ddebb4fc3c9145bba2714f090e6c550e2133d3b9ec89be1a85922f86860b30b1

Analysis

max time kernel
212s
max time network
219s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01-07-2024 02:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Roblox-Song-Sheet-text.txt
Size

259B
MD5

963aea559e0d8a538a582af14f3497f3
SHA1

90c26e4e18571ce45cb63bfe919859502b9d6730
SHA256

ddebb4fc3c9145bba2714f090e6c550e2133d3b9ec89be1a85922f86860b30b1
SHA512

626798f15e8e9e3dcf8c29cf9fb83c67bfad506035a5e4af7889539c1b1fffb2bb1f6e9adab45d42fa401270a702fb3fe2c9eac6760b9340f772157c650a9409

Score

8^/10

adware persistence privilege_escalation stealer

Malware Config

Signatures

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 20 IoCs

persistence

Image File Execution Options Injection

T1546.012

Processes:

integrator.exe

description	ioc	process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msoasb.exe	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msoadfsb.exe	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winword.exe	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\selfcert.exe	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\setlang.exe	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msqry32.exe	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\orgchart.exe	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\onenotem.exe	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\clview.exe	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\graph.exe	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msoxmled.exe	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sdxhelper.exe	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wordconv.exe	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msosrec.exe	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\onenote.exe	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\excel.exe	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msohtmed.exe	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msosync.exe	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\excelcnv.exe	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powerpnt.exe	integrator.exe

Manipulates Digital Signatures 1 TTPs 13 IoCs

Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.

SIP and Trust Provider Hijacking

T1553.003

Processes:

integrator.exe

description	ioc	process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CRYPTSIPDLLGETSIGNEDDATAMSG\{9FA65764-C36F-4319-9737-658A34585BB7}	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CRYPTSIPDLLCREATEINDIRECTDATA\{9FA65764-C36F-4319-9737-658A34585BB7}	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\PROVIDERS\TRUST\INITIALIZATION\{4ECC1CC8-31B7-45CE-B4B9-2DD45C2FF958}	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\PROVIDERS\TRUST\CLEANUP\{4ECC1CC8-31B7-45CE-B4B9-2DD45C2FF958}	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CRYPTSIPDLLPUTSIGNEDDATAMSG\{9FA65764-C36F-4319-9737-658A34585BB7}	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CRYPTSIPDLLREMOVESIGNEDDATAMSG\{9FA65764-C36F-4319-9737-658A34585BB7}	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\PROVIDERS\TRUST\SIGNATURE\{4ECC1CC8-31B7-45CE-B4B9-2DD45C2FF958}	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\PROVIDERS\TRUST\CERTCHECK\{4ECC1CC8-31B7-45CE-B4B9-2DD45C2FF958}	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\PROVIDERS\TRUST\DIAGNOSTICPOLICY\{4ECC1CC8-31B7-45CE-B4B9-2DD45C2FF958}	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OID\ENCODINGTYPE 0\CRYPTSIPDLLVERIFYINDIRECTDATA\{9FA65764-C36F-4319-9737-658A34585BB7}	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\PROVIDERS\TRUST\MESSAGE\{4ECC1CC8-31B7-45CE-B4B9-2DD45C2FF958}	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\PROVIDERS\TRUST\CERTIFICATE\{4ECC1CC8-31B7-45CE-B4B9-2DD45C2FF958}	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\PROVIDERS\TRUST\FINALPOLICY\{4ECC1CC8-31B7-45CE-B4B9-2DD45C2FF958}	integrator.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015
Executes dropped EXE 1 IoCs

Processes:

Un_A.exe

pid process

4680 Un_A.exe
Loads dropped DLL 4 IoCs

Processes:

Un_A.exeMsiExec.exeMsiExec.exe

pid process

4680 Un_A.exe
2308 MsiExec.exe
1036 MsiExec.exe
2308 MsiExec.exe

pid	process
4680	Un_A.exe

pid	process
4680	Un_A.exe
2308	MsiExec.exe
1036	MsiExec.exe
2308	MsiExec.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exe

description	ioc	process
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe

Installs/modifies Browser Helper Object 2 TTPs 1 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
stealer adware

Modify Registry
T1112

Browser Extensions
T1176

Processes:

integrator.exe

description ioc process

Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA} integrator.exe

description	ioc	process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}	integrator.exe

Drops file in System32 directory 3 IoCs

Processes:

integrator.exe

description	ioc	process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\OTele\integrator.exe.db-shm	integrator.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\OTele\integrator.exe.db	integrator.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\OTele\integrator.exe.db-wal	integrator.exe

Drops file in Program Files directory 54 IoCs

Processes:

Un_A.exemsiexec.exemaintenanceservice.exeintegrator.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe.moz-delete	Un_A.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice-install.log.moz-delete	Un_A.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\AppInfoDocument\Microsoft.VisualStudio.Tools.Office.AppInfoDocument\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\logs\	Un_A.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll	msiexec.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe	msiexec.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\1033\VSTOInstallerUI.dll	msiexec.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll	msiexec.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\adodb.dll	msiexec.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe	msiexec.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\AppInfoDocument\AddIns.store	msiexec.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\ActionsPane3.xsd	msiexec.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOLoader.dll	msiexec.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOMessageProvider.dll	msiexec.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.dll	msiexec.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe.moz-delete	Un_A.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\	Un_A.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\Microsoft.stdformat.dll	msiexec.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll	msiexec.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\VSTO\vstoee.dll	msiexec.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.dll	msiexec.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\updater.ini.moz-delete	Un_A.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	msiexec.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOLoader.dll	msiexec.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll	msiexec.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\Microsoft.Office.Tools.v9.0.dll	msiexec.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\Microsoft.mshtml.dll	msiexec.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.dll	msiexec.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\VSTOFiles.cat	msiexec.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.dll	msiexec.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll	msiexec.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll	msiexec.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice-uninstall.log	maintenanceservice.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\vstoee90.tlb	msiexec.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOMessageProvider.dll	msiexec.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.dll	msiexec.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\Microsoft Shared\MSEnv\PublicAssemblies\extensibility.dll	msiexec.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\vstoee100.tlb	msiexec.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.dll	msiexec.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\VSTO\vstoee100.tlb	msiexec.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\1033\VSTOLoaderUI.dll	msiexec.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\VSTOLoaderUI.dll	msiexec.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\VSTOInstallerUI.dll	msiexec.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll	msiexec.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\msdatasrc.dll	msiexec.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\vstoee.dll	msiexec.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\VSTO\vstoee90.tlb	msiexec.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\stdole.dll	msiexec.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice-uninstall.log.moz-delete	Un_A.exe
File opened for modification	C:\Program Files\Microsoft Office\root\VFS\Common AppData\Microsoft Help\nslist.hxl	integrator.exe
File opened for modification	\??\c:\Program Files\Common Files\DESIGNER\MSADDNDR.OLB	msiexec.exe

Drops file in Windows directory 7 IoCs

Processes:

msiexec.exe

description	ioc	process
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI39DE.tmp	msiexec.exe
File opened for modification	\??\c:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3C02.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3D89.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI768C.tmp	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

OfficeClickToRun.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	OfficeClickToRun.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	OfficeClickToRun.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	OfficeClickToRun.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

OfficeClickToRun.exechrome.exechrome.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	OfficeClickToRun.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	OfficeClickToRun.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	OfficeClickToRun.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies Internet Explorer settings 1 TTPs 15 IoCs

adware spyware

Modify Registry

T1112

Processes:

integrator.exeexplorer.exe

description	ioc	process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{789FE86F-6FC4-46A1-9849-EDE0DB0C95CA}	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5FBAF6E6-C64B-49DB-AB1B-F93C607EBC71}	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8D13E03F-8289-4c15-A84F-7A8F655C830A}	integrator.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8D13E03F-8289-4c15-A84F-7A8F655C830A}	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{2670000A-7350-4f3c-8081-5663EE0C6C49}	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5FBAF6E6-C64B-49DB-AB1B-F93C607EBC71}	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{789FE86F-6FC4-46A1-9849-EDE0DB0C95CA}	integrator.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{DD993BDC-06E0-4131-B889-DD3B9AEBE253}	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{2670000A-7350-4f3c-8081-5663EE0C6C49}	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{DD993BDC-06E0-4131-B889-DD3B9AEBE253}	integrator.exe

Modifies data under HKEY_USERS 27 IoCs

Processes:

integrator.exechrome.exechrome.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentEcs\all\Overrides	integrator.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\ExternalFeatureOverrides\officeclicktorun	integrator.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	integrator.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\integrator.exe	integrator.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\TrustCenter\Experimentation	integrator.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData	integrator.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	integrator.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\integrator.exe\ULSMonitor	integrator.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata	integrator.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentEcs\Overrides	integrator.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common	integrator.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry	integrator.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentEcs\officeclicktorun\Overrides	integrator.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\FirstSession\officeclicktorun	integrator.exe
Key created	\REGISTRY\USER\.DEFAULT\Printers\DevModes2	integrator.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun	integrator.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	integrator.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\integrator.exe\ULSMonitor	integrator.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133642735571985470"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs	integrator.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	integrator.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\integrator.exe	integrator.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0	integrator.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\integrator.exe\ULSMonitor\ULSTagIds0 = "18679566,5804129,7202269,23978014,39965824,7692557,5850525,34198423,41484365,17962391,17962392"	integrator.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	integrator.exe

Modifies registry class 64 IoCs

Processes:

integrator.exemsiexec.exeexplorer.exe

description	ioc	process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.xlt\ShellEx\{8895b1c6-b41f-4c1c-a562-0d564250836f}	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3FD37ABB-F90A-4DE5-AA38-179629E64C2F}	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9ED13477-E909-45BC-BADC-2106D04D6BD7}\Version	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.pps\ShellEx\{8895b1c6-b41f-4c1c-a562-0d564250836f}	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3120BA9F-4FC8-4A4F-AE1E-02114F421D0A}\1.0	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Components\175C21850F357644EBAFA0F4749A34C7	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3050F275-98B5-11CF-BB82-00AA00BDCE0B}\InprocServer32	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{68CED213-317D-3F27-9036-A33240DA522E}	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D66DC78C-4F61-447F-942B-3FB6980118CF}	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\SharePoint.DragDownloadCtl.1\CLSID	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.vstx\ShellEx\PropertyHandler	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}\InprocServer32	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\c:\|Program Files (x86)\|Common Files\|Microsoft Shared\|VSTA\|Pipeline.v10.0\|AddInViews\|Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.dll	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3050F3D0-98B5-11CF-BB82-00AA00BDCE0B}\InprocServer32	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\WINWORD.EXE\shell	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.dotm	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3050F4CC-98B5-11CF-BB82-00AA00BDCE0B}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\SharePoint.StssyncHandler.2	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\VisioViewerDWGDisplayCreator.VisioViewerDWGDisplayCreator.1\CLSID	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{83C25742-A9F7-49FB-9138-434302C88D07}\TypeLib	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5C615ED6-4F9F-48BE-8D84-17409196DE36}\InProcServer32	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.vstx\ShellEx	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{02BCC737-B171-4746-94C9-0D8A0B2C0089}\ProgID	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3050F25D-98B5-11CF-BB82-00AA00BDCE0B}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3050F317-98B5-11CF-BB82-00AA00BDCE0B}\InprocServer32	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9203C2CB-1DC1-482D-967E-597AFF270F0D}\TypeLib	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\SharePoint.SpreadsheetLauncher\CLSID	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0002E169-0000-0000-C000-000000000046}\InprocServer32\15.0.0.0	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0002E178-0000-0000-C000-000000000046}\InprocServer32\15.0.0.0	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\Shell\{D674391B-52D9-4E07-834E-67C98610F39D}\Vid = "{137E7700-3573-11CF-AE69-08002B2E1262}"	explorer.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\SharePoint.OpenDocuments.3\CLSID	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Excel.SheetBinaryMacroEnabled.12\XML Handler	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3050F278-98B5-11CF-BB82-00AA00BDCE0B}\InprocServer32	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3050F26E-98B5-11CF-BB82-00AA00BDCE0B}\InprocServer32	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.odp\PersistentHandler	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F8CF7A98-2C45-4c8d-9151-2D716989DDAB}\EnableFullPage\.vsd	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3BE786A0-0366-4F5C-9434-25CF162E475F}	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3050F38F-98B5-11CF-BB82-00AA00BDCE0B}\InprocServer32	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3050F27D-98B5-11CF-BB82-00AA00BDCE0B}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3050F38D-98B5-11CF-BB82-00AA00BDCE0B}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{68CED213-317D-3F27-9036-A33240DA522E}\ProgId	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3050F4B8-98B5-11CF-BB82-00AA00BDCE0B}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3050F317-98B5-11CF-BB82-00AA00BDCE0B}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3050F283-98B5-11CF-BB82-00AA00BDCE0B}\InprocServer32	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BDEADEF4-C265-11D0-BCED-00A0C90AB50F}\TreatAs	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FFFDC614-B694-4AE6-AB38-5D6374584B52}\InprocServer32	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{550D0110-8DCD-11D1-8524-00A02495E426}	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\VisShe.CInfoTipShellExt	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{34CEAC8D-CBC0-4f77-B7B1-8A60CB6DA0F7}\PersistentAddinsRegistered\{89BCB740-6119-101A-BCB7-00DD010655AF}	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\VisioViewer.Viewer\CLSID	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3050F27B-98B5-11CF-BB82-00AA00BDCE0B}\InprocServer32	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3050F269-98B5-11CF-BB82-00AA00BDCE0B}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Name.NameCtrl.1	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.xlsb\ShellEx\{BB2E617C-0920-11d1-9A0B-00C04FC2D6C1}	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B32C099E-C5D8-4E7C-9563-3D574C42C2FE}	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\VisShe.CVisioFileFilter.1	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{48E73304-E1D6-4330-914C-F5F514E3486C}\ProgID	integrator.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\Shell\{D674391B-52D9-4E07-834E-67C98610F39D}\LogicalViewMode = "1"	explorer.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F8CF7A98-2C45-4c8d-9151-2D716989DDAB}\EnableFullPage\.vdw	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}\Implemented Categories	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3050F277-98B5-11CF-BB82-00AA00BDCE0B}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3050F32B-98B5-11CF-BB82-00AA00BDCE0B}\InprocServer32	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FFFDC614-B694-4AE6-AB38-5D6374584B52}\InprocServer32	integrator.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3B0BD075-929C-4E52-AAD1-458C81A10B24}\ProgID	integrator.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

explorer.exe

pid process

3232 explorer.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

chrome.exechrome.exe

pid process

1076 chrome.exe
1076 chrome.exe
1724 chrome.exe
1724 chrome.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

explorer.exe

pid process

3232 explorer.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

Processes:

chrome.exechrome.exe

pid process

1076 chrome.exe
1076 chrome.exe
1076 chrome.exe
1724 chrome.exe
1724 chrome.exe
1724 chrome.exe
1724 chrome.exe
1724 chrome.exe
1724 chrome.exe
1724 chrome.exe
1724 chrome.exe

pid	process
3232	explorer.exe

pid	process
3232	explorer.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

chrome.exesvchost.exechrome.exeintegrator.exemsiexec.exe

description	pid	process
Token: SeShutdownPrivilege	1076	chrome.exe
Token: SeCreatePagefilePrivilege	1076	chrome.exe
Token: SeShutdownPrivilege	1076	chrome.exe
Token: SeCreatePagefilePrivilege	1076	chrome.exe
Token: SeShutdownPrivilege	1076	chrome.exe
Token: SeCreatePagefilePrivilege	1076	chrome.exe
Token: SeShutdownPrivilege	1076	chrome.exe
Token: SeCreatePagefilePrivilege	1076	chrome.exe
Token: SeShutdownPrivilege	1076	chrome.exe
Token: SeCreatePagefilePrivilege	1076	chrome.exe
Token: SeShutdownPrivilege	1076	chrome.exe
Token: SeCreatePagefilePrivilege	1076	chrome.exe
Token: SeShutdownPrivilege	1076	chrome.exe
Token: SeCreatePagefilePrivilege	1076	chrome.exe
Token: SeShutdownPrivilege	1076	chrome.exe
Token: SeCreatePagefilePrivilege	1076	chrome.exe
Token: SeShutdownPrivilege	1076	chrome.exe
Token: SeCreatePagefilePrivilege	1076	chrome.exe
Token: SeShutdownPrivilege	1076	chrome.exe
Token: SeCreatePagefilePrivilege	1076	chrome.exe
Token: SeTcbPrivilege	2836	svchost.exe
Token: SeRestorePrivilege	2836	svchost.exe
Token: SeShutdownPrivilege	1724	chrome.exe
Token: SeCreatePagefilePrivilege	1724	chrome.exe
Token: SeShutdownPrivilege	4436	integrator.exe
Token: SeIncreaseQuotaPrivilege	4436	integrator.exe
Token: SeSecurityPrivilege	2152	msiexec.exe
Token: SeCreateTokenPrivilege	4436	integrator.exe
Token: SeAssignPrimaryTokenPrivilege	4436	integrator.exe
Token: SeLockMemoryPrivilege	4436	integrator.exe
Token: SeIncreaseQuotaPrivilege	4436	integrator.exe
Token: SeMachineAccountPrivilege	4436	integrator.exe
Token: SeTcbPrivilege	4436	integrator.exe
Token: SeSecurityPrivilege	4436	integrator.exe
Token: SeTakeOwnershipPrivilege	4436	integrator.exe
Token: SeLoadDriverPrivilege	4436	integrator.exe
Token: SeSystemProfilePrivilege	4436	integrator.exe
Token: SeSystemtimePrivilege	4436	integrator.exe
Token: SeProfSingleProcessPrivilege	4436	integrator.exe
Token: SeIncBasePriorityPrivilege	4436	integrator.exe
Token: SeCreatePagefilePrivilege	4436	integrator.exe
Token: SeCreatePermanentPrivilege	4436	integrator.exe
Token: SeBackupPrivilege	4436	integrator.exe
Token: SeRestorePrivilege	4436	integrator.exe
Token: SeShutdownPrivilege	4436	integrator.exe
Token: SeDebugPrivilege	4436	integrator.exe
Token: SeAuditPrivilege	4436	integrator.exe
Token: SeSystemEnvironmentPrivilege	4436	integrator.exe
Token: SeChangeNotifyPrivilege	4436	integrator.exe
Token: SeRemoteShutdownPrivilege	4436	integrator.exe
Token: SeUndockPrivilege	4436	integrator.exe
Token: SeSyncAgentPrivilege	4436	integrator.exe
Token: SeEnableDelegationPrivilege	4436	integrator.exe
Token: SeManageVolumePrivilege	4436	integrator.exe
Token: SeImpersonatePrivilege	4436	integrator.exe
Token: SeCreateGlobalPrivilege	4436	integrator.exe
Token: SeRestorePrivilege	2152	msiexec.exe
Token: SeTakeOwnershipPrivilege	2152	msiexec.exe
Token: SeRestorePrivilege	2152	msiexec.exe
Token: SeTakeOwnershipPrivilege	2152	msiexec.exe
Token: SeShutdownPrivilege	1724	chrome.exe
Token: SeCreatePagefilePrivilege	1724	chrome.exe
Token: SeRestorePrivilege	2152	msiexec.exe
Token: SeTakeOwnershipPrivilege	2152	msiexec.exe

Suspicious use of FindShellTrayWindow 63 IoCs

Processes:

chrome.exeexplorer.exechrome.exe

pid	process
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
3232	explorer.exe
1724	chrome.exe
1724	chrome.exe
1724	chrome.exe
1724	chrome.exe
1724	chrome.exe
1724	chrome.exe
1724	chrome.exe
1724	chrome.exe
1724	chrome.exe
1724	chrome.exe
1724	chrome.exe
1724	chrome.exe
1724	chrome.exe
1724	chrome.exe
1724	chrome.exe
1724	chrome.exe
1724	chrome.exe
1724	chrome.exe
1724	chrome.exe
1724	chrome.exe
1724	chrome.exe
1724	chrome.exe
1724	chrome.exe
1724	chrome.exe
1724	chrome.exe
1724	chrome.exe
1724	chrome.exe
1724	chrome.exe
1724	chrome.exe
1724	chrome.exe
1724	chrome.exe
1724	chrome.exe
1724	chrome.exe
1724	chrome.exe
1724	chrome.exe

Suspicious use of SendNotifyMessage 56 IoCs

Processes:

chrome.exechrome.exe

pid	process
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1076	chrome.exe
1724	chrome.exe
1724	chrome.exe
1724	chrome.exe
1724	chrome.exe
1724	chrome.exe
1724	chrome.exe
1724	chrome.exe
1724	chrome.exe
1724	chrome.exe
1724	chrome.exe
1724	chrome.exe
1724	chrome.exe
1724	chrome.exe
1724	chrome.exe
1724	chrome.exe
1724	chrome.exe
1724	chrome.exe
1724	chrome.exe
1724	chrome.exe
1724	chrome.exe
1724	chrome.exe
1724	chrome.exe
1724	chrome.exe
1724	chrome.exe
1724	chrome.exe
1724	chrome.exe
1724	chrome.exe
1724	chrome.exe
1724	chrome.exe
1724	chrome.exe
1724	chrome.exe
1724	chrome.exe

Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

uninstall.exeUn_A.exemaintenanceservice.exeOfficeClickToRun.exeintegrator.exe

pid process

4704 uninstall.exe
4680 Un_A.exe
3852 maintenanceservice.exe
2184 OfficeClickToRun.exe
2184 OfficeClickToRun.exe
4436 integrator.exe

pid	process
4704	uninstall.exe
4680	Un_A.exe
3852	maintenanceservice.exe
2184	OfficeClickToRun.exe
2184	OfficeClickToRun.exe
4436	integrator.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	process	target process
PID 1076 wrote to memory of 2360	1076	chrome.exe	chrome.exe
PID 1076 wrote to memory of 2360	1076	chrome.exe	chrome.exe
PID 1076 wrote to memory of 3452	1076	chrome.exe	chrome.exe
PID 1076 wrote to memory of 3452	1076	chrome.exe	chrome.exe
PID 1076 wrote to memory of 3452	1076	chrome.exe	chrome.exe
PID 1076 wrote to memory of 3452	1076	chrome.exe	chrome.exe
PID 1076 wrote to memory of 3452	1076	chrome.exe	chrome.exe
PID 1076 wrote to memory of 3452	1076	chrome.exe	chrome.exe
PID 1076 wrote to memory of 3452	1076	chrome.exe	chrome.exe
PID 1076 wrote to memory of 3452	1076	chrome.exe	chrome.exe
PID 1076 wrote to memory of 3452	1076	chrome.exe	chrome.exe
PID 1076 wrote to memory of 3452	1076	chrome.exe	chrome.exe
PID 1076 wrote to memory of 3452	1076	chrome.exe	chrome.exe
PID 1076 wrote to memory of 3452	1076	chrome.exe	chrome.exe
PID 1076 wrote to memory of 3452	1076	chrome.exe	chrome.exe
PID 1076 wrote to memory of 3452	1076	chrome.exe	chrome.exe
PID 1076 wrote to memory of 3452	1076	chrome.exe	chrome.exe
PID 1076 wrote to memory of 3452	1076	chrome.exe	chrome.exe
PID 1076 wrote to memory of 3452	1076	chrome.exe	chrome.exe
PID 1076 wrote to memory of 3452	1076	chrome.exe	chrome.exe
PID 1076 wrote to memory of 3452	1076	chrome.exe	chrome.exe
PID 1076 wrote to memory of 3452	1076	chrome.exe	chrome.exe
PID 1076 wrote to memory of 3452	1076	chrome.exe	chrome.exe
PID 1076 wrote to memory of 3452	1076	chrome.exe	chrome.exe
PID 1076 wrote to memory of 3452	1076	chrome.exe	chrome.exe
PID 1076 wrote to memory of 3452	1076	chrome.exe	chrome.exe
PID 1076 wrote to memory of 3452	1076	chrome.exe	chrome.exe
PID 1076 wrote to memory of 3452	1076	chrome.exe	chrome.exe
PID 1076 wrote to memory of 3452	1076	chrome.exe	chrome.exe
PID 1076 wrote to memory of 3452	1076	chrome.exe	chrome.exe
PID 1076 wrote to memory of 3452	1076	chrome.exe	chrome.exe
PID 1076 wrote to memory of 3452	1076	chrome.exe	chrome.exe
PID 1076 wrote to memory of 3452	1076	chrome.exe	chrome.exe
PID 1076 wrote to memory of 3240	1076	chrome.exe	chrome.exe
PID 1076 wrote to memory of 3240	1076	chrome.exe	chrome.exe
PID 1076 wrote to memory of 4508	1076	chrome.exe	chrome.exe
PID 1076 wrote to memory of 4508	1076	chrome.exe	chrome.exe
PID 1076 wrote to memory of 4508	1076	chrome.exe	chrome.exe
PID 1076 wrote to memory of 4508	1076	chrome.exe	chrome.exe
PID 1076 wrote to memory of 4508	1076	chrome.exe	chrome.exe
PID 1076 wrote to memory of 4508	1076	chrome.exe	chrome.exe
PID 1076 wrote to memory of 4508	1076	chrome.exe	chrome.exe
PID 1076 wrote to memory of 4508	1076	chrome.exe	chrome.exe
PID 1076 wrote to memory of 4508	1076	chrome.exe	chrome.exe
PID 1076 wrote to memory of 4508	1076	chrome.exe	chrome.exe
PID 1076 wrote to memory of 4508	1076	chrome.exe	chrome.exe
PID 1076 wrote to memory of 4508	1076	chrome.exe	chrome.exe
PID 1076 wrote to memory of 4508	1076	chrome.exe	chrome.exe
PID 1076 wrote to memory of 4508	1076	chrome.exe	chrome.exe
PID 1076 wrote to memory of 4508	1076	chrome.exe	chrome.exe
PID 1076 wrote to memory of 4508	1076	chrome.exe	chrome.exe
PID 1076 wrote to memory of 4508	1076	chrome.exe	chrome.exe
PID 1076 wrote to memory of 4508	1076	chrome.exe	chrome.exe
PID 1076 wrote to memory of 4508	1076	chrome.exe	chrome.exe
PID 1076 wrote to memory of 4508	1076	chrome.exe	chrome.exe
PID 1076 wrote to memory of 4508	1076	chrome.exe	chrome.exe
PID 1076 wrote to memory of 4508	1076	chrome.exe	chrome.exe
PID 1076 wrote to memory of 4508	1076	chrome.exe	chrome.exe
PID 1076 wrote to memory of 4508	1076	chrome.exe	chrome.exe
PID 1076 wrote to memory of 4508	1076	chrome.exe	chrome.exe
PID 1076 wrote to memory of 4508	1076	chrome.exe	chrome.exe
PID 1076 wrote to memory of 4508	1076	chrome.exe	chrome.exe
PID 1076 wrote to memory of 4508	1076	chrome.exe	chrome.exe
PID 1076 wrote to memory of 4508	1076	chrome.exe	chrome.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\NOTEPAD.EXE
C:\Windows\system32\NOTEPAD.EXE C:\Users\Admin\AppData\Local\Temp\Roblox-Song-Sheet-text.txt
1⤵
PID:3408

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1076

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff89df8ab58,0x7ff89df8ab68,0x7ff89df8ab78
2⤵
PID:2360

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1712 --field-trial-handle=1960,i,5489639736400015865,16277784548844489348,131072 /prefetch:2
2⤵
PID:3452

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1532 --field-trial-handle=1960,i,5489639736400015865,16277784548844489348,131072 /prefetch:8
2⤵
PID:3240

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2216 --field-trial-handle=1960,i,5489639736400015865,16277784548844489348,131072 /prefetch:8
2⤵
PID:4508

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3080 --field-trial-handle=1960,i,5489639736400015865,16277784548844489348,131072 /prefetch:1
2⤵
PID:1776

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3088 --field-trial-handle=1960,i,5489639736400015865,16277784548844489348,131072 /prefetch:1
2⤵
PID:3488

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4280 --field-trial-handle=1960,i,5489639736400015865,16277784548844489348,131072 /prefetch:1
2⤵
PID:828

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4644 --field-trial-handle=1960,i,5489639736400015865,16277784548844489348,131072 /prefetch:8
2⤵
PID:772

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4820 --field-trial-handle=1960,i,5489639736400015865,16277784548844489348,131072 /prefetch:8
2⤵
PID:3784

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:3660

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2580

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2836

C:\Windows\system32\dashost.exe
dashost.exe {27b56189-0955-4e15-9f484588cecb6b38}
2⤵
PID:3956

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
PID:1756

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{5BD95610-9434-43C2-886C-57852CC8A120} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
PID:3232

C:\Program Files (x86)\Mozilla Maintenance Service\uninstall.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\uninstall.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:4704

C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe
"C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe" _?=C:\Program Files (x86)\Mozilla Maintenance Service\
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:4680

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe" uninstall
3⤵
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:3852

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" scenario=install scenariosubtype=ARP sourcetype=None productstoremove=ProPlusRetail.16_en-us_x-none culture=en-us version.16=16.0
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
PID:2184

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVShNotify.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppVShNotify.exe"
1⤵
PID:1676

C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe
integrator.exe /U /Extension /Msi /License PRIDName=ProPlusRetail.16 PackageGUID="9AC08E99-230B-47e8-9721-4577B7F124EA" PackageRoot="C:\Program Files\Microsoft Office\root"
1⤵
- Event Triggered Execution: Image File Execution Options Injection
- Manipulates Digital Signatures
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4436

C:\Windows\system32\schtasks.exe
schtasks.exe /Delete /F /tn "Microsoft\Office\Office Feature Updates"
2⤵
PID:2452

C:\Windows\system32\schtasks.exe
schtasks.exe /Delete /F /tn "Microsoft\Office\Office Feature Updates Logon"
2⤵
PID:1928

C:\Windows\system32\schtasks.exe
schtasks.exe /Delete /F /tn "Microsoft\Office\OfficeTelemetryAgentLogOn2016"
2⤵
PID:2504

C:\Windows\system32\schtasks.exe
schtasks.exe /Delete /F /tn "Microsoft\Office\OfficeTelemetryAgentFallBack2016"
2⤵
PID:2564

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1724

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xdc,0x108,0x7ff89df8ab58,0x7ff89df8ab68,0x7ff89df8ab78
2⤵
PID:4164

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1656 --field-trial-handle=1896,i,862861194868528770,159090331781684274,131072 /prefetch:2
2⤵
PID:4424

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 --field-trial-handle=1896,i,862861194868528770,159090331781684274,131072 /prefetch:8
2⤵
PID:1708

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2252 --field-trial-handle=1896,i,862861194868528770,159090331781684274,131072 /prefetch:8
2⤵
PID:5028

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2956 --field-trial-handle=1896,i,862861194868528770,159090331781684274,131072 /prefetch:1
2⤵
PID:4792

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2976 --field-trial-handle=1896,i,862861194868528770,159090331781684274,131072 /prefetch:1
2⤵
PID:3948

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3652 --field-trial-handle=1896,i,862861194868528770,159090331781684274,131072 /prefetch:1
2⤵
PID:3584

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4896 --field-trial-handle=1896,i,862861194868528770,159090331781684274,131072 /prefetch:1
2⤵
PID:4296

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=5048 --field-trial-handle=1896,i,862861194868528770,159090331781684274,131072 /prefetch:1
2⤵
PID:3956

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=4400 --field-trial-handle=1896,i,862861194868528770,159090331781684274,131072 /prefetch:1
2⤵
PID:2348

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=5380 --field-trial-handle=1896,i,862861194868528770,159090331781684274,131072 /prefetch:1
2⤵
PID:2836

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4960 --field-trial-handle=1896,i,862861194868528770,159090331781684274,131072 /prefetch:8
2⤵
PID:5252

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4928 --field-trial-handle=1896,i,862861194868528770,159090331781684274,131072 /prefetch:8
2⤵
PID:5392

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=4796 --field-trial-handle=1896,i,862861194868528770,159090331781684274,131072 /prefetch:1
2⤵
PID:5464

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:4556

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:2152

\??\c:\Windows\syswow64\MsiExec.exe
c:\Windows\syswow64\MsiExec.exe -Embedding 247D9C4D71E55D13001DAA23E2501EDF E Global\MSI0000
2⤵
- Loads dropped DLL
PID:2308

\??\c:\Windows\System32\MsiExec.exe
c:\Windows\System32\MsiExec.exe -Embedding C9D62BB9AF69EA4CC63C4E9ADBC6AA60 E Global\MSI0000
2⤵
- Loads dropped DLL
PID:1036

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft Help\nslist.hxl
Filesize
816B

MD5
05ea4d7d3fcfc5ed4b76b0c3e1c7cda0

SHA1
bb2dafd5cf78979a83e31cfe85055104dff5e01a

SHA256
2a2c3bfac69ed00267b3bf1f78752b0207a11fb721634ef209b387dc01495cbc

SHA512
a5c159ff09f5f2f426eff2981802ad860c918cae21630f9b946391e5baf9e8ec8c806e5dca85f41ebf7d8a36cb405803903f8222f88893d5f2556dfaf37f72c5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Filesize
40B

MD5
757f9692a70d6d6f226ba652bbcffe53

SHA1
771e76fc92d2bf676b3c8e3459ab1a2a1257ff5b

SHA256
d0c09cff1833071e93cda9a4b8141a154dba5964db2c6d773ea98625860d13ad

SHA512
79580dd7eb264967e0f97d0676ba2fcf0c99943681cad40e657e8e246df1b956f6daeb4585c5913ca3a93fdfd768933730a9a97a9018efa33c829ab1dea7a150

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
811B

MD5
ea49d5221956f7d3bef67a3df45abef1

SHA1
4eca5351534a1a7d26a35a8ba882565d0caa1cf6

SHA256
1a555ed538db0fa12253eb7b2e79f094692bc5e086dd9ce337c61c7a352bd6f3

SHA512
0f8240079f97f4d1797b530b56c0e0a70ef067fe4f37862c9586e57ecd0ddd9bf459b4fda000701b4d13cb3a6b2776524e833d432bdff27a0f8b90bb68f4ae42

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
7KB

MD5
8b90f3194eebbd59b7bd8242850d5067

SHA1
c95212a62cc8109148ae869a609cf6c0cbfe88d9

SHA256
55086d577d2d02471ad3efdded73e660f301236e449a2173eb884f298b347922

SHA512
76a0537c9c4b90bd7d18cd4a1fe0958d79d9ae29f312043013ee988a296631f7166d8ba76fde7afadee3192b71bc7bfa3eda123aea441c706661a4bc7c7100bb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
7KB

MD5
0aa97fdcec0778f9213a12a6ff382b63

SHA1
1ffa111c4c70ead415deaf64da19a5cd86a7b76e

SHA256
e89252a705c6527b064748c512dcc1890b48248f05e39ffafb4a3866c838f0fd

SHA512
de5776a8cb2a4588f906cc37662a0d56a21f6b9dc9637002fa8233475cc64c2e83a39d76139fabac3833b07c7798820d1b03e35019c0a9ce587de0830507c26e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
257KB

MD5
745fce66454e2ba8b42288a571c1d820

SHA1
4fd6724d6cae326715be6ff49b536cdc5d649086

SHA256
d49f9f58eee888d745955732774d053ce8a307aa7ae89e803b711c456ebc695c

SHA512
a9732af90974b237a135cf2457b34d7a7390198ad05f2d22f5ced29e1e365a4b229f74317c5d3fd2595f5723fd2fddb9b5d424991225fd5d7d2029eca0e7785c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
257KB

MD5
02760fadfeed5dcb9a9efbe6b64768ab

SHA1
b155fce676793b0b769cd5b107e45cbbeffd627d

SHA256
abd8f0e26a9a3201971334c122f88b11d1abb1ef6549d21b15722b1670f768ac

SHA512
21bab2de08e10531dacdf589a876b832d972651f8ec40dab63d392dc6b914524d8b3bf0c835e29399a2afe90a7275f4bec1f530988c3705058cb3b009ed4fb84

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
257KB

MD5
b3b47d824a23b6e8ce9457ee08a7d0a2

SHA1
e3109121d6825bef2ae01c82872ec78913ec9234

SHA256
84b8bd9a8a2a0c3bbf22fa39766a59aa919047520821f5c52331f613091d1cae

SHA512
b343168a7a292005371697f1ffc14d28243f07aefa2cb42eb7fb9c4d67fe727d52d10e9a0eed367e31aa4b4681b0e95eac40aac2ab322cd7c9e98f7a9da01030

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
257KB

MD5
b36312761591c6d50627161ae790845b

SHA1
e10e7663cc5c1b9119b21e394443bd1ca72ef439

SHA256
3626a0d8e09870338fdc35c7960601a7ac03db9730c28bee37ad8cb680fcc99d

SHA512
f81782711cb7d7436d0dbbe314777b4cb09abc97bedccea4c35702548a8fdfec98d1574bd5186c9c14dce2195a6cbec4e76c104dfaa453651b6d0ddd41cec37a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
257KB

MD5
a9daa3605cd05496cfdd813882e53f9c

SHA1
525be783b70e96572aa07020762d9b64c9198381

SHA256
3eead63b12544c6b110a2bb1e25a95832c0c826da7a39ee884dffe23b7e0a1d2

SHA512
b1a1344cbbde2f4fbfab83cf4a92823037d00047297324dbdc2dfa9375d4dfe4e22625f589a2a68d2b7ed0c8612f7cddf329dfd43cfe7959742fecf6538430b6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1
Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsxE084.tmp\System.dll
Filesize
22KB

MD5
b361682fa5e6a1906e754cfa08aa8d90

SHA1
c6701aee0c866565de1b7c1f81fd88da56b395d3

SHA256
b711c4f17690421c9dc8ddb9ed5a9ddc539b3a28f11e19c851e25dcfc7701c04

SHA512
2778f91c9bcf83277d26c71118a1ccb0fb3ce50e89729f14f4915bc65dd48503a77b1e5118ce774dea72f5ce3cc8681eb9ca3c55cf90e9f61a177101ba192ae9

Download Submit
C:\Users\Admin\Desktop\BlockDeny.ttc
Filesize
211KB

MD5
bd9d7a71ef6a66dbe8e1c41b855eda29

SHA1
aa048d03358f167e00af30bc4b2df3ba1f37ca4b

SHA256
5a8f2a47eac924cde4467ea71317a4e1e9ed07f193f9ccf573e5880ca300eeb8

SHA512
4d270bf82f453c78bc13e217fd1854803291c0ba76099ff568b9ae2b0f7709c920a4663d5d399f4a02c5f7f637fec30fd09aae3dd27b1c74b7eec9a7cb3cb0f9

Download Submit
C:\Users\Admin\Desktop\CloseAssert.vbs
Filesize
266KB

MD5
e0c3aa9a8653614407e85e6ad2af280f

SHA1
3729968c4fadaf44510b4a2989a5c646446c0fea

SHA256
a2508a0a36e29449a3ad22c4d75e9942cc0d08aa1b2b941a68272d62ea7ffa4a

SHA512
14f937141862fb1597c1ca0f08db7bf05315c748ab18209ea8f226256e1ce34ee26af6e226642bdc84d33f34eec7c58fecd4fbbf6bbb8e40c1a7f05539ed0f97

Download Submit
C:\Users\Admin\Desktop\DisableExpand.lnk
Filesize
172KB

MD5
7f88593dbaa465d17eb98c6370969566

SHA1
3ac3f92457a416ee5879df92fe001b0d6cf09aec

SHA256
536e621947b6002ccbb5f116f7e9394c04135c4a8e120905a464ff5dde3093d3

SHA512
2cb793b4440725edfa7770e203424a5d91c90b2b09a6e03ec21550cdd53792847c37e234f68599f6589e593b8318c3e54fcfffdf2a5231130c1a961f87737b20

Download Submit
C:\Users\Admin\Desktop\DisconnectResolve.mp3
Filesize
235KB

MD5
371b1766f3b36ee93f25bdc55a570c18

SHA1
f797a31afb61341db453a666eea4b1434c3c8e95

SHA256
f30c4b63ffec288b50ffa8b1f6d52cd617c549d3f9433c7340b6b79441400b4e

SHA512
02a2c23a50a45e5feaa85a7acbc63d58fbf222844dd7012030582caf90d8db258cdae2be0ad44729fbd0035053f199b22e5397bdac48b5e253ab50d84844581b

Download Submit
C:\Users\Admin\Desktop\DisconnectUninstall.shtml
Filesize
156KB

MD5
f51dc1f36aa64f18c0873cb748b033b8

SHA1
e31269448404c1e82c04361d576f993a37af7c5c

SHA256
191f8eb6d484b2be7e2b26ab3eacbb5e68770f805e02a6d7e1b2ef78eb78a6e5

SHA512
51bdd3bb1dd5ed2af601e9aa399e785833217d572fd9d814945139313471ac3853a7b7c21da75aff2286fe412d6c047069af72d87bd4732c1cd8d08c43b2dca8

Download Submit
C:\Users\Admin\Desktop\EditConfirm.vdx
Filesize
258KB

MD5
4ced8a45caaa2abcc5d943601d22843e

SHA1
8cc1b74978f48826155eb37b0817103b600fa6f9

SHA256
2d28f9849801de357821d91bf49a27311d153047fbb8820693d3a4135e1e7234

SHA512
49a19932e604e546cacf9bc06ad375092e4858b735a721bd2c8865077789fdbdf403511459a7201bd8c38693b2e76f02a1f0c6b6e7e9f298005aa2027074675d

Download Submit
C:\Users\Admin\Desktop\EditWrite.ico
Filesize
289KB

MD5
26453635719364263cbdcb8842c92ae1

SHA1
27e6c811b5e87abca101bd1442436c8e9c910bb5

SHA256
7f3e700e3eab385cae09bd65bad880879f5ff6279659ea8e2005e8b1fbf9e2cd

SHA512
8db4fc0891285f14142f3f186bcbfc717340886a9a1527ab5152f1073476a65423d0cb160f5bfe68cf07be63de48b9204807c94d9cbb4db7ea966fd1f6f4ee5c

Download Submit
C:\Users\Admin\Desktop\ExportInstall.7z
Filesize
125KB

MD5
0b88db3c224deef560853b4034ade61f

SHA1
8c86c9496d6d6e7f5c840b813e28a5232fb37cfe

SHA256
1c491f0778a40f3148ecf71b4609b579ad1a20e6072156495db478e5c333fc1b

SHA512
b984c70984a4de1fe0a6573fb918bf1a9c33baadebb14075de6069136d2ebfe65e7c18deafdb73ca471ba9375aba283653be4e92144467408535ea68ddba3379

Download Submit
C:\Users\Admin\Desktop\GetSplit.docx
Filesize
313KB

MD5
b6959e98df05e40eb24c732ffc519b13

SHA1
bd05385506ae5634e377627604fb624824ddcc3c

SHA256
c7974120ea9fe5b9769f9af5efd1752b9b18b4b20c4a30328bfff7366994e108

SHA512
85214d78a3e787999c6a4066ea82dc21d23c00dca049a853439eb87117a1b4ebded39ef41a498646af979179d43e00094af24b3809e435bac410441852117a38

Download Submit
C:\Users\Admin\Desktop\ImportRestore.aifc
Filesize
242KB

MD5
3e135a0ba20c1e0a77ca76ffadb9a7b8

SHA1
3c8607d66ea7d91d12e4f3c3bcf12247abb27c0a

SHA256
57d4893b72a4e35b7812d139d8923ce2ed67bf77d70c2d4478650ca3cd649595

SHA512
a03e6034b60964a0726d69164c37ac706454ebf422954e1effca9b5adfb7256de0b5d249139649d73c578844ece10c6452bfe4f4d470cfdf20edf976a1d339cb

Download Submit
C:\Users\Admin\Desktop\ImportSet.rtf
Filesize
219KB

MD5
dc5971f15b78c0aacdff8906046d9875

SHA1
7d07264462c0105cda6f001d4835943a3f45e325

SHA256
71820166b01cd7d37bb05844adccb3d02d9e5cb133412cdad625d789e60b344a

SHA512
0b4835bd9bd039e2ec102d312eb12e2f9e4cece44255d6057c9896e8e003f0195856c8b3e813ca61bcebe1869c02115de40880825e297ac9d1a8d261e7f5fb88

Download Submit
C:\Users\Admin\Desktop\ImportUnblock.au
Filesize
430KB

MD5
ba409654285b1b36af52810cf155713f

SHA1
53e53e61a9730cef847075a6495f49396d382b4d

SHA256
41c3e99922e902d3e7965269f18d0d1be5c32e943386f6018646ca8fe34462f5

SHA512
3d986e5f30bb762bdcb6da792830da1e74b24d4466ef11e3d71839f6dc05ef5b9eea0255165bb1b930ecdc0c55de6649e9aa3571eb9fb19067b3ff29fc6beae0

Download Submit
C:\Users\Admin\Desktop\OutProtect.pptm
Filesize
203KB

MD5
ac7f34926cbc47ce8b03021ea9d3f149

SHA1
a47cd0bc7ff6e832c8d0d41d844e837253d512bb

SHA256
fa66a9b77f3107dcecc7e1f015ccecdd931ebd3c6b33bc9ebdadf0be95706612

SHA512
bf10bedeefa033b587246b138bcf821f83b86f40f3765afd77a368672057db83826fe0552ba6465ecbd39b965d6acd02c1adee57bb5a553bdbaa032ee091dc0e

Download Submit
C:\Users\Admin\Desktop\OutUndo.vsdx
Filesize
250KB

MD5
71ca61c829c1fd6bb946d609a0bf42c9

SHA1
ad283d60df2504c480af28e981e40bd2bbbd1288

SHA256
ca4241b71ac2fb5d245a1c159aa6f85a8af73446dc1857bd1c4540594f9ea3e3

SHA512
43ce3b1e8d86b38ab0fec923472fae8f315c79eba2d859c243b848817f4e9ad8d48ff3359fbfa5b601281ab89e7523b00947b8f206b45d8065b5741cdddefc03

Download Submit
C:\Users\Admin\Desktop\ProtectSubmit.mpv2
Filesize
164KB

MD5
aec8caccdfa887f8fe3424f00145e846

SHA1
bdab178c2d968153fa059ce2c4b70e1081cdce3e

SHA256
1a99e69ee6784a763c1ef1e86dd594ff041135b0daef9dcfc8c5fda244f550df

SHA512
1e109575e9b423f7b1d625aeff9869a4d47e393426865c9c9e888f5d06a7e623040161ec223977f4a725b01465c749f25a40367b8d382b86e29ff2f8818fb21d

Download Submit
C:\Users\Admin\Desktop\PublishMerge.eps
Filesize
274KB

MD5
edf78b9989f9c20c7460472daadac97d

SHA1
17fd460dc61127d7352b8e2d452105bc2a339da8

SHA256
3247a315045c84f9a73fad5348f3fb80007ff312254cf943f93bbd6361d796bf

SHA512
9deb6eafcda90f85ddc6a729d1f487eeb3ad996630a5d0096582eaf072b282682a0eeb0adc5946f03751c96e19d32138936a2e4d32b1f265a5c773eca14c4e14

Download Submit
C:\Users\Admin\Desktop\PushEdit.tif
Filesize
282KB

MD5
773e97adbd429f15f178c96f81126c0e

SHA1
012326a81ddef521c2ac82eeb93171f22b8cca9b

SHA256
f6c1f690971251c9d191470678f88d283865705abc17323fb4bb2edc77c10a3a

SHA512
b71fd47ed24111ce58b8dc4287bcb3f5ea7779d443830aaf120003f907d375c21b89c29bdcc0924b8acef71925e426d3953a7d06886cb9a0bba932563b21fa72

Download Submit
C:\Users\Admin\Desktop\RenameCompress.html
Filesize
195KB

MD5
f6b91c6bec4b7f813db86a7834f4c780

SHA1
c468423c6d81fe3f25ab6d59de1550e81d62abec

SHA256
0cee435b5af94a38aa196bc329aa7b11d1b1b533b45416654aa7aac816eace4d

SHA512
9c57b4f810c78ecb9e85a11ac6f072b841c58a31c9dffe0d8085d076ea3a4155116b692a95c005e63ab7d3d6f65feadfc66472e8e9fee291f0a065ebfde946a8

Download Submit
C:\Users\Admin\Desktop\RenameGrant.xps
Filesize
180KB

MD5
447205478540fe56810f42892e40f425

SHA1
15b87ce854679d1ca92d13bf8c8c601909fbe8dc

SHA256
5ce2bf63b0b232c71bd2f3dd106e6ce444c5c7bb11583fe361bfb8b1a90b2cdf

SHA512
2c192084556935d77922d1ac3d711335df8d9e57b17646fc13aaf83d73f80278a75ae9a9e9257931c2ab246ef86eebce5706344f44db4efdcbba52f4741f0aab

Download Submit
C:\Users\Admin\Desktop\RevokeExit.dwfx
Filesize
297KB

MD5
c64232cf8388baf8643f302d150f0a9f

SHA1
3eadf99fca40e766a40c6acc0d20bab3a972c6f6

SHA256
dcc9af189dbdcbb9c46afd66711127744741bc3d8fff128d39665cf7f1f54a1e

SHA512
7e7077eb3f59a8c9fd6255021a71f5c76f76de6a973212b9f0600b3b257a0a0ee2aa19c5f340e5881c70af5116a916149ac25b31e7ddf35bc42d9f6f3ac83936

Download Submit
C:\Users\Admin\Desktop\SelectDeny.lock
Filesize
188KB

MD5
2d5921744c4421589e7c0d3b4d44015f

SHA1
ec10d5df360c569e5fba2ba9d86a7fa2a7ef2c50

SHA256
ef784abb629af0aeed364372357e09c411d78d38cf257da0187c198da8a255a7

SHA512
294bdc1dcfca294f538acd5ef9a9d45aa1db08297447f650c7479cc3b11640c615ef55462cad8405bd19392eefc7d3cb474e079626b5467965e4c039a6a1335d

Download Submit
C:\Users\Admin\Desktop\SetOpen.emz
Filesize
305KB

MD5
c7e87c733f77c3abb31df29f73612ad8

SHA1
1a24f8c9d5590cdd364ef5b7d34d1c9b91201678

SHA256
f815d5c055e62790842478f706a0b749a98a1e8eb4fba6b969db6c78852a95d3

SHA512
eabf5b1a21de12f8bc43a5a90f58e7f48e88b4499101a09690007a802e9907037aa090a359d5ca4bc9ec119ec01f49cfea2bfc681871a2c89598efe4f4241014

Download Submit
C:\Users\Admin\Desktop\SetRestore.xml
Filesize
227KB

MD5
e92444150cd3c69a290a6561afcf2c2e

SHA1
071d746523b120ad0d00d63ed4faf8b8aac77de9

SHA256
c4601bc6c2892c520bf6b4e001b4de6ce5eb9fadee5558490ac4d86c412d166e

SHA512
33ed28f15be265e890bfb77bfceeaea56ca12a8e8272e39e1388e3e1ea2b9173eb368250368606fbf9215f4c8ab9973deb08dd05b53885e46a9dc79f9bc84a1a

Download Submit
C:\Users\Admin\Desktop\SetResume.nfo
Filesize
141KB

MD5
f3dee49ee67ad02e10edf4ffc902b763

SHA1
df54464a18c3e82ba08a9e3f67668c918a0e542e

SHA256
6b9e37e415473ff8d5982f0e1ef458848655965af34891cd40a9fcbfffa0387e

SHA512
9ef54a4995e81641745dd9fb0705aa699caf219e0b5fff113c4c6a1a872621e468fe28e2e0778d09815eab2c26fc820b73e718a8efce362598d51062aebe1722

Download Submit
C:\Users\Admin\Desktop\SwitchStart.ods
Filesize
148KB

MD5
9e29892138645d129b4f73f04f0c8f81

SHA1
556723440cf717fe6838f91c0322085d62e80a86

SHA256
5157ddc8c8158c1a48265b54e58724399be4505364812cb7d3ef83742e4e2c03

SHA512
98b354acf9441cab46647f287e12898506be35ff5fcf9ec1df59c44e0488e4ed62c5b43720a9e9dd401c1ec95dedd11e3db4109854eb429baa9c24ff1a530d41

Download Submit
C:\Users\Admin\Desktop\TraceSync.jtx
Filesize
109KB

MD5
cce646a09b8a801270d79cada525242f

SHA1
e14ebdd59fabfed0c8f5dd207691544295ee0015

SHA256
7c727e185347838e97ba4f455d9a0b5b31a6db94de39227013e7773386d53966

SHA512
5797cb58d7541e55ff94dfd5201625489bfc70bb0bf6e17bc04eb185f588ad5e5f5b1cafca5419b3d9f4d3b95205bb6d9fd2817c0c03a644ca3b96fb3a0fee6f

Download Submit
C:\Users\Admin\Desktop\UndoResolve.vstm
Filesize
117KB

MD5
2af4998c6f7f350fef53a14920ab7271

SHA1
c78ac2ec2b3017f54aca51014491011546476303

SHA256
17cec7b35c9f1ad325d1760496174cfc69e37c4695712eac9510d75fd02bfe7f

SHA512
9990b00aedf401bf0e54d329e1c0905801db5813a91d7e37f6c58bd54dbac81ea437a4a68afeb518abc8404d202c76e74f80f11a9c2a5ef96e7ca70865afc324

Download Submit
C:\Users\Admin\Desktop\UnlockLock.exe
Filesize
133KB

MD5
28939c3f793cf6873e292aa3ea9f62a8

SHA1
868310c735df3e5aef011d8324cce3989f357777

SHA256
cc793e81fb9c707c6efaf9cc8e17af641609045dafb4867602bd166a5b37f414

SHA512
c586cff665b6076d657826a6f6739175536dac480242ad63b467f482514cd6c6687c2d5194483fea42a5210dab29d5a5aed5412bce76d56c8e7f76fff76e3554

Download Submit
C:\Users\Admin\Downloads\AddMeasure.nfo
Filesize
282KB

MD5
002c013f8cc636288133ac1808400348

SHA1
bb441869bb8c75e5929f8e49db102fa6526f7ab7

SHA256
abd5621565f7232362f32508fc78318dd6e8e19b1cc59edc3add84c79574f732

SHA512
7b514623ff9e6060f218b8df1872f7f8e6c645e70ec6422300930de13f0869c4b2756e5e191da2b4ae4fab9ed9a1759f58b34726e6e61b024580ae9a31b8abc6

Download Submit
C:\Users\Admin\Downloads\CompareOptimize.rm
Filesize
186KB

MD5
9ad7b94e37e5d2cd39ff17e999599b13

SHA1
28de02ba98860fee0f9b36f04d80ee78f1d3f3a9

SHA256
61d21ab8579c265895c9df5d1595525a165b69de211f7dfca242de8e9d5c9370

SHA512
43ab7224cfbac7fc7b5c002a18f4cf7e48b799c020be20c6fa09fe2431e8dab9995d627d8f40ae99f39caf142b4c0a8bc8047ad088838e0b9c1c91a2175011a2

Download Submit
C:\Users\Admin\Downloads\ComparePing.ogg
Filesize
442KB

MD5
7fc4467c187dfb70d74db11d0fde0b58

SHA1
83fdf4fe4388019fa8bee0fbfa9ca271b7d8cd40

SHA256
740d307046c3af5f8e45ecdda10460c4ff3bbf56f931cf93af5175b2b7ad06f5

SHA512
9fd576b28fcbbbe9faf0f8f1c51a3bc4037c25ea0bc0e954e3f82cf266e17d69d5230e6aa2420d253bda3d09c3cf4b473dda95d7d5f0a3da1760686385fe02d3

Download Submit
C:\Users\Admin\Downloads\CompareSplit.svg
Filesize
239KB

MD5
026ea82dc89d5dee736b7b89cdeb3f59

SHA1
c3c50d1dffb26eab366dd3e9db236a9d424773e0

SHA256
5f2a304c135545e182135acebc8c8f958ae7c338e4813431d5fe39141dcbb086

SHA512
3269e16ab81ddb05f8293ffdfc4c680ae3f679b81c8cb6c2ac152947332114159cce7caa07db5e53794cd6ed0b2162cf3aabb4dade70e873ec26641c130ce871

Download Submit
C:\Users\Admin\Downloads\DenyUnlock.cab
Filesize
261KB

MD5
30e1d805545c7216b76a4304ba58c02b

SHA1
21b72ca5088e3f639e7299f3b9e4d4dbdb960fab

SHA256
c2c77c3e0725b362a1a90f05a94f41bc5de614d33eebadad383a39b688e872db

SHA512
c1458e13bc7fdbf9aa69326295245cc6c22a5e6126641515dbc5a8567ffddd7da5f559dcda4453ca8857d665190dde202e00d3dc63ccda4369b23455208b3e19

Download Submit
C:\Users\Admin\Downloads\EnterImport.edrwx
Filesize
463KB

MD5
6316ff799e71e627a101bdc829ce3bba

SHA1
d6c0dfb0c5df68bf9c8fb5846c60705dd5734998

SHA256
2de298c031a4bc75d0735e29aa5b03cc2d49deb37e4d4b2ab3211d17d1a80eaf

SHA512
50c3bc7876f213443d86a27393408c1f2d2836b9775459f53d53c1d68230253aa565dad25df57061db855cd6bd79e04cc25ec2a5d8af62da0b9849290ad87878

Download Submit
C:\Users\Admin\Downloads\GrantSet.ram
Filesize
324KB

MD5
0956aa8d47e121d32bbb275a27cd6ddc

SHA1
a964a690fb90eb785014d33eb651ad1f60156759

SHA256
f1931194bdd23470c5e5830fa8df395c2a18cef54f4bcd34ba1560608f4e2dc8

SHA512
1555348a104c5926b23f00a3822ea9aaa16579c9a3012e5c2c683435c09f16518bea9afc9c37180cdc76cbae6cfcdf955d20fa57f6dc13f8b11ffa26ffd02d13

Download Submit
C:\Users\Admin\Downloads\ImportResolve.jtx
Filesize
207KB

MD5
a66e961ad16b9477dea92c99e9db858a

SHA1
8c3859ca2ade0c4964468b20588f08aa8a17597e

SHA256
15a2ba4e6430106638cab4745ece1ef4b71d08e65d46794012f9860a0ea5746d

SHA512
4da29172665a841171b2389b0ba8c085759c8fd438da7f37e76695dd8f1c3bdf3df02c1700c33738f18cc7470a3d87bd69610189d6ec9adb0f6e1983194ac738

Download Submit
C:\Users\Admin\Downloads\LimitMeasure.AAC
Filesize
314KB

MD5
28037df8df37f657fde41e93af65c132

SHA1
5a58c19d641b8896d15355b4bbb6127de3ddce5b

SHA256
6ce060807fde2d60f941c690991fc021bbc951395f9542062b56b411a60a69ed

SHA512
0a73e7de52a7a8e0f1ee527626ba296c3fe6791c109ad91d1ca208f0079d505b202e50f5aaa986a2e7b893f751d09382bddd985b23890839a6c0a07279c1d3c2

Download Submit
C:\Users\Admin\Downloads\LockUninstall.AAC
Filesize
303KB

MD5
9170e445fccd4c17a1a65a1d1ba81e79

SHA1
81c5204a00e1a7bc15d53e25d443ff15a062c5be

SHA256
acf0a3e590dddd9b9c697190d64219a92df332dd8a520e5d805ea29c9d84f146

SHA512
31acc83a27136bfa68bce3344f8fbda669471e7fcbfdfd30bb2dfbb9b73c27d14623080c5f4b9890277e16e8fc69fb15924c79b03a69a8a6872b86fd0f8b7f42

Download Submit
C:\Users\Admin\Downloads\MoveConnect.ps1xml
Filesize
250KB

MD5
83a661ae63f0409566f44c1f71a72a45

SHA1
d433a19b52b3cf3f838f3d223a6721dac3221783

SHA256
01a4c9eadc3c6264717d84deeb41b919380b0c4870a397f61d6b62458f822cf5

SHA512
349c8c120b8a6404264ff9c263cc58122186721ac360bb33862788644fb6741fa4bdf49014f9cfde27a1b9e0df39e932d1b5cb900a76fd319608a773e9ef3a97

Download Submit
C:\Users\Admin\Downloads\MoveDisconnect.pcx
Filesize
271KB

MD5
df04e5ad6c34d9ed162cbf73f9e5a0d2

SHA1
e6f50830e145e93d2d576cc8ec45d57bf5a40d87

SHA256
d112e6d3c774fc92bde7b23ae56d1070f295f317386df6c949b711f2d1ad00fb

SHA512
1b22cd4e431cf99585e421d955d539a904205d9d10981fe207d91855a4f77ac41aeefc4d703211845e430f3545313cb65c855b46cb2fb3b9ad6469ff2c55715d

Download Submit
C:\Users\Admin\Downloads\ReceiveRedo.fon
Filesize
356KB

MD5
aa8708c231c1cccaadc4c9840010c409

SHA1
3ed02db2dade12b0226e70f7d0c126e6a1080621

SHA256
c7178af31eadbd1207f809338df7a612b651a91b74b67456cf09e9c8a01af648

SHA512
39d1bbef48755f6f145b7952716ac165b7a4eb21e6702600af96656cca7699b84d3dd0d54937b9c2ccc18d9a91a9b2f0efb84cc5b059c4751892838aa1124c9e

Download Submit
C:\Users\Admin\Downloads\RegisterStart.ex_
Filesize
420KB

MD5
318b8da8744f22a6cbacb333628a46bd

SHA1
5880f76260155c69ccb9645f1b4e3baa42b93c0f

SHA256
b559c3794a3c16a93e83000beb90946b8d786ba976b587f38861c2c5bdb52473

SHA512
e97d75c21a4e4501f1bd9449b756c8a9e954f18c2ade5701ca1729475a98111b37283fbea88b7e79bd421ac0b907985dd5c1fda49527f051ce1247dcd7c9c050

Download Submit
C:\Users\Admin\Downloads\RepairPing.bmp
Filesize
293KB

MD5
69c9a589e50cb6cb0b4ef5e3b430efb4

SHA1
eff7f6bf3e45967e56adfde983528b7cc6b5c763

SHA256
87a8790b0f3f108d625841f4f46a792f42695e30aa8a46cc612e086dfd4337ac

SHA512
721e56b6713bc728269613626b21aa08dce5b93b635c1a32f23c4c248f93ffd6c77fa5b1794043b6156a9c4ed1fd6a4f25b2b41ee99414a4f2f3b54b20caadff

Download Submit
C:\Users\Admin\Downloads\ResizeMeasure.mhtml
Filesize
388KB

MD5
c01e03db3b1f236ebf7187b03e913430

SHA1
b1169673c2592f2c95539ea0f9bf9d0dedd4d05f

SHA256
5a8f2ca28ef6ead9844359cf422b392b008439eeecd6e8996c19c38060c2d4c4

SHA512
e7dea2ff7f004a614e051702509893fa545a48f596e397f88b5dbd3b63f49a44d9570d6ce2d1fccebfab35b65c48ab30dd62d9f4f5ba17a76124a66ef4d0389a

Download Submit
C:\Users\Admin\Downloads\RevokeShow.ADT
Filesize
452KB

MD5
fd54565e8ba74fafc4b3d0828b1f0752

SHA1
886051e0a02c125e97f8a1d03db918e43a6eb72c

SHA256
5dacc61e8912811e74f1f28c7544d9e7f03a4098acec93bbb85872c67ec5426e

SHA512
7c9491ce1d96c2aaf23faf2ab0e11446d0ab1b4e8e69585405161819ebec451829f618c6602de279edb69c1c0751c7f1a0d429e58ac1459ee4e425c49cb9c73d

Download Submit
C:\Users\Admin\Downloads\RevokeUnregister.xml
Filesize
335KB

MD5
9c8878df93f972002b2ae75c12320703

SHA1
d0e8054dce0335378672604dec62d716015239f7

SHA256
ff868baeac66643a319480363aeb40025607733c1eab332d65f4c95d760fe515

SHA512
de1a3bf6900b7d2fcce5fcebfd96024c388f01b2920eddc753d0624f1cd4ddd14c9bef918fd78acbb8bb3f948454a1f75386083b156ed3d9efd06d98cad3e1f6

Download Submit
C:\Users\Admin\Downloads\SearchEnable.pptm
Filesize
650KB

MD5
6db71c7ba57ecbfc9ab312c018fa88a7

SHA1
199ce295a2bd31e1e746965b9692e99e2ad36137

SHA256
171ac6ef15fdd128fdebf6c46497883b85aef5e709a6503eac24dc737d9db1f8

SHA512
d888fe0b4c027daa22e04f9bea249fe34e1c9e0d8647cd88f56924d89d16da70830f59736f0d7bbcebb869fa92e5d16dd028b81d7834796e4d222b0be4f874c5

Download Submit
C:\Users\Admin\Downloads\SelectDebug.txt
Filesize
218KB

MD5
94695e062cc6e7e739e99bc031222ba0

SHA1
7adca67a35310cae04a07b0409281ed33dddc688

SHA256
47ecf5ef6889623c90a9b1bea15e6723a2eb996229649ec24423ac18d78b2d0d

SHA512
713842c7a7d5a8dd6743b2cd8dbfe1c92101608b406571f8ca61adbf080dcc889b1301d4c834aee208438f0c2790b31bcc1d0afa88e366b71139edd2dd4dc0f2

Download Submit
C:\Users\Admin\Downloads\SetResume.bin
Filesize
431KB

MD5
b55f24f1a320b269651201db0095b82d

SHA1
17fdbff165388eff97697480331b9c2eead80b3c

SHA256
6220cd8b0d9d7b2c591518bfe0d12858052b915127c6ffe9c56df623a14e7b9e

SHA512
25abece8ffec1c43d03445e95dea85dc2b5ceed5a9218d1d1d96dbb3325a550791605b3c21df8eab7d275b0c5f1b0557f09cc6eacf65689c30847a6f1f211446

Download Submit
C:\Users\Admin\Downloads\StartResolve.svg
Filesize
410KB

MD5
2be7bee640e05084b716ff2ddf1be4ac

SHA1
491ba5cfea95f82491946005d7294f49d8dc154f

SHA256
fe6f4e9c3849e7fae1b6e6a0bf98a882e43789d74916b340885c7aa696cd6361

SHA512
49bd8f39cd6b15c38fa5f3be0561a322877811b55fb794a73c3fe686b4298d2bfbc179fd39d4bd17f31f900efa1387a138f7d651983304e0b5e2d2a05b55cff3

Download Submit
C:\Users\Admin\Downloads\UnblockConvertTo.htm
Filesize
175KB

MD5
683c284731ec2fd22f12810ad8cee40b

SHA1
46c5eae7646c817b8035d0704611692428a084c8

SHA256
877700dcd6e9f3d36ea551c826942ad25b32129323a2f80ff0042253967e4e39

SHA512
e89f6c240abc9711551914bce4aadfc49a037010e995389f92d99d3a5f171da4bde3b9e4ae4eadc7eb85faaec0623c09b25b87413f2086dcfc15e1fafc4ffc8b

Download Submit
C:\Users\Admin\Downloads\UninstallFind.3gpp
Filesize
165KB

MD5
d7318aa854570626a83223bcea4972cf

SHA1
0e3003044bad3012de31b440e60aeb700aa32387

SHA256
d69bd3ca06e9f442795563c0b9c4f241f51f7ecb4d0a5079301e6aceb59f15a6

SHA512
014c0f9f1cb61fadb9b1a76cb97ea5d258dd9e56363f5d731320f30bffa5974877b6d3a45b44fc27d4b669ee23fa32716fbd0959a9616648613c0060b0b12476

Download Submit
C:\Users\Admin\Downloads\UnprotectInvoke.potx
Filesize
367KB

MD5
47e958e483d04ab52ccc1af82fc1bf6f

SHA1
b5602561c1f1a04f4fc245d8bf1f7c84bbf5bf42

SHA256
c24e57b494e3ada6474c77c9e93bf2971888b756273ff1b7ceefd23da20bc2c7

SHA512
3a8ceeb92c0ff3c1ff22ae40ed1e3472401c9eb0b550c6703dcd275ac5e289a74e9ae4c862b166c115135b07f2f3a5cc22492b5967d1303c321cdd56823058c2

Download Submit
C:\Users\Admin\Downloads\UnprotectRead.asx
Filesize
229KB

MD5
c5dc26e63252de9ae2fb25d9c6c35d04

SHA1
c86e18bca034429eeae392f71e21f98cd9e06b36

SHA256
df84fd70b19758d390aca03af18e81b4451a8981477a7e47786b10ba997ec74a

SHA512
d1e1f614dd4b4de9aeec8ce9fd2e171d1625314fe387a83b08da17312bbc01973ed0dafa2c6c1807692812cc04763bf1dc1929b5a246a4b3ea9a7d98b7b8683c

Download Submit
C:\Users\Admin\Downloads\UnprotectReceive.dwfx
Filesize
474KB

MD5
7487c38061dff4a8274a100032dd5bcd

SHA1
aa774b97ef469c83d1991d076a696cb56f9b7119

SHA256
2e7182d6ed8e301fbfcb45be408e71e1d18da11c364b7045513e85dd564e00ed

SHA512
70adcfccc403cb20ff8d7ccc608bc68f799b84b5cc55b8235084b5f684cc47b151bbe018212fb1ae225c5ae3b2ec8302022b67b8b82d9e2f11e459376a1357d7

Download Submit
C:\Users\Admin\Downloads\WaitUnlock.edrwx
Filesize
197KB

MD5
ce3cfb182e6b370586980adddc463ac3

SHA1
499e2d29c07f3e4c7d84a49026fde4ce7efb8dd3

SHA256
c1dd3ac12be9d1db7782fd34d7f3f0491158e35c4ec59a96c1992b857eba51e9

SHA512
daf9d56fcbd7d6490182d532b9afbf29221115cd5a89ea3df046ce8927d057186453b0449d02497b1b4dc5316b9d69ff5571d728ef8da90455ca861035c42eee

Download Submit
\??\pipe\crashpad_1076_VLTZAMZWQYYJZARV
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit