f8787de711fcf69d438ccef382718a5ae77cbe060d95bdd641b6b838f39c099a

Analysis

user interaction
yes
max time kernel
900s
max time network
900s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/11/2026, 23:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
loader.exe
Size 18.0MB
Sample261110-3147kacf78
SHA256 f8787de711fcf69d438ccef382718a5ae77cbe060d95bdd641b6b838f39c099a
MD5 fc19e5d8c10e032307e16944b3c46bb6
SHA1 af7eda9fb5bd9ff55058e5283ff41dfc836b6c8f
SHA512 9e75aa64f4fbfef169b7e6c518ccdf93481ea2b8051a977ad3c5cba3052614cc55362895fdafb38688631e75321570e179eb41af9b48a9085ecdbf90bd50652e
SSDEEP 393216:eIDKl6Ffh82f3Ug9qd5MDWO4Icq+zj641v6Ywy:ee3Zqd5My9lqnSwy
TLSH
T1F81712C125E982FDC362C63DD24617EAE9C93C858DBB652ABFCA64013471C45C8EBD39
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware bootkit defense_evasion discovery execution persistence ransomware spyware

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Executes dropped EXE 2 IoCs

pid	Process
2504	loader.exe
4516	loader.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5668	powershell.exe
1064	powershell.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	explorer.exe
File opened (read-only)	\??\E:	explorer.exe

Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	loader.exe
File opened for modification	\??\PhysicalDrive0	loader.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\LogFiles\WMI\FaceTelManually.etl	svchost.exe
File opened for modification	C:\WINDOWS\SYSTEM32\WINBIODATABASE\51F39552-1075-4199-B513-0C10EA185DB0.DAT	svchost.exe

Suspicious use of NtCreateThreadExHideFromDebugger 1 TTPs 2 IoCs

defense_evasion

Debugger Evasion

T1622

pid	Process
6064	loader.exe
4800	loader.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Direct Volume Access: Opens a physical disk for reading 1 TTPs 48 IoCs

Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

defense_evasion

Direct Volume Access

T1006

description	ioc	Process
File opened (read-only)	\??\PhysicalDrive0	loader.exe
File opened (read-only)	\??\PhysicalDrive2	loader.exe
File opened (read-only)	\??\PhysicalDrive3	loader.exe
File opened (read-only)	\??\PhysicalDrive7	loader.exe
File opened (read-only)	\??\PhysicalDrive12	loader.exe
File opened (read-only)	\??\PhysicalDrive18	loader.exe
File opened (read-only)	\??\PhysicalDrive8	loader.exe
File opened (read-only)	\??\PhysicalDrive9	loader.exe
File opened (read-only)	\??\PhysicalDrive15	loader.exe
File opened (read-only)	\??\PhysicalDrive22	loader.exe
File opened (read-only)	\??\PhysicalDrive11	loader.exe
File opened (read-only)	\??\PhysicalDrive12	loader.exe
File opened (read-only)	\??\PhysicalDrive14	loader.exe
File opened (read-only)	\??\PhysicalDrive19	loader.exe
File opened (read-only)	\??\PhysicalDrive20	loader.exe
File opened (read-only)	\??\PhysicalDrive21	loader.exe
File opened (read-only)	\??\PhysicalDrive5	loader.exe
File opened (read-only)	\??\PhysicalDrive11	loader.exe
File opened (read-only)	\??\PhysicalDrive14	loader.exe
File opened (read-only)	\??\PhysicalDrive5	loader.exe
File opened (read-only)	\??\PhysicalDrive10	loader.exe
File opened (read-only)	\??\PhysicalDrive17	loader.exe
File opened (read-only)	\??\PhysicalDrive9	loader.exe
File opened (read-only)	\??\PhysicalDrive10	loader.exe
File opened (read-only)	\??\PhysicalDrive2	loader.exe
File opened (read-only)	\??\PhysicalDrive4	loader.exe
File opened (read-only)	\??\PhysicalDrive13	loader.exe
File opened (read-only)	\??\PhysicalDrive16	loader.exe
File opened (read-only)	\??\PhysicalDrive23	loader.exe
File opened (read-only)	\??\PhysicalDrive21	loader.exe
File opened (read-only)	\??\PhysicalDrive23	loader.exe
File opened (read-only)	\??\PhysicalDrive3	loader.exe
File opened (read-only)	\??\PhysicalDrive6	loader.exe
File opened (read-only)	\??\PhysicalDrive18	loader.exe
File opened (read-only)	\??\PhysicalDrive22	loader.exe
File opened (read-only)	\??\PhysicalDrive13	loader.exe
File opened (read-only)	\??\PhysicalDrive16	loader.exe
File opened (read-only)	\??\PhysicalDrive17	loader.exe
File opened (read-only)	\??\PhysicalDrive1	loader.exe
File opened (read-only)	\??\PhysicalDrive4	loader.exe
File opened (read-only)	\??\PhysicalDrive6	loader.exe
File opened (read-only)	\??\PhysicalDrive19	loader.exe
File opened (read-only)	\??\PhysicalDrive20	loader.exe
File opened (read-only)	\??\PhysicalDrive0	loader.exe
File opened (read-only)	\??\PhysicalDrive7	loader.exe
File opened (read-only)	\??\PhysicalDrive15	loader.exe
File opened (read-only)	\??\PhysicalDrive1	loader.exe
File opened (read-only)	\??\PhysicalDrive8	loader.exe

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4272	cmd.exe
3516	cmd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2000	chrome.exe

Checks SCSI registry key(s) 3 TTPs 62 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svchost.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Internet Explorer\Main	explorer.exe

Modifies data under HKEY_USERS 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe

Modifies registry class 46 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	StartMenuExperienceHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	StartMenuExperienceHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-461973139-3212354679-1508698038-1000\{93F35880-5297-449B-8A97-EC0B93427907}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "823"	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "856"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 010000000200000000000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "856"	SearchHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-461973139-3212354679-1508698038-1000\{3E0F88BD-7F2C-41AA-8A1F-262B50A82B64}	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-461973139-3212354679-1508698038-1000\{E4D15136-9085-4969-A44B-02DD5C535F95}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\MuiCache	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "856"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "823"	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "823"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify	explorer.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
5668	powershell.exe
5668	powershell.exe
1068	chrome.exe
1068	chrome.exe
1068	chrome.exe
1068	chrome.exe
4340	chrome.exe
4340	chrome.exe
1064	powershell.exe
1064	powershell.exe
1064	powershell.exe
3184	explorer.exe
3184	explorer.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs

pid	Process
6064	loader.exe
1068	chrome.exe
1068	chrome.exe
1068	chrome.exe
1068	chrome.exe
1068	chrome.exe
1068	chrome.exe
1068	chrome.exe
1068	chrome.exe
1068	chrome.exe
1068	chrome.exe
1068	chrome.exe
1068	chrome.exe
1068	chrome.exe
1068	chrome.exe
1068	chrome.exe
1068	chrome.exe
4800	loader.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
6064	loader.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeSystemtimePrivilege	6064	loader.exe
Token: SeDebugPrivilege	5668	powershell.exe
Token: SeShutdownPrivilege	3700	svchost.exe
Token: SeShutdownPrivilege	1068	chrome.exe
Token: SeCreatePagefilePrivilege	1068	chrome.exe
Token: SeShutdownPrivilege	1068	chrome.exe
Token: SeCreatePagefilePrivilege	1068	chrome.exe
Token: SeShutdownPrivilege	1068	chrome.exe
Token: SeCreatePagefilePrivilege	1068	chrome.exe
Token: SeShutdownPrivilege	1068	chrome.exe
Token: SeCreatePagefilePrivilege	1068	chrome.exe
Token: SeShutdownPrivilege	1068	chrome.exe
Token: SeCreatePagefilePrivilege	1068	chrome.exe
Token: SeShutdownPrivilege	1068	chrome.exe
Token: SeCreatePagefilePrivilege	1068	chrome.exe
Token: SeShutdownPrivilege	1068	chrome.exe
Token: SeCreatePagefilePrivilege	1068	chrome.exe
Token: SeShutdownPrivilege	1068	chrome.exe
Token: SeCreatePagefilePrivilege	1068	chrome.exe
Token: SeShutdownPrivilege	1068	chrome.exe
Token: SeCreatePagefilePrivilege	1068	chrome.exe
Token: SeShutdownPrivilege	1068	chrome.exe
Token: SeCreatePagefilePrivilege	1068	chrome.exe
Token: SeShutdownPrivilege	1068	chrome.exe
Token: SeCreatePagefilePrivilege	1068	chrome.exe
Token: SeShutdownPrivilege	1068	chrome.exe
Token: SeCreatePagefilePrivilege	1068	chrome.exe
Token: SeShutdownPrivilege	1068	chrome.exe
Token: SeCreatePagefilePrivilege	1068	chrome.exe
Token: SeShutdownPrivilege	1068	chrome.exe
Token: SeCreatePagefilePrivilege	1068	chrome.exe
Token: SeShutdownPrivilege	1068	chrome.exe
Token: SeCreatePagefilePrivilege	1068	chrome.exe
Token: SeShutdownPrivilege	1068	chrome.exe
Token: SeCreatePagefilePrivilege	1068	chrome.exe
Token: SeShutdownPrivilege	1068	chrome.exe
Token: SeCreatePagefilePrivilege	1068	chrome.exe
Token: SeShutdownPrivilege	1068	chrome.exe
Token: SeCreatePagefilePrivilege	1068	chrome.exe
Token: SeShutdownPrivilege	1068	chrome.exe
Token: SeCreatePagefilePrivilege	1068	chrome.exe
Token: SeShutdownPrivilege	1068	chrome.exe
Token: SeCreatePagefilePrivilege	1068	chrome.exe
Token: SeShutdownPrivilege	1068	chrome.exe
Token: SeCreatePagefilePrivilege	1068	chrome.exe
Token: SeShutdownPrivilege	1068	chrome.exe
Token: SeCreatePagefilePrivilege	1068	chrome.exe
Token: SeShutdownPrivilege	1068	chrome.exe
Token: SeCreatePagefilePrivilege	1068	chrome.exe
Token: SeShutdownPrivilege	1068	chrome.exe
Token: SeCreatePagefilePrivilege	1068	chrome.exe
Token: SeShutdownPrivilege	1068	chrome.exe
Token: SeCreatePagefilePrivilege	1068	chrome.exe
Token: SeShutdownPrivilege	1068	chrome.exe
Token: SeCreatePagefilePrivilege	1068	chrome.exe
Token: SeShutdownPrivilege	1068	chrome.exe
Token: SeCreatePagefilePrivilege	1068	chrome.exe
Token: SeShutdownPrivilege	1068	chrome.exe
Token: SeCreatePagefilePrivilege	1068	chrome.exe
Token: SeShutdownPrivilege	1068	chrome.exe
Token: SeCreatePagefilePrivilege	1068	chrome.exe
Token: SeShutdownPrivilege	1068	chrome.exe
Token: SeCreatePagefilePrivilege	1068	chrome.exe
Token: SeShutdownPrivilege	1068	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1068	chrome.exe
1068	chrome.exe
1068	chrome.exe
1068	chrome.exe
1068	chrome.exe
1068	chrome.exe
1068	chrome.exe
1068	chrome.exe
1068	chrome.exe
1068	chrome.exe
1068	chrome.exe
1068	chrome.exe
1068	chrome.exe
1068	chrome.exe
1068	chrome.exe
1068	chrome.exe
1068	chrome.exe
1068	chrome.exe
1068	chrome.exe
1068	chrome.exe
1068	chrome.exe
1068	chrome.exe
1068	chrome.exe
1068	chrome.exe
1068	chrome.exe
1068	chrome.exe
1068	chrome.exe
1068	chrome.exe
1068	chrome.exe
1068	chrome.exe
1068	chrome.exe
1068	chrome.exe
1068	chrome.exe
1068	chrome.exe
1068	chrome.exe
1068	chrome.exe
1068	chrome.exe
1068	chrome.exe
1068	chrome.exe
1068	chrome.exe
1068	chrome.exe
1068	chrome.exe
5504	sihost.exe
3184	explorer.exe
3184	explorer.exe
3184	explorer.exe
3184	explorer.exe
3184	explorer.exe
3184	explorer.exe
3184	explorer.exe
3184	explorer.exe
3184	explorer.exe
3184	explorer.exe
3184	explorer.exe
3184	explorer.exe
3184	explorer.exe
3184	explorer.exe
3184	explorer.exe
3184	explorer.exe
3184	explorer.exe
3184	explorer.exe
3184	explorer.exe
3184	explorer.exe
3184	explorer.exe

Suspicious use of SendNotifyMessage 59 IoCs

pid	Process
1068	chrome.exe
1068	chrome.exe
1068	chrome.exe
1068	chrome.exe
1068	chrome.exe
1068	chrome.exe
1068	chrome.exe
1068	chrome.exe
1068	chrome.exe
1068	chrome.exe
1068	chrome.exe
1068	chrome.exe
1068	chrome.exe
1068	chrome.exe
1068	chrome.exe
1068	chrome.exe
3184	explorer.exe
3184	explorer.exe
3184	explorer.exe
3184	explorer.exe
3184	explorer.exe
3184	explorer.exe
3184	explorer.exe
3184	explorer.exe
3184	explorer.exe
3184	explorer.exe
3184	explorer.exe
3184	explorer.exe
3184	explorer.exe
3184	explorer.exe
3184	explorer.exe
3184	explorer.exe
3184	explorer.exe
3184	explorer.exe
3184	explorer.exe
3184	explorer.exe
3184	explorer.exe
3184	explorer.exe
3184	explorer.exe
3184	explorer.exe
3184	explorer.exe
3184	explorer.exe
3184	explorer.exe
3184	explorer.exe
3184	explorer.exe
3184	explorer.exe
3184	explorer.exe
3184	explorer.exe
3184	explorer.exe
3184	explorer.exe
3184	explorer.exe
3184	explorer.exe
3184	explorer.exe
3184	explorer.exe
3184	explorer.exe
3184	explorer.exe
3184	explorer.exe
3184	explorer.exe
3184	explorer.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2296	SecHealthUI.exe
3584	StartMenuExperienceHost.exe
4020	SearchHost.exe
3184	explorer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 6064 wrote to memory of 2504	6064	loader.exe	88
PID 2504 wrote to memory of 4272	2504	loader.exe	89
PID 4272 wrote to memory of 5668	4272	cmd.exe	91
PID 1068 wrote to memory of 2252	1068	chrome.exe	110
PID 1068 wrote to memory of 2000	1068	chrome.exe	111
PID 1068 wrote to memory of 5768	1068	chrome.exe	112
PID 1068 wrote to memory of 5768	1068	chrome.exe	112
PID 1068 wrote to memory of 3216	1068	chrome.exe	114
PID 1068 wrote to memory of 3216	1068	chrome.exe	114
PID 1068 wrote to memory of 3712	1068	chrome.exe	116
PID 1068 wrote to memory of 5188	1068	chrome.exe	115
PID 1068 wrote to memory of 3712	1068	chrome.exe	116
PID 1068 wrote to memory of 5188	1068	chrome.exe	115
PID 1068 wrote to memory of 1332	1068	chrome.exe	117
PID 1068 wrote to memory of 1332	1068	chrome.exe	117
PID 1068 wrote to memory of 1092	1068	chrome.exe	118
PID 1068 wrote to memory of 1092	1068	chrome.exe	118
PID 1068 wrote to memory of 3952	1068	chrome.exe	119
PID 1068 wrote to memory of 4524	1068	chrome.exe	120
PID 1068 wrote to memory of 4524	1068	chrome.exe	120
PID 1068 wrote to memory of 4708	1068	chrome.exe	121
PID 1068 wrote to memory of 4708	1068	chrome.exe	121
PID 1068 wrote to memory of 2768	1068	chrome.exe	122
PID 1068 wrote to memory of 2768	1068	chrome.exe	122
PID 1068 wrote to memory of 2708	1068	chrome.exe	123
PID 1068 wrote to memory of 2708	1068	chrome.exe	123
PID 1068 wrote to memory of 5324	1068	chrome.exe	124
PID 1068 wrote to memory of 5324	1068	chrome.exe	124
PID 1068 wrote to memory of 1240	1068	chrome.exe	125
PID 1068 wrote to memory of 1240	1068	chrome.exe	125
PID 1068 wrote to memory of 5292	1068	chrome.exe	126
PID 1068 wrote to memory of 5292	1068	chrome.exe	126
PID 1068 wrote to memory of 3924	1068	chrome.exe	127
PID 1068 wrote to memory of 3924	1068	chrome.exe	127
PID 1068 wrote to memory of 1728	1068	chrome.exe	128
PID 1068 wrote to memory of 1728	1068	chrome.exe	128
PID 1068 wrote to memory of 4912	1068	chrome.exe	129
PID 1068 wrote to memory of 4912	1068	chrome.exe	129
PID 1068 wrote to memory of 4600	1068	chrome.exe	130
PID 1068 wrote to memory of 4600	1068	chrome.exe	130
PID 1068 wrote to memory of 2464	1068	chrome.exe	132
PID 1068 wrote to memory of 5912	1068	chrome.exe	131
PID 1068 wrote to memory of 2464	1068	chrome.exe	132
PID 1068 wrote to memory of 5912	1068	chrome.exe	131
PID 1068 wrote to memory of 3488	1068	chrome.exe	133
PID 1068 wrote to memory of 3488	1068	chrome.exe	133
PID 1068 wrote to memory of 4528	1068	chrome.exe	134
PID 1068 wrote to memory of 2772	1068	chrome.exe	135
PID 1068 wrote to memory of 2428	1068	chrome.exe	136
PID 1068 wrote to memory of 4884	1068	chrome.exe	137
PID 1068 wrote to memory of 4884	1068	chrome.exe	137
PID 1068 wrote to memory of 3228	1068	chrome.exe	138
PID 1068 wrote to memory of 1908	1068	chrome.exe	139
PID 1068 wrote to memory of 1908	1068	chrome.exe	139
PID 1068 wrote to memory of 200	1068	chrome.exe	140
PID 1068 wrote to memory of 200	1068	chrome.exe	140
PID 1068 wrote to memory of 5488	1068	chrome.exe	141
PID 1068 wrote to memory of 4340	1068	chrome.exe	145
PID 4800 wrote to memory of 4516	4800	loader.exe	146
PID 4516 wrote to memory of 3516	4516	loader.exe	147
PID 3516 wrote to memory of 1064	3516	cmd.exe	149
PID 1068 wrote to memory of 4144	1068	chrome.exe	153
PID 1068 wrote to memory of 4144	1068	chrome.exe	153
PID 5504 wrote to memory of 3184	5504	sihost.exe	157

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\loader.exe
"C:\Users\Admin\AppData\Local\Temp\loader.exe"
1⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6064
- C:\Users\Admin\AppData\Local\Temp\loader.exe
  "C:\Users\Admin\AppData\Local\Temp\loader.exe"
  2⤵
  - Executes dropped EXE
  - Writes to the Master Boot Record (MBR)
  - Direct Volume Access: Opens a physical disk for reading
  - Suspicious use of WriteProcessMemory
  PID:2504
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c powershell.exe -NoProfile -ExecutionPolicy Bypass -Command ^"^& { $encoded = 'QXBwIGluaXRpYWxpemF0aW9uIGVycm9yIDB4MTAz'; $text = [System.Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($encoded)); $text = $text.Replace('\n', [Environment]::NewLine); Add-Type -AssemblyName PresentationFramework; [System.Windows.MessageBox]::Show($text, 'sync.top', 'OK', 'Error', 'None', 'DefaultDesktopOnly') }^"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4272
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "& { $encoded = 'QXBwIGluaXRpYWxpemF0aW9uIGVycm9yIDB4MTAz'; $text = [System.Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($encoded)); $text = $text.Replace('\n', [Environment]::NewLine); Add-Type -AssemblyName PresentationFramework; [System.Windows.MessageBox]::Show($text, 'sync.top', 'OK', 'Error', 'None', 'DefaultDesktopOnly') }"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5668

C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\SecHealthUI.exe
"C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\SecHealthUI.exe" -ServerName:SecHealthUI.AppX8tam42xc7v2czs3s1nt0nkxvfjtepzp9.mca
1⤵
- Suspicious use of SetWindowsHookEx
PID:2296

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:4268

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {E041C90B-68BA-42C9-991E-477B73A75C90} -Embedding
1⤵
PID:2640

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1500

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k WbioSvcGroup -s WbioSrvc
1⤵
- Drops file in System32 directory
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3700

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5004

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:1408

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0xa4,0x134,0x7ffdd543c728,0x7ffdd543c734,0x7ffdd543c740
  2⤵
  PID:2252
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1928,i,11355450048243355105,7096884953702204935,524288 --field-trial-handle=2020,i,8720883412781588477,5930671925868902993,262144 --variations-seed-version --mojo-platform-channel-handle=2140 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1700,i,17341642784117327469,11807739790697270297,262144 --field-trial-handle=2020,i,8720883412781588477,5930671925868902993,262144 --variations-seed-version --mojo-platform-channel-handle=2016 /prefetch:2
  2⤵
  PID:5768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2336,i,4789176917729710424,10528879412785162638,524288 --field-trial-handle=2020,i,8720883412781588477,5930671925868902993,262144 --variations-seed-version --mojo-platform-channel-handle=2172 /prefetch:13
  2⤵
  PID:3216
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3264,i,3794119375012884876,15140236722662135512,2097152 --field-trial-handle=2020,i,8720883412781588477,5930671925868902993,262144 --variations-seed-version --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:5188
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3268,i,12740541818599159244,1504661535362223973,2097152 --field-trial-handle=2020,i,8720883412781588477,5930671925868902993,262144 --variations-seed-version --mojo-platform-channel-handle=1776 /prefetch:1
  2⤵
  PID:3712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4760,i,12535535860951114436,16279156891554408307,2097152 --field-trial-handle=2020,i,8720883412781588477,5930671925868902993,262144 --variations-seed-version --mojo-platform-channel-handle=4776 /prefetch:1
  2⤵
  PID:1332
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=3248,i,13658174750378372715,16027921896930828177,524288 --field-trial-handle=2020,i,8720883412781588477,5930671925868902993,262144 --variations-seed-version --mojo-platform-channel-handle=4920 /prefetch:14
  2⤵
  PID:1092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5372,i,5893377652174911331,14293082146326465681,524288 --field-trial-handle=2020,i,8720883412781588477,5930671925868902993,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:14
  2⤵
  PID:3952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5508,i,1100774268358436636,14415480666279125734,2097152 --field-trial-handle=2020,i,8720883412781588477,5930671925868902993,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:1
  2⤵
  PID:4524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5552,i,3027787353575353565,6999048184254735926,2097152 --field-trial-handle=2020,i,8720883412781588477,5930671925868902993,262144 --variations-seed-version --mojo-platform-channel-handle=5560 /prefetch:1
  2⤵
  PID:4708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5500,i,14873640726691005010,5328332276972302437,2097152 --field-trial-handle=2020,i,8720883412781588477,5930671925868902993,262144 --variations-seed-version --mojo-platform-channel-handle=5600 /prefetch:1
  2⤵
  PID:2768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5948,i,5766031130657961949,3685225574609456722,524288 --field-trial-handle=2020,i,8720883412781588477,5930671925868902993,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:14
  2⤵
  PID:2708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5544,i,10530516858190691688,13470808958294151929,2097152 --field-trial-handle=2020,i,8720883412781588477,5930671925868902993,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:1
  2⤵
  PID:5324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5580,i,2280541054080557728,468986572274518438,2097152 --field-trial-handle=2020,i,8720883412781588477,5930671925868902993,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:1
  2⤵
  PID:1240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6380,i,6886583330936531894,8639813405364451528,2097152 --field-trial-handle=2020,i,8720883412781588477,5930671925868902993,262144 --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:1
  2⤵
  PID:5292
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6672,i,4077018688282415378,17862096542128076445,2097152 --field-trial-handle=2020,i,8720883412781588477,5930671925868902993,262144 --variations-seed-version --mojo-platform-channel-handle=6628 /prefetch:1
  2⤵
  PID:3924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5588,i,4391786546657853449,8885186551769519518,2097152 --field-trial-handle=2020,i,8720883412781588477,5930671925868902993,262144 --variations-seed-version --mojo-platform-channel-handle=6380 /prefetch:1
  2⤵
  PID:1728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5780,i,13848269581024946859,7848814914913231444,524288 --field-trial-handle=2020,i,8720883412781588477,5930671925868902993,262144 --variations-seed-version --mojo-platform-channel-handle=6236 /prefetch:14
  2⤵
  PID:4912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6084,i,3070022258316100237,4007329146065186687,524288 --field-trial-handle=2020,i,8720883412781588477,5930671925868902993,262144 --variations-seed-version --mojo-platform-channel-handle=6372 /prefetch:14
  2⤵
  PID:4600
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=5880,i,12195702927421155848,521935085903069805,2097152 --field-trial-handle=2020,i,8720883412781588477,5930671925868902993,262144 --variations-seed-version --mojo-platform-channel-handle=6424 /prefetch:9
  2⤵
  PID:5912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6500,i,6337998579430336513,2174834656763119894,2097152 --field-trial-handle=2020,i,8720883412781588477,5930671925868902993,262144 --variations-seed-version --mojo-platform-channel-handle=6464 /prefetch:1
  2⤵
  PID:2464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=5676,i,10511082617490594855,12377935589219356388,2097152 --field-trial-handle=2020,i,8720883412781588477,5930671925868902993,262144 --variations-seed-version --mojo-platform-channel-handle=6812 /prefetch:1
  2⤵
  PID:3488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3724,i,17823544759339549236,10793448786327273772,524288 --field-trial-handle=2020,i,8720883412781588477,5930671925868902993,262144 --variations-seed-version --mojo-platform-channel-handle=3736 /prefetch:14
  2⤵
  PID:4528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3696,i,1839019881294598151,1784756685981214565,524288 --field-trial-handle=2020,i,8720883412781588477,5930671925868902993,262144 --variations-seed-version --mojo-platform-channel-handle=3744 /prefetch:14
  2⤵
  PID:2772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4900,i,13339888991666863733,3193806336690536441,524288 --field-trial-handle=2020,i,8720883412781588477,5930671925868902993,262144 --variations-seed-version --mojo-platform-channel-handle=3336 /prefetch:14
  2⤵
  PID:2428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=3712,i,7928106201215744285,13058643108667164502,2097152 --field-trial-handle=2020,i,8720883412781588477,5930671925868902993,262144 --variations-seed-version --mojo-platform-channel-handle=4496 /prefetch:1
  2⤵
  PID:4884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3716,i,16089918456075980888,17378686771134938897,524288 --field-trial-handle=2020,i,8720883412781588477,5930671925868902993,262144 --variations-seed-version --mojo-platform-channel-handle=5940 /prefetch:14
  2⤵
  - Modifies registry class
  PID:3228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=3368,i,5202018049850710857,2285370743442748807,524288 --field-trial-handle=2020,i,8720883412781588477,5930671925868902993,262144 --variations-seed-version --mojo-platform-channel-handle=6036 /prefetch:12
  2⤵
  PID:1908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --metrics-shmem-handle=3660,i,18015482328266267527,16083380062175205382,2097152 --field-trial-handle=2020,i,8720883412781588477,5930671925868902993,262144 --variations-seed-version --mojo-platform-channel-handle=5736 /prefetch:1
  2⤵
  PID:200
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5900,i,13760100271617713491,7200279655348909633,524288 --field-trial-handle=2020,i,8720883412781588477,5930671925868902993,262144 --variations-seed-version --mojo-platform-channel-handle=6412 /prefetch:14
  2⤵
  PID:5488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5436,i,10704287505224485423,12359834210026541524,262144 --field-trial-handle=2020,i,8720883412781588477,5930671925868902993,262144 --variations-seed-version --mojo-platform-channel-handle=6328 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4340
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=268,i,13465983411960941434,2709676316470748292,524288 --field-trial-handle=2020,i,8720883412781588477,5930671925868902993,262144 --variations-seed-version --mojo-platform-channel-handle=4640 /prefetch:14
  2⤵
  PID:4144

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1852

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1304

C:\Users\Admin\Downloads\loader\loader.exe
"C:\Users\Admin\Downloads\loader\loader.exe"
1⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
PID:4800
- C:\Users\Admin\Downloads\loader\loader.exe
  "C:\Users\Admin\Downloads\loader\loader.exe"
  2⤵
  - Executes dropped EXE
  - Writes to the Master Boot Record (MBR)
  - Direct Volume Access: Opens a physical disk for reading
  - Suspicious use of WriteProcessMemory
  PID:4516
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c powershell.exe -NoProfile -ExecutionPolicy Bypass -Command ^"^& { $encoded = 'QXBwIGluaXRpYWxpemF0aW9uIGVycm9yIDB4MTAz'; $text = [System.Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($encoded)); $text = $text.Replace('\n', [Environment]::NewLine); Add-Type -AssemblyName PresentationFramework; [System.Windows.MessageBox]::Show($text, 'sync.top', 'OK', 'Error', 'None', 'DefaultDesktopOnly') }^"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3516
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "& { $encoded = 'QXBwIGluaXRpYWxpemF0aW9uIGVycm9yIDB4MTAz'; $text = [System.Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($encoded)); $text = $text.Replace('\n', [Environment]::NewLine); Add-Type -AssemblyName PresentationFramework; [System.Windows.MessageBox]::Show($text, 'sync.top', 'OK', 'Error', 'None', 'DefaultDesktopOnly') }"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1064

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5504
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Enumerates connected drives
  - Checks SCSI registry key(s)
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:3184

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3584

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4020

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:1988

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Debugger Evasion

T1622

Direct Volume Access

T1006

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Browser Information Discovery

T1217

Debugger Evasion

T1622

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5102007d-a507-4cfe-ab36-a876a8fc5d72.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\5102007d-a507-4cfe-ab36-a876a8fc5d72.tmp
Size 150KB
SHA256 ad2cbc8fa0e50a84e87bd29d8f5504490fc6658c638f50b6e4019f6cb74f063c
MD5 da5f120188c6d74704adb910ae6da2d6
SHA1 537011d210354790556fae620104d6428fb55183
SHA512 3c6033e375102d69ebcb8a8a5506b29b8ca5f26046062a50bf39df9c07b063ce7e1683bcdad9d38b0d55eae251ba6712276c45eeb4e588f0adb30d961bb722af
SSDEEP 3072:vqQbuEbq5ojXhM5ihZmJlI1wggbi+4gKZXVaqB8gtT58SDWLZ1M+jWFTKbg:v7bubozhM5UIfI10bN4gGXVRB/d8n7Mp
TLSH
T10FE312B3D4447DB7ABFC69542123370B3D9816D788C5ECDCB5EA3681A69264E0A3783C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8d7b5352-7eb5-49ac-a4c0-4759593a40a9.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\8d7b5352-7eb5-49ac-a4c0-4759593a40a9.tmp
Size 150KB
SHA256 fb7e1c81256d8795f6b97d77064191c5f47fa1b8cca56842665480b9fa30aa2d
MD5 c696a38bacc3b091f8124b5391d6cb2a
SHA1 84b040b9cfd5d8fe485d861d96239f7e840dbc32
SHA512 d9bf5030be394c4732e1f0994b3a6db67460e59058dffc070faac11b290224edd9f9d488857855440edefbe8f9d00d5359e7398b20535ad5ef8430895faf4458
SSDEEP 3072:fqQbuEbq5ojXhM5ihZmJlI1wggbi+4gKZXVaqB8gtT58SDWLZ1M+jWFTKbg:f7bubozhM5UIfI10bN4gGXVRB/d8n7Mp
TLSH
T1C4E312B3D4447DB7ABFC69542123370B3D9816D788C5ECDCB5EA3681A69264E0A3783C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9661d42c-16f6-4b9b-93c8-f3f2a4f76426.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\9661d42c-16f6-4b9b-93c8-f3f2a4f76426.tmp
Size 4KB
SHA256 8186cb85ccbf6804e4900271f77f2088e806f1fdee328d8ae14f38a9a6d8612c
MD5 567658ae32ec8eeb0b2188dc3c171650
SHA1 6433b3d0e324f1c485b4814fdac2be31182a9e95
SHA512 3f65fdbec22e871cb382e9f70a81341c4026e4f34a20e6dc91594c1a060d01fdbd8c6e48088f55d5cbe43ed2674c2e4c3d6a340a75936eec0bf9f7b3f8382f86
SSDEEP 96:CC0d+TWqN/K890wxi+9M7fX3urjUBdyRDotok52p0cD1B6vGyvtBWG0cT3bOv4a:CC0oWqNVVxi+9oP8DUDk0KLDeW9cT3bQ
TLSH
T174A11931A869997789F6D585B1463E53CFB870AFA521DFD4E8EE1D1C20F309C1342627
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

99e6d398-183e-420f-98d3-2215145da1b5.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\99e6d398-183e-420f-98d3-2215145da1b5.tmp
Size 149KB
SHA256 90b20f0c242ac889111e09bb29e7bd5c7a6c337a41ee425cb305eede4216f944
MD5 12a1ba07f85f7079c1f2a43520457bc2
SHA1 e584dcccf8ff7bcc34e41770057a9500f25bfb7f
SHA512 2cb88488f568bf4be4bc7d9afbe053c176731b92d1ebc385990db3b115a72498853694fb7b844325639dbf00a98bb9c25ad3588db4869f2c7a071ec37f3d386d
SSDEEP 3072:0UQbuEbq5ojXhM5ihZmJlI1wggbi+4gKZXVaqB8gtT58SDWLZ1M+jWFTKbg:05bubozhM5UIfI10bN4gGXVRB/d8n7Mp
TLSH
T114E312A2D0547DB7A7FC65503633270F7E5904D648C6ECECAAE63391679264A163283C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

053fe30d-cd37-4af1-9e8b-37737d13f990.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\053fe30d-cd37-4af1-9e8b-37737d13f990.tmp
Size 11KB
SHA256 c9f948f56ad2a07052505c901816193ab78989d98d5337d53211ccfd6d3f4c73
MD5 b6650c9a718c11f5754894ae8f1a0dae
SHA1 feccc59205cc5ab008e062ad8b7b4305531c6d86
SHA512 513e0622126d109fdfb01fa22ee36303935016ba2fc6d44a9d7b8a25479583cdeb80688ba57135170eacfbaf87108f55bde8537f5630f3434f7906f161a26643
SSDEEP 192:ZROuW2v7RAPRp2GXsb+WNnAP0qkfYecJGtnaWiyIsnAUge:ZROuWCAXlXw00DfCkna/e
TLSH
T1AD32A52DED14B93B9CDBD219FA267B57D6F9102530D42E80E6FD882C15D79CC622B01B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

07689d6b-7b82-49cd-af9b-e54eb4f4fa8c.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\07689d6b-7b82-49cd-af9b-e54eb4f4fa8c.tmp
Size 13KB
SHA256 2d72bd987f4b1bf59f6261174afc1d40ece1671e56434e0fa50dd0827ab10f4b
MD5 8b819881d9d6f7ceed2d9e7e1b1b7e65
SHA1 607acdbe652d4e6485e6b4df8262d4abafc6a25f
SHA512 fe7620ab7ced853677dd080fdefd65b644575ed8d1798834e154cbc936f03c504479590aa5f2c1e56c6157641125dd49c0583f299e343e12eedcc75432e6e7f7
SSDEEP 384:usjYb7KxkXqKf/pUZNCgVLH2HfgslzFXODYX+ErU3iAHG8xkkkwlF+H:ugYb7KxkXqKf/pUZNCgVLH2HfgsRBOEJ
TLSH
T1B752F82B644C9A3F0FD8DA4CDC167F4FADB501466668096897FB9C1803A57CF114A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2872fe05-b221-4381-b14d-c1511e4e65d0.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\2872fe05-b221-4381-b14d-c1511e4e65d0.tmp
Size 11KB
SHA256 7e64c7bf639fcd90d196a7409156194d6639adec08249101098e4a4073d74ce2
MD5 853e903a23442350d7c683882b4accae
SHA1 cdad9eab57c223c67855bdc52dcfb5c3603d2ece
SHA512 9a2888b96b3490f3074a881a56e4fa91154c8d2a6647d1db8f49e00afeed305a8b6f5a9235759392d329953bc01718ad0556e69219954cf1a520c1ce5d7a6c5f
SSDEEP 192:ZROuf2v7VAPRp2GXsb+WNnAP0qkfYecJGtnaWiyIsnAUge:ZROufCkXlXw00DfCkna/e
TLSH
T19532942DED14B93B9CDAD219FB267B67D6F9102530D42E80E6FD882C15D79CC622701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

33567c50-13b8-4d54-9714-52e446614795.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\33567c50-13b8-4d54-9714-52e446614795.tmp
Size 13KB
SHA256 893fb3e25d4e15348e76c29b9558a4ee05ef4dfc37c4813c56f43ee08d8852f6
MD5 cc9702e841fadf9f934f10c64fb4dccd
SHA1 be10bbd780a37517c6c8c35feb105d53757baf14
SHA512 480074bf1fc7e6e1ffef359a805da32b763049865a743e436fc9158333590aa718a0f660eb4d7b84034d595f56e774f93feb2ca4bcec6179802a24c69e1e37f5
SSDEEP 192:ZR2cBzuWKv7t3pPRpNXQv2rXsb+WNYmAAPzVVKEwDkceOkfYecJGtna4iyIsnAU3:ZR2mzuWG/XocXwY8zirenfCknaJE
TLSH
T17852B62DE920793BADDAD219FE26BB6BD6F5102574D41E80E6FD882C11E79CC6227007
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

79f6a333-a987-4bbe-b699-e768b87f6f55.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\79f6a333-a987-4bbe-b699-e768b87f6f55.tmp
Size 13KB
SHA256 514de6cc327c7fb7a37c7359feef5119f186729ae2e556c46fecb2ea5985414c
MD5 4c7e94b88eef56bcdc24b138550ecabf
SHA1 3ebb11dded5f6bc79b3f9fa9c394349b21b073f5
SHA512 fa04623240cb5713482c806cdb602b4f762c1e5505f47866e72cb24940660f72afad857eea2b6be9c5783044b664dc6fe74fb32a9f0408a5309c258691fee4e3
SSDEEP 192:ZR2cBzuWGv7t3pPRpNXQv2rXsb+WNYmAAPzVShgwDkceNkfYecJGtna4iyIsnAU3:ZR2mzuWy/XocXwY8zy/eyfCknaJE
TLSH
T1AA52B62DE920793BADDAD219FE26BB6BD6F5102174D01E80E6FDC82C11E79CC6227017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8f8ef97f-18d6-4fef-abb5-548a11e543b5.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\8f8ef97f-18d6-4fef-abb5-548a11e543b5.tmp
Size 13KB
SHA256 96575124278f81b45ad3529b96ec4afece9989312855ec9f32e5c23936d226da
MD5 3da5131ac4787997b663164efb02ba9c
SHA1 c733d46f72b86cf7d66393a6b61623b4257b8b15
SHA512 640741afaa7afed1d246ab4a456dbd8703c30e23ce5ad6a447faaba21b6b11c5926c402cd1cbd6b2b54f7811e425f346073bfa557e3ced916d0e71d1c4af8f10
SSDEEP 192:ZR2cBzu2Ov7t3pPRpNXQv2rXsb+WNYmAAPzVVKEwDkceOkfYecJGtna4iyIsnAU3:ZR2mzu2q/XocXwY8zirenfCknaJE
TLSH
T1F052B72DE910793BADDAD219FE26BB6BD6F5102134D01E80E6FD882C15D79CC6227017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00001b

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001b
Size 23KB
SHA256 203de6062f92e115a1686354c4b17e1dd84f64600178957ab5701aeca974a36f
MD5 5a3222449650f48cd9aa9164ad9991c3
SHA1 5ff4453d43da4e6088b3e9ed4d29de443241bd50
SHA512 99b5e1815000193293ee22196e9952189be9ac8d285a0c4dbf2949009265c966b3a986998ab3b0e0d9e63876b96ee511f59035a08c04b0f3185825e4291ebdb1
SSDEEP 384:cbV0jJzFL7KaGtKhkIEMZ6T0Gs90cubptwr7vATq+OYihFYdUbC9fq2uS:cbQzJ7YUNENC6cu2+yhKdUbC9OS
TLSH
T160B2F1173E5A4FE8139DE41AACDFC7A0117C4BE56BA8C28B4173FB648C283899148877
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000025

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000025
Size 17KB
SHA256 ebec94616d60600a82278bfb32bfff8b8cfb447aea125f52fdd8a73e0ae04e95
MD5 2119100cff9cec46fdb70ae896d4373a
SHA1 2e70b6763a6d654919bad544bb9c17345501df01
SHA512 f475649b38e9632f6ce7e610d84310d97b3bd358cd5dbc6bf458a7d2290e45847dfbd9f4114746ad805f1de7f760823ee65abe26525a70f7d3d3cb138903aeea
SSDEEP 384:MI1uUAdneWS+/fzGtlhMJEo6lDGVx6YUoKPMjKkh6i49:T1d61/a1MeoKDSgHpPRsBm
TLSH
T15382D1D943EC08DE1EB1DA7014B9E2349A95AC589495D8CC503A7F569FC2826FA2F283
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 1KB
SHA256 2ca0abc202e37f107956d2ebe91f098c22552b3f38fb445125fc702cf26b9ffc
MD5 e292a04c0242584edf190e607b145be9
SHA1 e3bef277696c8f0c49948033bbb66cadf1ddaf7f
SHA512 a695857a6849d829818c3c33fea840e73f3ba805aac4c976ee5b4dd424adbaf57df20bbf0577906a2a5aa6627fc62707cf566a5767040859631aedc6c10a82ee
TLSH
T18C31CB41660C3721EFA718332CD4B5A3242103F9FEA34BDB75D229B43C572A3AA42177
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 1KB
SHA256 058a0eb54dab94bd56089922a1517c9a236f9483771d416426087f7ab4e1cd08
MD5 1f879a91287434126ee264f8e12d6879
SHA1 3c4338fe2df2bca8aa62f44e9446e6fd084fa44b
SHA512 f95afa031d2f164dac0043f9b6483732da038017921fea878307a33482eb69bc2702d3d0a872845a9cfe2d15651efbb1499749f5565f5e992812cfb5c379f984
TLSH
T146319A41660C3621EFA718322CD4B593642503F9FDA34BDB71D26AB83C573A3AA42177
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

00b46c90-f95c-4983-831d-65d10d67384c.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\00b46c90-f95c-4983-831d-65d10d67384c.tmp
Size 9KB
SHA256 1522957654677f60c3dc8722f3041a918447ed313021f24e121d824523bbc168
MD5 b6c1f223fd82428fe5eba12a08d7b628
SHA1 f7331848b5d3bfc2690bb429a4571f7e1de52531
SHA512 1b728b7be188f2e5e42e3d555aca1f03cc2730b2c1a0fc0c04f878410e072df8a0c2d77af01444a809b04c5bfe16e7bf4ae243f7a4f8430c396b37dbf01c057f
SSDEEP 192:D0umimtqJJGgxaj5Wa4w3KEdPoSNBNPzaPPvqfPLImmZttPRA8zR1GQS7BMdMFIt:D0umimtqJJGgxaj5Wa4w3KEdPoSNBNrW
TLSH
T1EF22ABF7D3F4862E890051F4EB156F1BCE291928832C3D66C9D8BE0BA3E3471E25165E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4277cc69-b9e3-442c-b91e-e00dcfa99ce6.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\4277cc69-b9e3-442c-b91e-e00dcfa99ce6.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

44b3a285-0fef-4654-830e-766fb07bc597.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\44b3a285-0fef-4654-830e-766fb07bc597.tmp
Size 11KB
SHA256 5390973bbe1e76d955f1a397c4698e038616912668747e1edf86169c1be7d8b3
MD5 cc2abd3727c2d126ea949ba8a8f55e27
SHA1 03985c264abd7842830192e39dd211b325ff0150
SHA512 b99d7de3b17f715988a2c3995acea56f0dd4ebe98f76cad1d1df52dcdf09065aee27463687078e3581962a4706fec25f562ba67864a849bf53347b2058717d54
SSDEEP 192:DA83ktl50J42x0NIFyY3KTNPogNBNPzaPPvwfPLIgSZrutPRA8zQ1GQS7BadMZIJ:DA83ktl50J42x0NIFyY3KTNPogNBNrax
TLSH
T1E1429BF7C3E8862E890556F4EB152E1BCE1D1928832C3D56C9D8AF0FA3E2471E25165E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

73f23713-974b-4128-9e54-f2c1d798b23a.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\73f23713-974b-4128-9e54-f2c1d798b23a.tmp
Size 1KB
SHA256 c4c551875ad9711aec47d35030be6929449c2226fc32095a39f4854381625bac
MD5 8cd8ba4b2671c97a71199a6ab2ed7aa1
SHA1 c28aba2ddb4db8f398894370c51e4c3fef5e1b93
SHA512 2701944cefa9384c5046e1fe618f7b84687815e139dc66950bcf9e0201a9f7c1df2bf6afd4b456f57c0b4f83165de09553fa37fa208a3a084de27d030d6bd272
TLSH
T13E215AF3867FB967543E0C7B4F40BC17BD7AB8340192A1F4CA56C22EA0D49E31A1A457
MD5 SHA1 SHA512 TLSH

Submit Download

77cc6925-2d18-406d-b93f-198aea68827b.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\77cc6925-2d18-406d-b93f-198aea68827b.tmp
Size 9KB
SHA256 149a413c729b69ad0a0286540d8c27ea101ef5f5597d58afe87472177c92728f
MD5 223b331a36c305adec50058d721db099
SHA1 75714cdb86e01c78c03d0aa96334360a242fbda8
SHA512 be9ee2394de03ce37d8d70dc90c09c7765d19bd3661ec56721a9f65b47019df3836ff73ae53ac051cdf0045e53fd3b8eec834b64526c8afbfda3e3b72ddd31a0
SSDEEP 192:D0umimtqJJGgxaj5Wa413KEdPoSNBNPzaPPvqfPLImmZttPRA8zR1GQS7BMdMFIT:D0umimtqJJGgxaj5Wa413KEdPoSNBNr+
TLSH
T10322BBF7D3F4862E890451F4EB156F1BCE291928832C3D66C9D8BE0BA3E3471E25165E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b45cbe91-f25a-4afc-ae83-c328b16ca783.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\b45cbe91-f25a-4afc-ae83-c328b16ca783.tmp
Size 11KB
SHA256 79d96131b419a96e11cac4aeba43668c968526b3868641361d07fbbb2c95b86a
MD5 04d3987f6ac9459cd83bedfdf9fa8d3b
SHA1 18ffb819593af5d7fbdb5e5f827173550232e774
SHA512 c00878d88d3186a8cbc1de7a99c6ceee0800a43b25118f18873794518cc144beffc9cea883fea1ffbe0872d58d591eb13862da205870f66beb24031e97837eb3
SSDEEP 192:DA83ktl50J42x0NIFq3KTNPogNBNP9yaPPvwfPLIgSZruidptPRA8zQ1GQS7BadW:DA83ktl50J42x0NIFq3KTNPogNBNVyap
TLSH
T19B329CF7C3E8862E890556F4EB152E1BCE1D1928832C3D56C9D8BF0FA3E2471D25165E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c77e50b7-5f0e-43d3-86af-2e8c47e5cadf.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\c77e50b7-5f0e-43d3-86af-2e8c47e5cadf.tmp
Size 11KB
SHA256 069b9874b373e715b8bbd32521292fe6268815013da4a8bd9219756d30f8ce52
MD5 aa35a2b50d3ab31850b7753938d8dbae
SHA1 3b1d20e535a53bc97648a1e3b029b56d11238fc8
SHA512 d921b9c879b14ab0312a25a0425c291b7a98170e3e71367c9257b6129ac996483c871761b4b4e121cf5815c101ba6698d8e6a53910217ce2ffba86189d165c4c
SSDEEP 192:DA83ktl50J42x0NIFyc13KTNPogNBNPzaPPvwfPLIgSZrutPRA8zQ1GQS7BadMZ0:DA83ktl50J42x0NIFyc13KTNPogNBNro
TLSH
T1BB429CF7C3E8862EC90555F4EB152E1BCE1D1928832C3D56C9D8AF0FA3E2471E25165E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\temp-index
Size 96B
SHA256 743b5fe22c124b3bb3901be16d9c083a9613ce6018813af0d8d396d4cd1db60f
MD5 1739de1fb119533d143e51448783d45b
SHA1 38a18ff06e54c50e460faf662099eb646d3d3ca1
SHA512 fd8b568c14daa3ca888eca474afc58c77c844d7386832b1c58c0ca4e6c70c42b0ee5fccb6e63abe8ccae68b801371c2d829c4b26fb808527eb459c6da3eeda70
TLSH
T10DB022F800E23802E0020B38CCC200F03222CC202B03A30382A088288A223C2E30008C
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\temp-index
Size 72B
SHA256 96f82a2e9eb5d15375796dd06499951720ec69eab7d5905e8df161cf9b02bb4a
MD5 f41d5ef4af5ba3feaaca9c0f04125dbf
SHA1 7ee2f1d7aca75c98b8de4468201cb3b477d74ebf
SHA512 192261e0cfe26591b216e3f50ed86cffdb26bcebfeed44a9a68775d5398736e9f78898129bcf75364fa9bcb03eb997182d2d013f1e0df633fc72cfacb301ca18
TLSH
T125A0027051CD1851CF084274607607693351DA242961835755B60449D95F1C64555654
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\wasm\index-dir\temp-index
Size 48B
SHA256 8ae92dd9c5a1b9178b8b0c1c8e4d6de20fbdf05c0c24d551f50f664659a4176b
MD5 d7ce753fe7d69dff8950c22d073e9f05
SHA1 64152f05e61f52962d1b979e84f42c2b1b5cd0ca
SHA512 7938e5f6d358d9031d8ac3c77486450f28172a3e393f7a321eb97f0e4f478489a8bd2c18020b339daf01f793222411b3e8d03247beb3df4597e391e5ee78ac4a
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

128.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir1068_101933350\Icons\128.png
Size 2KB
SHA256 3a45652c64d2a35cad427fc4541ab36ac42f11425f2d996edc38a6498d98bae8
MD5 306472d164006935bf98edcf0cd28837
SHA1 f2ad2740a46607728c5444ccf2a93a774bb300ea
SHA512 51547f18c6518d60ebb1aeca780bc1b9fa85f444a5abe60ba6b0f34d64f4006ae01c24128284e02e7b9e1d96c7111f3c8c597a1e74f2a29fe4ad6c139f0123de
TLSH
T1FF41C7998B466878F215E305C0493E7E79B2BD1A1C13E05A21B040430DA9BD55FEB61C
MD5 SHA1 SHA512 TLSH

Submit Download

192.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir1068_101933350\Icons\192.png
Size 1KB
SHA256 56b7a8100c9fd352d2c25b6a9c9a05b47950cf5f84d07ab014a0b7cd2850e5a5
MD5 51429005fa10fb2c81fe734e74695d0e
SHA1 9dad5c509e3ad1ab8b1d0ff911600a83b62e3aff
SHA512 999fbbfb741ad6499e617e1e637e014099a49e9a5374314e59f6f145cd19f9dcf3e131b4fd6c622f9293033dab91392b0665ca0d567af2c34d20ce255495a04f
TLSH
T1172178BF93B5D1F3DCC2CB03D640509CD80F762B7D6843C5DCA018A986B9D45AAB88A6
MD5 SHA1 SHA512 TLSH

Submit Download

256.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir1068_101933350\Icons\256.png
Size 4KB
SHA256 55d89ccdc27b413cc831f5496b0caf3ec390bc19270ec3294a5d2d38dec42c24
MD5 b3d7fffa6ed9b6dd37f5d2cdb077f22e
SHA1 cb2e013c3d6b7c35eb09170ce884da4fb480e1e6
SHA512 473db4b410a9fd56fa1289ec8314f908ee221977b2d32b5abfe1ad628e60addbc23e3b06f7fdd104d6a2e3076f992c65696ffe1ecc75d553e094a57869df04a8
SSDEEP 96:miJQW62M8GG901ZveUmX2KJ2tra+NO6+K6teIp5f:zJ/901ReUmNJ2tm+NO6ibf
TLSH
T16BA13A8E47A0DC8B8551A3BA1AFAA4E07A30983063F2133576F640EB742D523A309B75
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

32.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir1068_101933350\Icons\32.png
Size 960B
SHA256 c6fa451ecd1a8a9533801028bc70cf82ef48eba11bb835e53e6c530b43018938
MD5 8fc407c5a96f560cfbb46503741dd11f
SHA1 31eb59362b3c99abd75bdf605bdf46d793ef99b9
SHA512 7ed6d7c679ab5928427095beef9ae476e8bc57a5c81cb633bce1b646a896557b5b49112d489b2112ac2749e1adaf6b1a7544be36c570696fff80725352eac68a
TLSH
T1BC11CC5290BD5338C4D16953E04223E10E566CFCE4EE91366B8FC80D893EA5D9CCC621
MD5 SHA1 SHA512 TLSH

Submit Download

48.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir1068_101933350\Icons\48.png
Size 1KB
SHA256 3fc8b8392989fb26381f0a14bb356cae5f998a4dde004c06a51e974034f9ccfa
MD5 b75ce0c6ffcbdcc1066a2e6c8c3aa5fc
SHA1 2ca49f0080b985a68692eee2582298a9353c7916
SHA512 a3ac3a8cb7de26b7e4fa126497dcc228462b04da9a99a0b4647c1d8f877131f6597af80c3d7e834b50938a6c1349ccb14e9e0dd0b06673fa789d78e3e499bf7d
TLSH
T15C2196C3239DF6E5E54D50A745CF1B12F7BF375829B4A058A08E42C502B77C192CA534
MD5 SHA1 SHA512 TLSH

Submit Download

64.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir1068_101933350\Icons\64.png
Size 1KB
SHA256 f6ff978b0f4c0d28e96b27b6242565480a73615b03a4b95640f8d20136fc2a91
MD5 518326c327ce412aff2d0f63700b372e
SHA1 24b69d3fb978c36bd349b516cbb5720addcac515
SHA512 fa4c22a9c51cb75ef04984ac10ee068fc9d262b7cc2f969f537784bd71240359cb3c34d9789b043f43e7109e7028b17da50074cba2b8759ea31e5ef2898b0707
TLSH
T16E21E79532856E7C8FA21F4BE0642A1DF2761D0423258DA603B12CF10CE040829AD2A1
MD5 SHA1 SHA512 TLSH

Submit Download

96.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir1068_101933350\Icons\96.png
Size 1KB
SHA256 84a6d2571ed487aec05288f204c16ef239a740d2dfb105bf781c6708b938cf00
MD5 f674dfc82d3ab385e234cc05c89081b3
SHA1 dbdeda809b10a5df7da5b2a2dd12acdb7dc7d427
SHA512 56ad6146a5bd339fdcbd4d66cdfa8144c1eccc7db57a4f790e536fc97291ebd6b13dc5bc6b12c114e72054f87f3372e1cd0c4d6f11eec998e7d3fab008613046
TLSH
T1FE31DA5B19CA9ED15BCC933BE32401336A28845C4F1115890CD6B0AA59D5DB5F63C2BB
MD5 SHA1 SHA512 TLSH

Submit Download

128.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir1068_87308726\Icons\128.png
Size 8KB
SHA256 fa0d73901ae74d2d2c01f26442a2d489abc53facb18d532c67846bcb2cc6877a
MD5 0de22373525e2f8219958621a66ba3d0
SHA1 130e89d9409eda3bf4c24c45e8a7d50086134c2d
SHA512 ce3bbc18af6a84da5859f639ed0e8b578e0a4534ca16fac254e757aa06bf19bba00c0d4e922831a682e1d7ec5456af0635cc01c0a0885394dd6faf5565404767
SSDEEP 192:CKwpZjVWBmHOxZMDkfoy89zziiGjQH56E6vXmU1z:CTp3hOZMEj8J5IQDM
TLSH
T16502AEB2D08CAFA12ECD11D7D7111631F809B384481E9B047A3B789D6DC67696BF0963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

192.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir1068_87308726\Icons\192.png
Size 5KB
SHA256 cca43d465fed69867dfec3ee1faa43fe3cfc4fb118e3762f9f4f318856f2664e
MD5 da90d05a60eeeedea5d4c35c31413459
SHA1 591f0235e70c22d309271e9c81c9816e8a86f3e6
SHA512 95ea4002a0658583c34e92cce03d86e42fb73688373c7b11ccd9f94e21bb178cf32aa7dce89b1d2d297018f592d0702a64e6981b335da5da26f2b9362c559e73
SSDEEP 96:I1rvCO2A0aHOTRwC1kUof3cFpC3bbM2B/un+vT2+MMjCJhS8Jf:mrvC7L++wskcFwPM2B4+vTljCJ8Yf
TLSH
T1E8B16C5BEA450EA1D688A8AE5E036C0FDC830436A8236F0B6BD1CC399D9754DD775D04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

256.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir1068_87308726\Icons\256.png
Size 20KB
SHA256 ba50637a9a54c98264373add3ad0514b06e6ae59524a3f7a4552f556d1afb78f
MD5 7758b421c1ae0478425085df0fa43fe6
SHA1 7d7fbc301e0a25088f6226d38c4501b74c4fe338
SHA512 04c11d539944866aa7b63cd4606220e28a1938fabd8d3e60640f16857f61d823fd4d1e4cc50c96d840a7bded35d7230445e732050c657bac32b22e749fb0783d
SSDEEP 384:pEns51DuCwd79NHTa69gMWaGY/HgtO9az/h5I+/paoKvrYCEF9lzyL:pYs51uL7q2/HgO9apaoKhOWL
TLSH
T11692CF6AF0BD09744E49AD7892DD82B735027322B25503AB12C647384ECD98BB71DF76
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

32.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir1068_87308726\Icons\32.png
Size 1KB
SHA256 bff3a19327fd09a24c1aa4e7f34c508d7e668a8eb32f2cc7c33bcaa7e9ee2319
MD5 2f1881da261cfaea89605ee7a5e33e40
SHA1 fe61ed428aa3636adcfbeb66162f43f0ee091d25
SHA512 a9d8a4172c83030bf4472e900540b2ef3bbbb5e565c39f278cb8aae355354f063a4723c5ed8c3b32dcea45c70903271d170e56879a096b169697fc28dc768494
TLSH
T1FC413B2333F81ABFD81CD69BE465C8A50F395483DA39060706031CE8116343B19DDAF9
MD5 SHA1 SHA512 TLSH

Submit Download

48.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir1068_87308726\Icons\48.png
Size 2KB
SHA256 afbfdd55b59a6385a28bfe27ef81ffae07f9d77b8c073dc299c6060b5d964a89
MD5 4d5d17c7e7c06b887bb383077131f50e
SHA1 8b29cf29af8358672e31bee5472025b7b07e7df8
SHA512 ccb20424ba2566e11a359bd04cbcb54bc21947bc254f4939c334f7db8c784a1da35461f60a1fc559ab5bde5cda443c82b633b8cc5bda89f5019b391148050be3
TLSH
T179515DED0389C698FB6F764206866917621D39F824EC51E09AE816A3EB101AC1CC1FD2
MD5 SHA1 SHA512 TLSH

Submit Download

64.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir1068_87308726\Icons\64.png
Size 3KB
SHA256 02bd0f5d045eb5247e576d8151da19d36dc0eee7746c9a426d4dc92ee83125c8
MD5 aceb6eccca82014c9472e49e8b4b6eb4
SHA1 91d2c703fe33ea1867dd3d87b760aa2e5e68a55a
SHA512 b18d0edf51fb6245dc730b5aca21601dc40c762d6c3d96c950b38312406bce16fe7165e786bd0d6ee106d95c90139094bfc4fca08b0f37eb88c086606821ade4
TLSH
T111814D53467373A8BC788965CBCDD0EA8D732D594E4244F884CAD93429D54049825BDF
MD5 SHA1 SHA512 TLSH

Submit Download

96.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir1068_87308726\Icons\96.png
Size 5KB
SHA256 a5c76c56766d79ac0e66fbbf57806501919a63913fb224b0965041ec3645f9e0
MD5 52f979b0f8eb5e71105a106aeb669fbc
SHA1 d07100bf7c92275c1ac532a26a716f1e7b571122
SHA512 be82e2d6303989d27ea16c4c4fb22ab8d10f6a383ad7eacdaf00948431127dc43fbea2c9003832a081f42b2756ed4be6b1beeb4947e09eae7785640e89919fc2
SSDEEP 96:kSJ396EccyvubO7098NnZZVbEOSDV5wcZue0cyqi9yQt+nyYKutZ0MRP:Qcyx0YTV9SDREe0chi4Q8n1jZLRP
TLSH
T1CCC19E245B029EA9E4E0DFF34A97C45FF7A1429651A3C120E164F2D1EE9F3E019C64B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a1d8c1aa-5727-4fca-9332-9a29b64da0e6.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\a1d8c1aa-5727-4fca-9332-9a29b64da0e6.tmp
Size 12KB
SHA256 4efd851a1d981a5307586e6feeb3338caa3f488d09df57880bee78dd1175d254
MD5 9290df9a3188d7c106c07b1278dc1d7a
SHA1 f6d5d5774a77a93161ee9826e0de45a37917c00c
SHA512 d128c5877224e04d2542d609689062ef457ebfc76e234560627995dc47021bd12b82c54d791a46eda3ce475c2afaf2fac2565da68c0852a9ff3f9b63ce4cbac5
SSDEEP 192:ZR2cBzuWbv7RAPRp2XQCXsb+WNnAP47g2jkfYecJGtna2iyIsnAUgE:ZR2mzuWjAXOXw0T2gfCknafE
TLSH
T16942B52DED10B93BADDAD219FA227B6BD6F5102670D01E80E6FDC82C11E79CC6227017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ad300e65-0499-464a-aad8-f5996df89c5e.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\ad300e65-0499-464a-aad8-f5996df89c5e.tmp
Size 12KB
SHA256 73b818f9c026cdc363baf224a8164a0a6eaa9f8967bcfd3e0f24e5d6672b4a03
MD5 f2eff496dd6e734b6f95ab43dc954145
SHA1 c04690cf5dae74f51efd0bda40b9b8c440290161
SHA512 cc58c097493e61ffb5adc7b1986a35c7ebb201abb5d3845b06d67d90667c018972223c22524310b3cace3f9f647efb6e87001ab33ae8a0cc303236d48ed0018e
SSDEEP 192:ZR2cBzuWbv7t3APRp2XQv2UXsb+WNYmAAP4wDkce9CkfYecJGtna2iyIsnAUgE:ZR2mzuWj0XLfXwY83eBfCknafE
TLSH
T1F042A52DE920793BADDAD219FA26BB6BD7F5102570D41E80E6FDC82C11E79CC6227017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c798a062-27fc-4d13-b02e-c8e4ef7bc9ec.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\c798a062-27fc-4d13-b02e-c8e4ef7bc9ec.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 149KB
SHA256 30c573ff8884bd989be6dde3e0f373d38975abbb950ca705b129b0499f828966
MD5 b88bf565f7e5538519e3e422bfe93fef
SHA1 7e431bc86ca6c6fce8b6c2245557d24a0e0e5194
SHA512 21c12feb63b3cecd4aafc23ac5a941067e2599481f4eb553e989448a2d878c15ee17c92fcd00761e58d8723f818b19f3abfd8a33aaf531dfea4dac4996bd1514
SSDEEP 3072:TUQbuEbq5ojXhM5ihZmJlI1wggbi+4gKZXVaqB8gtT58SDWLZ1M+jWFTKbg:T5bubozhM5UIfI10bN4gGXVRB/d8n7Mp
TLSH
T1F7E312A3D0547DB7B7FC65502633270F7E5904D648C2ECECAAE73391679264A163283C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 67KB
SHA256 96952b58e7507bfbf6b1edf838d41182ae4f94e983572fa0c037be46d4ab1b05
MD5 b65d38126d60f6776d0fee761697a8ab
SHA1 fce1b1fa5ee6c386768d73e767a6bf9a04c23b30
SHA512 100a082250af816628e48f6949a2068bada9998b7bd29fa7408af7fd8d4425d03c85b92e6e2e4c08dc55e6bb56b4f31aedeaf3f4ac201e80d2cdac77353c5dd6
SSDEEP 1536:mKLg0mYo2hOovpfKQVGflJdpHYWh4iUx9R40i71Yi9MQyPcMrxoi3jiRjdvRwa5Z:mKLg0mYo2hOovpfKQVGflJd9YWqiU9Rg
TLSH
T11C636192E9204E75E1A66F3EF15622627C30394690F8113211DC25EFA987D970B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 550cc113b543432b3447d768177cf41c985158fa3c6a84ae8d2991e3f3ad0266
MD5 1279086b391d2d37cb07e17e82909832
SHA1 325a0d136dfb952f0d7480dd262a2cffbaf495e5
SHA512 0c5426af36ac216afbaa2ec2831b62cdfd7046eba0d48e6a7560b3cf4e1d8647865767a626778655c5e62aa5a405ec6b49ee93eedef2c6a2a954e2d14bd67d12
TLSH
T145217867F3CC8729DC9A403620CEAC1436B687E740DE8E57AB85D248B53F199DE61550
MD5 SHA1 SHA512 TLSH

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 599B
SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
MD5 658ab8c32d4cc5deb36ac5f63da4658b
SHA1 30c12cd871ff0c2c4098d794e9ae4f2540586813
SHA512 a73030c008ef3c2e274f11c90bfe79fa8ae402f76801c710bed8cc1ab1218a84858ea566b772be4bade8ef639a019c57d297028df15b64b3753482cf0f3c8f85
TLSH
T12AF05C83EB6A1B72C456123DC8EE56E47B31D1846EC11367A2107B1D3C2B7192D174BD
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_ff245czi.rxv.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ff245czi.rxv.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

loader.exe

Path C:\Users\Admin\AppData\Local\Temp\loader.exe
Size 18.0MB
SHA256 8b5334911c6240a12354d1b11041ab3303d0fe7ea57fa9a7d72002932a5f4149
MD5 6d03a12efa46b5e12fea99246402c2f7
SHA1 7c38a59f9b9d283a08ea45578491b2ee725a1cc0
SHA512 d7a5e7ba41be8ab501457fde0941278e36da3dc6262d89045546a869e16f62ffde912924eb5b066353a95c9133224f69972bbbd007d4488bbd897ba069df2e1e
SSDEEP 393216:eIDKl6Ffh82f3Ug9qd5MDWO4Icq+zj641v6Ywc:ee3Zqd5My9lqnSwc
TLSH
T1B61712C125E982FDC362C63DD24617EAE9C93C858DBB652ABFCA64013471C45C8EBD39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3b8b0ee6-fbae-482e-9906-132b59d03638.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1068_1838229043\3b8b0ee6-fbae-482e-9906-132b59d03638.tmp
Size 242KB
SHA256 81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82
MD5 541f52e24fe1ef9f8e12377a6ccae0c0
SHA1 189898bb2dcae7d5a6057bc2d98b8b450afaebb6
SHA512 d779d78a15c5efca51ebd6b96a7ccb6d718741bdf7d9a37f53b2eb4b98aa1a78bc4cfa57d6e763aab97276c8f9088940ac0476690d4d46023ff4bf52f3326c88
SSDEEP 3072:r+nmRykNgoldZ8GjJCiUXZSk+QSVh85PxEalRVHmcld9R6yYfEp4ABUGDcaKklrv:k3oF4Z4h45P99Fld9RBQYBVcaxlnfL
TLSH
T1F63402BD7D8AE686D006A17676C0B48BE1199F4E41CB7C0F668A89010D70F8C57B9DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1068_1838229043\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

loader.zip.crdownload

Path C:\Users\Admin\Downloads\loader.zip.crdownload
Size 15.2MB
SHA256 d9fd29f0ad31d5d80267d608c6293e808cc495453d4a89afd87b85ab31628d5c
MD5 9a4392d40471bc522aabcc92d234d175
SHA1 21eda9872da4312a90878ff05ca96cfb1abb0b8a
SHA512 33ffa1496275fb044555210451c543e02f4b274ab37f21f5683fc4a5c4a007aea3589659748e2e3e9964c0d0ca4f5102f1656061b8048124ccea58470dad01e8
SSDEEP 393216:k3rxyTxxywrX4MD4DtAjgT8NhqYbYMCvQPWlGMyVm1j8M4A:g0XN4DtA+YbY5oPdVm1vB
TLSH
T110F633F54D33F5B3979319B8B788225B18DFB4BB8865028A7285FB1C86D40894F6D339
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

loader.exe

Path C:\Users\Admin\Downloads\loader\loader.exe
Size 18.0MB
SHA256 91ed892703145978551285b189d527d777d1a265ab5716ad3dc1a42d69e8a87e
MD5 7fa956b1f47eed73d13b80c772570a10
SHA1 5d4bde53b3b67b0cc21200ab2a65c78159e72eae
SHA512 25d5e5900702dfbbe4a1fe3d0ee3c3ab1cc92a3a12635b89fde268990cdf94f6f6478dd232102e23b511d0be78eebc1ea27f826865c84d32887cabf69c80378b
SSDEEP 393216:eIDKl6Ffh82f3Ug9qd5MDWO4Icq+zj641v6YwM:ee3Zqd5My9lqnSwM
TLSH
T1971712C125E982FDC362C63DD24617EAE9C93C858DBB652ABFCA64013471C45C8EBD39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

report.cdr

Path C:\Users\Admin\Downloads\loader\report.cdr
Size 3KB
SHA256 08c312be3583f2749a1f874bb55d304c6b0fb00589fb2e175ce1b2dc9f21cb8e
MD5 25827bbc3d1768b7b95cf0538ac5c00e
SHA1 0d818c7557d77fb7584e9546ff6d32abae3d955c
SHA512 41dd916d8fa9108f51b889afc7786073a12f366473c81b8fd38d09238cb129f973ed4e8156db312528327c308f7f5269a203991f60462878f5e4395db340fef6
TLSH
T15D611C486052F6983DAC5ED2FC3148536B4E1994919CA9C9EC129F2D0F5875B6330AD5
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2504-81-0x00007FF6D33A0000-0x00007FF6D558B000-memory.dmp

Download

memory/2504-36-0x00007FF6D33A0000-0x00007FF6D558B000-memory.dmp

Download

memory/3184-1120-0x000000000E270000-0x000000000E2CA000-memory.dmp

Download

memory/4020-966-0x0000020481EA0000-0x0000020481FA0000-memory.dmp

Download

memory/4020-977-0x0000020481CA0000-0x0000020481CC0000-memory.dmp

Download

memory/4020-991-0x0000020494280000-0x00000204942A0000-memory.dmp

Download

memory/4020-946-0x00000204801E0000-0x00000204802E0000-memory.dmp

Download

memory/4020-965-0x0000020481C80000-0x0000020481CA0000-memory.dmp

Download

memory/4516-910-0x00007FF6C9220000-0x00007FF6CB40B000-memory.dmp

Download

memory/4516-863-0x00007FF6C9220000-0x00007FF6CB40B000-memory.dmp

Download

memory/4800-859-0x00007FF612150000-0x00007FF61433B000-memory.dmp

Download

memory/4800-825-0x00007FF612150000-0x00007FF61433B000-memory.dmp

Download

memory/5668-80-0x000001ED403D0000-0x000001ED403F2000-memory.dmp

Download

memory/6064-35-0x00007FF64A160000-0x00007FF64C34B000-memory.dmp

Download

memory/6064-1-0x00007FF64A160000-0x00007FF64C34B000-memory.dmp

Download