hxxp://google[.]com

Analysis

max time kernel
2159s
max time network
2049s
platform
windows10-2004_x64
resource
win10v2004-20230621-en
resource tags

arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system
submitted
29/06/2023, 12:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://google.com

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
888	Newgrounds Player.exe

Loads dropped DLL 4 IoCs

pid	Process
1724	MsiExec.exe
888	Newgrounds Player.exe
888	Newgrounds Player.exe
888	Newgrounds Player.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
218	whatismyipaddress.com
219	whatismyipaddress.com
220	whatismyipaddress.com

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Macromed\Flash\Flash32_32_0_0_363.ocx	msiexec.exe
File created	C:\Windows\SysWOW64\Macromed\Flash\mms.cfg	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\Macromed\Flash\Flash32_32_0_0_363.ocx	MsiExec.exe

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Newgrounds\Newgrounds Player\regular.ico	msiexec.exe
File created	C:\Program Files (x86)\Newgrounds\Newgrounds Player\Newgrounds Player.exe	msiexec.exe
File created	C:\Program Files (x86)\Newgrounds\Newgrounds Player\concrt140.dll	msiexec.exe
File created	C:\Program Files (x86)\Newgrounds\Newgrounds Player\small.ico	msiexec.exe
File created	C:\Program Files (x86)\Newgrounds\Newgrounds Player\vcruntime140.dll	msiexec.exe
File created	C:\Program Files (x86)\Newgrounds\Newgrounds Player\vccorlib140.dll	msiexec.exe

Drops file in Windows directory 22 IoCs

description	ioc	Process
File created	C:\Windows\Installer\$PatchCache$\Managed\3215379B32828F9428467382593D7920\1.0.0\msvcp140.dll.4DC92F6E_EBA2_3C5C_A487_1CFA4311A269	msiexec.exe
File created	C:\Windows\Installer\{B9735123-2823-49F8-8264-372895D39702}\_853F67D554F05449430E7E.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1B05.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\3215379B32828F9428467382593D7920\1.0.0\vccorlib140.dll.4DC92F6E_EBA2_3C5C_A487_1CFA4311A269	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\3215379B32828F9428467382593D7920\1.0.0\vcruntime140.dll.4DC92F6E_EBA2_3C5C_A487_1CFA4311A269	msiexec.exe
File created	C:\Windows\Installer\e5819af.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5819ad.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\3215379B32828F9428467382593D7920	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\3215379B32828F9428467382593D7920\1.0.0	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\3215379B32828F9428467382593D7920\1.0.0\concrt140.dll.4DC92F6E_EBA2_3C5C_A487_1CFA4311A269	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\3215379B32828F9428467382593D7920\1.0.0\msvcp140.dll.4DC92F6E_EBA2_3C5C_A487_1CFA4311A269	msiexec.exe
File opened for modification	C:\Windows\Installer\{B9735123-2823-49F8-8264-372895D39702}\_853F67D554F05449430E7E.exe	msiexec.exe
File created	C:\Windows\Installer\e5819ad.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\SourceHash{B9735123-2823-49F8-8264-372895D39702}	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\3215379B32828F9428467382593D7920\1.0.0\vcruntime140.dll.4DC92F6E_EBA2_3C5C_A487_1CFA4311A269	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\3215379B32828F9428467382593D7920\1.0.0\concrt140.dll.4DC92F6E_EBA2_3C5C_A487_1CFA4311A269	msiexec.exe
File created	C:\Windows\Installer\{B9735123-2823-49F8-8264-372895D39702}\_C57142D88604954431F9A9.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\{B9735123-2823-49F8-8264-372895D39702}\_C57142D88604954431F9A9.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\3215379B32828F9428467382593D7920\1.0.0\vccorlib140.dll.4DC92F6E_EBA2_3C5C_A487_1CFA4311A269	msiexec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000ee997c5502e070a80000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000ee997c550000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d012000000000000000032000000ffffffff000000000700010000680900ee997c55000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01232000000000020ed0d000000ffffffff000000000700010000680919ee997c55000000000000d0123200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000ee997c5500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	Newgrounds Player.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Newgrounds Player.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\NavigatorPluginsList\Shockwave Flash	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\NavigatorPluginsList\Shockwave Flash\application/futuresplash	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\NavigatorPluginsList\Shockwave Flash\application/x-shockwave-flash	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{D27CDB70-AE6D-11cf-96B8-444553540000}	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{D27CDB70-AE6D-11cf-96B8-444553540000}\Compatibility Flags = "65536"	MsiExec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\NAVIGATORPLUGINSLIST\SHOCKWAVE FLASH	MsiExec.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133325149114353464"	chrome.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1E\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{57A0E747-3863-4D20-A811-950C84F1DB9B}\TypeLib\Version = "1.1"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash.32\CLSID\ = "{D27CDB6E-AE6D-11cf-96B8-444553540000}"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{57A0E746-3863-4D20-A811-950C84F1DB9B}\1.1\FLAGS\ = "0"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FlashFactory.FlashFactory.1\CLSID	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash.8	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash.9\CLSID\ = "{D27CDB6E-AE6D-11cf-96B8-444553540000}"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash.20\ = "Shockwave Flash Object"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash.24\ = "Shockwave Flash Object"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D27CDB6B-AE6D-11CF-96B8-444553540000}\1.0\0\win32\ = "C:\\Windows\\SysWow64\\Macromed\\Flash\\Flash32_32_0_0_363.ocx"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D27CDB6C-AE6D-11CF-96B8-444553540000}\ProxyStubClsid32	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3215379B32828F9428467382593D7920\PackageCode = "537C26097FD07B34282C7175D77CDBC9"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{86230738-D762-4C50-A2DE-A753E5B1686F}\TypeLib	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3215379B32828F9428467382593D7920\ProductName = "Newgrounds Player"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2890635272-812199704-3564780063-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\MACHINE\Software\Classes\NewgroundsPlayer	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash.18	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash.27\CLSID	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib\ = "{D27CDB6B-AE6D-11cf-96B8-444553540000}"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Implemented Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4}	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MacromediaFlashPaper.MacromediaFlashPaper\DefaultIcon\ = "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe,-17"	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3215379B32828F9428467382593D7920\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\NewgroundsPlayer	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash.4\CLSID\ = "{D27CDB6E-AE6D-11cf-96B8-444553540000}"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash.17\CLSID\ = "{D27CDB6E-AE6D-11cf-96B8-444553540000}"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash.24\CLSID\ = "{D27CDB6E-AE6D-11cf-96B8-444553540000}"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash.29\CLSID	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D27CDB6C-AE6D-11CF-96B8-444553540000}\TypeLib	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{57A0E747-3863-4D20-A811-950C84F1DB9B}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3215379B32828F9428467382593D7920	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash.11\CLSID\ = "{D27CDB6E-AE6D-11cf-96B8-444553540000}"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash.13\ = "Shockwave Flash Object"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash.13\CLSID\ = "{D27CDB6E-AE6D-11cf-96B8-444553540000}"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID\ = "FlashFactory.FlashFactory"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D27CDB6B-AE6D-11CF-96B8-444553540000}	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D27CDB6D-AE6D-11CF-96B8-444553540000}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{86230738-D762-4C50-A2DE-A753E5B1686F}\ = "IFlashObject"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash.8\CLSID\ = "{D27CDB6E-AE6D-11cf-96B8-444553540000}"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID\ = "ShockwaveFlash.ShockwaveFlash"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Control	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.spl\Content Type = "application/futuresplash"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D27CDB6D-AE6D-11CF-96B8-444553540000}	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash.1\CLSID	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3215379B32828F9428467382593D7920\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash.1	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash.10\ = "Shockwave Flash Object"	MsiExec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{D27CDB6E-AE6D-11CF-96B8-444553540000}\PROGRAMMABLE	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Implemented Categories\{59FB2056-D625-48D0-A944-1A85B5AB2640}	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3215379B32828F9428467382593D7920	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash.5\CLSID	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash.18\CLSID	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash.17\ = "Shockwave Flash Object"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash.29	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{86230738-D762-4C50-A2DE-A753E5B1686F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{57A0E747-3863-4D20-A811-950C84F1DB9B}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash.1\ = "Shockwave Flash Object"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash.12\CLSID\ = "{D27CDB6E-AE6D-11cf-96B8-444553540000}"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mfp	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D27CDB6B-AE6D-11CF-96B8-444553540000}\1.0\0\win32	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FlashFactory.FlashFactory.1\CLSID\ = "{D27CDB70-AE6D-11cf-96B8-444553540000}"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash.27	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash\CurVer\ = "ShockwaveFlash.ShockwaveFlash.32"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32\ = "C:\\Windows\\SysWow64\\Macromed\\Flash\\Flash32_32_0_0_363.ocx"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{86230738-D762-4C50-A2DE-A753E5B1686F}\TypeLib\ = "{D27CDB6B-AE6D-11CF-96B8-444553540000}"	MsiExec.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3776	chrome.exe
3776	chrome.exe
4140	msiexec.exe
4140	msiexec.exe
3144	chrome.exe
3144	chrome.exe
888	Newgrounds Player.exe
888	Newgrounds Player.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 51 IoCs

pid	Process
3776	chrome.exe
3776	chrome.exe
3776	chrome.exe
3776	chrome.exe
3776	chrome.exe
3776	chrome.exe
3776	chrome.exe
3776	chrome.exe
3776	chrome.exe
3776	chrome.exe
3776	chrome.exe
3776	chrome.exe
3776	chrome.exe
3776	chrome.exe
3776	chrome.exe
3776	chrome.exe
3776	chrome.exe
3776	chrome.exe
3776	chrome.exe
3776	chrome.exe
3776	chrome.exe
3776	chrome.exe
3776	chrome.exe
3776	chrome.exe
3776	chrome.exe
3776	chrome.exe
3776	chrome.exe
3776	chrome.exe
3776	chrome.exe
3776	chrome.exe
3776	chrome.exe
3776	chrome.exe
3776	chrome.exe
3776	chrome.exe
3776	chrome.exe
3776	chrome.exe
3776	chrome.exe
3776	chrome.exe
3776	chrome.exe
3776	chrome.exe
3776	chrome.exe
3776	chrome.exe
3776	chrome.exe
3776	chrome.exe
3776	chrome.exe
3776	chrome.exe
3776	chrome.exe
3776	chrome.exe
3776	chrome.exe
3776	chrome.exe
3776	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3776	chrome.exe
Token: SeCreatePagefilePrivilege	3776	chrome.exe
Token: SeShutdownPrivilege	3776	chrome.exe
Token: SeCreatePagefilePrivilege	3776	chrome.exe
Token: SeShutdownPrivilege	3776	chrome.exe
Token: SeCreatePagefilePrivilege	3776	chrome.exe
Token: SeShutdownPrivilege	3776	chrome.exe
Token: SeCreatePagefilePrivilege	3776	chrome.exe
Token: SeShutdownPrivilege	3776	chrome.exe
Token: SeCreatePagefilePrivilege	3776	chrome.exe
Token: SeShutdownPrivilege	3776	chrome.exe
Token: SeCreatePagefilePrivilege	3776	chrome.exe
Token: SeShutdownPrivilege	3776	chrome.exe
Token: SeCreatePagefilePrivilege	3776	chrome.exe
Token: SeShutdownPrivilege	3776	chrome.exe
Token: SeCreatePagefilePrivilege	3776	chrome.exe
Token: SeShutdownPrivilege	3776	chrome.exe
Token: SeCreatePagefilePrivilege	3776	chrome.exe
Token: SeShutdownPrivilege	3776	chrome.exe
Token: SeCreatePagefilePrivilege	3776	chrome.exe
Token: SeShutdownPrivilege	3776	chrome.exe
Token: SeCreatePagefilePrivilege	3776	chrome.exe
Token: SeShutdownPrivilege	3776	chrome.exe
Token: SeCreatePagefilePrivilege	3776	chrome.exe
Token: SeShutdownPrivilege	3776	chrome.exe
Token: SeCreatePagefilePrivilege	3776	chrome.exe
Token: SeShutdownPrivilege	3776	chrome.exe
Token: SeCreatePagefilePrivilege	3776	chrome.exe
Token: SeShutdownPrivilege	3776	chrome.exe
Token: SeCreatePagefilePrivilege	3776	chrome.exe
Token: SeShutdownPrivilege	3776	chrome.exe
Token: SeCreatePagefilePrivilege	3776	chrome.exe
Token: SeShutdownPrivilege	3776	chrome.exe
Token: SeCreatePagefilePrivilege	3776	chrome.exe
Token: SeShutdownPrivilege	3776	chrome.exe
Token: SeCreatePagefilePrivilege	3776	chrome.exe
Token: SeShutdownPrivilege	3776	chrome.exe
Token: SeCreatePagefilePrivilege	3776	chrome.exe
Token: SeShutdownPrivilege	3776	chrome.exe
Token: SeCreatePagefilePrivilege	3776	chrome.exe
Token: SeShutdownPrivilege	3776	chrome.exe
Token: SeCreatePagefilePrivilege	3776	chrome.exe
Token: SeShutdownPrivilege	3776	chrome.exe
Token: SeCreatePagefilePrivilege	3776	chrome.exe
Token: SeShutdownPrivilege	3776	chrome.exe
Token: SeCreatePagefilePrivilege	3776	chrome.exe
Token: SeShutdownPrivilege	3776	chrome.exe
Token: SeCreatePagefilePrivilege	3776	chrome.exe
Token: SeShutdownPrivilege	3776	chrome.exe
Token: SeCreatePagefilePrivilege	3776	chrome.exe
Token: SeShutdownPrivilege	3776	chrome.exe
Token: SeCreatePagefilePrivilege	3776	chrome.exe
Token: SeShutdownPrivilege	3776	chrome.exe
Token: SeCreatePagefilePrivilege	3776	chrome.exe
Token: SeShutdownPrivilege	3776	chrome.exe
Token: SeCreatePagefilePrivilege	3776	chrome.exe
Token: SeShutdownPrivilege	3776	chrome.exe
Token: SeCreatePagefilePrivilege	3776	chrome.exe
Token: SeShutdownPrivilege	3776	chrome.exe
Token: SeCreatePagefilePrivilege	3776	chrome.exe
Token: SeShutdownPrivilege	3776	chrome.exe
Token: SeCreatePagefilePrivilege	3776	chrome.exe
Token: SeShutdownPrivilege	3776	chrome.exe
Token: SeCreatePagefilePrivilege	3776	chrome.exe

Suspicious use of FindShellTrayWindow 52 IoCs

pid	Process
3776	chrome.exe
3776	chrome.exe
3776	chrome.exe
3776	chrome.exe
3776	chrome.exe
3776	chrome.exe
3776	chrome.exe
3776	chrome.exe
3776	chrome.exe
3776	chrome.exe
3776	chrome.exe
3776	chrome.exe
3776	chrome.exe
3776	chrome.exe
3776	chrome.exe
3776	chrome.exe
3776	chrome.exe
3776	chrome.exe
3776	chrome.exe
3776	chrome.exe
3776	chrome.exe
3776	chrome.exe
3776	chrome.exe
3776	chrome.exe
3776	chrome.exe
3776	chrome.exe
3776	chrome.exe
3776	chrome.exe
3776	chrome.exe
3776	chrome.exe
3776	chrome.exe
3776	chrome.exe
3776	chrome.exe
3776	chrome.exe
3776	chrome.exe
3776	chrome.exe
3776	chrome.exe
3776	chrome.exe
3776	chrome.exe
3776	chrome.exe
3360	msiexec.exe
3360	msiexec.exe
3360	msiexec.exe
3360	msiexec.exe
3776	chrome.exe
3776	chrome.exe
3776	chrome.exe
3776	chrome.exe
3776	chrome.exe
3776	chrome.exe
3776	chrome.exe
3776	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3776	chrome.exe
3776	chrome.exe
3776	chrome.exe
3776	chrome.exe
3776	chrome.exe
3776	chrome.exe
3776	chrome.exe
3776	chrome.exe
3776	chrome.exe
3776	chrome.exe
3776	chrome.exe
3776	chrome.exe
3776	chrome.exe
3776	chrome.exe
3776	chrome.exe
3776	chrome.exe
3776	chrome.exe
3776	chrome.exe
3776	chrome.exe
3776	chrome.exe
3776	chrome.exe
3776	chrome.exe
3776	chrome.exe
3776	chrome.exe
3776	chrome.exe
3776	chrome.exe
3776	chrome.exe
3776	chrome.exe
3776	chrome.exe
3776	chrome.exe
3776	chrome.exe
3776	chrome.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3360	msiexec.exe
1724	MsiExec.exe
888	Newgrounds Player.exe
888	Newgrounds Player.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3776 wrote to memory of 556	3776	chrome.exe	84
PID 3776 wrote to memory of 556	3776	chrome.exe	84
PID 3776 wrote to memory of 3996	3776	chrome.exe	85
PID 3776 wrote to memory of 3996	3776	chrome.exe	85
PID 3776 wrote to memory of 3996	3776	chrome.exe	85
PID 3776 wrote to memory of 3996	3776	chrome.exe	85
PID 3776 wrote to memory of 3996	3776	chrome.exe	85
PID 3776 wrote to memory of 3996	3776	chrome.exe	85
PID 3776 wrote to memory of 3996	3776	chrome.exe	85
PID 3776 wrote to memory of 3996	3776	chrome.exe	85
PID 3776 wrote to memory of 3996	3776	chrome.exe	85
PID 3776 wrote to memory of 3996	3776	chrome.exe	85
PID 3776 wrote to memory of 3996	3776	chrome.exe	85
PID 3776 wrote to memory of 3996	3776	chrome.exe	85
PID 3776 wrote to memory of 3996	3776	chrome.exe	85
PID 3776 wrote to memory of 3996	3776	chrome.exe	85
PID 3776 wrote to memory of 3996	3776	chrome.exe	85
PID 3776 wrote to memory of 3996	3776	chrome.exe	85
PID 3776 wrote to memory of 3996	3776	chrome.exe	85
PID 3776 wrote to memory of 3996	3776	chrome.exe	85
PID 3776 wrote to memory of 3996	3776	chrome.exe	85
PID 3776 wrote to memory of 3996	3776	chrome.exe	85
PID 3776 wrote to memory of 3996	3776	chrome.exe	85
PID 3776 wrote to memory of 3996	3776	chrome.exe	85
PID 3776 wrote to memory of 3996	3776	chrome.exe	85
PID 3776 wrote to memory of 3996	3776	chrome.exe	85
PID 3776 wrote to memory of 3996	3776	chrome.exe	85
PID 3776 wrote to memory of 3996	3776	chrome.exe	85
PID 3776 wrote to memory of 3996	3776	chrome.exe	85
PID 3776 wrote to memory of 3996	3776	chrome.exe	85
PID 3776 wrote to memory of 3996	3776	chrome.exe	85
PID 3776 wrote to memory of 3996	3776	chrome.exe	85
PID 3776 wrote to memory of 3996	3776	chrome.exe	85
PID 3776 wrote to memory of 3996	3776	chrome.exe	85
PID 3776 wrote to memory of 3996	3776	chrome.exe	85
PID 3776 wrote to memory of 3996	3776	chrome.exe	85
PID 3776 wrote to memory of 3996	3776	chrome.exe	85
PID 3776 wrote to memory of 3996	3776	chrome.exe	85
PID 3776 wrote to memory of 3996	3776	chrome.exe	85
PID 3776 wrote to memory of 3996	3776	chrome.exe	85
PID 3776 wrote to memory of 3440	3776	chrome.exe	86
PID 3776 wrote to memory of 3440	3776	chrome.exe	86
PID 3776 wrote to memory of 4600	3776	chrome.exe	87
PID 3776 wrote to memory of 4600	3776	chrome.exe	87
PID 3776 wrote to memory of 4600	3776	chrome.exe	87
PID 3776 wrote to memory of 4600	3776	chrome.exe	87
PID 3776 wrote to memory of 4600	3776	chrome.exe	87
PID 3776 wrote to memory of 4600	3776	chrome.exe	87
PID 3776 wrote to memory of 4600	3776	chrome.exe	87
PID 3776 wrote to memory of 4600	3776	chrome.exe	87
PID 3776 wrote to memory of 4600	3776	chrome.exe	87
PID 3776 wrote to memory of 4600	3776	chrome.exe	87
PID 3776 wrote to memory of 4600	3776	chrome.exe	87
PID 3776 wrote to memory of 4600	3776	chrome.exe	87
PID 3776 wrote to memory of 4600	3776	chrome.exe	87
PID 3776 wrote to memory of 4600	3776	chrome.exe	87
PID 3776 wrote to memory of 4600	3776	chrome.exe	87
PID 3776 wrote to memory of 4600	3776	chrome.exe	87
PID 3776 wrote to memory of 4600	3776	chrome.exe	87
PID 3776 wrote to memory of 4600	3776	chrome.exe	87
PID 3776 wrote to memory of 4600	3776	chrome.exe	87
PID 3776 wrote to memory of 4600	3776	chrome.exe	87
PID 3776 wrote to memory of 4600	3776	chrome.exe	87
PID 3776 wrote to memory of 4600	3776	chrome.exe	87

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" http://google.com
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb587c9758,0x7ffb587c9768,0x7ffb587c9778
  2⤵
  PID:556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1796 --field-trial-handle=1812,i,7167150319755095308,11862686001476296914,131072 /prefetch:2
  2⤵
  PID:3996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=1812,i,7167150319755095308,11862686001476296914,131072 /prefetch:8
  2⤵
  PID:3440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2164 --field-trial-handle=1812,i,7167150319755095308,11862686001476296914,131072 /prefetch:8
  2⤵
  PID:4600
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3132 --field-trial-handle=1812,i,7167150319755095308,11862686001476296914,131072 /prefetch:1
  2⤵
  PID:4648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3160 --field-trial-handle=1812,i,7167150319755095308,11862686001476296914,131072 /prefetch:1
  2⤵
  PID:4956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4572 --field-trial-handle=1812,i,7167150319755095308,11862686001476296914,131072 /prefetch:1
  2⤵
  PID:3924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4708 --field-trial-handle=1812,i,7167150319755095308,11862686001476296914,131072 /prefetch:8
  2⤵
  PID:1624
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5180 --field-trial-handle=1812,i,7167150319755095308,11862686001476296914,131072 /prefetch:8
  2⤵
  PID:1092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5268 --field-trial-handle=1812,i,7167150319755095308,11862686001476296914,131072 /prefetch:8
  2⤵
  PID:2792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=2428 --field-trial-handle=1812,i,7167150319755095308,11862686001476296914,131072 /prefetch:1
  2⤵
  PID:3452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5024 --field-trial-handle=1812,i,7167150319755095308,11862686001476296914,131072 /prefetch:8
  2⤵
  PID:1288
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=4836 --field-trial-handle=1812,i,7167150319755095308,11862686001476296914,131072 /prefetch:1
  2⤵
  PID:2276
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=4776 --field-trial-handle=1812,i,7167150319755095308,11862686001476296914,131072 /prefetch:1
  2⤵
  PID:1832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3152 --field-trial-handle=1812,i,7167150319755095308,11862686001476296914,131072 /prefetch:8
  2⤵
  PID:1740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4724 --field-trial-handle=1812,i,7167150319755095308,11862686001476296914,131072 /prefetch:8
  2⤵
  PID:2260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3132 --field-trial-handle=1812,i,7167150319755095308,11862686001476296914,131072 /prefetch:8
  2⤵
  PID:4508
- C:\Windows\System32\msiexec.exe
  "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\Downloads\Install_Newgrounds_Player.msi"
  2⤵
  - Enumerates connected drives
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  PID:3360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=18 --mojo-platform-channel-handle=5012 --field-trial-handle=1812,i,7167150319755095308,11862686001476296914,131072 /prefetch:1
  2⤵
  PID:4556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5268 --field-trial-handle=1812,i,7167150319755095308,11862686001476296914,131072 /prefetch:8
  2⤵
  PID:1576
- C:\Program Files (x86)\Newgrounds\Newgrounds Player\Newgrounds Player.exe
  "C:\Program Files (x86)\Newgrounds\Newgrounds Player\Newgrounds Player.exe" "newgroundsplayer:621315__1"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3236 --field-trial-handle=1812,i,7167150319755095308,11862686001476296914,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3144
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=21 --mojo-platform-channel-handle=3252 --field-trial-handle=1812,i,7167150319755095308,11862686001476296914,131072 /prefetch:1
  2⤵
  PID:1428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=22 --mojo-platform-channel-handle=5800 --field-trial-handle=1812,i,7167150319755095308,11862686001476296914,131072 /prefetch:1
  2⤵
  PID:492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5868 --field-trial-handle=1812,i,7167150319755095308,11862686001476296914,131072 /prefetch:8
  2⤵
  PID:2168
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6012 --field-trial-handle=1812,i,7167150319755095308,11862686001476296914,131072 /prefetch:8
  2⤵
  PID:4864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=25 --mojo-platform-channel-handle=6024 --field-trial-handle=1812,i,7167150319755095308,11862686001476296914,131072 /prefetch:1
  2⤵
  PID:2228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=26 --mojo-platform-channel-handle=2208 --field-trial-handle=1812,i,7167150319755095308,11862686001476296914,131072 /prefetch:1
  2⤵
  PID:2464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3708 --field-trial-handle=1812,i,7167150319755095308,11862686001476296914,131072 /prefetch:8
  2⤵
  PID:4592
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=28 --mojo-platform-channel-handle=6368 --field-trial-handle=1812,i,7167150319755095308,11862686001476296914,131072 /prefetch:1
  2⤵
  PID:4868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=29 --mojo-platform-channel-handle=6388 --field-trial-handle=1812,i,7167150319755095308,11862686001476296914,131072 /prefetch:1
  2⤵
  PID:2500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=30 --mojo-platform-channel-handle=6620 --field-trial-handle=1812,i,7167150319755095308,11862686001476296914,131072 /prefetch:1
  2⤵
  PID:1020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=31 --mojo-platform-channel-handle=6788 --field-trial-handle=1812,i,7167150319755095308,11862686001476296914,131072 /prefetch:1
  2⤵
  PID:3804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=32 --mojo-platform-channel-handle=6992 --field-trial-handle=1812,i,7167150319755095308,11862686001476296914,131072 /prefetch:1
  2⤵
  PID:3844
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=36 --mojo-platform-channel-handle=6908 --field-trial-handle=1812,i,7167150319755095308,11862686001476296914,131072 /prefetch:1
  2⤵
  PID:5388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=37 --mojo-platform-channel-handle=7144 --field-trial-handle=1812,i,7167150319755095308,11862686001476296914,131072 /prefetch:1
  2⤵
  PID:5396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=35 --mojo-platform-channel-handle=7136 --field-trial-handle=1812,i,7167150319755095308,11862686001476296914,131072 /prefetch:1
  2⤵
  PID:5368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=43 --mojo-platform-channel-handle=8388 --field-trial-handle=1812,i,7167150319755095308,11862686001476296914,131072 /prefetch:1
  2⤵
  PID:5444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=42 --mojo-platform-channel-handle=7328 --field-trial-handle=1812,i,7167150319755095308,11862686001476296914,131072 /prefetch:1
  2⤵
  PID:5436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=41 --mojo-platform-channel-handle=7216 --field-trial-handle=1812,i,7167150319755095308,11862686001476296914,131072 /prefetch:1
  2⤵
  PID:5428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=40 --mojo-platform-channel-handle=7184 --field-trial-handle=1812,i,7167150319755095308,11862686001476296914,131072 /prefetch:1
  2⤵
  PID:5420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=39 --mojo-platform-channel-handle=7164 --field-trial-handle=1812,i,7167150319755095308,11862686001476296914,131072 /prefetch:1
  2⤵
  PID:5412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=38 --mojo-platform-channel-handle=7152 --field-trial-handle=1812,i,7167150319755095308,11862686001476296914,131072 /prefetch:1
  2⤵
  PID:5404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=34 --mojo-platform-channel-handle=6232 --field-trial-handle=1812,i,7167150319755095308,11862686001476296914,131072 /prefetch:1
  2⤵
  PID:5360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=33 --mojo-platform-channel-handle=6004 --field-trial-handle=1812,i,7167150319755095308,11862686001476296914,131072 /prefetch:1
  2⤵
  PID:5352
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=44 --mojo-platform-channel-handle=8712 --field-trial-handle=1812,i,7167150319755095308,11862686001476296914,131072 /prefetch:1
  2⤵
  PID:6132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=45 --mojo-platform-channel-handle=9160 --field-trial-handle=1812,i,7167150319755095308,11862686001476296914,131072 /prefetch:1
  2⤵
  PID:5252
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=9116 --field-trial-handle=1812,i,7167150319755095308,11862686001476296914,131072 /prefetch:8
  2⤵
  PID:2528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=48 --mojo-platform-channel-handle=9304 --field-trial-handle=1812,i,7167150319755095308,11862686001476296914,131072 /prefetch:1
  2⤵
  PID:6232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=47 --mojo-platform-channel-handle=8868 --field-trial-handle=1812,i,7167150319755095308,11862686001476296914,131072 /prefetch:1
  2⤵
  PID:6224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=51 --mojo-platform-channel-handle=9616 --field-trial-handle=1812,i,7167150319755095308,11862686001476296914,131072 /prefetch:1
  2⤵
  PID:6268
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=50 --mojo-platform-channel-handle=9584 --field-trial-handle=1812,i,7167150319755095308,11862686001476296914,131072 /prefetch:1
  2⤵
  PID:6260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=49 --mojo-platform-channel-handle=9552 --field-trial-handle=1812,i,7167150319755095308,11862686001476296914,131072 /prefetch:1
  2⤵
  PID:6252
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=52 --mojo-platform-channel-handle=9968 --field-trial-handle=1812,i,7167150319755095308,11862686001476296914,131072 /prefetch:1
  2⤵
  PID:6656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=54 --mojo-platform-channel-handle=10148 --field-trial-handle=1812,i,7167150319755095308,11862686001476296914,131072 /prefetch:1
  2⤵
  PID:6856
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=53 --mojo-platform-channel-handle=10032 --field-trial-handle=1812,i,7167150319755095308,11862686001476296914,131072 /prefetch:1
  2⤵
  PID:6848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=55 --mojo-platform-channel-handle=10272 --field-trial-handle=1812,i,7167150319755095308,11862686001476296914,131072 /prefetch:1
  2⤵
  PID:6204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=56 --mojo-platform-channel-handle=7428 --field-trial-handle=1812,i,7167150319755095308,11862686001476296914,131072 /prefetch:1
  2⤵
  PID:6240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=57 --mojo-platform-channel-handle=7452 --field-trial-handle=1812,i,7167150319755095308,11862686001476296914,131072 /prefetch:1
  2⤵
  PID:6692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=58 --mojo-platform-channel-handle=7952 --field-trial-handle=1812,i,7167150319755095308,11862686001476296914,131072 /prefetch:1
  2⤵
  PID:6744
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=59 --mojo-platform-channel-handle=7572 --field-trial-handle=1812,i,7167150319755095308,11862686001476296914,131072 /prefetch:1
  2⤵
  PID:6824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=60 --mojo-platform-channel-handle=6232 --field-trial-handle=1812,i,7167150319755095308,11862686001476296914,131072 /prefetch:1
  2⤵
  PID:7024
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=61 --mojo-platform-channel-handle=8020 --field-trial-handle=1812,i,7167150319755095308,11862686001476296914,131072 /prefetch:1
  2⤵
  PID:7076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=62 --mojo-platform-channel-handle=8076 --field-trial-handle=1812,i,7167150319755095308,11862686001476296914,131072 /prefetch:1
  2⤵
  PID:5388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=64 --mojo-platform-channel-handle=11004 --field-trial-handle=1812,i,7167150319755095308,11862686001476296914,131072 /prefetch:1
  2⤵
  PID:5616
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=63 --mojo-platform-channel-handle=7576 --field-trial-handle=1812,i,7167150319755095308,11862686001476296914,131072 /prefetch:1
  2⤵
  PID:5472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=66 --mojo-platform-channel-handle=9724 --field-trial-handle=1812,i,7167150319755095308,11862686001476296914,131072 /prefetch:1
  2⤵
  PID:5768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=65 --mojo-platform-channel-handle=9648 --field-trial-handle=1812,i,7167150319755095308,11862686001476296914,131072 /prefetch:1
  2⤵
  PID:5744
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=67 --mojo-platform-channel-handle=10472 --field-trial-handle=1812,i,7167150319755095308,11862686001476296914,131072 /prefetch:1
  2⤵
  PID:6840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=68 --mojo-platform-channel-handle=11064 --field-trial-handle=1812,i,7167150319755095308,11862686001476296914,131072 /prefetch:1
  2⤵
  PID:6660

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:852

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4140
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:3956
- C:\Windows\syswow64\MsiExec.exe
  "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\SysWOW64\Macromed\Flash\Flash32_32_0_0_363.ocx"
  2⤵
  - Loads dropped DLL
  - Drops file in System32 directory
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:1724

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:1632

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x504 0x4ec
1⤵
PID:3144

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e5819ae.rbs

Filesize
15KB

MD5
227a44bb83e07dfda08fe1be803925d3

SHA1
5df35031bc8c4cad8ad9e3aa305ac7e0efbb01c3

SHA256
e4813a05c21f10e42e3079c8fbc17e39c32bccbf5cbb78648dd00874afc544c9

SHA512
b0e08972375f3d811146bcaf2d11cd00801c87cd0ebe21de18970ed54647573230c6e66dd61eda1cb7ae139bccf152fcee9d9e356b8f6dfb426e20cd161779a0

Download Submit
C:\Program Files (x86)\Newgrounds\Newgrounds Player\Newgrounds Player.exe

Filesize
458KB

MD5
7308fcb446d7bec2a9b11bee7038d64a

SHA1
a4b91a318342a0074b217ab32b0aad17b53c8ec1

SHA256
631eec9b6eaab442416cb87b7f05e7cd03bfbea65692b9df0d0e04f722d6f1fa

SHA512
fd68f63e83d515418cfae7fed098c2104d9694e90225f0a3c8bd08edd7226f088b7ce4ff29af8b86f297cee34c7e73f47237b1b879ccaf2f095d23d1e511636d

Download Submit
C:\Program Files (x86)\Newgrounds\Newgrounds Player\Newgrounds Player.exe

Filesize
458KB

MD5
7308fcb446d7bec2a9b11bee7038d64a

SHA1
a4b91a318342a0074b217ab32b0aad17b53c8ec1

SHA256
631eec9b6eaab442416cb87b7f05e7cd03bfbea65692b9df0d0e04f722d6f1fa

SHA512
fd68f63e83d515418cfae7fed098c2104d9694e90225f0a3c8bd08edd7226f088b7ce4ff29af8b86f297cee34c7e73f47237b1b879ccaf2f095d23d1e511636d

Download Submit
C:\Program Files (x86)\Newgrounds\Newgrounds Player\VCRUNTIME140.dll

Filesize
83KB

MD5
607b9eef0c8173d1e8e75947aeed6a13

SHA1
43a575271718f44f4aadacf6476c54c29c2c096b

SHA256
a4e64b1281a49232aeddef73193111b55eb28961d47244d0eba1dfe2887c2b81

SHA512
7919425aca7881ff53ce4a637f6f6dedc47e030892c858c20d2e303872221764aad6826e1c1fd24f40d61af730403ee891d3e354fe9085158f35bf2d198f5d0f

Download Submit
C:\Program Files (x86)\Newgrounds\Newgrounds Player\regular.ico

Filesize
23KB

MD5
0bdaff25f4a67da0ffcc9fd7eb9628ae

SHA1
98004182b0be3354827a98e6b1c4e587461664f8

SHA256
18f6ba52f06036fe9139e765d0b307c0618e8755781d4dd74211a68ea971c05f

SHA512
9a13c876fd73a5c57e4c5b5a373dab6eb8dcff0a9bba8e7795962f0a6e3f11e489589e43693d3379a3efbb16322f589535aec3d6db8b032c32e6d7061f3b1c34

Download Submit
C:\Program Files (x86)\Newgrounds\Newgrounds Player\vcruntime140.dll

Filesize
83KB

MD5
607b9eef0c8173d1e8e75947aeed6a13

SHA1
43a575271718f44f4aadacf6476c54c29c2c096b

SHA256
a4e64b1281a49232aeddef73193111b55eb28961d47244d0eba1dfe2887c2b81

SHA512
7919425aca7881ff53ce4a637f6f6dedc47e030892c858c20d2e303872221764aad6826e1c1fd24f40d61af730403ee891d3e354fe9085158f35bf2d198f5d0f

Download Submit
C:\Program Files (x86)\Newgrounds\Newgrounds Player\vcruntime140.dll

Filesize
83KB

MD5
607b9eef0c8173d1e8e75947aeed6a13

SHA1
43a575271718f44f4aadacf6476c54c29c2c096b

SHA256
a4e64b1281a49232aeddef73193111b55eb28961d47244d0eba1dfe2887c2b81

SHA512
7919425aca7881ff53ce4a637f6f6dedc47e030892c858c20d2e303872221764aad6826e1c1fd24f40d61af730403ee891d3e354fe9085158f35bf2d198f5d0f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000009

Filesize
39KB

MD5
8877fbc3201048f22d98ad32e400ca4a

SHA1
993343bbecb3479a01a76d4bd3594d5b73a129bd

SHA256
22f8221159c3f919338da3a842d9a50171ddc5ac805be6239bd63e0db78046af

SHA512
3dfb36cd2d15347eaa3c7ae29bfa6aa61638e9739174f0559a3a0c676108ccc1a6028f58dad093d6b90cac72b4468eb1d88b6414339555c9f872a5638271d9c9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000013

Filesize
81KB

MD5
af93c529100b028720508a076550e5ab

SHA1
5ec18f357c1b8628299e0bf1b221cb7998bf69d3

SHA256
3d03de0c71e288a85b8182bd49e19bb059c040b0e819924100057562c75792a2

SHA512
856dc45cdd1a82712933c47a2c1cbba96d24ff2894b25f661df8d72ced47fd7c1be22d2c0f829f8984b22f5edea754185ecff35095427ec93a73db9b840226a2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
1313f7b46bf51eb2b6584f97316ca7f4

SHA1
a5bfd002ecaac38db4e71d83f8ba7f30b0d25408

SHA256
e8d448175684f46c36f35ec53ba1e495f509c7203907181f1fe0e55a6991d505

SHA512
25aa9f32a7f5106a9827819ab483c20fa721948138150ac00875eda695a8f75133bab9d0187f134a42b2df03c626872b1cbc40e1d72c383121be81a33c1ecb77

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
d99912d55b90c545d30808647c74562e

SHA1
6a899ceb618aaa73db286ebf7093b48747b4b449

SHA256
800f7298b21eb24f56f6aa6fefc4602ecfdbefa3997eb4876fef52491a916503

SHA512
25b57ec349f1cb9d989665844688bed60ed141876b7669bbe9092da32723f736264bcb356b2c721c09698c99504436b934e2d418d99996e68070b3dfce9595d4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
288B

MD5
da2343827e5dc0939b389c82f38c236b

SHA1
22681c0ccb61db045780d01b06a583e51f6dbe7c

SHA256
eac9438897422dadeb58399542942c6dee97aa216efe1d4bbbe9e826da26201d

SHA512
98acdf3a3433689f3bb4cb419be2bb5d7d84eca321e698efbaf391aa3cfd62d6bda904f9a0bf00efe6f030ad7c6f119fca63e9c1116cce783a03e3daf814570f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
4KB

MD5
bfabe4d6ca9cdf1532e2e7374da5a198

SHA1
87fc431939cba8433da9af75caee1019f66284b6

SHA256
3e755aad73a2f5766bc90a89997d528f1aa8c3e494051533414414919c7137f3

SHA512
483fa79c49911b1bcec9ca12a3a94eda6d37d4254e9f1420fd364349704e4e559471f62ba115c0b5a0b63dda862dbb7f8ae0b3cf79e8af747a360a2ca2807b6a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
4KB

MD5
29763aa996fdd3d5bfe6b1f690a1012a

SHA1
9a9cbf5183fbf3d678fb6f43acdd367ae8938cb8

SHA256
504fad74127b6b7b26ae4e714d73e5020afa15b1a63ec11c5f8b8453e4f133d0

SHA512
e9e7352734e3c3b4c08bf92687b702d093989f3b7ca3009306ac7eb5f828968f4dee4cdc1c5c53538900f187c24c2db89dd9f5b88f5e5ffe1b2f907a6a3d8c8b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
21KB

MD5
e7b2b966cec7b6148c5222d1773a1891

SHA1
86d0e734ef477a9eded969b5ea51da151709b6a2

SHA256
80ede6a8ba199f9371a8afc5910b85ad993380cd67772d1d7fb8569c2bdbbbf5

SHA512
f45088793b903be669e94ce6a12ca50a46cc10b32e1e358c0669c9048c51c5b9c88fa25e9a65dabdfdd7a7c58e70ce6cda56902415f939fed4fd6b5fc39b8402

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
22KB

MD5
2fece62306b6906cdbfcf10d3f33c958

SHA1
e90b9b18f00f65e4c0b6de209c1bf22233e1df95

SHA256
e738d8535ee107ce38ce88bd2bacb517a9995cc867dcc999eda306f52259ab25

SHA512
ca8764d323e1096574cabda3be62f8143a7dc459167e864b0f15acf636401f60228758d16904e8cc6cd1dfe5dd27ea0301bfcc8d23b04e6000bd5372a1c08dc7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
539B

MD5
d5593ab5d837e3be49abcefea1ef8809

SHA1
0869aec0b09ea395df735446fb20fc61c3d20412

SHA256
48184d9b2ca8e3f69fcc4f2f8daed9bd034f81b29a7850f92c57c905d239458d

SHA512
15a0e81b908bacc1ec1965f09234c3bdde6bef6c1e4007e74a2a6b7cb63b2ec082fa0a26ec72b46f1998f87244fa7033187d36fd41e6b64fe2a1108f8902abf6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
1d197405b6f7b4b2742fc667b94816a8

SHA1
a8266089f687a323fce709c26d799734a22256cc

SHA256
482a557c453713e8d76ad679bffc05f6b17c234e0b0caf0c83de3617180caa89

SHA512
13d3dfcf880d67ccb38fa9aa5f680c508f09c7c6d03b43f3c2ec216f2778376746233eb607aaaa0e471d007225ea67a770a1b7923a95b27ea122a2a2a95b7879

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
7KB

MD5
d6f004c6ac81d5d83c280f011abc5f4f

SHA1
369d87558c2f580c5556a6d70d68d44f6f50b324

SHA256
4a8d31e77d4c5dfaa14d88e94889d6b40c2485fc56162b7d10cfce8b39d533cb

SHA512
c8145c009c2134f29c5df9c898879d8e2a0d7497896d577cd01caae45a629d258891bfb7b818da4d8fba63b81f0421344ba1514bb2f6e6e31361d5d3f1d77f19

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
8KB

MD5
76f07f8ba4e24184c615b94f1a9efa68

SHA1
d82413e25502e1a0f89c2ac3548325f0aa755b39

SHA256
028a83a5802573bedf255503bb78a016fe8a08df0d5ffb7d1a861d1bf4948bc7

SHA512
cdaab1f952d78a36ea5a27181afb4c59a65916c19f1cfb5b5b90e00c7b433dc28047e7ff5d90cc219d025297ff015340b1d2507a9c9e4f22bb008d13b905bf8a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
875B

MD5
1c82ef0a9af714553834b43dcabbcd06

SHA1
be102984b3128fadf8ca0b58c5c5da53b802192d

SHA256
537ad9b6c303274e48838fc3805b4d2969850d811a907de36dad71cfa6969a0a

SHA512
b2aeee782f0298910b903cdeac7e08924cdbd6b9128056e0c2710a191958b708e119716875347611a12dec5cfdc71061a50ba90971fa234dfe145a8728212de5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
539B

MD5
0ada114f7c07a9de390c2324c726f648

SHA1
23ca5b3d131906d4ac5f91df69c46bb81dabed26

SHA256
fd705c3229a6ed005cadd70a6ddc41c56155c93a46b5432c98179dc0e7bd70bc

SHA512
184c1d140c597bc737a25079aaa4bacd42226ff93ed26ae4ba51e370b25e1bccae6d4e06629662858dbf45647dd44cdaee2d83d67e773702c07678442f7ba838

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
8KB

MD5
834ff11fe1edd8617b50fa04203972c4

SHA1
ddd72f093ebe317a417a9845d43cd6668871b467

SHA256
91299fd24356912fba1284f8c0ffb7b9310b1be07d551da6f9d3e1c18689bf88

SHA512
e2f40e6f31b090ca294085f091a0b1008a1c0228cb5c7c553e324745918c1dab5dda383d8c17c65d978869c4fdc770977482610979cf2bba57547c79699c33c5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
f36e0f6f1a0dcaabd736b2e43f6df8f2

SHA1
096f17e758de59703b86d8eba982ed7c304be934

SHA256
1f6ab3c78359991961e70525b84ce687f918312e8ee56cc45c1f1765b839dbfc

SHA512
cfd32c1518abdca2aaf0a16ee711c4b9b31bb0e7850cf182ebb38f2866f99b90ffc7020ed8defc5f0bf288944b5eb6b1608fa9d42957421ab5011a5b47a6b187

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
746d26e24ff3a450db4787a1134a9fad

SHA1
eb1832f953c63e7fcf5c2ecaaee9911dd68c3a5a

SHA256
316645cfd4813fb70d985d15eb17a7430dfa5c1af42440c26781c9de6c6c036a

SHA512
8660ab2a4557a0fea019b26fd1be4f1001bdcbf9d5527398a09ece5b924a1a4d4814668cb0acd3796532343a80e4a2c59113fdae90d33eb152b09b2deb34282f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
3f40ee98cb543c037451f05cedfb8ff9

SHA1
791131eb1cfb4f5ed92541823052900f417d1639

SHA256
f844120bdf49987bb9cd17ce4d784b271bb7f037b2778cf8243e9d0067da9e14

SHA512
64ad0ff7150fbd58fbf1ffdd1d29d5194e5610b65bf3b398657d4ab2ebd6fed824d4b5671ebb63484934189875387bc01d9bfe9fbc3bf1898de911be9a3bd34a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
82ab02098170db9cadf9a3e2bd011453

SHA1
43e98e9d8c869e1b2266937079e5a197a8d9a74e

SHA256
c97cb6da768d6aa5efc4b999d2ccf25a712095ddfb41a7030bec3e89ded86d1e

SHA512
827fe3cbe152cfd4e1bc408f59fd6e3e1302020b5600a55603925f4bfd8e518d4d59d2250de9727615967d22e105a1ca5564055c1d82cbbe1083563f62eabaac

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
c776907a4a92243f17341c50397617d2

SHA1
26b246f8ce14fae14bb79e34d175c2d6e9e6e879

SHA256
9479416a4cbf4e18ddc883e1300206e85bc0c3e0f94ada9581771457dc8d1ca2

SHA512
9290d72ae282b90e0587fda1aac4bcabe2c4d993daa0cae6385fb0325fa476ed49acb7b32c218584c4ce2ca01d152d483ffe59ac171f5194c9a1159409ecc6bf

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
a790f285d092d336b2805a145867e8bb

SHA1
ad74ff3c1f4af7ebb10db6aca21683b743f56c7a

SHA256
f40ca38e2f0b44c1d4e7cf227f627baf85a6f58451add36b06effd3bda8def37

SHA512
362c8909dd5647dc5b489676671f1fa13d0ce2bd2ccff4ceb2ab0582efbc245e0d723a09f894e1ad010ee861c5424d4fef0e0c60a6e70ec19f589959f0e5275a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
65ab74fbae7eab97bb8622828a55cde7

SHA1
62f770b3a19e51b0866b9d7e8277915005a6d884

SHA256
b371eb17cf00632af9d4307821ca6e7300ba236e8b96d1563e7ff92beb3e3942

SHA512
76f2ccd69fdb22cf136c9b043f2389f3eea766b024956447bd1452553c6e92613b90eedb1d072efea2b47e37e1251bfb2537405014d8538ab9e5e577e65f04bd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
174KB

MD5
0d6ebb4c3b4f12570b74109da22bb098

SHA1
d0e8a07b502998f93a6126e940f87eda492df075

SHA256
8bbfcb777780e711d1ed2e17618f770f01b943e0923d89bf82f7da4b8e5527bc

SHA512
ead40befdcf7f80fb41a802717d4b9eacabca55564f464bcbc0d116f1f613a8a722ea3d5ea2b5a5b08d2a1370daff8bb52297ead0d4226653572114b6b88e354

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
174KB

MD5
7d3f4f402291b5cb04b238cccf044ab8

SHA1
a66ed1ede759581d71a042675109a00b82fa39f4

SHA256
ef572c877f7ac4fc539bd432101d8aae6576af2b5adef056201d77c4150310a2

SHA512
a333155ee539bf4f230875b7134d111a99a0743abcc8612b9b8aa00aee11b80fb25f51ea5bf50d2c9104ba8f5cfd721990a22ba2500f70542e5a37bbc048c829

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
174KB

MD5
fb6ad2d33dd0e7f46995d0e1bbc8e20e

SHA1
e715cdb703ee7373bda2addb7506323b1f20b68d

SHA256
f264c5aa226297a425da53f855ee05647c330cf06af7b4ba29789e1046324bc1

SHA512
f30ed7243158ff4b38a182ee8831bfc5d34de18706bf1441b3d50b2c62c9e72683c932db4e438f98ec78706479ba99dbd2fe6e9af4a6f3a249c70fdca0ed922d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
174KB

MD5
fd598b855614375083f5e73098b1e34c

SHA1
a981ef8c90e39679ed7639837db4765f7f27c3b5

SHA256
8a17f9e95b29f1ec4dc2212b14928d4473ce593817549b1382d1377a922dd24c

SHA512
8925d2219e14e0641d032ed01bf482ce4184248976f2fff532360d7cf779b7df080ebfa09649086ef040e0ea59a0e48d1d39e047c13a570cf66f99fd6be5fe04

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
174KB

MD5
2e53bf1baa6eb0a7f3d79ed8ac42cbb4

SHA1
67dc816822f8dd70ee082c330e5e0d3768dfb559

SHA256
f55bc257ac66d0a7f7d35b8c322ae4437c425c086e6fe045a8c2271adfbfbfd1

SHA512
c44c336aa84ed2739be44e8d8af130878f939c4eca67790a54e8d91f4b499fb79063a353baf77f57781e81ba7265ea55e93e807f815038e4c79bdaa7a6889621

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
97KB

MD5
35dca78875fbfda00ac61f84271b7270

SHA1
4ccdc92fc87546d114227869d8821cd4d987e515

SHA256
3956818ede6ca4f783a04bf98cb6aaaf735392adccfb2b498c61289281790274

SHA512
9113b09b2132346ba865a8b3c7cf87ef6aa72f2ff65e60b5c30c97421fea4343965113d851e14d92224b68e928058e210429472f6f15bf0ba0dc840e1be7f9d3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
118KB

MD5
84966ec2fb124291d7d5eb7f2bc10d7f

SHA1
3b25a3a017e04b2cea6930b0aae7c6fbf0eb496a

SHA256
d53895ce8ed7b60691d88f09d3cc61da5354ee13ec5bc77bfa812a34233d25cc

SHA512
6a818887cfdc1b282038e8b44879de3135fff3b701689e12dfef5907917a330528cf21715c9c79bfbcc5f6c078644d14ff3164a7d78b5de7bfdb08e384da4a5f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
110KB

MD5
e78b76ce4d578b9542f422089610860b

SHA1
a3e21ba3098296e04506d7ef0be112c36bfaf995

SHA256
f1eaea6c3e47129e1fe19d777e104c31c3d807280d7115d3365f71726576bc3d

SHA512
14ebd69f0f23eb6f26ae4942391fb82049720adfa753a3e8678603644baf1686ead416aa0ca54323387053774d66baa4a2ebad103f7e31a0134fb5de9dc3b5b6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
113KB

MD5
2e56cce41cdac4a57b38e56ce4956996

SHA1
26bacbc192f7cd15906c1653222f351a464c398b

SHA256
b00a163f73ca6cf11467b760e9a56a1c24cec7313422c7cdb284d72faac5e0e4

SHA512
78f231c7c66d45f10bd55f2dbee15906cdae1e684a1d5d08017615714ac9facae2477591855babd43b9e247a372eec8a4a4740dde6d03a1398680acea47996fc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe5733b2.TMP

Filesize
96KB

MD5
e70dff30fb97e6166407900d256876f4

SHA1
127e57a1be22baa7d79434e658df73ef21fd4cbb

SHA256
f2d58784faa646c61ea29dde4df10361be77b91f2a532036ddb2b991c105cada

SHA512
5d536a405c711e3fd244417f6a9dafc458f2faac668104529ed09f2e43d7377f15858059361bf63784d879c3e0ba5e5735a7a19cb935dec376e11a7531d7c029

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\settings.sxx

Filesize
510B

MD5
5a85c51accf41d4ae63597e65551d43c

SHA1
15215126e5ef442ba5ddf65d54235f5c81b0e1db

SHA256
4787c1bae193b6a17999e692ab0f84a957d2be327467a90da2c1b0c4cbb3d911

SHA512
38011b028d8e166372b8de529ac5447ca72a8d0346a435aaf7d4a2d05eed13c0c93dbdf9a194f4fad525ac55769a342a106262a4fa7263d2777a0dc16121c4b2

Download Submit
C:\Users\Admin\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\settings.sxx

Filesize
1KB

MD5
32ebe93c4f541734f38429a59275efe2

SHA1
61edb33b3814ecde088d2c8adb17b832541ada04

SHA256
e5867cf559c510a16a1d995082e1fe6cdb1ab70ac871d074b012bd4489444fcb

SHA512
4e3f74bd6694afe8469120622efc1743a0f5c5abb8e32a39bc9ee9f5df4d6febb4a734e6004ddc6d96eee0a1abac08a377ed312cf1dd87b672985a879bb95f6c

Download Submit
C:\Users\Admin\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\settings.sxx

Filesize
1KB

MD5
16fb3fce1cc7d0406a1d818e95984dac

SHA1
a99a31fd749ec0ce3f3e1b816b601e0463ce5d38

SHA256
3a899dc5f2bfb0c8bc4b2a80613f7ca9231bafcd4d0fc32f30ca946ecfcfb0f8

SHA512
a09213fb505f3470badafe925330fb02d4a876ad1a92d8b096ad6701f43114e0e8aababf30097af950fabe4d5898f31be0524ef68714287f7d052ab47147006d

Download Submit
C:\Users\Admin\AppData\Roaming\Macromedia\Flash Player\openssl\cache\RevocationCacheFile.dat

Filesize
1024B

MD5
0f343b0931126a20f133d67c2b018a3b

SHA1
60cacbf3d72e1e7834203da608037b1bf83b40e8

SHA256
5f70bf18a086007016e948b04aed3b82103a36bea41755b6cddfaf10ace3c6ef

SHA512
8efb4f73c5655351c444eb109230c556d39e2c7624e9c11abc9e3fb4b9b9254218cc5085b454a9698d085cfa92198491f07a723be4574adc70617b73eb0b6461

Download Submit
C:\Users\Admin\Downloads\Install_Newgrounds_Player.msi

Filesize
11.1MB

MD5
6c36340c39b31dda3b85262f660edd45

SHA1
09196e17187bdfff2e3eb44892dcd85eadef66eb

SHA256
e3914c40e517abe2e827e3ab54f540d4aa434a7932c46941cd8b3ea880c6662e

SHA512
62ed68ae5948cebaeca96acab9be629115c70cdc412d05dde68205c61ead19e27a1590fabb3fccdc97c0eceecd2429d0079e847c58f5bb8e89fa43007ace1c25

Download Submit
C:\Users\Admin\Downloads\Install_Newgrounds_Player.msi

Filesize
11.1MB

MD5
6c36340c39b31dda3b85262f660edd45

SHA1
09196e17187bdfff2e3eb44892dcd85eadef66eb

SHA256
e3914c40e517abe2e827e3ab54f540d4aa434a7932c46941cd8b3ea880c6662e

SHA512
62ed68ae5948cebaeca96acab9be629115c70cdc412d05dde68205c61ead19e27a1590fabb3fccdc97c0eceecd2429d0079e847c58f5bb8e89fa43007ace1c25

Download Submit
C:\Windows\SysWOW64\Macromed\Flash\Flash32_32_0_0_363.ocx

Filesize
19.1MB

MD5
ecd28a3ffa2f235a8851aa2b3a646304

SHA1
df7e81e4bb5e32d1febec4472022ecb5ed97883a

SHA256
05ea1c89bf6067cb3f3aca6102c92f5fe9bc5df4f325053819ebc671bacdd0ca

SHA512
2b23637c04b1b9d5bd479074d10a07902fb03022bd1ffea7c84ff12c9645cdda1a3f6e9b88b8be2117afbfa8da2e15bb92d35ef81a804b6e20f65e40942956ef

Download Submit
C:\Windows\SysWOW64\Macromed\Flash\Flash32_32_0_0_363.ocx

Filesize
19.1MB

MD5
ecd28a3ffa2f235a8851aa2b3a646304

SHA1
df7e81e4bb5e32d1febec4472022ecb5ed97883a

SHA256
05ea1c89bf6067cb3f3aca6102c92f5fe9bc5df4f325053819ebc671bacdd0ca

SHA512
2b23637c04b1b9d5bd479074d10a07902fb03022bd1ffea7c84ff12c9645cdda1a3f6e9b88b8be2117afbfa8da2e15bb92d35ef81a804b6e20f65e40942956ef

Download Submit
C:\Windows\SysWOW64\Macromed\Flash\Flash32_32_0_0_363.ocx

Filesize
19.1MB

MD5
ecd28a3ffa2f235a8851aa2b3a646304

SHA1
df7e81e4bb5e32d1febec4472022ecb5ed97883a

SHA256
05ea1c89bf6067cb3f3aca6102c92f5fe9bc5df4f325053819ebc671bacdd0ca

SHA512
2b23637c04b1b9d5bd479074d10a07902fb03022bd1ffea7c84ff12c9645cdda1a3f6e9b88b8be2117afbfa8da2e15bb92d35ef81a804b6e20f65e40942956ef

Download Submit
C:\Windows\SysWOW64\Macromed\Flash\mms.cfg

Filesize
271B

MD5
e07a88fefe91d97afcd5eaa2580d50e4

SHA1
89563a619f89a43191c674fa4721aad0abd7147c

SHA256
be9ed1762003711deb5ccca542c51487ef73a3e72f192f4e31fc976be03e4c03

SHA512
00aceb52ba402b6eb744b2459d2cf9749f7db77f857a9d464b72586aa5358361bad926df82a154283b804a064ea3a2fabf7228d9117e4823c69952389b1b087f

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

Filesize
23.0MB

MD5
6788057de00dce7c4da1c714ee4cc7d3

SHA1
887c82e71eb81a7e64fc64a8257b22c5b72b67a5

SHA256
0632a9eaa9276017b6185f9a5d50df8731a4905b13d9927ee8f796acc4189b0d

SHA512
2c0fb1ec5ade2c229a3cac37647ca4021e7d66966d52a17a66bd030d80172c11cad1006a894a0e4bf0d82a969925501331e36ec3060c798c19ed9385e25862ac

Download Submit
\??\Volume{557c99ee-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{8f0bf8f5-975d-4843-874c-d591b3d7308c}_OnDiskSnapshotProp

Filesize
5KB

MD5
60ae0fab30b0f764be301db90058b0b6

SHA1
77e1179688be597b7a6ffa972ce7a941853beb45

SHA256
125d3c012a2ba3c4387cc579aca430df5e18f57c5745185a98b3578a9e51d6b8

SHA512
2bce1c7ceef06d1089c7724c2a934c7a9a2f47ba5ec80452582aa25c0b50dbee88b4db7e96a3b255a0654df24c75ffb3462dfc3297ff475cadffd6c75e0cab86

Download Submit