7896e31c4d4530334ef0ce3bdee08ff23585a917ecb08e9cfc9388366522fe2b

Analysis

max time kernel
1682s
max time network
1686s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
10/08/2024, 02:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

blender_cpu_check.dll
Size

20KB
MD5

9f92d056f2137ffbc5732913ab50cae0
SHA1

b0a639d0f4b7a29a01f99c94a2e8320a2eebb1e4
SHA256

7896e31c4d4530334ef0ce3bdee08ff23585a917ecb08e9cfc9388366522fe2b
SHA512

8d65fb3fabb0a79e4136e4d88aba3ab7f5c703da9681c10b3bea3ad87faa149000da0dcd098bff7da35509c0504b3eebac0037b0b108430e7b15f5b81f8ca3e0
SSDEEP

384:p87aDEFh6h2zg4NrBlv//buu2Z6kkDhCm/Rq:p8ODU6b4Nbn/6u2Z7TKQ

Score

8^/10

defense_evasion discovery

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 1 IoCs

pid	Process
3096	Memz Clean.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
1	raw.githubusercontent.com
8	camo.githubusercontent.com
39	raw.githubusercontent.com

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Memz Clean.exe:Zone.Identifier	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Memz Clean.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2842058299-443432012-2465494467-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Modifies registry class 11 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2842058299-443432012-2465494467-1000_Classes\py_auto_file\shell\Read	OpenWith.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2842058299-443432012-2465494467-1000\{4495A3DB-68BA-4B3E-9022-1C02D9F150AD}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2842058299-443432012-2465494467-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2842058299-443432012-2465494467-1000_Classes\.py	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2842058299-443432012-2465494467-1000_Classes\py_auto_file	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2842058299-443432012-2465494467-1000_Classes\py_auto_file\shell\Read\command	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2842058299-443432012-2465494467-1000_Classes\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\AcroRd32.exe\" \"%1\""	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2842058299-443432012-2465494467-1000_Classes\.py\ = "py_auto_file"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2842058299-443432012-2465494467-1000_Classes\隗퍒⬦耀	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2842058299-443432012-2465494467-1000_Classes\隗퍒⬦耀\ = "py_auto_file"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2842058299-443432012-2465494467-1000_Classes\py_auto_file\shell	OpenWith.exe

NTFS ADS 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 366921.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Memz Clean.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Cwelium.py:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 38 IoCs

pid	Process
3200	msedge.exe
3200	msedge.exe
3404	msedge.exe
3404	msedge.exe
2216	identity_helper.exe
2216	identity_helper.exe
976	msedge.exe
976	msedge.exe
812	msedge.exe
812	msedge.exe
2148	msedge.exe
2148	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
3868	msedge.exe
3868	msedge.exe
5880	AcroRd32.exe
5880	AcroRd32.exe
5880	AcroRd32.exe
5880	AcroRd32.exe
5880	AcroRd32.exe
5880	AcroRd32.exe
5880	AcroRd32.exe
5880	AcroRd32.exe
5880	AcroRd32.exe
5880	AcroRd32.exe
5880	AcroRd32.exe
5880	AcroRd32.exe
5880	AcroRd32.exe
5880	AcroRd32.exe
5880	AcroRd32.exe
5880	AcroRd32.exe
5880	AcroRd32.exe
5880	AcroRd32.exe
5880	AcroRd32.exe
5880	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5648	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 22 IoCs

pid	Process
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	2080	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2080	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe

Suspicious use of SetWindowsHookEx 46 IoCs

pid	Process
3096	Memz Clean.exe
3096	Memz Clean.exe
5648	OpenWith.exe
5648	OpenWith.exe
5648	OpenWith.exe
5648	OpenWith.exe
5648	OpenWith.exe
5648	OpenWith.exe
5648	OpenWith.exe
5648	OpenWith.exe
5648	OpenWith.exe
5648	OpenWith.exe
5648	OpenWith.exe
5648	OpenWith.exe
5648	OpenWith.exe
5648	OpenWith.exe
5648	OpenWith.exe
5648	OpenWith.exe
5648	OpenWith.exe
5648	OpenWith.exe
5648	OpenWith.exe
5648	OpenWith.exe
5648	OpenWith.exe
5648	OpenWith.exe
5648	OpenWith.exe
5648	OpenWith.exe
5648	OpenWith.exe
5648	OpenWith.exe
5648	OpenWith.exe
5648	OpenWith.exe
5648	OpenWith.exe
5648	OpenWith.exe
5648	OpenWith.exe
5648	OpenWith.exe
5648	OpenWith.exe
5648	OpenWith.exe
5648	OpenWith.exe
5648	OpenWith.exe
5648	OpenWith.exe
5648	OpenWith.exe
5648	OpenWith.exe
5880	AcroRd32.exe
5880	AcroRd32.exe
5880	AcroRd32.exe
5880	AcroRd32.exe
5880	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3404 wrote to memory of 4164	3404	msedge.exe	86
PID 3404 wrote to memory of 4164	3404	msedge.exe	86
PID 3404 wrote to memory of 5060	3404	msedge.exe	87
PID 3404 wrote to memory of 5060	3404	msedge.exe	87
PID 3404 wrote to memory of 5060	3404	msedge.exe	87
PID 3404 wrote to memory of 5060	3404	msedge.exe	87
PID 3404 wrote to memory of 5060	3404	msedge.exe	87
PID 3404 wrote to memory of 5060	3404	msedge.exe	87
PID 3404 wrote to memory of 5060	3404	msedge.exe	87
PID 3404 wrote to memory of 5060	3404	msedge.exe	87
PID 3404 wrote to memory of 5060	3404	msedge.exe	87
PID 3404 wrote to memory of 5060	3404	msedge.exe	87
PID 3404 wrote to memory of 5060	3404	msedge.exe	87
PID 3404 wrote to memory of 5060	3404	msedge.exe	87
PID 3404 wrote to memory of 5060	3404	msedge.exe	87
PID 3404 wrote to memory of 5060	3404	msedge.exe	87
PID 3404 wrote to memory of 5060	3404	msedge.exe	87
PID 3404 wrote to memory of 5060	3404	msedge.exe	87
PID 3404 wrote to memory of 5060	3404	msedge.exe	87
PID 3404 wrote to memory of 5060	3404	msedge.exe	87
PID 3404 wrote to memory of 5060	3404	msedge.exe	87
PID 3404 wrote to memory of 5060	3404	msedge.exe	87
PID 3404 wrote to memory of 5060	3404	msedge.exe	87
PID 3404 wrote to memory of 5060	3404	msedge.exe	87
PID 3404 wrote to memory of 5060	3404	msedge.exe	87
PID 3404 wrote to memory of 5060	3404	msedge.exe	87
PID 3404 wrote to memory of 5060	3404	msedge.exe	87
PID 3404 wrote to memory of 5060	3404	msedge.exe	87
PID 3404 wrote to memory of 5060	3404	msedge.exe	87
PID 3404 wrote to memory of 5060	3404	msedge.exe	87
PID 3404 wrote to memory of 5060	3404	msedge.exe	87
PID 3404 wrote to memory of 5060	3404	msedge.exe	87
PID 3404 wrote to memory of 5060	3404	msedge.exe	87
PID 3404 wrote to memory of 5060	3404	msedge.exe	87
PID 3404 wrote to memory of 5060	3404	msedge.exe	87
PID 3404 wrote to memory of 5060	3404	msedge.exe	87
PID 3404 wrote to memory of 5060	3404	msedge.exe	87
PID 3404 wrote to memory of 5060	3404	msedge.exe	87
PID 3404 wrote to memory of 5060	3404	msedge.exe	87
PID 3404 wrote to memory of 5060	3404	msedge.exe	87
PID 3404 wrote to memory of 5060	3404	msedge.exe	87
PID 3404 wrote to memory of 5060	3404	msedge.exe	87
PID 3404 wrote to memory of 3200	3404	msedge.exe	88
PID 3404 wrote to memory of 3200	3404	msedge.exe	88
PID 3404 wrote to memory of 860	3404	msedge.exe	89
PID 3404 wrote to memory of 860	3404	msedge.exe	89
PID 3404 wrote to memory of 860	3404	msedge.exe	89
PID 3404 wrote to memory of 860	3404	msedge.exe	89
PID 3404 wrote to memory of 860	3404	msedge.exe	89
PID 3404 wrote to memory of 860	3404	msedge.exe	89
PID 3404 wrote to memory of 860	3404	msedge.exe	89
PID 3404 wrote to memory of 860	3404	msedge.exe	89
PID 3404 wrote to memory of 860	3404	msedge.exe	89
PID 3404 wrote to memory of 860	3404	msedge.exe	89
PID 3404 wrote to memory of 860	3404	msedge.exe	89
PID 3404 wrote to memory of 860	3404	msedge.exe	89
PID 3404 wrote to memory of 860	3404	msedge.exe	89
PID 3404 wrote to memory of 860	3404	msedge.exe	89
PID 3404 wrote to memory of 860	3404	msedge.exe	89
PID 3404 wrote to memory of 860	3404	msedge.exe	89
PID 3404 wrote to memory of 860	3404	msedge.exe	89
PID 3404 wrote to memory of 860	3404	msedge.exe	89
PID 3404 wrote to memory of 860	3404	msedge.exe	89
PID 3404 wrote to memory of 860	3404	msedge.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\blender_cpu_check.dll,#1
1⤵
PID:756

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffb48113cb8,0x7ffb48113cc8,0x7ffb48113cd8
  2⤵
  PID:4164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1716,5465683106961899215,16831252243375574291,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1820 /prefetch:2
  2⤵
  PID:5060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1716,5465683106961899215,16831252243375574291,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2300 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1716,5465683106961899215,16831252243375574291,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2560 /prefetch:8
  2⤵
  PID:860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1716,5465683106961899215,16831252243375574291,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:2284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1716,5465683106961899215,16831252243375574291,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:1184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1716,5465683106961899215,16831252243375574291,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1804 /prefetch:1
  2⤵
  PID:468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1716,5465683106961899215,16831252243375574291,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4524 /prefetch:1
  2⤵
  PID:3536
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1716,5465683106961899215,16831252243375574291,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5188 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1716,5465683106961899215,16831252243375574291,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1428 /prefetch:1
  2⤵
  PID:3868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1716,5465683106961899215,16831252243375574291,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4856 /prefetch:1
  2⤵
  PID:3308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1716,5465683106961899215,16831252243375574291,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5272 /prefetch:1
  2⤵
  PID:1808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1716,5465683106961899215,16831252243375574291,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1428 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1716,5465683106961899215,16831252243375574291,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5348 /prefetch:1
  2⤵
  PID:4028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1716,5465683106961899215,16831252243375574291,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5192 /prefetch:1
  2⤵
  PID:3336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1716,5465683106961899215,16831252243375574291,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5560 /prefetch:8
  2⤵
  PID:1796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1716,5465683106961899215,16831252243375574291,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5416 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1716,5465683106961899215,16831252243375574291,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5568 /prefetch:1
  2⤵
  PID:3188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1716,5465683106961899215,16831252243375574291,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5872 /prefetch:1
  2⤵
  PID:3128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1716,5465683106961899215,16831252243375574291,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5884 /prefetch:1
  2⤵
  PID:1536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1716,5465683106961899215,16831252243375574291,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5692 /prefetch:1
  2⤵
  PID:4752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1716,5465683106961899215,16831252243375574291,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6392 /prefetch:8
  2⤵
  PID:812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1716,5465683106961899215,16831252243375574291,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6416 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:2148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1716,5465683106961899215,16831252243375574291,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5196 /prefetch:1
  2⤵
  PID:3980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1716,5465683106961899215,16831252243375574291,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6072 /prefetch:1
  2⤵
  PID:3392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1716,5465683106961899215,16831252243375574291,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6692 /prefetch:1
  2⤵
  PID:4576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1716,5465683106961899215,16831252243375574291,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1708 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1716,5465683106961899215,16831252243375574291,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5244 /prefetch:1
  2⤵
  PID:4760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1716,5465683106961899215,16831252243375574291,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5636 /prefetch:1
  2⤵
  PID:5104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1716,5465683106961899215,16831252243375574291,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7420 /prefetch:1
  2⤵
  PID:5288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1716,5465683106961899215,16831252243375574291,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5264 /prefetch:1
  2⤵
  PID:5184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1716,5465683106961899215,16831252243375574291,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5988 /prefetch:1
  2⤵
  PID:5208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1716,5465683106961899215,16831252243375574291,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3808 /prefetch:1
  2⤵
  PID:3572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1716,5465683106961899215,16831252243375574291,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7360 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:3868

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2364

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2092

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004E4 0x00000000000004E0
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2080

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4660

C:\Users\Admin\Downloads\Memz Clean.exe
"C:\Users\Admin\Downloads\Memz Clean.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=batch+virus+download
  2⤵
  PID:2384
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffb48113cb8,0x7ffb48113cc8,0x7ffb48113cd8
    3⤵
    PID:1680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=how+2+remove+a+virus
  2⤵
  PID:3228
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ffb48113cb8,0x7ffb48113cc8,0x7ffb48113cd8
    3⤵
    PID:3148

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:5648
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\Downloads\Cwelium.py"
  2⤵
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:5880
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6044
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=D4D1D183ECDF891E80364691C0A69286 --mojo-platform-channel-handle=1776 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      PID:1576
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=1451DB51E78A85E69F9FD8B8310D2361 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=1451DB51E78A85E69F9FD8B8310D2361 --renderer-client-id=2 --mojo-platform-channel-handle=1768 --allow-no-sandbox-job /prefetch:1
      4⤵
      System Location Discovery: System Language Discovery
      PID:904
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=936D0AFA04784DDCBFEFDFDE12D616B2 --mojo-platform-channel-handle=2312 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      PID:2164
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=E4FDF05CC4BC2E98DCE59D7AC5F24DBF --mojo-platform-channel-handle=1948 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      PID:2980
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=8168BB4B4A214FDE55CABD6CDF9395B0 --mojo-platform-channel-handle=1944 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      PID:1128

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:908

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
36KB

MD5
b30d3becc8731792523d599d949e63f5

SHA1
19350257e42d7aee17fb3bf139a9d3adb330fad4

SHA256
b1b77e96279ead2b460de3de70e2ea4f5ad1b853598a4e27a5caf3f1a32cc4f3

SHA512
523f54895fb07f62b9a5f72c8b62e83d4d9506bda57b183818615f6eb7286e3b9c5a50409bc5c5164867c3ccdeae88aa395ecca6bc7e36d991552f857510792e

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
56KB

MD5
752a1f26b18748311b691c7d8fc20633

SHA1
c1f8e83eebc1cc1e9b88c773338eb09ff82ab862

SHA256
111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131

SHA512
a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
f51326c30193e84cf6cda50a5281f2f7

SHA1
5710018794759f98d3798d4790e614c65cca633b

SHA256
2c89d8a7ef3411c71f1a4e71b219c374bfd9bff14142cc06939577bbe5e882c6

SHA512
fc2da40e0704d0feac041a1148e603c7a841034fba87dac3e02eaceaf1fe574b61d822bf7f7c09737e787b88c7e743afcfc4c2c668e9fdffddaba111af50555b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
026e0c65239e15ba609a874aeac2dc33

SHA1
a75e1622bc647ab73ab3bb2809872c2730dcf2df

SHA256
593f20dfb73d2b81a17bfcc1f246848080dfc96898a1a62c5ddca62105ed1292

SHA512
9fb7644c87bdd3430700f42137154069badbf2b7a67e5ac6c364382bca8cba95136d460f49279b346703d4b4fd81087e884822a01a2a38901568a3c3e3387569

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
228fefc98d7fb5b4e27c6abab1de7207

SHA1
ada493791316e154a906ec2c83c412adf3a7061a

SHA256
448d09169319374935a249b1fc76bcf2430b4e1436611f3c2f3331b6eafe55a2

SHA512
fa74f1cc5da8db978a7a5b8c9ebff3cd433660db7e91ce03c44a1d543dd667a51659ba79270d3d783d52b9e45d76d0f9467458df1482ded72ea79c873b2a5e56

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
62KB

MD5
c3c0eb5e044497577bec91b5970f6d30

SHA1
d833f81cf21f68d43ba64a6c28892945adc317a6

SHA256
eb48be34490ec9c4f9402b882166cd82cd317b51b2a49aae75cdf9ee035035eb

SHA512
83d3545a4ed9eed2d25f98c4c9f100ae0ac5e4bc8828dccadee38553b7633bb63222132df8ec09d32eb37d960accb76e7aab5719fc08cc0a4ef07b053f30cf38

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
67KB

MD5
a074f116c725add93a8a828fbdbbd56c

SHA1
88ca00a085140baeae0fd3072635afe3f841d88f

SHA256
4cdcda7d8363be5bc824064259780779e7c046d56399c8a191106f55ce2ed8a6

SHA512
43ed55cda35bde93fc93c408908ab126e512c45611a994d7f4e5c85d4f2d90d573066082cb7b8dffce6a24a1f96cd534586646719b214ac7874132163faa5f28

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
19KB

MD5
2e86a72f4e82614cd4842950d2e0a716

SHA1
d7b4ee0c9af735d098bff474632fc2c0113e0b9c

SHA256
c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f

SHA512
7a5fd3e3e89c5f8afca33b2d02e5440934e5186b9fa6367436e8d20ad42b211579225e73e3a685e5e763fa3f907fc4632b9425e8bd6d6f07c5c986b6556d47b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
63KB

MD5
710d7637cc7e21b62fd3efe6aba1fd27

SHA1
8645d6b137064c7b38e10c736724e17787db6cf3

SHA256
c0997474b99524325dfedb5c020436e7ea9f9c9a1a759ed6daf7bdd4890bdc2b

SHA512
19aa77bed3c441228789cf8f931ca6194cc8d4bc7bb85d892faf5eaeda67d22c8c3b066f8ceda8169177da95a1fe111bd3436ceeaf4c784bd2bf96617f4d0c44

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
84KB

MD5
74e33b4b54f4d1f3da06ab47c5936a13

SHA1
6e5976d593b6ee3dca3c4dbbb90071b76e1cd85c

SHA256
535fc48679c38decd459ad656bdd6914e539754265244d0cc7b1da6bddf3e287

SHA512
79218e8ee50484af968480ff9b211815c97c3f3035414e685aa5d15d9b4152682d87b66202339f212bf3b463a074bf7a4431107b50303f28e2eb4b17843991c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000025

Filesize
210KB

MD5
48d2860dd3168b6f06a4f27c6791bcaa

SHA1
f5f803efed91cd45a36c3d6acdffaaf0e863bf8c

SHA256
04d7bf7a6586ef00516bdb3f7b96c65e0b9c6b940f4b145121ed00f6116bbb77

SHA512
172da615b5b97a0c17f80ddd8d7406e278cd26afd1eb45a052cde0cb55b92febe49773b1e02cf9e9adca2f34abbaa6d7b83eaad4e08c828ef4bf26f23b95584e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
d8a4b68482afd5d62161c30b006d9bc4

SHA1
1a2e01d2afeec870a60b04beff6d564dcf87dafd

SHA256
7b7b5594568d45e3aecd23a9410016ea80435d71990bdfe2f3445e48781498b0

SHA512
8e82e20c54d76ad78786ca43f66c027291c9f6dc7b2f876d59573e1b4b8a59d50226e1af03374be766bbc57447c4793caaffb4988ff3039fb70e886ec0f03994

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
1bb7b87eaca4713fa3c5992dfb623f1a

SHA1
90853f5287e8be7cf5c74959cf3fe187036ba5d1

SHA256
88d95294ba5041e00be75503144f935cc610fee967d77c66db4543be4bdba4f4

SHA512
031908f9e158ca0bcdd0faee54d1cf7c98e08aa0e79b58050e3a555b0d9509991c46fa747643b5da4181c6760d3eb2bc3abb1cbdb610b8e95d391bc8e83b9586

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
78922aa99830b82507f7f8d26d6baf58

SHA1
1f0e812ea1fc91771489ba79b027009e0dc61af1

SHA256
be1531a88ffc8e090b77dc260290071eaf30f1c4a9447fdc9b558fa3be899f14

SHA512
089935079c122851a1424f85db2dbae014337af465b3a1b193cd1b91a9af7f03fcf7e063a68de9f69a322caed360d6e1a75f8c5a33c62ae5b633310c48c75d18

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
8ec49ae7b4dbdb5beb01baeef5326ef5

SHA1
34af3e577b7f8be670756c20ca1348153b0fad6b

SHA256
18611e47b40dbb7e370e8904accdc0f4dc5c726be3fdd9835cb1aacaa1f1f93b

SHA512
079b2c519272624631580dc3fb5cacc52a0a38fc77ffd05aae2be27a125ed1d7f0e8894f74ebca610e67ee18c7f6a7fed20dd93c041a89b36985a84d3c34382b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
8122d761311ccf242bfa6dbe575d3190

SHA1
0910d8507aa547aa3c205ad8d793b82b871132e8

SHA256
6ae3e0930e6f2722c114e79a2e863995c622ec12cf9de3506ad94841be30eff2

SHA512
be8b47fc5f9079828de6831af7c8815fb8e8f608ccec0535279073a85c4d1405cd2d6c5131bfd2d3389a210a554725046ae47079bd5f00587abfceddce8b57df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
bc81b32db542a7b52d9c6ca6bcaf60dd

SHA1
decd0b477bdae7c77b0f5cb7285f00d260cc8b3f

SHA256
66181bd07208c08102f5404209801d82c89e222b82dbb17eca2a0e7e4b8d1dc1

SHA512
9b698f9ef1a5a81ea50384bf418df1bd5e40f00eb042754996acce3ef6ff43d03886cbad81118905b5e4a31af66e2b28556d22e3e24403212fbc77dfca591572

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
870B

MD5
ff08d7352bd3d0d46cd5c51f61496384

SHA1
1987db61348ec1065369e7d4f09cca2891bceea1

SHA256
ba0ac047a64bc673cf605ac985c90b3aa032f2c44645839bb0d316c0d83b119b

SHA512
e2d93e6d4cef9e5295fc91176beb71ded8e81b9d74907dad4aa6c519e1f85c29f64f10d7c992609fc032ad4e947818039305b7cdce5b08e0a7f95ba9c084fa5a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
9bb67508101703158a68776a42cb40c2

SHA1
5b710819d151a1ae71b3113d0554ebf25d51fa8a

SHA256
f2e69566202167ea049fdba5a5982cdbaab6c898a57cf5a7fd1e4ad73ef67031

SHA512
8246144d3e5700010e2af3ce89aa4bf69cbbf776084d0869623114cd162c7913bcb94d9c79c5208e7d40333c335c01e9346985d37d20575f53289e70205b8f65

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
884ccc050b6682cf7d62b4081411a1e3

SHA1
40e170188f6c6e040b02af6e654b487943ab3d0a

SHA256
f0e7bdbb016eea981bc8c1d96aa64d8301e0fa65acdb8b5f6353f588d828bbf3

SHA512
4d50538b23520afdca905c4e9ba16cd4e5004a0c591fda65498816ad461916c58602e0855e5643b8bad4a5bdb9a2c5c95a089f01c419aeea36b1b60aa3172a7b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
cbedc0fc996bb9c1fe69827633af16b1

SHA1
2cffad81f5bd8fd69b9b3a9318452cf723693703

SHA256
eb332f5fda3fee3e1d01110bb1302b946a3076fe53136576d485e3f5e24fb300

SHA512
134ab95ad22586a6620c94474c10a76e82515175d682e93f1d944ea03384c069044ef118d5baab4f043a3408c54a80d9fba747cd3f6c26c8a56fa61002293822

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
4e88b035313264dda72a314cf7a99fe5

SHA1
7614e64f1955be355b852cd6d9b20226e9594577

SHA256
599171fd7700e24f8fd10e6aefc4a02258cbd57cf7939405f4f813cc1bafd960

SHA512
9769d62b4c707ccd9c2ba7d692e40d6cee2b69b3efe931e2c7450fcd686faabc9dad3b91b63a0a1685810c3e265efc9341d7c31a7c25c0bffae0b26622e60929

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
946baab26cf01ff11daa51cd70079fa6

SHA1
e8988cc0cc37d94c61787a680e97a68e80f93756

SHA256
64d9c22f9fd09278cced68a958bccf81e25004ae497d2027b75e1f5070619ad6

SHA512
4cdf90529094fbc0de1a981be158121d5eddfdcee539a5167fa1ab140ae84ab27a1436e8d705f3a543efe527f4d94b057b4b0e72b08467e365636bc589b6c147

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d17f476f9d815e52cf37c0d160d57dc0

SHA1
3267714db5f8eddb85332c8d04782de0c8afce02

SHA256
40ff530dc122431e3df86cbffb886b9fde1a08bf8640eaaa9c1d9776391af8e7

SHA512
ef4aa78908813c5454e8ca91651c0df6bffee374e3c390402c141430901c0d3f26ac3d37964f4c22720d580f63b6f3c415da56f0d399032a779bdaad3bac9a23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
735e89708b06b1622365e6bff77652e1

SHA1
815272b9116820d2d34fa57a9b6b4bc49600887e

SHA256
7d9eb720522a601ba606441f6f852ef3ba08f546f47f8376b699d85bc2f688c2

SHA512
e91461dae36998ffe3eb8556627d82877775ffe43e475879c030734c8522b94ebbeb208acc71c908fa130ead172f1d1b35cc1d2e3b9f8b9b60549545c47f1b87

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
96ae8700b00cac9d0c892f33b176bd99

SHA1
8b0f6a4b9ca71a8c8785c81fba1299d9fd673234

SHA256
db3060070fe9dc2cefa7cc42e7314f70f3c007e6333ac1c70a3fb44e0c164102

SHA512
3357585b15fbf5b01490048c41bcd72d2ec9d562d1f39ec1df3e20e76fc1b74364ae78c754ebb84edeb96378de3de539b622ac768fcf713b03dd3ff743158bfe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
8d1e9b5e98adcc900202bc81d7a375a2

SHA1
7a0cde1f539d36a67d6b37a4511e966d0c74ca0d

SHA256
9dbd63b6431152d44acf61efee2acb43e2bde6472d9452b755832b6f92c113db

SHA512
7afb12a4a5f73490cb150eba078623c294a229872c79107fddd8b9c7fd060166e2fc25704c1686d433adcf608ccfc9c60b11c22b752ca19548a87f76f2a76024

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
c42e2553fad244e1e689ab691838ea32

SHA1
48cfc4d3d48c0da3f69bf1568c58849fe0f40673

SHA256
1ca3d0b29cb2eddd89ac18776c91ed7284e60a1b3404ee9a9f2ff5ae55ac8c56

SHA512
ce3702205bef66c55bd46fcbc05f888bed6113673836fb80966a0f7eaaabada9a6737bf36e2a34b9fa57da27fbae07b74b888b5edee4f4e529a03359455626f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
0a613cc3caa12554659351d9942210a6

SHA1
de655120676079281f59a1fd164ac90fc6489e6e

SHA256
5b394b2fdb609d184a44e245b2735d4e53398731cc226a26eb1ed38484183d7f

SHA512
f62cd968c8d1d971fc3dffb032fb21a2aea4880c995b2dbdd3d100d3bba8922fa6fbc21fa9523160d72638e26babde68ff5a0b3d690056abf0f30eee13092a7e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
a92f60bae0cedd072d67618ed10b22ce

SHA1
f39ac4951c76a4af1b7527c1329a85bc97dfb596

SHA256
cc77b80bf377f09195f2c8407e972df6b369ea7a70409ab5c270e07998ccbae1

SHA512
2e0c77233890f4c221352e5d3c188593b540c29db649f92fa426c76ebaaefc3a986dd507322546096af05b8543b32e55760303975198e71a8388686cdd5f2720

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
1be24abfbc6cdfa594ecf385355f55bf

SHA1
4287ac10cab6986a0b3782bbe554be79840e10ab

SHA256
ff793ac64b9e38f4e046eb52f5ff4460360cdde887e832bd0c5d452dd369dd7f

SHA512
8357f886775f53a7a2386d831a73bfb0f3356c8aa1f022eff64fb4cee1ecc355562308d6f3b26b0bac4d199d7048f0dab574ac2fd000bed34e2867d977d932ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
52bdf4843a76b37c6c1bb112e81a3f8b

SHA1
aea0822cb2acf80d6f3228e360edfb10eaa24885

SHA256
504856c32483afdd5e24f22d0492eb92ceab78562771714713516bbab8b370b4

SHA512
b3f5bb7f6ab3f411d473d27295917652023b89493505d2001187298308ebbe3e88788e7800e6b14c963e9974a83e9f3237e1533ed2860ec67d37ab6023b02514

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
25a0f92063024dfb688d6110f1f2926e

SHA1
792d1e26b417d28d95c09e67d8243c424c283c76

SHA256
2c57cdb3e3e05a66ff0e9cccba22e92d48b6d5e449552401a46b715234914911

SHA512
799308bc0f1f0fa1f42013384f3d2bcfe027494ca789e99baf77cea533c322312a2c1ecb4e3ffc8f714255d56f48df1fe93e2e8690648ecd65c58117c8833bd4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5848ac.TMP

Filesize
538B

MD5
88253b0d60a79ee250d2472d94652247

SHA1
297342a012de6187eaeed0b1269f3ead48a25c62

SHA256
5dec0afc7f9f3f2bbb99ccdd66f384b119c733795f4806a7db62d86a95e5e1fe

SHA512
55d41d2e5fdceef7db7e7de4b5b8646091c5a4cc4bb6f9c94764ac91e22e7b4f7b2ac5fb29d9ba574cdf0e18cc6d2c0ffa4087773e33f50a4942ee30bbe2e766

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
c1455ad087d23288fdaecd385456fbee

SHA1
9fe0cd5722a203de0c87a1eaabc09a5cdfece936

SHA256
10bb86af09bbb97603006839b462745beb5a699b560291ea2dd345f9c57c60ad

SHA512
94d202f8eec5f3f5816cf14b638cba08befd37e9d2295d6a80bae7422bb8f4361c99449f663ff045eed4dd1c09836877e58896ac3f818c803fe75bcdd644553d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
34eaf91d72c756ca52b5c47583bfb934

SHA1
485c118bc091484be8f68543fbc9ced589acf643

SHA256
f005628433fac391d0d3715cee7e08560f83c9d51e2248585f8489a222d1ac11

SHA512
e3135661c5e1138307958c1e97f60054100ad97dad1fba387834598d4e5703264fdcaf46dbd7f922bb1e334679afe2b8291a850e7ee8d7aabc1b946efe097902

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
083db8bb2a4ca619f5e1482e76733eb3

SHA1
62259d7acdf6cf25a47dbfe97aad91ad8b89f78d

SHA256
60b85cc1c16beae8d5cfa6e77f1a6a3abe0277292c5921675ff35c8cf78d7182

SHA512
b9e763e7d120a27895ea6db5c9cc60cb83003583f2003eb611a201ef023f5b05061dbb4dfc41c8c21e3ae8d4ea2c839ad82920059893018f1e104327f66ddf19

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
6754b166cddfbc14d8d01029631dbe46

SHA1
c6609a7edec3c947e509704a6156d0e2d203367f

SHA256
8328415b6b4a1c434f4f76925759d9cd490b3db5e208c0db16eba99d319d02c6

SHA512
2b28c8d8a4f783d53dd562f8376b045d95f45266089ae825df841548ef7e82bdea7d653fe6938004ecd70eb0244647239682955c85f6eab4e2947e5ba9c1cfbe

Download Submit
C:\Users\Admin\Downloads\Cwelium.py

Filesize
77KB

MD5
4e4a0c49f44fcb1d70e22b9042dc0555

SHA1
ee38fc1e6e1f71b8624f9137f01254dc6b067eea

SHA256
f1d05726fe0a59ed920d043ed8153e0d26bab1512360fc9e825280c25503c1d9

SHA512
23c0c0942ffde25d0e1cc0de85c295dfa777381e439af7112435981f65872bb6a1f13c69e15d3e3436875703dbf8f7e0127cd9b02404f9c070cc084e6450a2b2

Download Submit
C:\Users\Admin\Downloads\Memz Clean.exe

Filesize
12KB

MD5
9c642c5b111ee85a6bccffc7af896a51

SHA1
eca8571b994fd40e2018f48c214fab6472a98bab

SHA256
4bbf7589615ebdb6c769d6d2e7bdcb26072bac0cda6e225a4133ba8819e688d5

SHA512
23cc74b5a7bdf70ba789d1730a0009414cfb9c780544e3d8d841be58782b9a9a089969c4295a0da25d07285505992386486d6ff0524e75605b96bb99cd3aaa1c

Download Submit
C:\Users\Admin\Downloads\Memz Clean.exe:Zone.Identifier

Filesize
55B

MD5
0f98a5550abe0fb880568b1480c96a1c

SHA1
d2ce9f7057b201d31f79f3aee2225d89f36be07d

SHA256
2dfb5f4b33e4cf8237b732c02b1f2b1192ffe4b83114bcf821f489bbf48c6aa1

SHA512
dbc1150d831950684ab37407defac0177b7583da0fe13ee8f8eeb65e8b05d23b357722246888189b4681b97507a4262ece96a1c458c4427a9a41d8ea8d11a2f6

Download Submit
memory/5880-1306-0x0000000009890000-0x0000000009B3B000-memory.dmp

Filesize
2.7MB

Download