411e60d5bb41e87870a1c0c1be11d1d0b53df39c3a2b02da6d0d3ac00ed00416

Analysis

user interaction
yes
max time kernel
1800s
max time network
1804s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/11/2026, 00:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Captura de tela 2026-10-17 212200.png
Size 168KB
Sample261102-agajmadf75
SHA256 411e60d5bb41e87870a1c0c1be11d1d0b53df39c3a2b02da6d0d3ac00ed00416
MD5 1476450c525459ea6c72a2f268006e0a
SHA1 4acbd661373f40549f4e5764e0008b498970bcdb
SHA512 98148c825585740dc259bd9b97bb3c31582a771b19afb7ecf5f062e1d34c9fbd4a42fab5270589c623caf7590f13fdd93330105fcefcec868bc1b5213efc8461
SSDEEP 3072:97Ou2U6BB84AKK8OSlhXPHJha09VEmOUY5z2tPjSouJTY7g8HMGHiT9//d:97OvBK4AF+lVTXOU+z2neTYLHpHiT9nd
TLSH
T131F3F14ED5F3C28A4EDF21342419EF6BEF9B088326F562B5D2B5B14DC811C3E8510AAD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware discovery persistence ransomware spyware

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3220	chrome.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\Main	explorer.exe

Modifies data under HKEY_USERS 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe

Modifies registry class 45 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	StartMenuExperienceHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	StartMenuExperienceHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	StartMenuExperienceHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1404337215-1550464601-2805570857-1000\{E7B57911-D353-4D52-B440-958E40F1ACBA}	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23"	SearchHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1404337215-1550464601-2805570857-1000\{3E99D851-03C5-411C-939A-AB13700D54A7}	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1404337215-1550464601-2805570857-1000\{F587BB3D-7216-481A-879B-B5B5EDE67B0B}	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\MuiCache	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchHost.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4656	mspaint.exe
4656	mspaint.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
248	chrome.exe
248	chrome.exe
3764	explorer.exe
3764	explorer.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs

pid	Process
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5360	chrome.exe
Token: SeCreatePagefilePrivilege	5360	chrome.exe
Token: SeShutdownPrivilege	5360	chrome.exe
Token: SeCreatePagefilePrivilege	5360	chrome.exe
Token: SeShutdownPrivilege	5360	chrome.exe
Token: SeCreatePagefilePrivilege	5360	chrome.exe
Token: SeShutdownPrivilege	5360	chrome.exe
Token: SeCreatePagefilePrivilege	5360	chrome.exe
Token: SeShutdownPrivilege	5360	chrome.exe
Token: SeCreatePagefilePrivilege	5360	chrome.exe
Token: SeShutdownPrivilege	5360	chrome.exe
Token: SeCreatePagefilePrivilege	5360	chrome.exe
Token: SeShutdownPrivilege	5360	chrome.exe
Token: SeCreatePagefilePrivilege	5360	chrome.exe
Token: SeShutdownPrivilege	5360	chrome.exe
Token: SeCreatePagefilePrivilege	5360	chrome.exe
Token: SeShutdownPrivilege	5360	chrome.exe
Token: SeCreatePagefilePrivilege	5360	chrome.exe
Token: SeShutdownPrivilege	5360	chrome.exe
Token: SeCreatePagefilePrivilege	5360	chrome.exe
Token: SeShutdownPrivilege	5360	chrome.exe
Token: SeCreatePagefilePrivilege	5360	chrome.exe
Token: SeShutdownPrivilege	5360	chrome.exe
Token: SeCreatePagefilePrivilege	5360	chrome.exe
Token: SeShutdownPrivilege	5360	chrome.exe
Token: SeCreatePagefilePrivilege	5360	chrome.exe
Token: SeShutdownPrivilege	5360	chrome.exe
Token: SeCreatePagefilePrivilege	5360	chrome.exe
Token: SeShutdownPrivilege	5360	chrome.exe
Token: SeCreatePagefilePrivilege	5360	chrome.exe
Token: SeShutdownPrivilege	5360	chrome.exe
Token: SeCreatePagefilePrivilege	5360	chrome.exe
Token: SeShutdownPrivilege	5360	chrome.exe
Token: SeCreatePagefilePrivilege	5360	chrome.exe
Token: SeShutdownPrivilege	5360	chrome.exe
Token: SeCreatePagefilePrivilege	5360	chrome.exe
Token: SeShutdownPrivilege	5360	chrome.exe
Token: SeCreatePagefilePrivilege	5360	chrome.exe
Token: SeShutdownPrivilege	5360	chrome.exe
Token: SeCreatePagefilePrivilege	5360	chrome.exe
Token: SeShutdownPrivilege	5360	chrome.exe
Token: SeCreatePagefilePrivilege	5360	chrome.exe
Token: SeShutdownPrivilege	5360	chrome.exe
Token: SeCreatePagefilePrivilege	5360	chrome.exe
Token: SeShutdownPrivilege	5360	chrome.exe
Token: SeCreatePagefilePrivilege	5360	chrome.exe
Token: SeShutdownPrivilege	5360	chrome.exe
Token: SeCreatePagefilePrivilege	5360	chrome.exe
Token: SeShutdownPrivilege	5360	chrome.exe
Token: SeCreatePagefilePrivilege	5360	chrome.exe
Token: SeShutdownPrivilege	5360	chrome.exe
Token: SeCreatePagefilePrivilege	5360	chrome.exe
Token: SeShutdownPrivilege	5360	chrome.exe
Token: SeCreatePagefilePrivilege	5360	chrome.exe
Token: SeShutdownPrivilege	5360	chrome.exe
Token: SeCreatePagefilePrivilege	5360	chrome.exe
Token: SeShutdownPrivilege	5360	chrome.exe
Token: SeCreatePagefilePrivilege	5360	chrome.exe
Token: SeShutdownPrivilege	5360	chrome.exe
Token: SeCreatePagefilePrivilege	5360	chrome.exe
Token: SeShutdownPrivilege	5360	chrome.exe
Token: SeCreatePagefilePrivilege	5360	chrome.exe
Token: SeShutdownPrivilege	5360	chrome.exe
Token: SeCreatePagefilePrivilege	5360	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
5360	chrome.exe
3764	explorer.exe
3764	explorer.exe
3764	explorer.exe
3764	explorer.exe
3764	explorer.exe
3764	explorer.exe
3764	explorer.exe
3764	explorer.exe
3764	explorer.exe
3764	explorer.exe
3764	explorer.exe
3764	explorer.exe
3764	explorer.exe
3764	explorer.exe
3764	explorer.exe
3764	explorer.exe
3764	explorer.exe
3764	explorer.exe
3764	explorer.exe
3764	explorer.exe
3764	explorer.exe
3764	explorer.exe
3764	explorer.exe
3764	explorer.exe
3764	explorer.exe
3764	explorer.exe
3764	explorer.exe
3764	explorer.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
4656	mspaint.exe
4656	mspaint.exe
4656	mspaint.exe
4656	mspaint.exe
5664	StartMenuExperienceHost.exe
5620	SearchHost.exe
3764	explorer.exe

Suspicious use of WriteProcessMemory 62 IoCs

description	pid	Process	procid_target
PID 5360 wrote to memory of 4200	5360	chrome.exe	95
PID 808 wrote to memory of 4960	808	chrome.exe	97
PID 5360 wrote to memory of 3220	5360	chrome.exe	98
PID 5360 wrote to memory of 4660	5360	chrome.exe	99
PID 5360 wrote to memory of 4660	5360	chrome.exe	99
PID 5360 wrote to memory of 3404	5360	chrome.exe	101
PID 5360 wrote to memory of 3404	5360	chrome.exe	101
PID 5360 wrote to memory of 1200	5360	chrome.exe	102
PID 5360 wrote to memory of 1200	5360	chrome.exe	102
PID 5360 wrote to memory of 6088	5360	chrome.exe	103
PID 5360 wrote to memory of 6088	5360	chrome.exe	103
PID 5360 wrote to memory of 1744	5360	chrome.exe	104
PID 5360 wrote to memory of 1744	5360	chrome.exe	104
PID 5360 wrote to memory of 1408	5360	chrome.exe	105
PID 5360 wrote to memory of 1408	5360	chrome.exe	105
PID 5360 wrote to memory of 3676	5360	chrome.exe	106
PID 5360 wrote to memory of 5220	5360	chrome.exe	107
PID 5360 wrote to memory of 5220	5360	chrome.exe	107
PID 5360 wrote to memory of 4920	5360	chrome.exe	108
PID 5360 wrote to memory of 4920	5360	chrome.exe	108
PID 5360 wrote to memory of 256	5360	chrome.exe	112
PID 5360 wrote to memory of 5148	5360	chrome.exe	113
PID 5360 wrote to memory of 256	5360	chrome.exe	112
PID 5360 wrote to memory of 4080	5360	chrome.exe	114
PID 5360 wrote to memory of 5148	5360	chrome.exe	113
PID 5360 wrote to memory of 4080	5360	chrome.exe	114
PID 5360 wrote to memory of 2520	5360	chrome.exe	115
PID 5360 wrote to memory of 2520	5360	chrome.exe	115
PID 5360 wrote to memory of 4464	5360	chrome.exe	116
PID 5360 wrote to memory of 5468	5360	chrome.exe	117
PID 5360 wrote to memory of 4464	5360	chrome.exe	116
PID 5360 wrote to memory of 5468	5360	chrome.exe	117
PID 5360 wrote to memory of 3528	5360	chrome.exe	118
PID 5360 wrote to memory of 3528	5360	chrome.exe	118
PID 5360 wrote to memory of 2824	5360	chrome.exe	119
PID 5360 wrote to memory of 2824	5360	chrome.exe	119
PID 5360 wrote to memory of 5748	5360	chrome.exe	120
PID 5360 wrote to memory of 5748	5360	chrome.exe	120
PID 5360 wrote to memory of 1032	5360	chrome.exe	121
PID 5360 wrote to memory of 5212	5360	chrome.exe	122
PID 5360 wrote to memory of 1032	5360	chrome.exe	121
PID 5360 wrote to memory of 5212	5360	chrome.exe	122
PID 5360 wrote to memory of 4604	5360	chrome.exe	123
PID 5360 wrote to memory of 4604	5360	chrome.exe	123
PID 5360 wrote to memory of 4320	5360	chrome.exe	124
PID 5360 wrote to memory of 4104	5360	chrome.exe	125
PID 5360 wrote to memory of 5256	5360	chrome.exe	126
PID 5360 wrote to memory of 2672	5360	chrome.exe	127
PID 5360 wrote to memory of 2672	5360	chrome.exe	127
PID 5360 wrote to memory of 5228	5360	chrome.exe	128
PID 5360 wrote to memory of 3252	5360	chrome.exe	129
PID 5360 wrote to memory of 3252	5360	chrome.exe	129
PID 5360 wrote to memory of 3912	5360	chrome.exe	131
PID 5360 wrote to memory of 3912	5360	chrome.exe	131
PID 5360 wrote to memory of 3888	5360	chrome.exe	132
PID 5360 wrote to memory of 3888	5360	chrome.exe	132
PID 5360 wrote to memory of 248	5360	chrome.exe	133
PID 5360 wrote to memory of 3456	5360	chrome.exe	134
PID 5360 wrote to memory of 3456	5360	chrome.exe	134
PID 5360 wrote to memory of 3984	5360	chrome.exe	135
PID 5360 wrote to memory of 3984	5360	chrome.exe	135
PID 2084 wrote to memory of 3764	2084	sihost.exe	141

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\Captura de tela 2026-10-17 212200.png"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4656

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
- Checks SCSI registry key(s)
PID:3844

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ff88c0fc728,0x7ff88c0fc734,0x7ff88c0fc740
  2⤵
  PID:4200
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2028,i,13120396798775277459,4931117005047313433,524288 --field-trial-handle=2088,i,13388604753709447335,16125635980336163463,262144 --variations-seed-version --mojo-platform-channel-handle=2140 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3220
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1692,i,983351251506791548,14360322562582762998,262144 --field-trial-handle=2088,i,13388604753709447335,16125635980336163463,262144 --variations-seed-version --mojo-platform-channel-handle=2076 /prefetch:2
  2⤵
  PID:4660
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2340,i,5406695034397792519,4390594379060010512,524288 --field-trial-handle=2088,i,13388604753709447335,16125635980336163463,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:13
  2⤵
  PID:3404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3284,i,2564589354098496088,858793720316096614,2097152 --field-trial-handle=2088,i,13388604753709447335,16125635980336163463,262144 --variations-seed-version --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:1200
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3324,i,3781267649981195103,14635121760868630844,2097152 --field-trial-handle=2088,i,13388604753709447335,16125635980336163463,262144 --variations-seed-version --mojo-platform-channel-handle=3368 /prefetch:1
  2⤵
  PID:6088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4748,i,13293344525508028181,7219102690410532825,2097152 --field-trial-handle=2088,i,13388604753709447335,16125635980336163463,262144 --variations-seed-version --mojo-platform-channel-handle=4768 /prefetch:1
  2⤵
  PID:1744
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4912,i,4196594004554162912,8855755669664024929,524288 --field-trial-handle=2088,i,13388604753709447335,16125635980336163463,262144 --variations-seed-version --mojo-platform-channel-handle=4924 /prefetch:14
  2⤵
  PID:1408
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5432,i,8028838875023637094,14896545663005524134,524288 --field-trial-handle=2088,i,13388604753709447335,16125635980336163463,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:14
  2⤵
  PID:3676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5532,i,1450930562033908773,12041454779775677950,2097152 --field-trial-handle=2088,i,13388604753709447335,16125635980336163463,262144 --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:1
  2⤵
  PID:5220
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5564,i,1726909036300926980,9521236265159336396,2097152 --field-trial-handle=2088,i,13388604753709447335,16125635980336163463,262144 --variations-seed-version --mojo-platform-channel-handle=5584 /prefetch:1
  2⤵
  PID:4920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5836,i,4477233968739986305,9987321171706135030,2097152 --field-trial-handle=2088,i,13388604753709447335,16125635980336163463,262144 --variations-seed-version --mojo-platform-channel-handle=5596 /prefetch:1
  2⤵
  PID:256
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5628,i,14534589540444599411,18239618439770228789,524288 --field-trial-handle=2088,i,13388604753709447335,16125635980336163463,262144 --variations-seed-version --mojo-platform-channel-handle=5592 /prefetch:14
  2⤵
  PID:5148
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5476,i,11453736378550977651,18039650489481084505,2097152 --field-trial-handle=2088,i,13388604753709447335,16125635980336163463,262144 --variations-seed-version --mojo-platform-channel-handle=5564 /prefetch:1
  2⤵
  PID:4080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6040,i,4328417953324494935,13333299868451498044,2097152 --field-trial-handle=2088,i,13388604753709447335,16125635980336163463,262144 --variations-seed-version --mojo-platform-channel-handle=5820 /prefetch:1
  2⤵
  PID:2520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5568,i,12145290531215585275,100881340314312549,2097152 --field-trial-handle=2088,i,13388604753709447335,16125635980336163463,262144 --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:1
  2⤵
  PID:4464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5420,i,224780879389557560,12984588962229208773,524288 --field-trial-handle=2088,i,13388604753709447335,16125635980336163463,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:14
  2⤵
  PID:5468
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5516,i,7727053460613628567,8688690430188222733,2097152 --field-trial-handle=2088,i,13388604753709447335,16125635980336163463,262144 --variations-seed-version --mojo-platform-channel-handle=6280 /prefetch:1
  2⤵
  PID:3528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6472,i,17414156737586699496,15115894843669757377,2097152 --field-trial-handle=2088,i,13388604753709447335,16125635980336163463,262144 --variations-seed-version --mojo-platform-channel-handle=4784 /prefetch:1
  2⤵
  PID:2824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5624,i,17040287625362636815,16762584439634438424,524288 --field-trial-handle=2088,i,13388604753709447335,16125635980336163463,262144 --variations-seed-version --mojo-platform-channel-handle=4760 /prefetch:14
  2⤵
  PID:5748
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=4872,i,14871645174015233848,1822719059588343183,2097152 --field-trial-handle=2088,i,13388604753709447335,16125635980336163463,262144 --variations-seed-version --mojo-platform-channel-handle=6388 /prefetch:9
  2⤵
  PID:1032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=4824,i,1379369665351708145,1597004768205423699,2097152 --field-trial-handle=2088,i,13388604753709447335,16125635980336163463,262144 --variations-seed-version --mojo-platform-channel-handle=5512 /prefetch:1
  2⤵
  PID:5212
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=5560,i,7618642649498487664,319075168266372511,2097152 --field-trial-handle=2088,i,13388604753709447335,16125635980336163463,262144 --variations-seed-version --mojo-platform-channel-handle=5592 /prefetch:1
  2⤵
  PID:4604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5824,i,11835362593180147642,18171546393335014312,524288 --field-trial-handle=2088,i,13388604753709447335,16125635980336163463,262144 --variations-seed-version --mojo-platform-channel-handle=4812 /prefetch:14
  2⤵
  PID:4320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4880,i,11616027105717738943,970121813327701904,524288 --field-trial-handle=2088,i,13388604753709447335,16125635980336163463,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:14
  2⤵
  PID:4104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6392,i,13770471815820017124,9703906149212176513,524288 --field-trial-handle=2088,i,13388604753709447335,16125635980336163463,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:14
  2⤵
  PID:5256
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=4956,i,1711163594225805458,6268858995443584285,2097152 --field-trial-handle=2088,i,13388604753709447335,16125635980336163463,262144 --variations-seed-version --mojo-platform-channel-handle=4704 /prefetch:1
  2⤵
  PID:2672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6388,i,3333771209784868810,16089316539702712901,524288 --field-trial-handle=2088,i,13388604753709447335,16125635980336163463,262144 --variations-seed-version --mojo-platform-channel-handle=5980 /prefetch:14
  2⤵
  - Modifies registry class
  PID:5228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=6412,i,792791871968908089,8925307747979517363,524288 --field-trial-handle=2088,i,13388604753709447335,16125635980336163463,262144 --variations-seed-version --mojo-platform-channel-handle=6452 /prefetch:12
  2⤵
  PID:3252
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --metrics-shmem-handle=6340,i,7159639341147115378,2608974625695953283,2097152 --field-trial-handle=2088,i,13388604753709447335,16125635980336163463,262144 --variations-seed-version --mojo-platform-channel-handle=4748 /prefetch:1
  2⤵
  PID:3912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --metrics-shmem-handle=6460,i,1339911068094776660,11380239996778784803,2097152 --field-trial-handle=2088,i,13388604753709447335,16125635980336163463,262144 --variations-seed-version --mojo-platform-channel-handle=6328 /prefetch:1
  2⤵
  PID:3888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6212,i,9741906700569953296,3864656714081334274,262144 --field-trial-handle=2088,i,13388604753709447335,16125635980336163463,262144 --variations-seed-version --mojo-platform-channel-handle=6056 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --metrics-shmem-handle=1568,i,15242388945503329510,16493122366024346453,2097152 --field-trial-handle=2088,i,13388604753709447335,16125635980336163463,262144 --variations-seed-version --mojo-platform-channel-handle=5516 /prefetch:1
  2⤵
  PID:3456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=6880,i,13003317598179182803,18200844606485365202,524288 --field-trial-handle=2088,i,13388604753709447335,16125635980336163463,262144 --variations-seed-version --mojo-platform-channel-handle=6896 /prefetch:14
  2⤵
  PID:3984

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ff88c0fc728,0x7ff88c0fc734,0x7ff88c0fc740
  2⤵
  PID:4960

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:948

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:692

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:4676

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2020

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:2084
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Enumerates connected drives
  - Checks SCSI registry key(s)
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:3764

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5620

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5664

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:5568

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2568

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

06ddaf86-c4e3-45d1-bd64-0b813585b0c5.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\06ddaf86-c4e3-45d1-bd64-0b813585b0c5.tmp
Size 143KB
SHA256 36efb6d21d9dc73fe05835a5c97f08aa249e09f8eea546aa257e8f30119767bb
MD5 99ee16031cfd344ae12842530813294f
SHA1 920a78c826d5d934451e124326c67d1635d5e9ef
SHA512 f0ed76e01d2e03901ccb08703d7d366e891b9f0e20431a3aaa0aa49f3acd1a73352b28ab6a293368fc665d0eb1e94e6d745705c552cb62eeac59a5d573babab3
SSDEEP 3072:M/c9FQi576SmvxZuviCLQpNOSYNTRw0sX09MzZcpYPgv3+:KyQcfSxZLpN1YNTRJsX0qZcpYPgv3+
TLSH
T1F8E312F6A0AEED3E84318392F07776E3C6B0299098584F8519F31FDD1B269949307F4A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1b185c50-4310-484a-9d4b-432f913d3eab.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\1b185c50-4310-484a-9d4b-432f913d3eab.tmp
Size 144KB
SHA256 37f8611da7eb825a1fe6a5ab0d2e5b7b834ec75345b7ee125608197476670de7
MD5 4de136fa88ae306f36c395311aadc441
SHA1 aa59cadf8db9503a72adb99185f4c95640b5a1cd
SHA512 9d1be4afc69993dc6f9f6f1076b4f7b42079fdcdd9f66ca81052b0195b90c0463dda384e68f8f459ddd76c9827b8d4c3f18caa2b7508571033be4d6279337868
SSDEEP 3072:8U/c9FQi576SmvxZuviCLQpNOSYNTRw0sX09MzZcpYPgv3+:8SyQcfSxZLpN1YNTRJsX0qZcpYPgv3+
TLSH
T1FAE312F6A0AEDD2E89718755F07375D38EF03B55D8088F4429F22EC91B2B9948707B89
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

433ed910-6988-4d37-b10b-a2d7bc199309.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\433ed910-6988-4d37-b10b-a2d7bc199309.tmp
Size 144KB
SHA256 0d5f9b5227aee7d87b513a53b2883997f383b1d13a9495d20bc6aa67fecf9e56
MD5 49450b4e404caaea560a0cf385f02eee
SHA1 8bc25a0874c717161d6f211927db6400545462b3
SHA512 4b7f880e353ef74f0265380a86227848e54cabd794201ae4dcaa0782d0906ca42c6c230552e009a1fd58f773b489e06692c08bce9efe8aefbcdfceeabd378d31
SSDEEP 3072:MU/c9FQi576SmvxZuviCLQpNOSYNTRw0sX09MzZcpYPgv3+:MSyQcfSxZLpN1YNTRJsX0qZcpYPgv3+
TLSH
T1D8E313F660AEDD2E89718755F07375D38EF03B55D8088F4429F21EC91B2B9948707B89
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7a0d989c-54a3-45cf-9b19-2101f87d26b9.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\7a0d989c-54a3-45cf-9b19-2101f87d26b9.tmp
Size 144KB
SHA256 da74aea5bfab8dda180b2efb3f9e218780f56c714010dfb3fac6afe4a52db403
MD5 0a4f52ca69378d30bed5a458e6922197
SHA1 7f949842a86f04c21ce3f5898d753556451f1ba3
SHA512 f25e0b49f4e93275edbe95bcd667c91cb5d45f6a04f640d4a4690334d6dcfa9edc10a89a12299a11f83bf7aee532bfe96b809fe4d3e2db96fe514b4814cfda55
SSDEEP 3072:9U/c9FQi576SmvxZuviCLQpNOSYNTRw0sX09MzZcpYPgv3+:9SyQcfSxZLpN1YNTRJsX0qZcpYPgv3+
TLSH
T1BAE312F660AEDD2E89718795F07375D38EF03B55D8088F4429F21EC91B2B9948707B8A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

901612ff-e998-441e-9365-b6efc9e0137a.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\901612ff-e998-441e-9365-b6efc9e0137a.tmp
Size 4KB
SHA256 969827a48c76d50154aa7606ce3934750c8832802f6c7cb984c1cc80571e31c7
MD5 379a2dfea25ca0b9cf9c06f1c30bb7b7
SHA1 007e8f23c11cfe182836da31be455900849a30a5
SHA512 be927aea6abb9ac7c0412f8f0c6c2b0edc9d0699ab527935973000c9c9441ae4c40230b0a587a408d2cacc6e470705475f43a0fd716370582fabdd41a0202e07
SSDEEP 96:E3C0d+OBIsu/Fl3fIUKsI8EnZIJRDotok5NsiD1B6m8dGyvELkzA8rbuj1v4a:kC0pB+fTbnvDUDN3L4w/gA8rbu1
TLSH
T121A12C30E4B888BB54B5C184B5963E53CFB462E7A810AE80C9DE1F0C10A71F82381E6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 d8b9f6b3b9a215f0ce7a911dc243e42c4a408cef8396b955f5429a76fbc6a1ab
MD5 b9ca8d0e2252dc7edd00350f18a54b48
SHA1 532114cd0c61852ec9b6946cdb7b6cb49a5fa51f
SHA512 f2bf4cbf48b84bf7b23b79579da73e608c64124d99491db65b32efdb7265f9db9f57154bb29add3e56792cba361cb9b2f7740d0edbb426fe923112f715240c57
MD5 SHA1 SHA512

Submit Download

040c635b-c38b-436a-97ea-752886a96f8b.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\040c635b-c38b-436a-97ea-752886a96f8b.tmp
Size 13KB
SHA256 1ced81f45570ac8c6036d3e9cb0c9559290b7299bb540cbb8e4ee3054fdd8c3d
MD5 b1330e42b6040277769c5950238b9831
SHA1 8cbb2c01a08e668312d7c21286661cdb4fd07190
SHA512 61c1ffe0ba3c19bcdb5756476cf4ecbf7c5f81d64e7b456e8437e912b0f5f3a841e830cb3bf0b638bfc376071e113ebca1849cdee2023c4873a2c1d664d51b03
SSDEEP 384:QGjDC7KxkXqKf/pUZNCgVLH2HfgslDLXODgj+ErU3lZHGQYE3VGj2f:QmDC7KxkXqKf/pUZNCgVLH2Hfgs1TOE6
TLSH
T1E152F927A48D953F0FD4C68CDC17AF8FACF501566668492457FA9C0803A9BCF114A2F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

17053321-5359-43e3-b118-f902c4713a19.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\17053321-5359-43e3-b118-f902c4713a19.tmp
Size 14KB
SHA256 589ef467bb539c807b33f2678dc9ea802f8d69f65eab755c6520e59ccea39c05
MD5 2116a5849dc74120c0d4cf438a3d1c8f
SHA1 82a1804232ca651d8433743a7235f1e0d54ddcf4
SHA512 acbb00a319a404d1a3811ceef0983efc281796097faba31e3853dc8b63b0cd566aa7b650abe2d272d65f2dd5bec29ac1fe1c7135e1ffc6544c666ac3edf3d9a6
SSDEEP 192:DBRpcBhBXzFfcv7jIKPRpQ/mgqlRh99OHKDHsb+WNtqQY9ivLaA+rQ+ljEd1KGA8:lRpmhBXBfI3nXvXFrwtvv55YE+zaXqE
TLSH
T1D562D92EA964697BACDAC225F922BB5BE7F4203560C42E84E7FC8D2C14E75CC3257417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

17fe1762-e46a-457b-92f1-fc9da5b4e149.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\17fe1762-e46a-457b-92f1-fc9da5b4e149.tmp
Size 13KB
SHA256 dddd6f7f62172182f5a2c39eb48054569ab0d62de82ee80effa52460a33df50f
MD5 67015e0ee465b8deddf4ea5e9a098d08
SHA1 ea828a4bd4fc4ecd7a0df4347958d3b0a90a7e93
SHA512 6248ee5b9d86d4dc71a7a157691fc3aef13cc3265706ab9f41e7d1e40c1200f9db184b7b0df6d746bd660f65b3db43d0ed21b4221bcadaa1aedce9a7ac41e9ba
SSDEEP 192:DBRpcBhBXzFVv7jIKPRpQ8mgqlRh99OHsb+WNtqQY9ivLaAMljEY1KGAaW+qVyI4:lRpmhBXBl3nXwXkwtvv5uEpzaXqE
TLSH
T1A952D82EA964797BACDBC225F922BB5BE7F4203560C42E84E6FC8D2C14E75CC2257417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

19c75519-f45b-4ea5-9125-d8b487155f02.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\19c75519-f45b-4ea5-9125-d8b487155f02.tmp
Size 14KB
SHA256 838d8c25c07930402fadf4e537f952f193e87b7e4f9cb2a914dc486dd1403ec0
MD5 0b98cc42f2918011ec1257796cdf0f87
SHA1 cb7f91ffae279e5f5fa9c042f29bd82c344cc8ef
SHA512 8ed280a54f57f2ecd5fe0cd89f69f740b5905f55b041e1dab929dcfdcd4183af9b3dc352c8b0724fb4fe91f69143c7d0dd8d9885f59f5bffdff33638aac7bfd0
SSDEEP 192:DBRpcBhBXzFCv7jIKPRpQ8mgqlRh99OHKDHsb+WNtqQY9ivLaAMljEY1KGAaW+qO:lRpmhBXBO3nXwXFrwtvv5uEpzaXqE
TLSH
T1C152C82EA964697BACDBC325F922BB5BE7F4203560C42E84E6FC8D2C14E75CC2257417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

35d49c2a-0e05-4ec0-9486-a07423ac25b1.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\35d49c2a-0e05-4ec0-9486-a07423ac25b1.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

5840b4eb-ff04-4ad7-b741-738a43b129c9.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\5840b4eb-ff04-4ad7-b741-738a43b129c9.tmp
Size 14KB
SHA256 0da41ec7663b918ea5cea5fb4ad1665e68dfb908c268c605a3c419f1d03b2193
MD5 245f000611c9159d5fb9cf9dd5bfff7e
SHA1 441ba7e2a10afccf624952354ac01e4c7a7f0a12
SHA512 484bb2aeeb6753985f8b3af58f7b94ce618740649c00d5b28a05c05757c364f2f258ae1f76e5f18007cebe0afb954575b0d953db99eb0dc1270d85da254a867f
SSDEEP 192:DBRpcBhBXzFDv7jIKPRpQ/mgqlRh99OHKDHsb+WNtqQY9ivLaA+rQ+ljEd1KGAap:lRpmhBXB73nXvXFrwtvv55YE+zaXqE
TLSH
T13762D92EA964697BACDAC225F922BB5BE7F4203560C42E84E7FC8D2C14E75CC3257417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000006

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000006
Size 346KB
SHA256 0f8a0722302d1b8e1050f1c7882af2c0feb056752c3feddcc0b4316891d60d44
MD5 cffe89fe76f974f10f591767becdc8ea
SHA1 63d099b0fca6062bb726f3c8bbbc704a1611182d
SHA512 69a6672dde71770eef237d7bedfb1a82317a68339abd399505acf995dc2132b0ef4e4fbd36b8453c8b9556877ba778722662b901166c77ef2c38a8d88a0a8a3d
SSDEEP 6144:kEen5NJZWrGd8LABzhu4/tZvMBhSoAxh/u0jd33ScBSNFWMI+t4A9AdHgndKrRqL:ktLWrGDdlMBhSoAxU033ScoNFWMmgnEa
TLSH
T1E774230B2E1DCA322357475B503E382845454A294BCF27921B689BE8853C9FBBEF51DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00001d

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001d
Size 43KB
SHA256 08b668ab17c2dde5424fbfacddfcca4e37e2471be0e1cfff477831d4122157b3
MD5 a524ec6f978e298c04ff7e6e618245df
SHA1 15e6b5ac570c11bd38953ed2c8d9c2306f062a2c
SHA512 416e1be619b0d64f694a2aa7bf945d89d0d812e7cd12e387efac6574d1c66596d3b075b786a2a399d3c03de326666bb7a196851d85c4b85aa609c85c920ddb42
SSDEEP 768:aD2YhIpzPQAP6aqZjY5tBJtKLNtyn1EnHHDpDm4cuK12p5ZNS/DeWTzR:aDTapzIAP6BuzJtIdptcuG0zNADb
TLSH
T1E5130219B14CB841D529773F326A76F1F61DD50AF9E6FE403A7103400BDADB260A68CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00001e

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001e
Size 37KB
SHA256 8203df5f83f40df7d76d17157ac0403708863f5970a59232758ea6c3cb1501cd
MD5 f220815e032b534010c60f614ba0305b
SHA1 550c9732f3f94dddb7acaee21cbc34d0ab2e1697
SHA512 52555a0c8f1de1717ceb3197b54eed19880ac37b5123ce137fcf3c6d58b6c8230d55a158cd72a762a9780fc96df02464f1f524993ca115be4577bf2949aea549
SSDEEP 768:BfqvadvJx2YFPNYq2Ijfd8hXijyZ1has3857gojo8uPtxgIjE3WnfHfgFn:BiStHFPrjqhsy985rjvotxgIjUWnfHIF
TLSH
T15203F116E53FD421238D9465F91B7E04382FD2982868906E2E7E017E6AF214493AD37F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000022

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000022
Size 164KB
SHA256 fb78d226fa3ad9e88e2d043ed5fa20ecaf56efe7f71b33a1f820d5c038f9a058
MD5 286c1da96c0c76b1f60c3cf5ff22e11d
SHA1 a6324171f4a75f80b41dd15b6a13ff76c703ddfa
SHA512 6eee91216098eafa1521f1eb5a73c3478239753cf1e0f34dba715dcaccbb667dafcb1a145f737dbfc21ecc7e513f7fdea67c207a3b2650581939976a6c3197c8
SSDEEP 3072:wx3+iepePPGtWlpe4iJxnLJiNLs/GAt/Gl2IjEHN3akHASVlTOYc2p0COoa:wxqePVpxiJxnFiQGAIwHBP7AB
TLSH
T104F312B2C63CD21DBEA59678BF86D2C0784F091E976D24B6159933C3F4FA03A1231D66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000023

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000023
Size 22KB
SHA256 d17c9cff19e331c1cb11bcae1366bc72bf17bb454e6066b8df74ac707f5283cf
MD5 b79907b72b6c604b8e8ef6347e4c850a
SHA1 c3dfe3efd0a23da19b6ba3d2aae48451dec8b388
SHA512 09c1b87d416709e10a9420e5be784904495324e5602535a52b8745a2e820158661935ca196ec8a65b751725e24055cceb0120c0f358ae83e50e0597525279860
SSDEEP 384:SSts2GYhpVc88yOmTbLQMgaeCaa3WqlpR+EaJI8ly18UF/yW8oi2Y6V4+Z5YIY1R:SgpK8fT/ZgaeC8qlpYVfYZy8i2j4+nYN
TLSH
T197A2E1C10ED93C1897E84927429BD36D5734B7642265A3831573B317E4BB4AB22EFD4C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000024

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000024
Size 22KB
SHA256 b15bc52db9a0c2cba713aabc2db82c71220f43b6eb256150c7467ce46d16b714
MD5 de71e74b2e2dfd8d2d79cb6de83feda9
SHA1 4b3311f258000418aa3e7a316cc95a7c0b74e2ee
SHA512 5a713f2982b3f94bbbfd4a9b9b09082330a362ba3bea79c4391e1b8b53e9d87d9baa75ea5972842dca1172b60681a5c394c10b3a1cf2cfa63c5ec6a9336e7c5b
SSDEEP 384:teNGHWOxsHsoEJ+7aOCxF8WtKPTPNDDMtXlmtc2VbzJXz4IbwC4/ES0RnzLmoxbE:3T7oEQ7Dsre7N6lCcib5/4/Pvoxbn2q8
TLSH
T18BA2D0F1AF654D9D462164FF45D8EA811DD2FE5C4BA79BFD0EA70C481F888E8491402F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000027

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000027
Size 16KB
SHA256 32a0c1a8bb47427a275f03c27302fce64224889ef5edcc0407a0cec73fd573e3
MD5 d384ee179185ea4a3703c55988753f02
SHA1 f6f52cbdff454d73d50997c3ee84e8eeb71856ba
SHA512 2046a7cf2545ee5fe856d88366ee3972d345005440915363d984ba366a4e545d3cf5b87bad2bd0a845a5341cc938717ceded02c4206bf74008354b7ce96c9374
SSDEEP 384:mEz1PHdgYe8xkMl+tgYang3sFjhjnEQeZkSzN:hzV9gYe8VIXanhFjhDEQJSp
TLSH
T1CF72D020B13657377318DB141931B8D0D79A762BF8DB490BCEA6E2005E2ED4B9693F0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 1KB
SHA256 5055b061ffad7be03838e7a4a109ff77509659bd1ca3a813e4757e98f4d2269e
MD5 7140758ea16bfaafc618f4b96c31e95d
SHA1 d6fa5af26bd03bb0e34414896341d25da31e1cf6
SHA512 135a2d8ce45537443bccb3c4f69ff0024e8a5decaee7c13e59e51202677d3f57fb9518ff67d39359b9d89aaf6b7164c5e3429abf4e6ffa188ab8bbdf7147b006
TLSH
T1B911FD1833428057DF2441FC09E50574477C58BBE942A53BC928877AFAC33551D8FAC2
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 1KB
SHA256 87f6c7ae348be1651a24b682feac38aa7962902b65d4d03589e80916418878ed
MD5 d1692ad9ba6b537a54c87f8dcc49a8df
SHA1 863b761409edf569a5ccefa9a4a0a99a8d12cf12
SHA512 dd4db4573cccb458536f44af4991cbe47bfe25c9ce042f7158ef19d634d3c0a674ed83921176400ab0185931e6ddc7db1b08f4a9c0585d65df85ccef9454de0f
TLSH
T1FE21CE1837864096DF2551BC19E40570077D58BBE802A53BCA78477AFAC33961D8FAC6
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 144B
SHA256 5ecc13a8cdc4c8997ad14ada397b7cc586a0d0cd7edcee91bfb09db54ff96537
MD5 6ab743b591461e4d420f00d65d72d5a4
SHA1 00f326ae11db405ec76f8647ef9e137079936beb
SHA512 a48bb6e13a7d851e1c8ff909e7038533fd349805edc1c3f9a50e2cd5f5c80b0325a1bbf586f45f4a5f4d64a97260825e1bc99ad8e48c45e488045f5156ab91ea
TLSH
T166C0929D83825411EB7A01F22991105036B998700F138746DAE0B0B8ABB3A91AE03501
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

1529807f-b593-4a7a-b7f7-cc2304d6c3d1.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\1529807f-b593-4a7a-b7f7-cc2304d6c3d1.tmp
Size 9KB
SHA256 a5eb2195136b2c447b4b49c052a570edc7420cd7d68f71ac78603a5f02cc880d
MD5 48285b7f15100a3334af5779a7347311
SHA1 bf77c8926ef5d4b11fb29cce0cef30e1fa57ceda
SHA512 6e50b212d284a21735326fa66a7f043b8588451d908cab0c7bec96718720d3c8670410ca776a6e0b61ff7b2d93b95a276c00383b9d3d716f06ac30337134feea
SSDEEP 192:DIfwrh99CQ1J/JjQa7OEzN62e0uaPnEvufPWNPUIjI2no7oRjIjwjxjhzjV8jh6G:DIfwrh99CQ1J/JjQa7OEzN62e0ua/Em7
TLSH
T1A212ADF7C3D8852DC94156F49B166F2ECE2E1918432C3C2789D8BE4B93F2871E25564E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

42283a05-68df-401b-95ff-5d27d1759ee9.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\42283a05-68df-401b-95ff-5d27d1759ee9.tmp
Size 7KB
SHA256 6590c5a3ef45f0f2f8c23cb96dcc91e7ebd56bbbc479675bd72511e492212257
MD5 cda2612723398b7f152aa697b565a816
SHA1 743b84db7c12bae2e1e301366e26adfa2f5696fa
SHA512 c086958daa52a22ac849a236ef01e5d6d6110efa3d7bc869087a26fbdad5377ad8c81c20baa8169fcb522d3a1516250cb1bd67868f0e54fb2ea740208e68557e
SSDEEP 192:DOh1uWtQ5JJ5JjGEka7OEdN6keUuaPiEvqfPiNPUIjImuNojIjwjxjhzjV8jhib7:DOh1uWtQ5JJ5JjGEka7OEdN6keUuaqE5
TLSH
T132F1BEF7C3E4852DCA1156F49B16AF2FCE291528032C3C6689D4BE1BD3E2872E25574E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6ca350a2-ddf2-4101-b297-fa96fdf4ae51.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\6ca350a2-ddf2-4101-b297-fa96fdf4ae51.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

92a49fd6-7ede-4c67-a0c8-79149b22c828.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\92a49fd6-7ede-4c67-a0c8-79149b22c828.tmp
Size 9KB
SHA256 0fc88c5f8998598ee0e478b70dcef4ede333ade7092ff29138cad2b07ab34a3a
MD5 730fdfc2c11cdbd369442f5dd98060f1
SHA1 a3a5152930b382292e6f53060bb47c2132f017d2
SHA512 a0de38cbac1511ed3f25cf475658281a89384de16b34cb47bda85b2f8aa730dd4c9e07bb50b485911e8470565a7eae08b0863f88ebda6a93735d16c892b87863
SSDEEP 192:DIfwrh99CQ1J/JjkWa7OEzN62e0uaPnEvufPWNPUIjI+o7ojIjwjxjhzjV8jhdb8:DIfwrh99CQ1J/JjkWa7OEzN62e0ua/EX
TLSH
T1B012BDF7C3D8852DC94156F49B166F2ECE2E1A18432C3C2789D8BE4B93F2871E25564E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9d377eea-971c-4096-8824-7acce3fd5a5a.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\9d377eea-971c-4096-8824-7acce3fd5a5a.tmp
Size 7KB
SHA256 5a2d74a81d39d61478db3a068df50a839ead68f04299e43bcdf364f03f47a95b
MD5 9dd677786aaa288ba8816f6d7ac2798e
SHA1 f407bfcee02414ab7779ad0000074d162dd671ea
SHA512 2d8dd4ae5ca0e2d5915d063455b2cb2f118dbce21d6058f4334ccb673ee4923a1ec39ed417cefaa8bb342773bb3db0183aa1172e7efe811c62cd71d5f2980b96
SSDEEP 192:DOh1muWtQ5JJ5JjGwa7OEdN6keUuaPiEvqfPiNPUIjImuNojIjwjxjhzjV8jhibH:DOh1muWtQ5JJ5JjGwa7OEdN6keUuaqEx
TLSH
T124F1BFF7C3E4852DCA0156F49B16AF2FCE291528432C3C6689D4BE1BD3E2872E25574E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d511ed36-e670-47bd-ac7d-aef24e7f9019.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\d511ed36-e670-47bd-ac7d-aef24e7f9019.tmp
Size 1024B
SHA256 315d942fab164512af1d9a9057b3ef85997f3ab87461a486d8962560b866efc4
MD5 6039aa64f0de928f86941aa70bdd4cf2
SHA1 453dc5c87d94924b7e1add091e7d7cf8253b6c3b
SHA512 0cf464f4a1b599dc8460564a386e16762a567f6c5c4c806f1509ef64607c25221e69825858d9162c15333dd0a23ef37af4a1576da255e58e60ae417ed1c77c81
TLSH
T1211189E7C5BEB42B002D09B71D027C0A2D76B4301292A8F8CEA6827DA0C14F31B168A6
MD5 SHA1 SHA512 TLSH

Submit Download

ec23632b-90ba-4104-af65-c2ea441253c4.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\ec23632b-90ba-4104-af65-c2ea441253c4.tmp
Size 3KB
SHA256 7c2d7f45cd557293365188a23c02959b2fd7741504bcad903c34f6c8b0bca027
MD5 d6b75a83617077d3027bd68982c9f941
SHA1 21b04844ba2661a284a02dd3c8f7f61ccdb77918
SHA512 619ed6e64056d6fb84897cd56a198fb519bf9ec1773dd3929f2b1350198dea66f066b22e428b9b4c8b72269b3a091dc921b2c18efed3a6e890ba72c2ddf4c8d4
TLSH
T1DC816BB7C3D8C52D895156F49B166F1ECE291A18432C3C67C9D8AE5B93F2872E21134E
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 96B
SHA256 05e5db07f125ae7dfb1cfc88ada7d942f120919e6c17c720e3a63e362ded505b
MD5 a7eb19cefbc178af4b31c47e83458463
SHA1 9783e6e7e5bceb5543ac41df3477925be10fa12f
SHA512 95b7a9ea1338db8574ef915a875bf632cfa3a9476416efadd25f4fd8f6c7a5a1d3361f1c6673c3c927cb51ea1d13132ea9b8f47c9d221994786959390166991f
TLSH
T1B6B022AC0002EC03C000CBF203C023C033B22E303BA3028300A080F0BC022030303200
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\temp-index
Size 72B
SHA256 016646dbb4468f20351d5008965af40b9f6bf3b013f96e4bc946867bd192ea41
MD5 917d0ad09bdd8c622149fbb8676658d9
SHA1 6fb2d3215eb633bf3deda6d46969468f9cedac48
SHA512 385f542c2cd41b430c2a6897d2efbaacf7de4ef1b5c0fc91cff188760f66bc7f206f69aee884b8d08a9224ecaeb9cae2ca0e0b1f91a7a4e0f869b0c8bf53dbb2
TLSH
T1CFA0021D42C51F11DD3052F460F609453779A8787551A703959128E89B5B1D89303201
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 4a3794b2fc227413632e8bf8e18b2885caee13db1b4846d0ee674ded621f5483
MD5 e5ebd5fb5163a7a503c4d27d99a378d1
SHA1 4c4e2df91083f0a032fc6c83ef2928690da576f7
SHA512 6030cedcf2d8aa69ae343c1847edc5d522ea23480684de80571d587184f65eccabc3c7cc46adf28432b82703426e40a4a7b3c12413779b4fc3bbd9c64f72a96a
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

a033b5c8-cdea-434c-8447-108c1507b8dc.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\a033b5c8-cdea-434c-8447-108c1507b8dc.tmp
Size 12KB
SHA256 dc72ffa3d66487d7a548f63392d51b51b5ddbadafdd009a38c6f0fbf99c90f50
MD5 f1a7c413ae61033bfa70cd10fba93a56
SHA1 61c9cec223b832d296e388f60da34c911933d86c
SHA512 5203b9f65a4c143764cd4c8fc65d62cfc35125b8784085aec74eaa9c18a59769198d99de25aa5d1ec72d46551d33975fd2a7968a8f86bb4eea816711368e95f0
SSDEEP 192:DBRpcBhBXcFov7jIKPRpQYgG9OHsb+WNn9iBI3YW1KGAaW+qVyIsnAUgE:lRpmhBXo03nXDkwUeYzzaXqE
TLSH
T10F42B72DB954B53B6CDAC329F922BB5BE7F9103520D42E84E6FC892C14E79CC2257417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c007b98e-647c-43f2-90dd-336bf56d9976.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\c007b98e-647c-43f2-90dd-336bf56d9976.tmp
Size 13KB
SHA256 9940579ba7f9b2badcd0bbe74f2f55810c37341510ab368d861b238a3e02050c
MD5 1e2e6da04bd320a076934e8128949966
SHA1 1b88200a25284588955966855fc84593e28faf2d
SHA512 a326d033cd52daa7fb21208c05b3c83dc76dc994046b61b83be1711d372f0ef66a0b74cab4a8cd6f5878beb86e5095bee9f446a7a640f6cd41b19a5f3920c9e6
SSDEEP 192:DBRpcBhBXcFdv7jIKPRpQ8mgqlRh99OHsb+WNtqQY9ivLaAMljEY1KGAaW+qVyI4:lRpmhBXod3nXwXkwtvv5uEpzaXqE
TLSH
T11F52C82EA964797BACDAC325F922BB5BE7F4203560C42E84E6FC8C2C14E75CC2257417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fb34366c-7dfe-4a1a-af25-ca458c3161d5.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\fb34366c-7dfe-4a1a-af25-ca458c3161d5.tmp
Size 11KB
SHA256 3b26bafb315b03fc5ab2a95bba1df53e4615d735259e4f5357aec2022843b390
MD5 a6d23a8a4eed3faf27441361fd34cd7b
SHA1 59ff81361ab277409fe15d5dd1c32bb84470509a
SHA512 9e9208a7a539324c19c35d63f3ff9cd9449fb8eaa45674850abcf6cdf27a612b1ffa5de188fc74a04d11afaee5658d6d7b55f9ebecd7352f51b30a3154b48e7f
SSDEEP 192:DBR1BXcFov7HIAPRp2b9OHsb+WNn9in01KGAaW+/VyIsnAUge:lR1BXo0bJXokwUn1zaXZe
TLSH
T10C42B72DA965B53FACDAC329FA22BB57D7F9103520C42E84E6FC892C14E75CC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 607B
SHA256 be6b74e52e5eef1f1c27c0976bf3bf1bfa99958c00bbef2898a602f691be6dae
MD5 76b78ed7ff6273215b134d6a6488035d
SHA1 9e7a11ffb68d027036302eccd4c22315054843a9
SHA512 9919504cd4d8c0757abff8da4bbad1c4b6532f81d290c736fc5624ef66de45e6a9e29a8290854ae554d5bdfc5291f1ea81ae62d1b25846bfbcf1515e2ec3e4f1
TLSH
T174F0DC53CBD6536BD527223CC8E207E1FA70E2719E81212386106F2D6CB77241E474B4
MD5 SHA1 SHA512 TLSH

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 599B
SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
MD5 658ab8c32d4cc5deb36ac5f63da4658b
SHA1 30c12cd871ff0c2c4098d794e9ae4f2540586813
SHA512 a73030c008ef3c2e274f11c90bfe79fa8ae402f76801c710bed8cc1ab1218a84858ea566b772be4bade8ef639a019c57d297028df15b64b3753482cf0f3c8f85
TLSH
T12AF05C83EB6A1B72C456123DC8EE56E47B31D1846EC11367A2107B1D3C2B7192D174BD
MD5 SHA1 SHA512 TLSH

Submit Download

0a851abf-b51b-48bc-a1bd-035b88a5a3d7.tmp

Path C:\Users\Admin\AppData\Local\Temp\0a851abf-b51b-48bc-a1bd-035b88a5a3d7.tmp
Size 242KB
SHA256 81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82
MD5 541f52e24fe1ef9f8e12377a6ccae0c0
SHA1 189898bb2dcae7d5a6057bc2d98b8b450afaebb6
SHA512 d779d78a15c5efca51ebd6b96a7ccb6d718741bdf7d9a37f53b2eb4b98aa1a78bc4cfa57d6e763aab97276c8f9088940ac0476690d4d46023ff4bf52f3326c88
SSDEEP 3072:r+nmRykNgoldZ8GjJCiUXZSk+QSVh85PxEalRVHmcld9R6yYfEp4ABUGDcaKklrv:k3oF4Z4h45P99Fld9RBQYBVcaxlnfL
TLSH
T1F63402BD7D8AE686D006A17676C0B48BE1199F4E41CB7C0F668A89010D70F8C57B9DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5360_1764152090\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

DummyLab_Demo_0.3.1_Windows.zip.crdownload

Path C:\Users\Admin\Downloads\DummyLab_Demo_0.3.1_Windows.zip.crdownload
Size 256KB
SHA256 aaaf47e7fa4fd795daf87871298eca740b561bce40ed1ae91cfaaa922f1bf369
MD5 6cf6589b1d1204af1d61de4a92c1f9f8
SHA1 439f4946c3ac7e2ea244f0dec4e48673e06e18c9
SHA512 5393ef561d9651a1cf36d8693e55e06b36726ef9e11b705e2127498a704138e41cc62e15402804d1df2135be17f20d0034792105c539567a9d6da880a1033957
SSDEEP 6144:tsj3mMxHqZ+Gukm4baAaJ0zZYxK9N903KRr:tM1+U4aAvZUK903ar
TLSH
T10B442341645C461FCFABA6D13BA5661AA710968BE90ECF2F5C8DF03F848863597DC730
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3764-1076-0x000000000DE90000-0x000000000DF23000-memory.dmp

Download

memory/5620-906-0x000001FA03ED0000-0x000001FA03FD0000-memory.dmp

Download

memory/5620-901-0x000001FA001E0000-0x000001FA002E0000-memory.dmp

Download

memory/5620-902-0x000001FA001E0000-0x000001FA002E0000-memory.dmp

Download

memory/5620-905-0x000001FA03CF0000-0x000001FA03D10000-memory.dmp

Download

memory/5620-946-0x000001FA14710000-0x000001FA14730000-memory.dmp

Download

memory/5620-900-0x000001FA001E0000-0x000001FA002E0000-memory.dmp

Download

memory/5620-932-0x000001FA03E50000-0x000001FA03E70000-memory.dmp

Download