	4180	chrome.exe	111
PID 4180 wrote to memory of 5400	4180	chrome.exe	112
PID 4180 wrote to memory of 5400	4180	chrome.exe	112
PID 4180 wrote to memory of 1488	4180	chrome.exe	113
PID 4180 wrote to memory of 1488	4180	chrome.exe	113
PID 4180 wrote to memory of 2900	4180	chrome.exe	114
PID 4180 wrote to memory of 3768	4180	chrome.exe	115
PID 4180 wrote to memory of 2900	4180	chrome.exe	114
PID 4180 wrote to memory of 3768	4180	chrome.exe	115
PID 4180 wrote to memory of 1676	4180	chrome.exe	116
PID 4180 wrote to memory of 1676	4180	chrome.exe	116
PID 4180 wrote to memory of 4252	4180	chrome.exe	117
PID 4180 wrote to memory of 4252	4180	chrome.exe	117
PID 4180 wrote to memory of 2652	4180	chrome.exe	118
PID 4180 wrote to memory of 2652	4180	chrome.exe	118
PID 4180 wrote to memory of 4568	4180	chrome.exe	119
PID 4180 wrote to memory of 4568	4180	chrome.exe	119
PID 4180 wrote to memory of 4852	4180	chrome.exe	120
PID 4180 wrote to memory of 4852	4180	chrome.exe	120
PID 4180 wrote to memory of 1460	4180	chrome.exe	121
PID 4180 wrote to memory of 5236	4180	chrome.exe	124
PID 4180 wrote to memory of 3936	4180	chrome.exe	125
PID 4180 wrote to memory of 5668	4180	chrome.exe	126
PID 888 wrote to memory of 5000	888	TQX V5 LITE.exe	130
PID 5000 wrote to memory of 3908	5000	TQX V5 LITE.exe	131
PID 3908 wrote to memory of 5408	3908	cmd.exe	132
PID 5000 wrote to memory of 1676	5000	TQX V5 LITE.exe	133
PID 4180 wrote to memory of 5644	4180	chrome.exe	134
PID 5000 wrote to memory of 700	5000	TQX V5 LITE.exe	135
PID 5000 wrote to memory of 3212	5000	TQX V5 LITE.exe	136
PID 5000 wrote to memory of 4216	5000	TQX V5 LITE.exe	137
PID 5000 wrote to memory of 2480	5000	TQX V5 LITE.exe	138
PID 5000 wrote to memory of 2604	5000	TQX V5 LITE.exe	139
PID 5000 wrote to memory of 896	5000	TQX V5 LITE.exe	140
PID 4180 wrote to memory of 1924	4180	chrome.exe	141
PID 4180 wrote to memory of 1968	4180	chrome.exe	142

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\NOTEPAD.EXE
C:\Windows\system32\NOTEPAD.EXE "C:\Users\Admin\AppData\Local\Temp\Collect your.txt"
1⤵
PID:5780

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4180
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x58,0x134,0x7ffc050fc728,0x7ffc050fc734,0x7ffc050fc740
  2⤵
  PID:3392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1392,i,17624200685016605805,4754936015264617260,524288 --field-trial-handle=1976,i,18384456376174597343,5123651353265939369,262144 --variations-seed-version --mojo-platform-channel-handle=2004 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1516
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1600,i,6598601919140590086,15585772090481788970,262144 --field-trial-handle=1976,i,18384456376174597343,5123651353265939369,262144 --variations-seed-version --mojo-platform-channel-handle=1972 /prefetch:2
  2⤵
  PID:3192
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2296,i,16120689595361350103,15463280100670079845,524288 --field-trial-handle=1976,i,18384456376174597343,5123651353265939369,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:13
  2⤵
  PID:1084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3240,i,9914981046932665041,7847864934833417110,2097152 --field-trial-handle=1976,i,18384456376174597343,5123651353265939369,262144 --variations-seed-version --mojo-platform-channel-handle=3452 /prefetch:1
  2⤵
  PID:2452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3328,i,17211613984694415267,7912745259589324746,2097152 --field-trial-handle=1976,i,18384456376174597343,5123651353265939369,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:2008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4696,i,7838340936453112716,6184274311890483016,2097152 --field-trial-handle=1976,i,18384456376174597343,5123651353265939369,262144 --variations-seed-version --mojo-platform-channel-handle=4700 /prefetch:1
  2⤵
  PID:2840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4828,i,10088061082331383553,7022004625694027574,524288 --field-trial-handle=1976,i,18384456376174597343,5123651353265939369,262144 --variations-seed-version --mojo-platform-channel-handle=4852 /prefetch:14
  2⤵
  PID:4496
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5012,i,1141408653378905604,8612159834788673007,524288 --field-trial-handle=1976,i,18384456376174597343,5123651353265939369,262144 --variations-seed-version --mojo-platform-channel-handle=4736 /prefetch:14
  2⤵
  PID:2640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5180,i,11487355302228556159,14372530102876917745,524288 --field-trial-handle=1976,i,18384456376174597343,5123651353265939369,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:14
  2⤵
  PID:2032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5284,i,7104381191185921943,4496989829400598820,2097152 --field-trial-handle=1976,i,18384456376174597343,5123651353265939369,262144 --variations-seed-version --mojo-platform-channel-handle=5260 /prefetch:1
  2⤵
  PID:5488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5512,i,17243918400004930109,12284056541085570222,524288 --field-trial-handle=1976,i,18384456376174597343,5123651353265939369,262144 --variations-seed-version --mojo-platform-channel-handle=5516 /prefetch:14
  2⤵
  PID:4544
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5536,i,7120449068656599134,9132972211860840457,2097152 --field-trial-handle=1976,i,18384456376174597343,5123651353265939369,262144 --variations-seed-version --mojo-platform-channel-handle=5096 /prefetch:1
  2⤵
  PID:3196
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5056,i,711127969538760118,18413750696431929537,2097152 --field-trial-handle=1976,i,18384456376174597343,5123651353265939369,262144 --variations-seed-version --mojo-platform-channel-handle=4736 /prefetch:1
  2⤵
  PID:3336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5676,i,1099749980793373390,13557137725827239618,2097152 --field-trial-handle=1976,i,18384456376174597343,5123651353265939369,262144 --variations-seed-version --mojo-platform-channel-handle=5788 /prefetch:1
  2⤵
  PID:2804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5700,i,11492651020937790328,5154306186137597987,524288 --field-trial-handle=1976,i,18384456376174597343,5123651353265939369,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:14
  2⤵
  PID:2004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5552,i,6750272653331897800,17017052709017123216,2097152 --field-trial-handle=1976,i,18384456376174597343,5123651353265939369,262144 --variations-seed-version --mojo-platform-channel-handle=5052 /prefetch:1
  2⤵
  PID:5400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6116,i,2785796132715867152,2039115881502691079,2097152 --field-trial-handle=1976,i,18384456376174597343,5123651353265939369,262144 --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:1
  2⤵
  PID:1488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5776,i,12104377590645214117,10463920784113812290,524288 --field-trial-handle=1976,i,18384456376174597343,5123651353265939369,262144 --variations-seed-version --mojo-platform-channel-handle=4848 /prefetch:14
  2⤵
  PID:2900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=5668,i,697294749721183818,12786023050602847379,2097152 --field-trial-handle=1976,i,18384456376174597343,5123651353265939369,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:1
  2⤵
  PID:3768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=5356,i,8498604682059131408,6697964632815668615,2097152 --field-trial-handle=1976,i,18384456376174597343,5123651353265939369,262144 --variations-seed-version --mojo-platform-channel-handle=5668 /prefetch:1
  2⤵
  PID:1676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=5692,i,12980756745148523193,13645446086355452605,2097152 --field-trial-handle=1976,i,18384456376174597343,5123651353265939369,262144 --variations-seed-version --mojo-platform-channel-handle=5040 /prefetch:1
  2⤵
  PID:4252
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5812,i,4662294182065604803,16586549765428495746,524288 --field-trial-handle=1976,i,18384456376174597343,5123651353265939369,262144 --variations-seed-version --mojo-platform-channel-handle=6048 /prefetch:14
  2⤵
  PID:2652
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=6532,i,15571131383573435171,17578443174098361929,2097152 --field-trial-handle=1976,i,18384456376174597343,5123651353265939369,262144 --variations-seed-version --mojo-platform-channel-handle=6580 /prefetch:1
  2⤵
  PID:4568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=6556,i,12934974932318260749,18080984801833712997,2097152 --field-trial-handle=1976,i,18384456376174597343,5123651353265939369,262144 --variations-seed-version --mojo-platform-channel-handle=6600 /prefetch:9
  2⤵
  PID:4852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5204,i,15460762583747362577,6547137256064347328,524288 --field-trial-handle=1976,i,18384456376174597343,5123651353265939369,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:14
  2⤵
  PID:1460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6556,i,10365589384995638079,2990115796398120394,524288 --field-trial-handle=1976,i,18384456376174597343,5123651353265939369,262144 --variations-seed-version --mojo-platform-channel-handle=6528 /prefetch:14
  2⤵
  PID:5236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6632,i,759033985138692275,6122909250376847090,524288 --field-trial-handle=1976,i,18384456376174597343,5123651353265939369,262144 --variations-seed-version --mojo-platform-channel-handle=5048 /prefetch:14
  2⤵
  PID:3936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6648,i,8258680163156532327,1063337110612429166,524288 --field-trial-handle=1976,i,18384456376174597343,5123651353265939369,262144 --variations-seed-version --mojo-platform-channel-handle=6544 /prefetch:14
  2⤵
  PID:5668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5868,i,1444635207755215808,14995384120591182694,524288 --field-trial-handle=1976,i,18384456376174597343,5123651353265939369,262144 --variations-seed-version --mojo-platform-channel-handle=5992 /prefetch:14
  2⤵
  PID:5644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5760,i,273921390708194930,4385691513110825634,262144 --field-trial-handle=1976,i,18384456376174597343,5123651353265939369,262144 --variations-seed-version --mojo-platform-channel-handle=6536 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=4568,i,14418852667251529198,13329306216535668630,524288 --field-trial-handle=1976,i,18384456376174597343,5123651353265939369,262144 --variations-seed-version --mojo-platform-channel-handle=2164 /prefetch:14
  2⤵
  PID:1968

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2620

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3352

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:2148

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2004

C:\Users\Admin\Downloads\TQX V5 LITE [NO KEY]\TQX V5 LITE [NO KEY]\TQX V5 LITE.exe
"C:\Users\Admin\Downloads\TQX V5 LITE [NO KEY]\TQX V5 LITE [NO KEY]\TQX V5 LITE.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:888
- C:\Users\Admin\Downloads\TQX V5 LITE [NO KEY]\TQX V5 LITE [NO KEY]\TQX V5 LITE.exe
  "C:\Users\Admin\Downloads\TQX V5 LITE [NO KEY]\TQX V5 LITE [NO KEY]\TQX V5 LITE.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5000
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c title Hits: 0 | Ready
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3908
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" title Hits: 0 "
      4⤵
      PID:5408
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    - Executes a command shell one-liner
    PID:1676
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    - Executes a command shell one-liner
    PID:700
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    - Executes a command shell one-liner
    PID:3212
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    - Executes a command shell one-liner
    PID:4216
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    - Executes a command shell one-liner
    PID:2480
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    - Executes a command shell one-liner
    PID:2604
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    - Executes a command shell one-liner
    PID:896
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c title Hits: 1
    3⤵
    - Executes a command shell one-liner
    PID:3160

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1372

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
PID:4216
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Enumerates connected drives
  - Checks SCSI registry key(s)
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:4244

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5876

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4460

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:3616

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1500

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Network Service Discovery

T1046

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

16a0126d-4090-441d-8320-86da3b9619b6.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\16a0126d-4090-441d-8320-86da3b9619b6.tmp
Size 139KB
SHA256 94113eb44132e391df6eb30d25e90e54812c8dab00ffb05cc16454f2b059b125
MD5 c8388ad395b75d10a9eb09c0d8059925
SHA1 cb788c6b8846d96e7bd673247d168fdfbc6e77fe
SHA512 8cd3a9acd4581f1ea67a830fcf29ce95b9939967437023dc13373e59d5350928c4836c9041c9e7b511b94ae00a3f3319566bb0b2ffcb4eb4559ecd969772dd89
SSDEEP 3072:T6xBdcx0+1HN8bg6HofwIEV3DuTe1pPInY6fG7Ct9E+TKq9aRoUq+m1KK:TWdctNj6GwF3hvIYKG7ClTrsbpK
TLSH
T186D3127DACA52CB349E81106B60729870EA9B3C9F03591D447EFA781335D0FD1B879BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

27f69f92-438b-4e37-ba52-f9a119509075.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\27f69f92-438b-4e37-ba52-f9a119509075.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

665e62bb-1d60-41dd-b7b0-ea7be5c1e951.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\665e62bb-1d60-41dd-b7b0-ea7be5c1e951.tmp
Size 11KB
SHA256 2e9fce4a3355c3ac8307f238b18acc0a3a8bb49c927335bf2ffe745055180b00
MD5 0d761f19cab392f823d3343f40241917
SHA1 06fcdb35e2fc7d8bb2171176e7d361914e7a4198
SHA512 9338b9426738fb2bcd04984c47a859812d58fb8bacf6bb6a24213eeb24677ff3fefea269eb5efaab273e45defb0968bc495fa3ccedf6374fb144d69a2e5921c4
SSDEEP 192:RRyNz33T6v7EIAPRp2Hlf97Hsb+WNndJubr2AI2leASVyIsnAUgR:RRyZTW+XuVwvy2x2QR
TLSH
T1D232952AEE10797B5CDBD219FA257B53E3F5102225D52E84E6FC893D11E79CC222702B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

68ea8404-d1f8-4333-9323-737b00d9d241.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\68ea8404-d1f8-4333-9323-737b00d9d241.tmp
Size 12KB
SHA256 2ebb5a73f8d432afab0c3e9c32a34e47c0ceb49af162d005e2aafb27cd45d682
MD5 0ca662b899ed45b94af949592dc5ca6b
SHA1 910bb1d0146dd4ec9bca47b957561a2d2da3714d
SHA512 48fc1a49be4ae3902b47c75fb6ad80d0ffe70e8bf3894a5a0b845befa2b2f01e2cea45160b37bcfea5cc0cfde4eaf8950104abe7e3e21e8c5d1fb7e739c765cb
SSDEEP 192:RRyND33T6v7EIyPRpKHlf97Hsb+WNndJubr2+I2leAaVyIsnAUgE:RRyNTWIXCVwvy2D2cE
TLSH
T1EC42A62EEE107ABB5CDAD219FA657B53E3F5102225D42E44E6FC893D11E79CC222701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

73f75fcb-3997-43ae-9f3b-bbd0723a9953.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\73f75fcb-3997-43ae-9f3b-bbd0723a9953.tmp
Size 12KB
SHA256 1459d82a6d62d015af6e2383ff75bb1b6409a0808e5bcea776314675c36b8916
MD5 e04c9cf6e60a046375272aad0a43af14
SHA1 c3c4f75e8f050ad9aaeb118cec185c450b96b2f0
SHA512 046465ca2e30fd55ed2a1a6386198bc5febde95b0d1c63fd71233c49bfc2daeabcece51c164d838bf2d071c56b485b86f348c1c119ab5b12297ca9d0ee051c2a
SSDEEP 192:RRyNDk3TEv7EI3JjPRpKHlf97HcDHsb+WNndJu+KErI2leAaVyIsnAUgE:RRyN2gblXCSrwvWEc2cE
TLSH
T1C242B62AEE1079BB5CDAD219FA257B67E3F5102221D52E84E6FC893D11E79CC321701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7d636b29-7ee0-4af0-b8d6-1ad7a33cd57e.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\7d636b29-7ee0-4af0-b8d6-1ad7a33cd57e.tmp
Size 13KB
SHA256 94af08de5d4a2e2b8b85138a2c998899fe90d3276d1855d0a80b0d355109683a
MD5 db9b0c01a706b82ae28251d12cb8795f
SHA1 603deaff1dc1124d482f9ee94548d96e961ff5b7
SHA512 2d8bf655f03a4bcc079d8d946fc435ef41fdc0f0077aaf9b8d745f911598251f9ccc519fbf31216da4a283a7914a936f0f1b3194bf2c608662e98021082fe2f3
SSDEEP 384:vBjNU7KxkXqKf/pUZNCgVLH2HfgslGmXODNc+ErU3hjHGf+LS/hwYk6:vBNU7KxkXqKf/pUZNCgVLH2HfgswsOZO
TLSH
T13952F927A84DAA7B0FD8D68CCC12AF4FADF5019765A8092453FB5C0903D57DB120A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

81940935-1dd6-4215-9847-24cf2a2d56be.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\81940935-1dd6-4215-9847-24cf2a2d56be.tmp
Size 11KB
SHA256 6ddeea320d6abdc313946bb886109326bf6367d688e89b4dc62f76ef5e07b539
MD5 920c1311ba837097f609c4ee499256d9
SHA1 af879f6226132b2b8080cc25e57e4d586f9eaccd
SHA512 ad3158f281dd0b21604d28449b31c0cf24ca9c40bcc19993ba5d178919000a9b4914c522886a2ecc9e1c98ff82a53b203f3d485ec651c1fedbf7a712129465a9
SSDEEP 192:RRyND33T6v7EIAPRp2Hlf97Hsb+WNndJubr2AI2leASVyIsnAUge:RRyNTW+XuVwvy2x2Qe
TLSH
T1AB42A52EEE107A7B5CDAD219FA257B53E3F5102221D52E84E6FC893D11E79CC222701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 1KB
SHA256 17a7d35eaf33fb4b74f54419a74f3d6b99272ee42b172f4868241eed2a020382
MD5 c79a469bb2b64224aaf0d72361e8ad87
SHA1 72a7b27c980b90ff8ebdd835168ebbc41c5879eb
SHA512 b9370be1650f09d06befec5e70531e2fcdcfc39f22f74ec0c8a34c6c2f3c96689a9b99f140622738fcf31dbbfd6653baf4dfea432d7817ba120918deff5e0e4c
TLSH
T1F321B8A5610138D0E755B3705DF0965B79F30583830BEDB780060CBA7E31B8E966879C
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

14d18edd-62e0-490e-89fe-b16b0014db38.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\14d18edd-62e0-490e-89fe-b16b0014db38.tmp
Size 3KB
SHA256 1aa96a25d9087b4a6a851b0751e4b2f61d3ccb59a466a44f2c5856c2352e0abf
MD5 ded4a8f995cbbae99a9e92d39826d0a6
SHA1 c96793656a0fc099c0524e3d053a24b472051f70
SHA512 3b09f88871b8ef5678d25869b74b7d315feb7b96dc18cbba5af195f4c23b88c43849b23183b5d4506b5afd3407bc0ca4638c9dad4b3d5bfe670b1a63c7f84c73
TLSH
T17A618EF3D3D4996D881166F49B257E2FCE291A18532C3D6688D4EE4F93E2872D24034E
MD5 SHA1 SHA512 TLSH

Submit Download

1a62162e-58a5-478d-8dd5-c94162967b0a.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\1a62162e-58a5-478d-8dd5-c94162967b0a.tmp
Size 3KB
SHA256 d502e4f2b6c45f704da9ef06c4c45227d146d49c2dfa58209c0892bb91b50922
MD5 c9262f2567247138ecac9458c6cb1901
SHA1 2ef622b35504c192ed1f240158a48daebe13e461
SHA512 0961142cee42e05e029350dfa2d13869133a46e54b9c96b23acce229c83e2e70fe6e7a2f3f06df217833dbe4bfd96a8513bc143029043895d0c465b0698e21db
TLSH
T11D51BDF7D3E4867DC911A6F4DB11AE2FDD2D0924432C3C6589D4AE1B93E2972D24038E
MD5 SHA1 SHA512 TLSH

Submit Download

5ecfe59b-9dff-4769-9b31-8d16df626a2d.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\5ecfe59b-9dff-4769-9b31-8d16df626a2d.tmp
Size 3KB
SHA256 3107f88ebfd2c8b7207d3420e040737380e32f207c5150121163ba9638fb035d
MD5 55b2254a0ebb5aa6914de475a048db85
SHA1 d7d7210b914fda8cb33338186dea622c84d7087c
SHA512 56856aefa78d726dcc22f23981810285371638928b4bae4d196aad61eb3c46a0721608ea0e537954c29f5391063de71b3b93cc77618f64ac98153d0d3820f0f1
TLSH
T10251BDF7D3E4867DC911A6F4DB11AE2FDD290924432C3C7588D4AE1B53E2972D24038E
MD5 SHA1 SHA512 TLSH

Submit Download

7b7b1eef-db97-44b5-9c89-169102b0eea7.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\7b7b1eef-db97-44b5-9c89-169102b0eea7.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

cb6b39ab-22e3-4e95-8c85-c32204920ebb.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\cb6b39ab-22e3-4e95-8c85-c32204920ebb.tmp
Size 1024B
SHA256 8b3701a6d93555cd0016ee6206810b4529a030e85218c909b0fef8e17a0a60d7
MD5 5833023d52c082c4b0f293a3611e1d4f
SHA1 bc8f8accea3f501ad19f4eda6ecd02708fcefbc3
SHA512 63ca23d448570cbe7764c259f6bf5aaaadd19da587387dd0b5a4a34173fbb26da2149fb5655dfd813288ee424450059f74eccc00229d2759e0c06a6440ce5f95
TLSH
T16B1102A7D6BFB86720A944BB2E147C0A3DB9B4311281A4F4DF57416CB0C16F31F02853
MD5 SHA1 SHA512 TLSH

Submit Download

f4fd6428-790b-4560-9d53-445d7f01b81d.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\f4fd6428-790b-4560-9d53-445d7f01b81d.tmp
Size 2KB
SHA256 461c1cbee5342ecee3fc0f0123e82bd36204c8c4ed3d23c223ab2ec94753e1e7
MD5 aed52b3b5f470561153c59c48c782323
SHA1 f9d8a56706107969c38b3143e2e72e06293a9d57
SHA512 bc41a9033304b00cf017d7bbd7e52380faa6583e2a4123529aabaf546c7eb3793d2b042493b2516b937694bb4a8704aad236dee853e75c1bce1eb6883918ece3
TLSH
T17451AAF793E4866DC911A6F4DB11AE2FDD690924432C3C7589D4AE1B93E2973D24038E
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\temp-index
Size 72B
SHA256 4cf0a572ec5005eba38c1eff9806224bb1fdd748bc753cf08d5e7e93917e97ed
MD5 f89ea82b08093c8a9648a25d1187ebdb
SHA1 a04939c7d1da362183c25d4a7985155e8ad66052
SHA512 cc226822301994926a9ff618920930de966d1aa6ca3c2f8f48bee2193375ec0013d04327759a28724b1e0a6c2d4df71c2e218880262a143e5cd005c3f224a81e
TLSH
T1ACA0021082D44516CE0C9376607305416ED669693E52830394919859AE5F5C54112619
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 92fd726933596bb3359670e505aa4b1e722b2f0d47ef7ec5a2243fe4e5e06e3c
MD5 4b60e439189ad0f828027a19f66e7f3f
SHA1 812be7669d4a96422c845338f49774107206e104
SHA512 0b0e8e87009b5ebada26af2534bb3a374f474e14241537ab92bf774c2ec7d858a387537b58978cdcc5190c8f0bf58612d86575252e52463c5694da4a3174e7d5
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

b96abb49-aff6-4c98-8439-034722cdb2ca.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\b96abb49-aff6-4c98-8439-034722cdb2ca.tmp
Size 12KB
SHA256 539093613f312e58223290379930c3bb32e6c64e0d6b5804e7c2b65fced75f7d
MD5 1ae22968c30bdcd0d391ba6817593b39
SHA1 e2778b9a1b94f609cf01d4729944649a9e43b6f1
SHA512 ddb5a58d6c51a7876f83f9014ba884fdc30c156ba259bba44f5d1eb6238ab14d60cf65c80e9fcd5939d73aa737d778eab7e07d17938ba8e5f0411f220d429a9a
SSDEEP 192:RRyNDk3TAv7EIyPRpKHlf97HcDHsb+WNndJu1lYYI2leAaVyIsnAUgE:RRyN2cIXCSrwv6YZ2cE
TLSH
T1EC42B62EEE1079BB5CDAD219FA257B67E3F5102221D42E44E6FC893D11E79CC222701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f16305fc-a5ec-40cd-abfd-7e688b2c5ff9.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\f16305fc-a5ec-40cd-abfd-7e688b2c5ff9.tmp
Size 12KB
SHA256 954808b683bb52dc77137c84d697887f21b31d7b70d5adcb5eff861cc002c147
MD5 adc867e37523533a1b549e19459097da
SHA1 60d53bbdad9b924a21871c5fcbb864d38987bf06
SHA512 f8b83da78324b79f815e58c44237497e349872355a5093c0867d190e510d6c5f5126012a78e4be332cd743e5591534cc433f3885f6152d1c7fbd6687f1421d19
SSDEEP 192:RRyNDk3T6v7EIyPRpKHlf97Hsb+WNndJubr2+I2leAaVyIsnAUgE:RRyN2WIXCVwvy2D2cE
TLSH
T1A142B62EEE107ABB5CDAD219FA657B53E3F5102225D42E44E6FC893D11E79CC2227027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a82684b1-6f82-408d-bd3c-5787126de75f.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\a82684b1-6f82-408d-bd3c-5787126de75f.tmp
Size 4KB
SHA256 b033d2d6b275fc71c3f8ca54e25d69c32ca19a19900b56c8010ee85e318c517c
MD5 622f6d937e3896d2f359ea2cccb47a7f
SHA1 c797d4627a9c04f21bb4afc257d4b8310588dc9d
SHA512 6963478d1fc23447f3d3d9a4d086f7136418406568ef11716646ca87ae335bb3c11ebaeb7017810475be6cd4b00e51774d62621de23ac694d1c17f47e6c03516
SSDEEP 96:eIlC0d+pK242KafJf1OIu5fksRDotok55sD8B6qpGyv+7hhe0bZv4a:ZlC0bt8OI8lDUDgQPUhhhe0bV
TLSH
T183A11A70E96C99B728B5C584B6062F43DFF8226761A2DFC4DCDD5A1D20E71F80342523
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adb4049c-1649-4772-8e6b-d8e7b5d73af8.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\adb4049c-1649-4772-8e6b-d8e7b5d73af8.tmp
Size 139KB
SHA256 bac6048c38b96dfe1ce31ee2fac11cc4577bea3320eb9c7809ba29c650961430
MD5 f4e0e3b5d46236a2fb5785aa70b42e12
SHA1 574f8f13033f2fb406d1a93047d02e451d67ae7a
SHA512 9fd292801b41add576e281067734b4f934d570c473c2e51d1393cc2319a1e7059aa9b8648d14bb32959491c6a44bf5552be58a5a861dfae676740c40b2cb3ba8
SSDEEP 3072:y6xBdcx0+1HN8bg6HofwIEV3DuTe1pPInY6fG7Ct9E+TKq9aRoUq+m1KK:yWdctNj6GwF3hvIYKG7ClTrsbpK
TLSH
T1C9D3127DAC952CB349E81106B60329870EA9B3C9F03991D447EFA781335D0FD1B879BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c99febc6-53d7-4536-8f93-624b90490eb7.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\c99febc6-53d7-4536-8f93-624b90490eb7.tmp
Size 140KB
SHA256 4729c5042daefc3902f22a41f4caf41fbfc604daaee4257f59978e997d98be99
MD5 05b0b8b604beff9f2183e6c8c5f19a3a
SHA1 93a26b2b73d6b04d0c4fd98f36d41e997cceab48
SHA512 1d3cd8c43d125e9705bbf6bd53a7984d77bb63bd628ce8194ea95bd033789955b40bb9608ed82dc7fb4197ed9f044b27a4048e104befef78e497f7299498a211
SSDEEP 3072:gJBdcx0+1HN8bg6HofwIEV3DuTe1pPInY6fG7Ct9E+TKq9aRoUq+m1KK:WdctNj6GwF3hvIYKG7ClTrsbpK
TLSH
T1D5E3127A6C952CB34DF51045720729870DE9B2CFF035A1D84BAAB781235D0ED1B87DBA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ffb10bc0-fb67-48d6-b214-2c7bcc114c2e.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ffb10bc0-fb67-48d6-b214-2c7bcc114c2e.tmp
Size 140KB
SHA256 bf2db18cd62c4a88a0e87c25a18778f673c27933d6c017baf708caa0da063da7
MD5 ae74915313d22ebbed5aa64ee86e1340
SHA1 c846f461f2a2a738b844371d1af7525ef6602539
SHA512 d36ebadc0c6227ae075642e46e3e013ebe0ce01153b46461974f266ebad054be219dd992c1304f1912d8800e91c883635c1d514d5caed1624586ccfdaca6f128
SSDEEP 3072:QJBdcx0+1HN8bg6HofwIEV3DuTe1pPInY6fG7Ct9E+TKq9aRoUq+m1KK:GdctNj6GwF3hvIYKG7ClTrsbpK
TLSH
T146E3127A6C952CA34DF51045720729870DE9F2CFF035A1D84BAAB782235D0ED1B87DBA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 599B
SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
MD5 658ab8c32d4cc5deb36ac5f63da4658b
SHA1 30c12cd871ff0c2c4098d794e9ae4f2540586813
SHA512 a73030c008ef3c2e274f11c90bfe79fa8ae402f76801c710bed8cc1ab1218a84858ea566b772be4bade8ef639a019c57d297028df15b64b3753482cf0f3c8f85
TLSH
T12AF05C83EB6A1B72C456123DC8EE56E47B31D1846EC11367A2107B1D3C2B7192D174BD
MD5 SHA1 SHA512 TLSH

Submit Download

33d0e923-e849-4fa8-9032-eee91af0e82b.tmp

Path C:\Users\Admin\AppData\Local\Temp\33d0e923-e849-4fa8-9032-eee91af0e82b.tmp
Size 242KB
SHA256 81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82
MD5 541f52e24fe1ef9f8e12377a6ccae0c0
SHA1 189898bb2dcae7d5a6057bc2d98b8b450afaebb6
SHA512 d779d78a15c5efca51ebd6b96a7ccb6d718741bdf7d9a37f53b2eb4b98aa1a78bc4cfa57d6e763aab97276c8f9088940ac0476690d4d46023ff4bf52f3326c88
SSDEEP 3072:r+nmRykNgoldZ8GjJCiUXZSk+QSVh85PxEalRVHmcld9R6yYfEp4ABUGDcaKklrv:k3oF4Z4h45P99Fld9RBQYBVcaxlnfL
TLSH
T1F63402BD7D8AE686D006A17676C0B48BE1199F4E41CB7C0F668A89010D70F8C57B9DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000003782\VCRUNTIME140.dll
Size 117KB
SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
MD5 32da96115c9d783a0769312c0482a62d
SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
TLSH
T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000003782\VCRUNTIME140_1.dll
Size 48KB
SHA256 6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8
MD5 c0c0b4c611561f94798b62eb43097722
SHA1 523f515eed3af6d50e57a3eaeb906f4ccc1865fe
SHA512 35db454dbcc7ed89842c0440b92ce0b0b0db41dbd5432a36a0b7e1eddf51704b1f0d6cff5e3a3b0c3ff5db3d8632fed000471180ad72e39d8dbe68a757ccdfb0
SSDEEP 768:vzzO6ujT3MbR3v0Cz6Sz5q83ywug1HDV9zxfYbK9z:mq/oMx3hXHDnzxfYiz
TLSH
T1AE236BA453784486D4AB99B0C0DAEE577D7CFA964B10928F0BA0D15C1F637D0EB3D21B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000003782\_bz2.pyd
Size 84KB
SHA256 df21ec68d062eb375dba4ea8332aa859d0d4b91f9eddc45e1cebfd54742044e2
MD5 bcbc321b91892f43cabe8428e803d83b
SHA1 c7db6eedfa9b28d131c11a4d0513a2675dc5b286
SHA512 a64a0cb601109f2ce5bfe20635e53ac04b360e9732b844083c288711bd8b674a67b6cb2b0b56c66584e986c0c16ebbcdcb0e907cca16a7e035a71ff028ed520d
SSDEEP 1536:vwSHVz7omiqvcmgWkT8dtGCBqtbe8kEsRm75pIjLVEyvcvR9wfIk4vH:vRHVz0lqpm8vGVb5kXipIjLVol
TLSH
T194838E96E3A542F6F99B91B886840793F730BB960750A36FF144C2893F13BD06E9C359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000003782\_ctypes.pyd
Size 131KB
SHA256 c95add0b1a541b723c9090c23abeadb8f642b31bb33f2e1ae005fbb8a331ef73
MD5 97b66a00ce30db4174b6442d180b9edf
SHA1 7fa648986bdfb82e026783781e0234763be4888e
SHA512 84fe7d9a73b7484b4f0e12fac4b65414a2c3a2eb0f25a874478aa18fe453f96c87117e61915f2317d8349f464f9e770f65a0224165efa9d1ed5eb5e2069abe48
SSDEEP 3072:BcR020vICVNAa9f/FTi4PKJLSFmVIjyPHw:BVfvImff/FTiIKJ7g
TLSH
T1CED37D0B735800AADAA39178C573AF47EBF1B453171047CF02A4C69A2F637A26E7E305
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000003782\_hashlib.pyd
Size 67KB
SHA256 8770291fed8af2ea8e9fd2ed695e8c56f8e26848c91d320d1a22ddf404d02116
MD5 7c12176dcf9c3fbd6e3b57c2a1c2288f
SHA1 be855ab76ddae5ba357d757a8cdf7873142c1cde
SHA512 a3ed996523f26110fb813b5fdb123fc5ed375e9068c7c770628fc270528e3b7f017f03242143d5573c91b0147dae5f9bd70d10d3a5cd96eabd20535a1a3c99a4
SSDEEP 1536:mqXn1xAu1lEAXfX6fcV5TaSZ6CAhIjvI1yvcvR9BfIkYn:L1l1uAifcySZ6CAhIjvIIR
TLSH
T10D637B95AA894092D96382B5C4A34F83F9B1F35217119BDFA2A8C0CD2F233C39777756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000003782\_lzma.pyd
Size 155KB
SHA256 1ddce9934889905b482f8587656f28ae1988365a55ae86ca4438873fd0184340
MD5 ad90d5a76fb77b395450308a5a1d39a5
SHA1 4431fdc99b1400392f68e2d10a4b490e4d881c7e
SHA512 4f3f23d36a8397392e139ff7aee3cebe720ce400aa0e025f69575615eed024c4f871fe7bc372c42b253ecbfd55e84b319b437c2b536fdb8d88b67ea8683f913f
SSDEEP 3072:mqZ/boPLmhrKifqGDRJUsYznfB9mNoMvmiRnS+pIj01YVP:meTgLhyvUsu5YOMnS+Ut
TLSH
T106F34C86B794F0D6F3728C38D6624F57E6F5785A0320929A01CC936D2B1FB659A2F313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_queue.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000003782\_queue.pyd
Size 34KB
SHA256 0d316914b426e71bbd263b78fe23622ac1c8e6f86bae42ef6ffbb609e6257e3a
MD5 e37dbf94deca08f03ebb7c55d447bc6e
SHA1 e1c7a36b3f8d464deea7c74586673db9a74a2b84
SHA512 a038c211b514889fe623af50e5585fce629c82b96920354cfdf7367b8b7d6e86ec064bd4f2cbbb4f0be70730d57560710995939a19e91662c4f2eff6d93ae189
SSDEEP 768:2+MdD6rUhf46VIj9Uet5YyvcZRYT2Ip4HTxf1ml6Z+7E5Ngx3:oGUhfbVIj9UzyvcvR9tfILWS
TLSH
T1AAF27ECA9B684487E563DA70C1A2EE92F435F7D3661187AB207982CD1F173C1A33A359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000003782\_socket.pyd
Size 84KB
SHA256 a69f3a7e281009c86868dd56c2e933ca2634a3979fdc2a4ca751ee4ef5e6ece7
MD5 8280efb5ca04f7b733aa8c7fd3e1c0a0
SHA1 4ababc55d839ab4ffbba8b784d9261d4e7fcf179
SHA512 09d60bd1f81fe8cbdf8d27d4f7898e87aa2deda6a1bd18691b92d0532fbb156ed37258df544e0e5f63d8e3a7aee48f07bb8205a58a73d3f5a5cc353d2e1f8a20
SSDEEP 1536:AFl/fFBFuJaBvTl5CgDyJwvQlyJ+9+nzL3Lvxtq3hSyVIjyw8yvcvR9cUfIbHWnu:AFR1uJmB9yJwvQlyJs+nzLbvxSjVIjyM
TLSH
T1C0836B00A65041FAEBB3D071C2639E63FBB4B5C11395A75F1066C65A1F33382BF7AA85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000003782\_ssl.pyd
Size 177KB
SHA256 eb860d3a4ad45e3d7975c5fdc3994798ee9b7ab685fa920c2656878b7dcd3029
MD5 931b9b40b7dd3bd40b6ada65396538a5
SHA1 7a9a90fa6449ba7a1a40ce0a5c9bb33df9efe0fe
SHA512 d89b9e8bb273f24f4846c891fd7f713eff3b2ee1359b31a4d4f872fd691093c6ca9fd3f6140c7663fc0430a8fd61fbdb4f052fdae185f9eea120d2c385db4222
SSDEEP 3072:KofR8NKUKIUlfw6CsH1UOmI7IM/cbPuC/JgpIjL772:KoZuKUNyw6CsyOsy3
TLSH
T160048C07B6945AF7D813E4F9C2234903EBB1F145331247DE48D6D6890F0374AAEAAB63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_wmi.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000003782\_wmi.pyd
Size 38KB
SHA256 1800304e19246edfdb56a14ffabc129b6b5b73e25dbedd2302e75a9eb4d78352
MD5 ad46ca17b5d97639b13ed6ece091d7e6
SHA1 fba1a87d747b43cfab7de140449324f870ce07a4
SHA512 ba8f6b5595797ed2294afb8dbe3af7380622ed115b41645f9c76352ece511de21ff9b5b02c6c7599291f7a1fb4f4dadfb8b03abf457508d279014e2ba4824d8a
SSDEEP 768:Y2/EEqrVmjsruI2crupIjLivYyvcZRYT2Ip4qTTxf1mlIJHlU:FE9BExI2crupIjLigyvcvR9qxfIkHS
TLSH
T1B5038D89E6680083EB67CA70C5A5CE53F575B7D32711878F326582990F233D0EB3A279
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI000003782\base_library.zip
Size 1.3MB
SHA256 8c0876f61f9663352a36cb1115bb4ec93efc2ec45718b2dcf4f07e9ca03b78f1
MD5 c63fa0446366e374eb0fb1495f9ac928
SHA1 35d19aa68ba5e9043e715380eb6ea9a531c04492
SHA512 68c2e5daad44e29754cff65f9239a87b2abd4b8b651f47190787732cd32c2e3bdc6781dff554d092ed581b57c1fa12c80a80593478cca3ea39ab58aaee03a573
SSDEEP 12288:DWiXjEAxtYzGN8Txti2cPPdxhYT5wwtjvL+DlcTe1djdTmuIva80201jwCVRDVoK:fjESuTxt5cPPdxhYynNdZml87WppO
TLSH
T119551992B9527953FF64F37B80B7484CF31E86A2EF00C207355E42661EFE6B09E59588
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000003782\libcrypto-3.dll
Size 5.0MB
SHA256 e03dd02fdcfb791981c9962827cfcf495f2a47a514c1526efb57f847a9df514a
MD5 8e8f32ae40518478e44269cf22cf4399
SHA1 3bd9ea6294eebd45c867178bac0f4f77a49525a9
SHA512 d2d6bf1aac274fbbecafe2344242dd8edf9894c996d5e7c484cff828971287070de20abee1d2d706492063ffed64223020c9859df7596bd4d16c6d738efca6be
SSDEEP 98304:D03+0YMHT8tCl1r2qxPJ1W1CPwDvt3uFlDC1:DyPYMz8tK1r2qxR1W1CPwDvt3uFlDC
TLSH
T1BE367B6AA7A80149E4BAC13CC9534617D2B1F85A57B097CF18A196BD0F33FDA2B3D740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000003782\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
TLSH
T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000003782\libssl-3.dll
Size 776KB
SHA256 1e4bc0638682bfcbb36f4465d6a2e9944d917a60f05ecc8ddf9e96847e05e13f
MD5 f31ed8154564b75e48f2525a7e9f5742
SHA1 d2ff57bdca2030379da6d256892350ca85a0411f
SHA512 dc313916fce80ba99461dd758f424987344d5fdecc4ea28d01764440282b5bcde569eaf8a895fd966ee281aaad94d1b937f0e2164a45ddb18d3698e22b0f6ebb
SSDEEP 12288:gwgpFEKP7Mn162zCpbbICGxsQ7caA0V/jcrldFe9XbE:X6P7Mn16sCpbbI1iecoVGFe9Xb
TLSH
T16FF44CADB3B805DDD8B6C17986934623E3B6F4552330EBEF065186790F277D42B3A248
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pyarmor_runtime.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000003782\pyarmor_runtime_000000\pyarmor_runtime.pyd
Size 625KB
SHA256 790a9cdccf929b7d685d7f1528ca4e8861249e2f0ac507788fd6009bd0e1c413
MD5 c1e72743e29a0aad8415fdfae1454eef
SHA1 2849dd6f5c6e70abade397afcc3ca6b58ee816db
SHA512 b1dacb9b85ed08b2088acda7f9c5f2ca08d226e2228da7717249b336370177c3189fbc09d510551e83a770716e5ef3a78502a9df5e42a11fa6ae3e280435479e
SSDEEP 12288:bcIxPU6PGVHvi5v3ctjdcg7fUoP9c95RnEvu9G:bcW44ctjdcg7fUoP9c95Rneu
TLSH
T1AAD4294BE1FA25E0E6B6D17C078BF2737C3ABA488160775B355CD3A127D4A5212E1F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000003782\python3.dll
Size 70KB
SHA256 ca9313dce359c129edc385af4d0c2322e6b3fdad4969d5c2fbc36e0886da58bf
MD5 62b4aa40b1ac2a3f511c1bb83b6c1d5c
SHA1 2cad9261b959e2fe71dc88908262863b4b57a37f
SHA512 27863a313b5c2f20f56b6382235e19673f564760873a7c4ce932cdc05f8ec6f3dd8bcd840fa8efe89a90748617bdd7e14d666a6e30c20a8aa08ac5af5ddf2479
SSDEEP 1536:yotssyKcunV8PHVIjy0UyvcvR9ZfIbH9n9k:JtssyKQVIjy0NTk
TLSH
T152634BC25B57F8A2D6F669FC78DDD9CD242B12CC53298D9FA47993820F1A310A22734D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python313.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI000003782\python313.dll
Size 5.8MB
SHA256 265a27242ee97f81eeac6a556fd7de56baff2222f2334386d8f948e359a649d8
MD5 6aa80c7706a9f1638fe6076c9934db8e
SHA1 b922f6a19a6349607753bec54af07207a2788a81
SHA512 24df17179656feca73776a03a8907676ee1b408266cce9c6646c5106b2cb1c403b88a9697ee8b7d82c726eb2542587f2f91bfbe2950f3be2d501cffb7847f778
SSDEEP 49152:CW+zL84N/BRqK1Ww9errjThuTmsoVmlqxRKkMhXWNOzsf0I4TxHBPcYyK8Nh1U/w:Cx/Bs3jykmsxM7n+Nh1Lv5HDMiEJwb
TLSH
T161567C12729D41ACC9BB8078CA13864BFBB27C153F60434B61A6BB5D2F737624B6E705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI000003782\select.pyd
Size 32KB
SHA256 7d061afc87ba79f90878af39a1ebc7b4cf238d52e5bbe16ff7e176cbba266ec0
MD5 f859886b72b5e5db8e9c9414839b8e79
SHA1 2dd9008afc850f90d80f95fabfa864263db72c58
SHA512 3d0828181bc0a2a8df7c9c8a7cf77485eaf9905d8557317ade5fcb2da22d1adffa7b1c124a5d019083ff6fd4eb9cb0fcd8a64f87404d88804c40b274e03f38f8
SSDEEP 768:npX5zHfnLTaPVIj9GN8YyvcZRYT2Ip4CITxf1ml9dHT7L97:pX5z/n/aPVIj9GXyvcvR9C0fIbHTn97
TLSH
T15DE27D8A6B785047E6A3CA31C6A2DE43F93AB3A3565186DF30B581CD1F177C1A337258
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lorem ipsum.txt

Path C:\Users\Admin\AppData\Local\Temp\_MEI000003782\setuptools\_vendor\jaraco\text\Lorem ipsum.txt
Size 1KB
SHA256 37fedcffbf73c4eb9f058f47677cb33203a436ff9390e4d38a8e01c9dad28e0b
MD5 4ce7501f6608f6ce4011d627979e1ae4
SHA1 78363672264d9cd3f72d5c1d3665e1657b1a5071
SHA512 a4cdf92725e1d740758da4dd28df5d1131f70cef46946b173fe6956cc0341f019d7c4fecc3c9605f354e1308858721dada825b4c19f59c5ad1ce01ab84c46b24
TLSH
T1972163328E9C03006FD1303A636E89EFD948F0281A04BB25ECF9D68FA44115CD6E2375
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4180_891923736\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

TQX V5 LITE [NO KEY].zip.crdownload

Path C:\Users\Admin\Downloads\TQX V5 LITE [NO KEY].zip.crdownload
Size 14.9MB
SHA256 a659bdf18c49447993a103f6f61c93ecff6992ff649cb2ad8134871b70752efd
MD5 eb7b28572f7dad7191743a227757ff82
SHA1 0ca177497340b3638a6f2caa7443fb6c105c82fb
SHA512 9426238a87fa71e8734bf5b47fed7447dc0f0163f21d3906af711cf3a0712bea0638836fca58436bc742e758d7ac749037be5750cdbb8d048353c64279f295c6
SSDEEP 393216:jgs+8sC2+i+r2sKkd3bpl+kTcvEpjK6wfAPK:b+hpJ+DtX+sccpjTuAPK
TLSH
T173F633BCE58C0FFBB1C28168536AB85117E9B9569FA31937093269F11DA32D3CB01F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

config.json

Path C:\Users\Admin\Downloads\TQX V5 LITE [NO KEY]\TQX V5 LITE [NO KEY]\config.json
Size 248B
SHA256 2d2479d5ed43aac1d998b2132e8414426e5d61fbcdf44e74f8c6cafaec1e69b9
MD5 36c07b7d67e4501f3e6a22cf6106d915
SHA1 e40b221de016d173fdc7e99a77a482240bfe1c9d
SHA512 fed2d8a0cc37bd16138e6f9c57cc60372a47a38998aa17f560ddce64ce63f2b0f32d45bea4ca410dc14d2242950f7b58ec9a468eabd04a7c28e6963a8939bbb6
TLSH
T16CD0A90BFAD98E2B1074F0B096582289F025A30F09404A0BB2B2C97E8FF2D28A487400
MD5 SHA1 SHA512 TLSH

Submit Download

config.json

Path C:\Users\Admin\Downloads\TQX V5 LITE [NO KEY]\TQX V5 LITE [NO KEY]\config.json
Size 369B
SHA256 e5a2a77b177ea234498e2fb49643c871b3de50db7cd37fd05e69fa85440f6c94
MD5 0ff2f0bd0a6a99eb2391a3cc68e0068b
SHA1 2f48d596b92a6434fa753381a93a7dde96fb723a
SHA512 81ba21d151e3744fcbb31bb954fd42794389aaf3cca333947c119813a5164f1585e9a4a5988f0b838f7dc2c89f8865d5b08e6072c854c95cf9f3b962982d9e52
TLSH
T124E02053F5C4CE274574E0B46145124DF592934F0C844E0B31B1C53E4FF5D61B443044
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4460-978-0x0000022D82A00000-0x0000022D82A20000-memory.dmp

Download

memory/4460-956-0x0000022D801E0000-0x0000022D802E0000-memory.dmp

Download

memory/4460-987-0x0000022D82DE0000-0x0000022D82E00000-memory.dmp

Download

memory/4460-955-0x0000022D801E0000-0x0000022D802E0000-memory.dmp

Download

memory/4460-979-0x0000022D82E60000-0x0000022D82F60000-memory.dmp

Download

memory/4460-957-0x0000022D801E0000-0x0000022D802E0000-memory.dmp

Download

memory/4460-1001-0x0000022D942E0000-0x0000022D94300000-memory.dmp

Download

memory/5000-720-0x0000000070180000-0x000000007022B000-memory.dmp

Download