fabookie | 67b1a7835687bf5851cf29539b2d0ce90ab30d373edfcf9ee54237026c67df33

Resubmissions

04-10-2024 18:01

241004-wl132axhpm 10

22-04-2024 20:52

27-02-2024 22:40

03-01-2024 09:53

29-12-2023 23:48

Analysis

max time kernel
150s
max time network
149s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
04-10-2024 18:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

078192e792b12a8d9980f364e110155c.exe
Size

8.7MB
MD5

078192e792b12a8d9980f364e110155c
SHA1

89596e27530eeccd6ad9644aa045e8e0499301a1
SHA256

67b1a7835687bf5851cf29539b2d0ce90ab30d373edfcf9ee54237026c67df33
SHA512

72a2f85f8aa87fed3b84641bfc4ecde195588837da52553871b9aa917b26c073fea973d2e521290ac08ef6907a21677ebf7bb7886ddef3996625cc81855c0bbc
SSDEEP

196608:UYE5OOysmxHcbDvsAKhZcIGijUtw+cs3Ax9stqFiRtHTV3hZF:XE5OOSuszcTtwp1s8gRtHT5J

Score

10^/10

fabookie ffdroider glupteba privateloader socelars discovery dropper evasion loader persistence privilege_escalation rootkit spyware stealer trojan upx vmprotect

Malware Config

Extracted

Family

socelars

http://www.iyiqian.com/

http://www.xxhufdc.top/

http://www.uefhkice.xyz/

http://www.fcektsy.top/

Extracted

Family

ffdroider

http://186.2.171.3

Signatures

Detect Fabookie payload 1 IoCs

resource	yara_rule
behavioral1/files/0x000b00000001ab58-27.dat	family_fabookie

FFDroider
Stealer targeting social media platform users first seen in April 2022.
stealer ffdroider

FFDroider payload 3 IoCs

resource	yara_rule
behavioral1/memory/4132-82-0x0000000000400000-0x000000000060D000-memory.dmp	family_ffdroider
behavioral1/memory/4132-1340-0x0000000000400000-0x000000000060D000-memory.dmp	family_ffdroider
behavioral1/memory/4132-1805-0x0000000000400000-0x000000000060D000-memory.dmp	family_ffdroider

Fabookie
Fabookie is facebook account info stealer.
spyware stealer fabookie
Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Modifies Windows Defender Real-time Protection settings 3 TTPs 7 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	Complete.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	Complete.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	Complete.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRawWriteNotification = "1"	Complete.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Complete.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	Complete.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	Complete.exe

PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
loader privateloader

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2812	4868	rUNdlL32.eXe	91

Socelars
Socelars is an infostealer targeting browser cookies and credit card credentials.
stealer socelars

Socelars payload 1 IoCs

resource	yara_rule
behavioral1/files/0x000800000001ac43-39.dat	family_socelars

Windows security bypass 2 TTPs 10 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\csrss = "0"	Info.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\QuietRiver = "0"	Info.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\windefender.exe = "0"	Info.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\csrss.exe = "0"	Info.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\windefender.exe = "0"	Info.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\Info.exe = "0"	Info.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows = "0"	Info.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\rss = "0"	Info.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\wup = "0"	Info.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\System32\drivers = "0"	Info.exe

Detected Nirsoft tools 2 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

resource	yara_rule
behavioral1/memory/4048-73-0x0000000000400000-0x000000000045B000-memory.dmp	Nirsoft
behavioral1/memory/1428-312-0x0000000000400000-0x0000000000422000-memory.dmp	Nirsoft

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
508	netsh.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Control Panel\International\Geo\Nation	078192e792b12a8d9980f364e110155c.exe

Executes dropped EXE 17 IoCs

pid	Process
380	Files.exe
4668	KRSetp.exe
4208	Install.exe
1744	Folder.exe
4424	Info.exe
4420	Install_Files.exe
4048	jfiag3g_gg.exe
4924	jamesdirect.exe
4748	Complete.exe
1928	pub2.exe
4132	md9_1sjm.exe
1776	Folder.exe
1428	jfiag3g_gg.exe
5684	Info.exe
3340	csrss.exe
6140	jamesdirect.exe
7084	injector.exe

Loads dropped DLL 1 IoCs

pid	Process
4624	rundll32.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

VMProtect packed file 5 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral1/files/0x000700000001ac50-84.dat	vmprotect
behavioral1/memory/4132-82-0x0000000000400000-0x000000000060D000-memory.dmp	vmprotect
behavioral1/memory/4132-81-0x0000000000400000-0x000000000060D000-memory.dmp	vmprotect
behavioral1/memory/4132-1340-0x0000000000400000-0x000000000060D000-memory.dmp	vmprotect
behavioral1/memory/4132-1805-0x0000000000400000-0x000000000060D000-memory.dmp	vmprotect

Windows security modification 2 TTPs 10 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows = "0"	Info.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\csrss = "0"	Info.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\windefender.exe = "0"	Info.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\csrss.exe = "0"	Info.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\windefender.exe = "0"	Info.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\Info.exe = "0"	Info.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\rss = "0"	Info.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\QuietRiver = "0"	Info.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\wup = "0"	Info.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\System32\drivers = "0"	Info.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Microsoft\Windows\CurrentVersion\Run\QuietRiver = "\"C:\\Windows\\rss\\csrss.exe\""	Info.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\haleng = "C:\\Users\\Admin\\AppData\\Local\\Temp\\haleng.ex"	Files.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	md9_1sjm.exe

Drops Chrome extension 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\kjkfjbddnkpfcflenfcleijhgaaiapaf\8.66.88_0\manifest.json	Install.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 8 IoCs

Web Service

T1102

flow	ioc
19	iplogger.org
23	iplogger.org
46	iplogger.org
58	iplogger.org
59	iplogger.org
64	iplogger.org
65	iplogger.org
17	iplogger.org

Looks up external IP address via web service 7 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	ip-api.com
4	ipinfo.io
7	ipinfo.io
8	ipinfo.io
20	api.db-ip.com
21	api.db-ip.com
22	api.db-ip.com

Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.

Manipulates WinMonFS driver. 1 IoCs

Roottkits write to WinMonFS to hide directories/files from being detected.

rootkit evasion

description	ioc	Process
File opened for modification	\??\WinMonFS	csrss.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\Tasks\csrss	svchost.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2604 set thread context of 3700	2604	svchost.exe	96
PID 4924 set thread context of 6140	4924	jamesdirect.exe	128

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000700000001ac4d-61.dat	upx
behavioral1/memory/4048-73-0x0000000000400000-0x000000000045B000-memory.dmp	upx
behavioral1/memory/4048-65-0x0000000000400000-0x000000000045B000-memory.dmp	upx
behavioral1/files/0x000a00000001ab56-303.dat	upx
behavioral1/memory/1428-304-0x0000000000400000-0x0000000000422000-memory.dmp	upx
behavioral1/memory/1428-312-0x0000000000400000-0x0000000000422000-memory.dmp	upx

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\VBoxMiniRdrDN	Info.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File opened for modification	C:\Windows\rss	Info.exe
File created	C:\Windows\rss\csrss.exe	Info.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3276	1928	WerFault.exe	82

System Location Discovery: System Language Discovery 1 TTPs 20 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Info.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pub2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jamesdirect.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Folder.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Files.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jfiag3g_gg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Install_Files.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Info.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jamesdirect.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Install.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jfiag3g_gg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Complete.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	md9_1sjm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Folder.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xcopy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	078192e792b12a8d9980f364e110155c.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	pub2.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	pub2.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	pub2.exe

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

GoLang User-Agent 1 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	103	Go-http-client/1.1

Kills process with taskkill 1 IoCs

evasion

pid	Process
312	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	Info.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2181 = "Astrakhan Daylight Time"	csrss.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1971 = "Belarus Daylight Time"	csrss.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-661 = "Cen. Australia Daylight Time"	csrss.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-342 = "Egypt Standard Time"	csrss.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2411 = "Marquesas Daylight Time"	csrss.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-31 = "Mid-Atlantic Daylight Time"	csrss.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-341 = "Egypt Daylight Time"	csrss.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-261 = "GMT Daylight Time"	csrss.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-335 = "Jordan Standard Time"	csrss.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-772 = "Montevideo Standard Time"	csrss.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-72 = "Newfoundland Standard Time"	csrss.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	Info.exe
Key created	\REGISTRY\USER\.DEFAULT\System\CurrentControlSet	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-131 = "US Eastern Daylight Time"	csrss.exe
Key created	\REGISTRY\USER\.DEFAULT\System\CurrentControlSet\Control\NetTrace	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\System\CurrentControlSet\Control\NetTrace\Session	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-451 = "Caucasus Daylight Time"	csrss.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-722 = "Central Pacific Standard Time"	csrss.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-52 = "Greenland Standard Time"	csrss.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-201 = "US Mountain Daylight Time"	csrss.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	Info.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2161 = "Altai Daylight Time"	csrss.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-452 = "Caucasus Standard Time"	csrss.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-171 = "Central Daylight Time (Mexico)"	csrss.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-271 = "Greenwich Daylight Time"	csrss.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-362 = "GTB Standard Time"	csrss.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-32 = "Mid-Atlantic Standard Time"	csrss.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2321 = "Sakhalin Daylight Time"	csrss.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-382 = "South Africa Standard Time"	csrss.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-751 = "Tonga Daylight Time"	csrss.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-202 = "US Mountain Standard Time"	csrss.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-912 = "Mauritius Standard Time"	csrss.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-364 = "Middle East Daylight Time"	csrss.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2791 = "Novosibirsk Daylight Time"	csrss.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2572 = "Turks and Caicos Standard Time"	csrss.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-401 = "Arabic Daylight Time"	csrss.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-384 = "Namibia Daylight Time"	csrss.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2842 = "Saratov Standard Time"	csrss.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2432 = "Cuba Standard Time"	csrss.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-385 = "Namibia Standard Time"	csrss.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	Info.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2162 = "Altai Standard Time"	csrss.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2342 = "Haiti Standard Time"	csrss.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2752 = "Tomsk Standard Time"	csrss.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1502 = "Turkey Standard Time"	csrss.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2391 = "Aleutian Daylight Time"	csrss.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-291 = "Central European Daylight Time"	csrss.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-272 = "Greenwich Standard Time"	csrss.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1911 = "Russia TZ 10 Daylight Time"	csrss.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	Info.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-672 = "AUS Eastern Standard Time"	csrss.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-142 = "Canada Central Standard Time"	csrss.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-891 = "Morocco Daylight Time"	csrss.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-381 = "South Africa Daylight Time"	csrss.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-532 = "Sri Lanka Standard Time"	csrss.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-931 = "Coordinated Universal Time"	csrss.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2492 = "Aus Central W. Standard Time"	csrss.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1891 = "Russia TZ 3 Daylight Time"	csrss.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-831 = "SA Eastern Daylight Time"	csrss.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	Info.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-652 = "AUS Central Standard Time"	csrss.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2042 = "Eastern Standard Time (Mexico)"	csrss.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-542 = "Myanmar Standard Time"	csrss.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\msn.com	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionHigh = "268435456"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingDelete	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-SubSysId = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\DynamicCodePolicy = 00000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\CIStatus	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif = 01000000d8faf94d3a0e626d0a2079ee8d0676c118ff28296e11c36577e6cbd365435c61a0981a28e154416214ec973205a056de37197545fb99e02acd90	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionLow = "395205405"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DomainSuggestion	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore\LastCleanup = ce5940788716db01	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\Total	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\Total\ = "101"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate\CRLs	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BingPageData\RulesFileNextUpdateDate = "434227001"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{AEBA21FA-782A-4A90-978D-B7216 = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\CA\CTLs	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Privacy\InProgressFlags = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Privacy	MicrosoftEdge.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3G51HL4I-1PF3-A1H0-WPFI-30022GM05LHE}\1 = "30"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\EdpDomStorage\www.msn.com	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\Extensions	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\CA\Certificates	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\trust\Certificates	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Disallowed\Certificates	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.15063.0\"hypervisor=\"No Hypervisor (No SLAT)\""	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 0a8f09878716db01	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\Active = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 9b24167d8716db01	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\CA\CRLs	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionLow = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionLow = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListDOSTime = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 8d6432728716db01	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DomainSuggestion\FileNames\	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\IETld\LowMic	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DXFeatureLevel = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5516	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4624	rundll32.exe
4624	rundll32.exe
2604	svchost.exe
2604	svchost.exe
1428	jfiag3g_gg.exe
1428	jfiag3g_gg.exe
4424	Info.exe
4424	Info.exe
5604	chrome.exe
5604	chrome.exe
5684	Info.exe
5684	Info.exe
4420	Install_Files.exe
4420	Install_Files.exe
4420	Install_Files.exe
4420	Install_Files.exe
4420	Install_Files.exe
4420	Install_Files.exe
4420	Install_Files.exe
4420	Install_Files.exe
4420	Install_Files.exe
4420	Install_Files.exe
4420	Install_Files.exe
4420	Install_Files.exe
3340	csrss.exe
3340	csrss.exe
7084	injector.exe
7084	injector.exe
7084	injector.exe
7084	injector.exe
7084	injector.exe
7084	injector.exe
7084	injector.exe
7084	injector.exe
7084	injector.exe
7084	injector.exe
7084	injector.exe
7084	injector.exe
7084	injector.exe
7084	injector.exe
7084	injector.exe
7084	injector.exe
7084	injector.exe
7084	injector.exe
7084	injector.exe
7084	injector.exe
7084	injector.exe
7084	injector.exe
7084	injector.exe
7084	injector.exe
7084	injector.exe
7084	injector.exe
7084	injector.exe
7084	injector.exe
7084	injector.exe
7084	injector.exe
7084	injector.exe
7084	injector.exe
7084	injector.exe
7084	injector.exe
7084	injector.exe
7084	injector.exe
7084	injector.exe
7084	injector.exe

Suspicious behavior: MapViewOfSection 9 IoCs

pid	Process
4148	MicrosoftEdgeCP.exe
4148	MicrosoftEdgeCP.exe
4148	MicrosoftEdgeCP.exe
4148	MicrosoftEdgeCP.exe
4148	MicrosoftEdgeCP.exe
4148	MicrosoftEdgeCP.exe
4148	MicrosoftEdgeCP.exe
4148	MicrosoftEdgeCP.exe
4148	MicrosoftEdgeCP.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
5604	chrome.exe
5604	chrome.exe
5604	chrome.exe
5604	chrome.exe
5604	chrome.exe
5604	chrome.exe
5604	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeCreateTokenPrivilege	4208	Install.exe
Token: SeAssignPrimaryTokenPrivilege	4208	Install.exe
Token: SeLockMemoryPrivilege	4208	Install.exe
Token: SeIncreaseQuotaPrivilege	4208	Install.exe
Token: SeMachineAccountPrivilege	4208	Install.exe
Token: SeTcbPrivilege	4208	Install.exe
Token: SeSecurityPrivilege	4208	Install.exe
Token: SeTakeOwnershipPrivilege	4208	Install.exe
Token: SeLoadDriverPrivilege	4208	Install.exe
Token: SeSystemProfilePrivilege	4208	Install.exe
Token: SeSystemtimePrivilege	4208	Install.exe
Token: SeProfSingleProcessPrivilege	4208	Install.exe
Token: SeIncBasePriorityPrivilege	4208	Install.exe
Token: SeCreatePagefilePrivilege	4208	Install.exe
Token: SeCreatePermanentPrivilege	4208	Install.exe
Token: SeBackupPrivilege	4208	Install.exe
Token: SeRestorePrivilege	4208	Install.exe
Token: SeShutdownPrivilege	4208	Install.exe
Token: SeDebugPrivilege	4208	Install.exe
Token: SeAuditPrivilege	4208	Install.exe
Token: SeSystemEnvironmentPrivilege	4208	Install.exe
Token: SeChangeNotifyPrivilege	4208	Install.exe
Token: SeRemoteShutdownPrivilege	4208	Install.exe
Token: SeUndockPrivilege	4208	Install.exe
Token: SeSyncAgentPrivilege	4208	Install.exe
Token: SeEnableDelegationPrivilege	4208	Install.exe
Token: SeManageVolumePrivilege	4208	Install.exe
Token: SeImpersonatePrivilege	4208	Install.exe
Token: SeCreateGlobalPrivilege	4208	Install.exe
Token: 31	4208	Install.exe
Token: 32	4208	Install.exe
Token: 33	4208	Install.exe
Token: 34	4208	Install.exe
Token: 35	4208	Install.exe
Token: SeDebugPrivilege	4668	KRSetp.exe
Token: SeDebugPrivilege	4624	rundll32.exe
Token: SeDebugPrivilege	4624	rundll32.exe
Token: SeDebugPrivilege	2604	svchost.exe
Token: SeDebugPrivilege	4624	rundll32.exe
Token: SeDebugPrivilege	4624	rundll32.exe
Token: SeDebugPrivilege	4624	rundll32.exe
Token: SeDebugPrivilege	4624	rundll32.exe
Token: SeDebugPrivilege	4624	rundll32.exe
Token: SeDebugPrivilege	4624	rundll32.exe
Token: SeDebugPrivilege	4624	rundll32.exe
Token: SeDebugPrivilege	4624	rundll32.exe
Token: SeDebugPrivilege	4624	rundll32.exe
Token: SeDebugPrivilege	4624	rundll32.exe
Token: SeDebugPrivilege	4624	rundll32.exe
Token: SeDebugPrivilege	4624	rundll32.exe
Token: SeDebugPrivilege	4624	rundll32.exe
Token: SeAssignPrimaryTokenPrivilege	2712	svchost.exe
Token: SeIncreaseQuotaPrivilege	2712	svchost.exe
Token: SeSecurityPrivilege	2712	svchost.exe
Token: SeTakeOwnershipPrivilege	2712	svchost.exe
Token: SeLoadDriverPrivilege	2712	svchost.exe
Token: SeSystemtimePrivilege	2712	svchost.exe
Token: SeBackupPrivilege	2712	svchost.exe
Token: SeRestorePrivilege	2712	svchost.exe
Token: SeShutdownPrivilege	2712	svchost.exe
Token: SeSystemEnvironmentPrivilege	2712	svchost.exe
Token: SeUndockPrivilege	2712	svchost.exe
Token: SeManageVolumePrivilege	2712	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2712	svchost.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
5604	chrome.exe
5604	chrome.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
4420	Install_Files.exe
4748	Complete.exe
748	MicrosoftEdge.exe
4148	MicrosoftEdgeCP.exe
4544	MicrosoftEdgeCP.exe
4148	MicrosoftEdgeCP.exe
2720	MicrosoftEdgeCP.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3012 wrote to memory of 380	3012	078192e792b12a8d9980f364e110155c.exe	74
PID 3012 wrote to memory of 380	3012	078192e792b12a8d9980f364e110155c.exe	74
PID 3012 wrote to memory of 380	3012	078192e792b12a8d9980f364e110155c.exe	74
PID 3012 wrote to memory of 4668	3012	078192e792b12a8d9980f364e110155c.exe	76
PID 3012 wrote to memory of 4668	3012	078192e792b12a8d9980f364e110155c.exe	76
PID 3012 wrote to memory of 4208	3012	078192e792b12a8d9980f364e110155c.exe	77
PID 3012 wrote to memory of 4208	3012	078192e792b12a8d9980f364e110155c.exe	77
PID 3012 wrote to memory of 4208	3012	078192e792b12a8d9980f364e110155c.exe	77
PID 3012 wrote to memory of 1744	3012	078192e792b12a8d9980f364e110155c.exe	78
PID 3012 wrote to memory of 1744	3012	078192e792b12a8d9980f364e110155c.exe	78
PID 3012 wrote to memory of 1744	3012	078192e792b12a8d9980f364e110155c.exe	78
PID 3012 wrote to memory of 4424	3012	078192e792b12a8d9980f364e110155c.exe	79
PID 3012 wrote to memory of 4424	3012	078192e792b12a8d9980f364e110155c.exe	79
PID 3012 wrote to memory of 4424	3012	078192e792b12a8d9980f364e110155c.exe	79
PID 3012 wrote to memory of 4420	3012	078192e792b12a8d9980f364e110155c.exe	81
PID 3012 wrote to memory of 4420	3012	078192e792b12a8d9980f364e110155c.exe	81
PID 3012 wrote to memory of 4420	3012	078192e792b12a8d9980f364e110155c.exe	81
PID 3012 wrote to memory of 1928	3012	078192e792b12a8d9980f364e110155c.exe	82
PID 3012 wrote to memory of 1928	3012	078192e792b12a8d9980f364e110155c.exe	82
PID 3012 wrote to memory of 1928	3012	078192e792b12a8d9980f364e110155c.exe	82
PID 380 wrote to memory of 4048	380	Files.exe	83
PID 380 wrote to memory of 4048	380	Files.exe	83
PID 380 wrote to memory of 4048	380	Files.exe	83
PID 3012 wrote to memory of 4924	3012	078192e792b12a8d9980f364e110155c.exe	84
PID 3012 wrote to memory of 4924	3012	078192e792b12a8d9980f364e110155c.exe	84
PID 3012 wrote to memory of 4924	3012	078192e792b12a8d9980f364e110155c.exe	84
PID 3012 wrote to memory of 4748	3012	078192e792b12a8d9980f364e110155c.exe	85
PID 3012 wrote to memory of 4748	3012	078192e792b12a8d9980f364e110155c.exe	85
PID 3012 wrote to memory of 4748	3012	078192e792b12a8d9980f364e110155c.exe	85
PID 3012 wrote to memory of 4132	3012	078192e792b12a8d9980f364e110155c.exe	86
PID 3012 wrote to memory of 4132	3012	078192e792b12a8d9980f364e110155c.exe	86
PID 3012 wrote to memory of 4132	3012	078192e792b12a8d9980f364e110155c.exe	86
PID 1744 wrote to memory of 1776	1744	Folder.exe	87
PID 1744 wrote to memory of 1776	1744	Folder.exe	87
PID 1744 wrote to memory of 1776	1744	Folder.exe	87
PID 2812 wrote to memory of 4624	2812	rUNdlL32.eXe	94
PID 2812 wrote to memory of 4624	2812	rUNdlL32.eXe	94
PID 2812 wrote to memory of 4624	2812	rUNdlL32.eXe	94
PID 4624 wrote to memory of 2604	4624	rundll32.exe	45
PID 4624 wrote to memory of 4880	4624	rundll32.exe	62
PID 2604 wrote to memory of 3700	2604	svchost.exe	96
PID 2604 wrote to memory of 3700	2604	svchost.exe	96
PID 2604 wrote to memory of 3700	2604	svchost.exe	96
PID 4624 wrote to memory of 376	4624	rundll32.exe	15
PID 4624 wrote to memory of 2400	4624	rundll32.exe	40
PID 4624 wrote to memory of 2428	4624	rundll32.exe	41
PID 4624 wrote to memory of 1224	4624	rundll32.exe	21
PID 4624 wrote to memory of 1120	4624	rundll32.exe	20
PID 4624 wrote to memory of 1436	4624	rundll32.exe	26
PID 4624 wrote to memory of 1908	4624	rundll32.exe	36
PID 4624 wrote to memory of 1244	4624	rundll32.exe	23
PID 4624 wrote to memory of 3024	4624	rundll32.exe	52
PID 4624 wrote to memory of 1444	4624	rundll32.exe	27
PID 4624 wrote to memory of 2712	4624	rundll32.exe	49
PID 4624 wrote to memory of 4312	4624	rundll32.exe	66
PID 4624 wrote to memory of 2736	4624	rundll32.exe	50
PID 4208 wrote to memory of 3852	4208	Install.exe	98
PID 4208 wrote to memory of 3852	4208	Install.exe	98
PID 4208 wrote to memory of 3852	4208	Install.exe	98
PID 3852 wrote to memory of 312	3852	cmd.exe	101
PID 3852 wrote to memory of 312	3852	cmd.exe	101
PID 3852 wrote to memory of 312	3852	cmd.exe	101
PID 380 wrote to memory of 1428	380	Files.exe	102
PID 380 wrote to memory of 1428	380	Files.exe	102

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
1⤵
PID:376

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Schedule
1⤵
- Drops file in System32 directory
PID:1120

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
1⤵
PID:1224

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Themes
1⤵
PID:1244

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s SENS
1⤵
PID:1436

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s UserManager
1⤵
PID:1444

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
1⤵
PID:1908

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
1⤵
PID:2400

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
1⤵
PID:2428

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Browser
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2604
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k SystemNetworkService
  2⤵
  PID:3700

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2712

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s WpnService
1⤵
PID:2736

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s TokenBroker
1⤵
PID:3024

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -s DsmSvc
1⤵
PID:4880

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s wlidsvc
1⤵
PID:4312

C:\Users\Admin\AppData\Local\Temp\078192e792b12a8d9980f364e110155c.exe
"C:\Users\Admin\AppData\Local\Temp\078192e792b12a8d9980f364e110155c.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3012
- C:\Users\Admin\AppData\Local\Temp\Files.exe
  "C:\Users\Admin\AppData\Local\Temp\Files.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:380
- - C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
    C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4048
- - C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
    C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:1428
- C:\Users\Admin\AppData\Local\Temp\KRSetp.exe
  "C:\Users\Admin\AppData\Local\Temp\KRSetp.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:4668
- C:\Users\Admin\AppData\Local\Temp\Install.exe
  "C:\Users\Admin\AppData\Local\Temp\Install.exe"
  2⤵
  - Executes dropped EXE
  - Drops Chrome extension
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4208
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c taskkill /f /im chrome.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3852
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im chrome.exe
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      PID:312
- - C:\Windows\SysWOW64\xcopy.exe
    xcopy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data" "C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\" /s /e /y
    3⤵
    - System Location Discovery: System Language Discovery
    - Enumerates system info in registry
    PID:5376
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --window-position=-50000,-50000 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" https://www.facebook.com/ https://www.facebook.com/pages/ https://secure.facebook.com/ads/manager/account_settings/account_billing/
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    PID:5604
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99 /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xd4,0xd8,0xdc,0xb0,0xe0,0x7ff831679758,0x7ff831679768,0x7ff831679778
      4⤵
      PID:5840
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1552 --field-trial-handle=2172,i,14974231090864106768,4215208676126089562,131072 /prefetch:2
      4⤵
      PID:3220
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=1692 --field-trial-handle=2172,i,14974231090864106768,4215208676126089562,131072 /prefetch:8
      4⤵
      PID:5420
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=1728 --field-trial-handle=2172,i,14974231090864106768,4215208676126089562,131072 /prefetch:8
      4⤵
      PID:5480
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2840 --field-trial-handle=2172,i,14974231090864106768,4215208676126089562,131072 /prefetch:1
      4⤵
      PID:5368
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2844 --field-trial-handle=2172,i,14974231090864106768,4215208676126089562,131072 /prefetch:1
      4⤵
      PID:5340
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=2040 --field-trial-handle=2172,i,14974231090864106768,4215208676126089562,131072 /prefetch:1
      4⤵
      PID:5168
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3412 --field-trial-handle=2172,i,14974231090864106768,4215208676126089562,131072 /prefetch:1
      4⤵
      PID:5208
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=4776 --field-trial-handle=2172,i,14974231090864106768,4215208676126089562,131072 /prefetch:1
      4⤵
      PID:5404
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=4896 --field-trial-handle=2172,i,14974231090864106768,4215208676126089562,131072 /prefetch:1
      4⤵
      PID:5872
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=5036 --field-trial-handle=2172,i,14974231090864106768,4215208676126089562,131072 /prefetch:1
      4⤵
      PID:316
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=3496 --field-trial-handle=2172,i,14974231090864106768,4215208676126089562,131072 /prefetch:8
      4⤵
      PID:6816
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=5304 --field-trial-handle=2172,i,14974231090864106768,4215208676126089562,131072 /prefetch:8
      4⤵
      PID:6824
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1468 --field-trial-handle=2172,i,14974231090864106768,4215208676126089562,131072 /prefetch:2
      4⤵
      PID:6388
- C:\Users\Admin\AppData\Local\Temp\Folder.exe
  "C:\Users\Admin\AppData\Local\Temp\Folder.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1744
- - C:\Users\Admin\AppData\Local\Temp\Folder.exe
    "C:\Users\Admin\AppData\Local\Temp\Folder.exe" -a
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1776
- C:\Users\Admin\AppData\Local\Temp\Info.exe
  "C:\Users\Admin\AppData\Local\Temp\Info.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4424
- - C:\Users\Admin\AppData\Local\Temp\Info.exe
    "C:\Users\Admin\AppData\Local\Temp\Info.exe"
    3⤵
    - Windows security bypass
    - Executes dropped EXE
    - Windows security modification
    - Adds Run key to start application
    - Checks for VirtualBox DLLs, possible anti-VM trick
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    PID:5684
  - - C:\Windows\System32\cmd.exe
      C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
      4⤵
      PID:312
    - - C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
        5⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        Modifies data under HKEY_USERS
        
        PID:508
  - - C:\Windows\rss\csrss.exe
      C:\Windows\rss\csrss.exe /94-94
      4⤵
      Executes dropped EXE
      Manipulates WinMonFS driver.
      System Location Discovery: System Language Discovery
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      PID:3340
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5516
    - - C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
        
        C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:7084
- C:\Users\Admin\AppData\Local\Temp\Install_Files.exe
  "C:\Users\Admin\AppData\Local\Temp\Install_Files.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:4420
- C:\Users\Admin\AppData\Local\Temp\pub2.exe
  "C:\Users\Admin\AppData\Local\Temp\pub2.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Checks SCSI registry key(s)
  PID:1928
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1928 -s 492
    3⤵
    - Program crash
    PID:3276
- C:\Users\Admin\AppData\Local\Temp\jamesdirect.exe
  "C:\Users\Admin\AppData\Local\Temp\jamesdirect.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  PID:4924
- - C:\Users\Admin\AppData\Local\Temp\jamesdirect.exe
    C:\Users\Admin\AppData\Local\Temp\jamesdirect.exe
    3⤵
    PID:5928
- - C:\Users\Admin\AppData\Local\Temp\jamesdirect.exe
    C:\Users\Admin\AppData\Local\Temp\jamesdirect.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:6140
- C:\Users\Admin\AppData\Local\Temp\Complete.exe
  "C:\Users\Admin\AppData\Local\Temp\Complete.exe"
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4748
- C:\Users\Admin\AppData\Local\Temp\md9_1sjm.exe
  "C:\Users\Admin\AppData\Local\Temp\md9_1sjm.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - System Location Discovery: System Language Discovery
  PID:4132

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:748

C:\Windows\system32\rUNdlL32.eXe
rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:2812
- C:\Windows\SysWOW64\rundll32.exe
  rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4624

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:192

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:4148

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4544

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:1780

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:6024

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2720

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:6096

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:6724

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
PID:1004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\kjkfjbddnkpfcflenfcleijhgaaiapaf\8.66.88_0\background.html

Filesize
786B

MD5
9ffe618d587a0685d80e9f8bb7d89d39

SHA1
8e9cae42c911027aafae56f9b1a16eb8dd7a739c

SHA256
a1064146f622fe68b94cd65a0e8f273b583449fbacfd6fd75fec1eaaf2ec8d6e

SHA512
a4e1f53d1e3bf0ff6893f188a510c6b3da37b99b52ddd560d4c90226cb14de6c9e311ee0a93192b1a26db2d76382eb2350dc30ab9db7cbd9ca0a80a507ea1a12

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\kjkfjbddnkpfcflenfcleijhgaaiapaf\8.66.88_0\icon.png

Filesize
6KB

MD5
c8d8c174df68910527edabe6b5278f06

SHA1
8ac53b3605fea693b59027b9b471202d150f266f

SHA256
9434dd7008059a60d6d5ced8c8a63ab5cae407e7152da98ca4dda408510f08f5

SHA512
d439e5124399d1901934319535b7156c0ca8d76b5aa4ddf1dd0b598d43582f6d23c16f96be74d3cd5fe764396da55ca51811d08695f356f12f7a8a71bcc7e45c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\kjkfjbddnkpfcflenfcleijhgaaiapaf\8.66.88_0\js\aes.js

Filesize
13KB

MD5
4ff108e4584780dce15d610c142c3e62

SHA1
77e4519962e2f6a9fc93342137dbb31c33b76b04

SHA256
fc7e184beeda61bf6427938a84560f52348976bb55e807b224eb53930e97ef6a

SHA512
d6eee0fc02205a3422c16ad120cad8d871563d8fcd4bde924654eac5a37026726328f9a47240cf89ed6c9e93ba5f89c833e84e65eee7db2b4d7d1b4240deaef2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\kjkfjbddnkpfcflenfcleijhgaaiapaf\8.66.88_0\js\content.js

Filesize
14KB

MD5
dd274022b4205b0da19d427b9ac176bf

SHA1
91ee7c40b55a1525438c2b1abe166d3cb862e5cb

SHA256
41e129bb90c2ac61da7dac92a908559448c6448ba698a450b6e7add9493739c6

SHA512
8ee074da689a7d90eca3c8242f7d16b0390b8c9b133d7bbdef77f8bf7f9a912e2d60b4a16f1c934f1bd38b380d6536c23b3a2f9939e31a8ef9f9c539573387b4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\kjkfjbddnkpfcflenfcleijhgaaiapaf\8.66.88_0\js\jquery-3.3.1.min.js

Filesize
84KB

MD5
a09e13ee94d51c524b7e2a728c7d4039

SHA1
0dc32db4aa9c5f03f3b38c47d883dbd4fed13aae

SHA256
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef

SHA512
f8da8f95b6ed33542a88af19028e18ae3d9ce25350a06bfc3fbf433ed2b38fefa5e639cddfdac703fc6caa7f3313d974b92a3168276b3a016ceb28f27db0714a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\kjkfjbddnkpfcflenfcleijhgaaiapaf\8.66.88_0\js\mode-ecb.js

Filesize
604B

MD5
23231681d1c6f85fa32e725d6d63b19b

SHA1
f69315530b49ac743b0e012652a3a5efaed94f17

SHA256
03164b1ac43853fecdbf988ce900016fb174cf65b03e41c0a9a7bf3a95e8c26a

SHA512
36860113871707a08401f29ab2828545932e57a4ae99e727d8ca2a9f85518d3db3a4e5e4d46ac2b6ba09494fa9727c033d77c36c4bdc376ae048541222724bc2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\kjkfjbddnkpfcflenfcleijhgaaiapaf\8.66.88_0\js\pad-nopadding.js

Filesize
268B

MD5
0f26002ee3b4b4440e5949a969ea7503

SHA1
31fc518828fe4894e8077ec5686dce7b1ed281d7

SHA256
282308ebc3702c44129438f8299839ca4d392a0a09fdf0737f08ef1e4aff937d

SHA512
4290a1aee5601fcbf1eb2beec9b4924c30cd218e94ae099b87ba72c9a4fa077e39d218fc723b8465d259028a6961cc07c0cd6896aa2f67e83f833ca023a80b11

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\kjkfjbddnkpfcflenfcleijhgaaiapaf\8.66.88_0\manifest.json

Filesize
1KB

MD5
f0b8f439874eade31b42dad090126c3e

SHA1
9011bca518eeeba3ef292c257ff4b65cba20f8ce

SHA256
20d39e65b119ed47afd5942d2a67e5057e34e2aef144569796a19825fea4348e

SHA512
833e3e30f091b4e50364b10fc75258e8c647ddd3f32d473d1991beda0095827d02f010bf783c22d8f8a3fa1433b6b22400ad93dc34b0eb59a78e1e18e7d9b05f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
18KB

MD5
4fa6f1d0a2343c61f0c1747485db7e34

SHA1
9f8ef06cf9748c9c81d21a54083ec8b4b85b896a

SHA256
952e9b8bd63df8b0c95760a549d7b32b2406f3fc8645721ed533dcd17d50e217

SHA512
e616e7b83b4f6aa56b9b3ed1a6e4bb2bf3b8ceb05e97212e0407619e59c1bc2a17cb45c2d022faa97ca50b30203f95f2b8cc3614888ec7026d112e5e133e5b78

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\E49JWOHD\edgecompatviewlist[1].xml

Filesize
74KB

MD5
d4fc49dc14f63895d997fa4940f24378

SHA1
3efb1437a7c5e46034147cbbc8db017c69d02c31

SHA256
853d2f4eb81c9fdcea2ee079f6faf98214b111b77cdf68709b38989d123890f1

SHA512
cc60d79b4afe5007634ac21dc4bc92081880be4c0d798a1735b63b27e936c02f399964f744dc73711987f01e8a1064b02a4867dd6cac27538e5fbe275cc61e0a

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\6ERTDPD6\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\O0P00EOG\favicon[1].png

Filesize
2KB

MD5
18c023bc439b446f91bf942270882422

SHA1
768d59e3085976dba252232a65a4af562675f782

SHA256
e0e71acef1efbfab69a1a60cd8fadded948d0e47a0a27c59a0be7033f6a84482

SHA512
a95ad7b48596bc0af23d05d1e58681e5d65e707247f96c5bc088880f4525312a1834a89615a0e33aea6b066793088a193ec29b5c96ea216f531c443487ae0735

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\SYK6SA8B\favicon[1].ico

Filesize
758B

MD5
84cc977d0eb148166481b01d8418e375

SHA1
00e2461bcd67d7ba511db230415000aefbd30d2d

SHA256
bbf8da37d92138cc08ffeec8e3379c334988d5ae99f4415579999bfbbb57a66c

SHA512
f47a507077f9173fb07ec200c2677ba5f783d645be100f12efe71f701a74272a98e853c4fab63740d685853935d545730992d0004c9d2fe8e1965445cab509c3

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\WOH1NYTJ\favicon[2].png

Filesize
7KB

MD5
9e3fe8db4c9f34d785a3064c7123a480

SHA1
0f77f9aa982c19665c642fa9b56b9b20c44983b6

SHA256
4d755ac02a070a1b4bb1b6f1c88ab493440109a8ac1e314aaced92f94cdc98e9

SHA512
20d8b416bd34f3d80a77305c6fcd597e9c2d92ab1db3f46ec5ac84f5cc6fb55dfcdccd03ffdc5d5de146d0add6d19064662ac3c83a852f3be8b8f650998828d1

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\Temp\~DF220FF0B29632C662.TMP

Filesize
60KB

MD5
1241bc48f6dd0092ac0a11f194110500

SHA1
827484d72bc872723d1e2d7936c89ed0f0a8029a

SHA256
0f84e45d7e2bd9c39c8a88403d49dc461094fdd9bc52929ef8b6a478d1e5b791

SHA512
f7c264f93e66e39cda89c3c2b616b4ca0282e3671e2ed682856c8d3b0ea86674a10b657933f8d35c457560d660149c602aea51f2313da75a6a79e1250eafddd8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Complete.exe

Filesize
804KB

MD5
92acb4017f38a7ee6c5d2f6ef0d32af2

SHA1
1b932faf564f18ccc63e5dabff5c705ac30a61b8

SHA256
2459694049abfe227ddcf5b4d813fe3ae8e1e9066de5228acf20c958d425c2e1

SHA512
d385b2857d934628e1df3ef493b3a33e2a042c5974d9c153c126a86a28fc61bcc02db0a0791c225378994737a16cd35b74f217600d4b837cda779200c9faeb73

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files.exe

Filesize
975KB

MD5
2d0217e0c70440d8c82883eadea517b9

SHA1
f3b7dd6dbb43b895ba26f67370af99952b7d83cb

SHA256
d8ede520a96e7eff75e753691e1dd2c764a3171ffa0144675c3e08f4be027c01

SHA512
6d7779a1f0dd54c0598bfb68f5e01a309021437a8b578353a063baf7c5ac2b29e5706ba51d1c1831e1517c5ea6fa662744c3f3e68a0e094c3b83ca9ed134413d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Folder.exe

Filesize
712KB

MD5
b89068659ca07ab9b39f1c580a6f9d39

SHA1
7e3e246fcf920d1ada06900889d099784fe06aa5

SHA256
9d225182e9a8f073e8cf1d60a8258369a394bcae5fbc52d845d71a0fa440539c

SHA512
940690b0844e678e45ead2e7639407ffac43ab45265d2682a4c2e6400ac8fa2188c50a3b17dad241517dd4624ee92d159c7e6d59c8d069b9edd1445115255d52

Download Submit
C:\Users\Admin\AppData\Local\Temp\Info.exe

Filesize
4.4MB

MD5
f67ac68040dcf6a7c499bbc0d149397d

SHA1
4e61f7ca82126d8aab52a1881965d1ed38f93769

SHA256
7b8a8c6b1b0bf9d637c94f73d189f81398837eaa1d9cd431eeff6e7a398a32b4

SHA512
4398c085593c7756257dd3eaf859b5e16a393280d2bd2601902c3e44453ad77748a32c95ee9c5ceaf998ebb4b23ab3a9d235351865d2ffe33387657102b61719

Download Submit
C:\Users\Admin\AppData\Local\Temp\Install.exe

Filesize
1.4MB

MD5
41b7c6d48d13e1a864bf2d3759e257e6

SHA1
7ee45121a927d744941651bd6673d3df21f1611b

SHA256
820c980f68378170cec0e1f2f4e2e319a07b1d030d7712ece110f579fcd1a8c2

SHA512
0ac230d6ea4f7eaf1c5dbc919e1de41416e4c5e527e0ec583135eab2067d0fcd22615d80a93f803ce327cdbb58b5b236ca47d759647b8c36a98a17a3e1504077

Download Submit
C:\Users\Admin\AppData\Local\Temp\Install_Files.exe

Filesize
1.7MB

MD5
509b000635ab3390fa847269b436b6ba

SHA1
cc9ea9a28a576def6ae542355558102b6842538b

SHA256
7266a9d0f9a50aff61cc32794e421c4215e49e0b54c6b90e13ae05a8a8e5fc12

SHA512
c64d0cabeede0f3617d3535767637d8ffc7dc51145f2e2db48b6f720dfe76e2e897e456f91c83235b1b5c9833e468244f2fe67379c0da47b9ea045b1362cebd4

Download Submit
C:\Users\Admin\AppData\Local\Temp\KRSetp.exe

Filesize
201KB

MD5
b70f516d57624c741cabeebb65cce996

SHA1
98c27ae9fa2742dfedcf765c5b37d7830673c2ff

SHA256
32e4d190cebe0be41e148b8863fad2c8973b1afc9d60238ac9ec1daeb1e1a2d2

SHA512
aae21583810803053b0112f720c142de570b75c41d6bb63ae7e870750678478cc7140204c1108b83fee7f53de77e5de2a9752fdff0279563ceea94c2401acf95

Download Submit
C:\Users\Admin\AppData\Local\Temp\axhub.dat

Filesize
552KB

MD5
5fd2eba6df44d23c9e662763009d7f84

SHA1
43530574f8ac455ae263c70cc99550bc60bfa4f1

SHA256
2991e2231855661e94ef80a4202487a9d7dc7bebccab9a0b2a786cf0783a051f

SHA512
321a86725e533dedb5b74e17218e6e53a49fa6ffc87d7f7da0f0b8441a081fe785f7846a76f67ef03ec3abddacbe8906b20a2f3ce8178896ec57090ef7ab0eb7

Download Submit
C:\Users\Admin\AppData\Local\Temp\axhub.dll

Filesize
73KB

MD5
1c7be730bdc4833afb7117d48c3fd513

SHA1
dc7e38cfe2ae4a117922306aead5a7544af646b8

SHA256
8206b4b3897ca45b9e083273f616902966e57091516844906e6ae2aefe63cef1

SHA512
7936c862a06b7ecdb6710a1bb62cbea149f75504b580c2f100945674c987f3eec53e9aa5915e32b4f74bcf46f2df9468f68a454400faebd909f933e8072e0f2e

Download Submit
C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\CrashpadMetrics-active.pma

Filesize
1024KB

MD5
d998db6bb78f1336ff0e927205cd5dcd

SHA1
4d4a205d698b61b661514654b3917375f8ab644a

SHA256
32bce0ec12f35821550b935f0f9d841c1dcb83e9316c804190d0aa26881e9d9f

SHA512
c8e05fd8ab522baeab3742ceec64eea154ebb72f9408c82babec3d01ecad67886626c13a126b9290074d4149eef1be56853e9aea72c455147fe3f7039bbfe21f

Download Submit
C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Crashpad\settings.dat

Filesize
40B

MD5
acdad9483d3f27ed7e86c7f0116d8ad9

SHA1
dd2cfd176ad33d12ba7e6d260e1069b1dd4490c4

SHA256
bff5b4fff4b34ed3ea2754985b5ba1a8d6921517b0fa370f71f37ee0845552ba

SHA512
6e3ab4b6cfa73a7ad3c36fa621b1d2817b26e8e3613b78a40df6691d65e1486e6c2281efa0f8d3f30d2c6647b7ba3430a8be77df770f1cc575e8db76be6836a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\Affiliation Database

Filesize
32KB

MD5
69e3a8ecda716584cbd765e6a3ab429e

SHA1
f0897f3fa98f6e4863b84f007092ab843a645803

SHA256
e0c9f1494a417f356b611ec769b975a4552c4065b0bc2181954fcbb4b3dfa487

SHA512
bb78069c17196da2ce8546046d2c9d9f3796f39b9868b749ecada89445da7a03c9b54a00fcf34a23eb0514c871e026ac368795d2891bbf37e1dc5046c29beaaa

Download Submit
C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\Cache\Cache_Data\f_000002

Filesize
128KB

MD5
7a0800c240893e344efd1617cc6f45e3

SHA1
c414c4e3918e1f3dadd86adf3151e113ebf384f5

SHA256
4de73b996c1d6897fa7404627213aed78bd75901eeb82a4a97adc6fabe33284b

SHA512
a645dde1cd0b8c44226fdb5c9b9aa006d15f4b6b46107e7b60db35000341235ec31fea5d8f7ff35be38df475fcbee9d62f186e60f7e69bb2aa2041992d8e8e94

Download Submit
C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\Cache\Cache_Data\f_000003

Filesize
40KB

MD5
331650c7fbee1942024df4a9dcb91325

SHA1
440ca47d1d97d9fa83c23c537608edfbe3edccd8

SHA256
f6884fe3b8f6de9ff805e24c218c39dcb32927366ae7df13578a1d63721aea4b

SHA512
55eeccb1574984871fd360675b488259522843965f23299356061a75c2ddb9d629b66e9575fae8a83343ccb2da802b72db2404b7c2cbf77523317267c3aa5f36

Download Submit
C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\Cache\Cache_Data\f_000004

Filesize
39KB

MD5
7640caed67f2ceda05b589d19b39b88c

SHA1
8b94af53174d0b61965d403b2fd1b6518d295982

SHA256
597c53628120a919930c4c5103152364d83bb35d743386f15a98376163d933dc

SHA512
21dc36b2872632a3d1ce52daf77ef661c54191f19a5e6591613ff08cde7fe1b1ae1470d36ef8e56078a189de9bd10f82577599dc4c3a191ac2d1082e2559b8b8

Download Submit
C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\Cache\Cache_Data\f_00000b

Filesize
56KB

MD5
2a8f8282639054ea9ccbe5409ae50670

SHA1
6b7ee0e3eb3c602cd357156e3e8818c8fe42d605

SHA256
655dd9104000564ed7747d8a4f126e7b9a70ead0fcdee9ecb9eea3b7f4873038

SHA512
1ab4580509d7ce6ffaa4d7031b759efa2d6c81c97e0d13fffc1fd470194c8065e3fa189ee0b93ce492f0436d4254719a940de21ff295dab0fbd5b9dc383bd196

Download Submit
C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\Cache\Cache_Data\f_00000d

Filesize
27KB

MD5
224079a35d4304d08b7b3a71d6bdeeea

SHA1
8a42e167264379f9e76f82dae4769907f22e1023

SHA256
8b4b7f915efb500e68cba8f3a6a92a9c96b6e890ac06ff58fac84a8fd922949d

SHA512
4c590abeb0b3a2c14aef1e1b88d67aa153e3b2204c16e9da7f2cfe088429a1983e5912b8e07bfe9f2ebb9b9de36d22a292989252a463b74179194343972ff9de

Download Submit
C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\Cache\Cache_Data\f_00000e

Filesize
72KB

MD5
29795640fd66540ae6966686d70e8ff7

SHA1
8cec9769773d9de56fc4c18c4fba51203956fe4a

SHA256
cd6804f15ad4caebee829ce16695d2e8dd0cada974828ea2f81c139578f10cba

SHA512
8e7b6816f1c2517e5453fc8697dcba1bb37ca1fcaefbb64db0acf4018c81ad925972abbbc9ef08de33d970167cbfc636fd5bb24736ab877df9dee5f3d74621cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\Cache\Cache_Data\f_00000f

Filesize
21KB

MD5
3669e98b2ae9734d101d572190d0c90d

SHA1
5e36898bebc6b11d8e985173fd8b401dc1820852

SHA256
7061caa61b21e5e5c1419ae0dc8299142ba89c8169a2bd968b6de34a564f888a

SHA512
0c5f0190b0df4939c2555ec7053a24f5dae388a0936140d68ed720a70542b40aaf65c882f43eb1878704bea3bd18934de4b1aac57a92f89bbb4c67a51b983ae3

Download Submit
C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\Cache\Cache_Data\f_000010

Filesize
20KB

MD5
c1164ab65ff7e42adb16975e59216b06

SHA1
ac7204effb50d0b350b1e362778460515f113ecc

SHA256
d7928d8f5536d503eb37c541b5ce813941694b71b0eb550250c7e4cbcb1babbb

SHA512
1f84a9d9d51ac92e8fb66b54d103986e5c8a1ca03f52a7d8cdf21b77eb9f466568b33821530e80366ce95900b20816e14a767b73043a0019de4a2f1a4ffd1509

Download Submit
C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\Cache\Cache_Data\f_000011

Filesize
34KB

MD5
b63bcace3731e74f6c45002db72b2683

SHA1
99898168473775a18170adad4d313082da090976

SHA256
ea3a8425dcf06dbc9c9be0ccd2eb6381507dd5ac45e2a685b3a9b1b5d289d085

SHA512
d62d4dddb7ec61ef82d84f93f6303001ba78d16fd727090c9d8326a86ab270f926b338c8164c2721569485663da88b850c3a6452ccb8b3650c6fa5ce1ce0f140

Download Submit
C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\Cache\Cache_Data\f_000012

Filesize
16KB

MD5
9978db669e49523b7adb3af80d561b1b

SHA1
7eb15d01e2afd057188741fad9ea1719bccc01ea

SHA256
4e57f4cf302186300f95c74144cbca9eb756c0a8313ebf32f8aba5c279dd059c

SHA512
04b216bd907c70ee2b96e513f7de56481388b577e6ccd67145a48178a605581fab715096cfb75d1bb336e6ad0060701d2a3680e9f38fe31e1573d5965f1e380a

Download Submit
C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
1ad941430a1aefd9ef845680e573867e

SHA1
dbe8cea009d98748e69fa166bd72145284533997

SHA256
e2fcc7620e2a9f71543784cbb9ac661f0f1dc6cbcad0a745856ec808fe045d83

SHA512
37ddcc62abf07e4b46ffa31a9613cc427acaae78a3b8bd01703035051cff934ddae1986f3fd7adcffe1b7e1432156e5018f99981b96f9e5f240b5a383e890b4b

Download Submit
C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\Code Cache\js\index-dir\the-real-index~RFe580b36.TMP

Filesize
48B

MD5
312f52bd21f6ac1d99faa4daa7b367dd

SHA1
9941789441ecf8d3fb165cb300fe29b7ff39a0cc

SHA256
e4e16394c5bcb5d553abfae53f34b11fd66196c7bb5096dfd0162c5cd5fe84f7

SHA512
04fae47e67d1598de0c666e91121ea5aa93028d34fcedadbbc5623926eac6b18693e37172b20e7396d1dbd0a0fa9b03c9fc6cef7800a62db54d7bd1db0184931

Download Submit
C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\Code Cache\wasm\index

Filesize
24B

MD5
54cb446f628b2ea4a5bce5769910512e

SHA1
c27ca848427fe87f5cf4d0e0e3cd57151b0d820d

SHA256
fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d

SHA512
8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0

Download Submit
C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\Code Cache\wasm\index-dir\the-real-index

Filesize
48B

MD5
621827a76af6b7c4d0b740314803a52b

SHA1
103ee79ae221a6cf89082c8a946e68dda35ff50b

SHA256
359f323d4c3f88a85057ae16d9adb2effc030ad48a1e50146f0b696cd78efc23

SHA512
336eab907a48e2aae68532a43bd7eaac7661903637008dc47252308737bb4657f9638b9f3bf3c10a83a8d314091581d116803a4d296cb6b402c50feba2314ca1

Download Submit
C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\DawnCache\data_2

Filesize
8KB

MD5
0962291d6d367570bee5454721c17e11

SHA1
59d10a893ef321a706a9255176761366115bedcb

SHA256
ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

SHA512
f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\Extension Scripts\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\Extension Scripts\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.62.0_0\_locales\en_CA\messages.json

Filesize
851B

MD5
07ffbe5f24ca348723ff8c6c488abfb8

SHA1
6dc2851e39b2ee38f88cf5c35a90171dbea5b690

SHA256
6895648577286002f1dc9c3366f558484eb7020d52bbf64a296406e61d09599c

SHA512
7ed2c8db851a84f614d5daf1d5fe633bd70301fd7ff8a6723430f05f642ceb3b1ad0a40de65b224661c782ffcec69d996ebe3e5bb6b2f478181e9a07d8cd41f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\Extensions\kjkfjbddnkpfcflenfcleijhgaaiapaf\8.66.88_0\js\background.js

Filesize
15KB

MD5
9a82c233c3c06572894b4ffb9ba942db

SHA1
dad0e2308b177c3a33836e54095e2bec7a90f982

SHA256
ed9b58f3c59de47388ab615cf6bcae054d57f6d1fad2da4fa9c48ee18e3ac3b3

SHA512
85c6f748579f8459404ec01b6a6c2a91998e180125fcf61af155e7108430b64391013832c711ff15b2517c52017008faa89db1b8c678c5c71065fe0dbd34fbfc

Download Submit
C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en_GB\messages.json

Filesize
593B

MD5
91f5bc87fd478a007ec68c4e8adf11ac

SHA1
d07dd49e4ef3b36dad7d038b7e999ae850c5bef6

SHA256
92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9

SHA512
fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9

Download Submit
C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\Favicons

Filesize
20KB

MD5
3eea0768ded221c9a6a17752a09c969b

SHA1
d17d8086ed76ec503f06ddd0ac03d915aec5cdc7

SHA256
6923fd51e36b8fe40d6d3dd132941c5a693b02f6ae4d4d22b32b5fedd0e7b512

SHA512
fb5c51adf5a5095a81532e3634f48f5aedb56b7724221f1bf1ccb626cab40f87a3b07a66158179e460f1d0e14eeb48f0283b5df6471dd7a6297af6e8f3efb1f9

Download Submit
C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\GPUCache\data_0

Filesize
8KB

MD5
cf89d16bb9107c631daabf0c0ee58efb

SHA1
3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b

SHA256
d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e

SHA512
8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\GPUCache\data_3

Filesize
8KB

MD5
41876349cb12d6db992f1309f22df3f0

SHA1
5cf26b3420fc0302cd0a71e8d029739b8765be27

SHA256
e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

SHA512
e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

Download Submit
C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\GPUCache\index

Filesize
256KB

MD5
596fa0d2aaf7d7d1c8b4eefc07fc53bc

SHA1
2a60f51a6b5dbdec80e204a9f608ec235594b67b

SHA256
9f645b3ca6642edc62a0ca3ab4bb4d99a52e0904f74ca7368514f07ca640bd4e

SHA512
83ab2c2e7aeaceb6506cd8cd28e04bb5b1894031e2857c5d1c3730bce6a590934513f4b41fdfafd79d8b19affe93e82ff57cb35e24c402a8aa1804b9a4445b10

Download Submit
C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\History

Filesize
148KB

MD5
90a1d4b55edf36fa8b4cc6974ed7d4c4

SHA1
aba1b8d0e05421e7df5982899f626211c3c4b5c1

SHA256
7cf3e9e8619904e72ea6608cc43e9b6c9f8aa2af02476f60c2b3daf33075981c

SHA512
ea0838be754e1258c230111900c5937d2b0788f90bbf7c5f82b2ceda7868e50afb86c301f313267eaa912778da45755560b5434885521bf915967a7863922ae2

Download Submit
C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\Login Data For Account

Filesize
46KB

MD5
02d2c46697e3714e49f46b680b9a6b83

SHA1
84f98b56d49f01e9b6b76a4e21accf64fd319140

SHA256
522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9

SHA512
60348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac

Download Submit
C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\Network\Network Persistent State

Filesize
1KB

MD5
0e0caa96b86b8f58fdd81044ad10f2c4

SHA1
b9f8a6fd5aefb27ad8d065b604ce493cc35bb8fa

SHA256
09995c9f71b8a2ef21bca02be96dadfc1c8d9cfccd0a13f4cc82f374420ea157

SHA512
036c567aef0248b8612e63e836a5adbab34909903adb06829ec1ae9e66689faea81d051dbfa8d6b5cbd7ef3fca20860215efa742a8c69dd07d9067248402c727

Download Submit
C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\Network\TransportSecurity

Filesize
874B

MD5
791bcfd07cceed693fa794fe1209b880

SHA1
0dbdf356f23f35f914978f227a66709027a46d9a

SHA256
7c9b5f0fa047aafdb246e87e88a7d17f9b935499dd949eaf31b660cb9a8add6f

SHA512
6b9108a02dd040d17b03a605b26d4b67cd81bd8fda8e46cf8769ef9bc8e106ce68987f5306df986fe736f8ccbca00a87ff55d96f76fabb86b082ce67f6e8d0fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\Network\TransportSecurity

Filesize
872B

MD5
c8ae5c427af8b7e1ce4e5f272ad8ff29

SHA1
69af9cb87aa5036bd55caa55ee4166b7ab07c693

SHA256
f8bc5419529471d1f9020b5acc3e6784bdcdef6d4dd494bda197062929f5fd12

SHA512
8131ce7a370d281835e17a539aec50c75c10406c546f1a17f170d5cec46df0951f5a6c8952a3df0a13fd23556ed8272862fa59bff174050083794c7b31bd4e21

Download Submit
C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\Network\TransportSecurity

Filesize
874B

MD5
1e6825fbab27077c8904e66cf4daf7bd

SHA1
040539d99b96d73be3cd80388b895c24fccf4dad

SHA256
2dcefcf7febbf9c94bf7b1b030d3b4ae50031654c98a99123b0156339730e1db

SHA512
b682cc1835f22edfbe5025704ef99e3c6ddff2852b29cd046b733669893655555cfde7baa66580e9130ed46487396bc72635e1faa954cb00e4d036fbfabfba24

Download Submit
C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\Preferences

Filesize
6KB

MD5
fdada187b405e6ff6cd8cf6edb490096

SHA1
3947732d17d281039200f83ff9d905d948b2f719

SHA256
5bd8e161092e6d150bf03339bf22d80e8a9147a11739c16904c3cb7e395b9fc8

SHA512
9e8fb2829b189036576f4f8335e8543b4d035746ecaf4487dcfea8245f685435fae8b371c1f89ee428bf2f5d7d03975dab848b8992c2fbd991701ff566053d4c

Download Submit
C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\Preferences

Filesize
6KB

MD5
107ed1b11f0f9acdfe9851778492f874

SHA1
dbe1ce2247c334c2ce4945e57c5dd3a75eabf1e5

SHA256
1ea86be41bbe5c43b87c388bc37e31056171bb11d73089249a4ed253e2d61f6f

SHA512
7144306b7aeb004705b5ead973d3d773f13ec59f659eea42968908f73b2aeb7ba79774dc4195d8caf453330021a1542d12aeb3ee4dbef87c85f5fd00af354ba1

Download Submit
C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\Safe Browsing Network\Safe Browsing Cookies

Filesize
20KB

MD5
c9ff7748d8fcef4cf84a5501e996a641

SHA1
02867e5010f62f97ebb0cfb32cb3ede9449fe0c9

SHA256
4d3f3194cb1133437aa69bb880c8cbb55ddf06ff61a88ca6c3f1bbfbfd35d988

SHA512
d36054499869a8f56ac8547ccd5455f1252c24e17d2b185955390b32da7e2a732ace4e0f30f9493fcc61425a2e31ed623465f998f41af69423ee0e3ed1483a73

Download Submit
C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\Site Characteristics Database\LOG

Filesize
345B

MD5
d9b8055be12888453c176266c4147a80

SHA1
324e7694809bcd31d80d12bd53d3e6ec5bacd460

SHA256
997fe842a85d4883c23d722b382ca15198bf039b8102da8e0609e8c7d83e66a4

SHA512
8c4780c2f9804dad757c4b315eb03152b24a39f2258662c61dbd98451e07b418cd193512208f4d5bf28a26708874a8128aeed76429d05d2bd3caad1278e73874

Download Submit
C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\Site Characteristics Database\LOG.old

Filesize
305B

MD5
80a2e8cea9cd3d9b9b24c2e202984705

SHA1
f159cbece3bc34087ad14aa68541892e4f9c0733

SHA256
aea9ffa5adc6cf56339153d7e5896441b80cbf339631109eaa4a1d195145390a

SHA512
426a9cd36a60b82bd3419a8ca0c55e9f532fbaa7b3ffda6fdb94c92a031e6fd906dbbd9c0fbeb242edb564237918e5ab71a646a7c0b19fbb683c401c34fbd8cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\wasm\index-dir\the-real-index

Filesize
48B

MD5
0663df3fc1ff36c6e25d68e5933415cb

SHA1
a0d3716cf4df61b41554540af08822c3148799f7

SHA256
06b7c001a163bc3b0688cd5d28d6c3908b7bd5e721ffa713c0b7075eb63aa7ed

SHA512
381e89ee6b2590272710b677b73e8c020ad1a720ca1b92f2c86a8263e91e1688bfbe8036d6dc5fb3e22b490b7f5b54f469939a18b66dcebef51f4724a2057a56

Download Submit
C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\Sync Data\LevelDB\000003.log

Filesize
6KB

MD5
bb1883a56d5c6e812c9caadfbd32a9e0

SHA1
0c3beaec6718f7689565ccd75dea8d9fc0955f4d

SHA256
2617e6ff83f9c1350ac4964e5923d8f7aa8b5d046891bbfc9d03b543d88db7a6

SHA512
dde910c9ad70108ae3b19d53a7805918bcd3be124ba2b1c6df3d0d292ebc719edf14ace8f8c09960f554d3fb51d4e6b6ba6d268f25ad0902da35262eb4da259d

Download Submit
C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\Sync Data\LevelDB\LOG

Filesize
321B

MD5
c4f2ca9a895bdaae6b5f53c27acbd77c

SHA1
1bde2a13fae9f9a8b234c2489815fccc754af0d2

SHA256
644e797fabf65107858a49f15fdc3d7850b3eb8da151975c652922f91715b135

SHA512
2006be6ff7bea3916c0a47b7b5d87954b7a5324144f6b9d77c1be189d53fef8f3d24916513a046884698e2b70b0ac0c254fff1076f0d03742a9607d840eb2a12

Download Submit
C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\Sync Data\LevelDB\LOG.old

Filesize
281B

MD5
5b9f5f23904513d362962aa7304bea9c

SHA1
c58baa876085e67e8205011729d47f7d9e55815b

SHA256
80e121d8a94ac3d425b89e4c4159f4531f9db49bec93b97abda8b4336750865f

SHA512
9962a7cc0291c21ca3f44dc51343e07052de7edc49b546cceee07e59a2f677ff95dcddda87e31c24f780c53429e3568fca4dab3df68b5b8e238cf766df3384e6

Download Submit
C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\Trusted Vault

Filesize
33B

MD5
fa4aac177a2036fc47292859c7efb753

SHA1
f8f54e214f3b240f2586e35d0e814742cb7546c1

SHA256
217a660a6da8d71781ac24702dd1d9684424710cda42022d773afd577b6db91f

SHA512
9d17da0b9832d2cdd4329bd22f77356c91df2aec12ef1f148794937fa36d3b6035330494b2ee4e34802660eecd3f3d9d2480aed4bbef2e3807ddc9cb712a7d6c

Download Submit
C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\Visited Links

Filesize
128KB

MD5
1da5106027b66c058d662ba08a114730

SHA1
ceabf23f06ddde6afc03c55fe6d8be8c0c3f0bbb

SHA256
4f3a5f60d50e57f3ca1ef011b4b0d934a926087f70f07147d07ceb68772fb3b3

SHA512
fdfd900da44342dc8f11de7a302b16a740d2882d4450847c35ec22d1cd7a95eb619fccf671fda3aaaf9a02012d66d54bd1492808bc6ac6a252b4dc8b538ae19e

Download Submit
C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Default\b5e9e68c-7cba-4032-b2d1-5eec8f9d8198.tmp

Filesize
18KB

MD5
00020fb57be2b33eed6d993bbade4ed5

SHA1
afce82c82adb83284a668755a37300e2b23c1657

SHA256
9cfce6ddd52518f3eb7f009fab67b154f9e4f3ec75a5944c44f51158500bd8b8

SHA512
cefc54f6a8700538eea5048d31c1d7223f1841798d01bc8920dc5047585e161a4dd4104ddc12a64e64ca48a55134dc38d0a7ed7ae39aa18537a9fd281800d4d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Last Version

Filesize
14B

MD5
9eae63c7a967fc314dd311d9f46a45b7

SHA1
caba9c2c93acfe0b9ceb9ab19b992b0fc19c71cf

SHA256
4288925b0cf871c7458c22c46936efb0e903802feb991a0e1803be94ca6c251d

SHA512
bed924bff236bf5b6ce1df1db82e86c935e5830a20d9d24697efd82ca331e30604db8d04b0d692ec8541ec6deb2225bcc7d805b79f2db5726642198ecf6348b8

Download Submit
C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Local State

Filesize
309KB

MD5
4373895d9723d45ceefe2c5329ae0668

SHA1
373612b50fc1b82deac4a8b7cde78f52a2281860

SHA256
62411ad582d54d992322f4d28400d0ff99aacd2e0bcb8cea5705d713b6bcae8b

SHA512
df8da1ab1f07ca2eec8ebf7a3be93272e89e99f222a9b069c594dda51b76fcb87093d803d0d9909631dd94878aa3a34714b2391d1c41cba51a420679a5376475

Download Submit
C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Local State

Filesize
138KB

MD5
b567abe390ce890c753443e71f428baf

SHA1
fe9ea0d3f5fa3027445fc0866ca70cebfb6f8d4d

SHA256
ce136daf8320cc3eced5a44df10739c72ff11e5f4e204a2ec094960b0bd92762

SHA512
963683f32e7a35b61abe69a9c8c7c0204acaad6834a81782c7ee7376f302e894ed244ae9116fbf042fd5a0b2af4ceadcf98c0b0ce39e83b78e95f4157aedd0b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Local State

Filesize
137KB

MD5
4a3054491d3acf36048c24d694b6da37

SHA1
b15dffb35f808724aaa62f61405d3fea7e2ecd75

SHA256
e134080306a64d392b9fe6a8c3232706c4f021ddad459448be173bcf9049148a

SHA512
f0c8c207f1d439a68350f0511a4d3522f34fb438e212c0858145fdffebd6c29fd64012cf86214c2f42145ba5a731ac9c25d9a125f424881cf6258d1f759f7fd6

Download Submit
C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Local State

Filesize
311KB

MD5
91e1ff714d3acf15b88840cdcd27cf3e

SHA1
9ae971cdbe0d029b47ba1f8f26f75a77273b9f1e

SHA256
d894c6e716c64db50e256780ab0a4a2f839b3023e8020f3115c3ff5c2723cd4f

SHA512
481db5d302595945f66f7166cbd0c5a82b6e0decadb6c9e30b11d89b26c1e89c2304e0f5ad30a8f13af90afca17a50affa0c2e8589ac5633aef5151a9b413191

Download Submit
C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\ShaderCache\index

Filesize
256KB

MD5
61038ba819f0c1bb44bbdb94f64395e1

SHA1
2d0ea7563874778925ff908217c57a698b414af9

SHA256
56cedc63d22d3631ed13bff977ddb110148b0fdc15416333cac5de10bb76d551

SHA512
0cd837372a91c3da3394ccda03f85563ab5757dd83d77dbc0ede0e0a46a83f9ce4be64e7daa6ffce74e46427b0a615dccd0484e8d04bdd78ef14dd5486b76e25

Download Submit
C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Variations

Filesize
86B

MD5
961e3604f228b0d10541ebf921500c86

SHA1
6e00570d9f78d9cfebe67d4da5efe546543949a7

SHA256
f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed

SHA512
535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472

Download Submit
C:\Users\Admin\AppData\Local\Temp\d

Filesize
41.5MB

MD5
f4b8597ddba09d2cb5e612187f18c61f

SHA1
e9f43f701436f31aabe76e49bf6453ac308e7283

SHA256
c37af3bc479c3a350335abb49a53b27feac6617225b6ad8424d1b2f440944223

SHA512
cb92cc5bdf9d265f8be783abc1cd655f4036ea04c5096c5487cf8a520178e3e348fc8508b7363baed45bf03dd58c7357a6090ead23ba083622bd3e438546179b

Download Submit
C:\Users\Admin\AppData\Local\Temp\d

Filesize
41.5MB

MD5
91d11d0c01edafd00691610474ae43cd

SHA1
5fcc0fc9bdbadc8487ce4c84d18d75f12c1c9f22

SHA256
4aca3181c798f728600183bb01e38804983b0f673ecc3438824f419bd9013e51

SHA512
9e7617f4f92d32c18df49b290f98526333fe402cc4c3257b7d6f81e14120b6b119cc8bf11b6016e149bed05ba8510c4e6865f2f01f401480fcd3150e92afd0b2

Download Submit
C:\Users\Admin\AppData\Local\Temp\d

Filesize
41.5MB

MD5
603d2d58ab9bffa4ed2d2fa1c9953821

SHA1
076ddfb3be034b6cba46adc5b23295242b94d343

SHA256
66e526d6ee63d5ef3219588ce665ccaa9dcb5267481a7ff8e03ea7cf24f793a8

SHA512
3a613971866d762e86ebe8251019faa6016eb5fa51f8ed7f577bf4eb3c51069dd6d9804e9aff80fa4db86158fff697f0619d759c40ea14b245664165e83cc6e9

Download Submit
C:\Users\Admin\AppData\Local\Temp\d

Filesize
41.5MB

MD5
6cf8c99eb86c9b6b2b1797f42d9de52f

SHA1
a9a40c1674ab2fe6c23d27f1b3cda9381b7e5b60

SHA256
c5f09633ff97da937d880819b4b27a27acb647959bbfd903dd4225d83637aa6a

SHA512
9865fb20cab5dd636a11ca6275fa0197c9328e05023936f13d95654f2481434204434464c8ef3f44a77949d896cb23bab3d4fb888f47b936d97fc5250cd8e25c

Download Submit
C:\Users\Admin\AppData\Local\Temp\d.INTEG.RAW

Filesize
84KB

MD5
59fea8b2210721acd2f1e5380026c781

SHA1
47942416425f5115d30c6614eaaa8383f2ce18b9

SHA256
f0e319666c57ca361d71e0dfb94e03ccc75af6b4da923e5b57a6e32938133e95

SHA512
fa4b0be944c9baafc100f186a5b8a4d6bb1d1a5aa92f74f09763a95081d7a368ec3e02a049b780b1374d0df1331d07db2515762a281d80bc0f4b22cbef3c3df6

Download Submit
C:\Users\Admin\AppData\Local\Temp\d.jfm

Filesize
16KB

MD5
4d2a59d9fc516291f42721e10165ddc4

SHA1
c2c51480d280cc51b0802082e30405560f9cc9c0

SHA256
bb9a81db24c387e4144961907f6da5c795833e08957e1a1a5f81ddb7e0bed1c5

SHA512
7d437cc6e0d446532f77a7cf30bd493e2bad930e2a4f8dc5712a9aa9e08de5d154026e8199b7d4c1528c6e589a95083b529813f898cc2fa4b6fd582b174b0745

Download Submit
C:\Users\Admin\AppData\Local\Temp\d.jfm

Filesize
16KB

MD5
2477ab6e588ca078e88184b5a44af8f9

SHA1
615622c59843f2226a022b99a28b6a52d849a9c0

SHA256
198f28146de032c79f86a98aa4496e7034fb250da56d2c13d1f01524077b2e11

SHA512
c7a90f51b134af73bd34f6f49bf3a5401e8bf38f6723b4a29919a8c3e5c4ca123e4770811da83b2798fa894873d3a92e093c7a2ad22194f016a90afaaa6e2e81

Download Submit
C:\Users\Admin\AppData\Local\Temp\d.jfm

Filesize
16KB

MD5
3dd20e81bf17e9f5562c6765e47609a9

SHA1
0c763e847aedba3ce9e741c745fd361098e7f900

SHA256
12d381f31f52dd0540857482058ffe7703b05d20d4ab1fe4eed25cfacd72a442

SHA512
d7d836baf96ca128e0a489f865edd5a296910f7d31e67afb67c010d4efae28730b97577ffde7098f1b971d239f7a5b7c6bc832d06518c1388dee282613faaf17

Download Submit
C:\Users\Admin\AppData\Local\Temp\d.jfm

Filesize
16KB

MD5
2281beddeac4a4996cc7c152b03ff73c

SHA1
25bc6c671154a4240327897d0605c887ef415aa6

SHA256
862127f18d2f997ceb1442ab4b976cffe947507ed59d2c71d33655acfe16d689

SHA512
7d46b693c6a10085e81980c7d90c8ca1c55e1fdf4bd0eea7d4dc87e4d95d55114901df4e374b7a7ac6c86eb738e177eeb4e5811aaeb71706cbb8846ea4bf5570

Download Submit
C:\Users\Admin\AppData\Local\Temp\d.jfm

Filesize
16KB

MD5
aad6137a6e70504893de34a73a62eb99

SHA1
883f863269428c7e1590322f5935903e0bf8c971

SHA256
3646779bdaa7e9ffcfece4ce4c0cb7e5c21dbf782d05faa00390d154234309dd

SHA512
06b12402f8ca5b78c988ddf777644822972dade68ba4b412e5a9554d99e356233307107e6db289554ea660620c4ea5a2a83c1183173fe08b5094ba1a2a3178aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\d.jfm

Filesize
16KB

MD5
973c303541ec9bbb44c2bab2c27314ad

SHA1
48a8c1a2bd0793501ea563dbdcc33c7976b9b90f

SHA256
918eacd0dd4a833790f21062ccd50c7ce6b13d40b0a06d76d5717e3ad77084c1

SHA512
bb32a9e8241a9580f3a9c217134a56916216a57bee9ada790d27fe013516692947b4bf3ae7db3e05e8832c44fad4ac52fba601b9c96f9407247236f3015f4e8a

Download Submit
C:\Users\Admin\AppData\Local\Temp\d.jfm

Filesize
16KB

MD5
ffa6b7296dce29cfef14d1a9e2a7565f

SHA1
6425c41851afcba5b411ac53eb01de9ddb495d7b

SHA256
e31797670fec049f8ac563578b1153f6541fc66e1ec213f064a2135e45a47f3b

SHA512
fa3da83cd9e62b68432bd48611b272f3cda03525e0dfba235bd4e46befa8d331e978185a1d419918a351d1a0b6a1dd88973ea03ae3d99a613acc6a1b04c7185d

Download Submit
C:\Users\Admin\AppData\Local\Temp\d.jfm

Filesize
16KB

MD5
9db9275f5aed38b6cfc8226325be92bc

SHA1
58595aeb79837364954b31caf8d3e11a7f1c681a

SHA256
c4452385c6d4d7fc8e970de9312427b80a14fc930f64ae166979d887d7873017

SHA512
853b35313f15e3821de16f77dcee2338a986187b8f8273691242cf66e5a94b39c5a8ffe56b15fec6674c6c752e67da2d271468c439c1d21aa473bdb8ecd0e4c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\d.jfm

Filesize
16KB

MD5
696318dcd8ad43b07b1c64b07c4a9fba

SHA1
23450a2a9eccac12b2df7dc8791793c058a7b92d

SHA256
bed5e9d2a6ee893175e5d7e66ea061087f92b0b87023c19a0c7473cd117d141c

SHA512
5d51972a0ca046ded685c8ceae50d793dfe33c76bd6ef9907ec2d525327899713ff329b0800cd02eb2452adce7b1e7a05ca9e3e633b8142b8c028361431dd5f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\d.jfm

Filesize
16KB

MD5
d0b3422ff9adc0a1eccaa9d92ea2c414

SHA1
2c73fff8b7dd3bc697fef2330e1a4e473782dd80

SHA256
d9d6d794acdd56a6a106a8ea3ef3e98dad9f98b8c30691adea694a6fb09fa30e

SHA512
1a2e9b14d683d349e19cf0581f4295930cc7d4a990f0056154a9c196cbb72b8f46d62cdab97a34c611bfe9f0b17e7c889726afd5097d3129734a2c0efcb96a76

Download Submit
C:\Users\Admin\AppData\Local\Temp\d.jfm

Filesize
16KB

MD5
ae76fa99df560f3c0ebab0bcb9c3b164

SHA1
41ac04333322cf2b5f39ab565982498a1a70e544

SHA256
29b6ea8733dfb1e5065512d6e892f97d91280b16308a373116339632d3ce4d75

SHA512
1c0763737caf13eb07ff42ab94120320e8154e069e85d787a9c4e96f9bbed4b284f69e99ab6f7f4132d049ce487ea1e51722deb4ba1cf888f16009d1e03786e4

Download Submit
C:\Users\Admin\AppData\Local\Temp\d.jfm

Filesize
16KB

MD5
ea0570e92b863988749c59832e4dc563

SHA1
675b4327e21c1c7b1fa5bae2f55f84f79e8f10ea

SHA256
692faafcf2b4bb89b83c9e87a2ea75f166de9a8a0536db1b65ee9492172832b9

SHA512
485fb536cf3d961d3f4dd2e5ba9662ab7a8d759811d351053d1c418060d6cc6aa9fd7262f05170e413df3a512cb5f0150c08240cef73cecb01e99ec9e784e8a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\d.jfm

Filesize
16KB

MD5
33156f3ce325b00beff93d14ff45ea18

SHA1
73e1d8b5353575fef0655a1b386409797c8da051

SHA256
03cf273ef2f3ffde3eb622111ceb535ae29da0d064d798b84cb72f83c9f2c9bf

SHA512
fef5a422e985d491c7071900dba632cb0d7880233e3ab30674d715b8fe83a2900f5135a9350a1170a85feeb7d0aca47501e90327c332caf22f1ec89e3fc7dc97

Download Submit
C:\Users\Admin\AppData\Local\Temp\d.jfm

Filesize
16KB

MD5
9163744efba6afb4c47b7a75bde0e507

SHA1
44fae3e8b915f98eeeb0804264f23d87fb94531f

SHA256
35d42eedf8bee4e86e8f9f590e7483193cb8ed9f10b23e99e328cb46229de75e

SHA512
9e24f29d9bb6b308910067582ac764278172e4e4de8bf99875dc157679617e67fc7110f8864008f1b192da26baa6a09e18a1eb6de29d0bf63d0d4fedd244f57c

Download Submit
C:\Users\Admin\AppData\Local\Temp\d.jfm

Filesize
16KB

MD5
2aee02811d289a36fa0694a151d950d5

SHA1
5f8678e7922c662614aaf4ef531ee971f2bae36f

SHA256
141beacd28782a08c5921ca90e6123a44e54017963bbb7c5e42d27cce42bdf9c

SHA512
30b603f70702468bdff6b9781d01577ebef28049122ed4174f8d969b4d4a9152d146dad329527b8c4194b151beb2f365055bf4dab6834975a53b0539604f49eb

Download Submit
C:\Users\Admin\AppData\Local\Temp\d.jfm

Filesize
16KB

MD5
eb0fb6a1aee6304d1c3ea3055689b7a6

SHA1
4f294785ea93281406308ea613e4d99dd4156d61

SHA256
43f9cecde582049210d4d0ef568d71d0dc9474d8de50ecd4e3464249a9deee1b

SHA512
e3bc0b49a4502a60e4f0d0b876b9e428e8aaa5dc8f2301c7cc07ca0ddc5c423536275669b4bc92f5bbf5dd9716b502c4276c3f16f9921ffb0f68086c961e7899

Download Submit
C:\Users\Admin\AppData\Local\Temp\d.jfm

Filesize
16KB

MD5
f96d788cbfacdaf03be49fb4762eea24

SHA1
11d3cef850a03658cdafaa79019047cdbca2d7ae

SHA256
fb40b662380c938931a2f635d56d381ee0d43c2935c55ca8f81c8b373ff5535c

SHA512
695229f02d78572c5ea87e8ad95fa2a0d9964ba0dcfecc21314fe119eafc3a3eb33c98b36b45c9f87ee223d12f53d9e035b58f356987d244e64d5d7ddcf18166

Download Submit
C:\Users\Admin\AppData\Local\Temp\ecv74D2.tmp

Filesize
25.5MB

MD5
00859ea11f078d8057eb7a195b9888d6

SHA1
7bbb6f684d587dcc8c3e93375de9cb4431e16caa

SHA256
d6b95ac13a19dce2678bdeb61f93bb9e391721ef3074ee8b2227d4bd9f1abbfe

SHA512
bed363454c7a94fd33415349fbbf3ef5108908f29c47a5f0f3291641504cf35ca58d94fbd993c17351f643b2d3b43fd53b7e9b30cad4ec26c7786895ebf1b388

Download Submit
C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt

Filesize
31B

MD5
b7161c0845a64ff6d7345b67ff97f3b0

SHA1
d223f855da541fe8e4c1d5c50cb26da0a1deb5fc

SHA256
fe9e28ff0b652e22a124b0a05382bc1ac48cbd9c7c76ca647b0c9f8542888f66

SHA512
98d8971ff20ba256cf886a9db416ac9366d2c6ad4ff51a65bd7e539974dc93f4c897f92d8c9c0319c69b27eacf05cd350a0302828e63190b03457a0eda57f680

Download Submit
C:\Users\Admin\AppData\Local\Temp\jamesdirect.exe

Filesize
537KB

MD5
6bb2444563f03f98bcbb81453af4e8c0

SHA1
97f7d6c15d2a1cd34d32e6d6106fcf5e8a0515ed

SHA256
af1beafe8b2042586f291bd09192e420349c87bfaf48233c9ae5ceae4b19df4d

SHA512
dbf81f69c4e9086cf6da8e83f3f32346e44a590d4c037c02c83a5e3af2f666dec0a00a4eb296c90d54a4231b8060b76cf26147f4bb78b6e04d6009c77082be36

Download Submit
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe

Filesize
184KB

MD5
7fee8223d6e4f82d6cd115a28f0b6d58

SHA1
1b89c25f25253df23426bd9ff6c9208f1202f58b

SHA256
a45317c374d54e322153afd73f0e90f1486638d77b7fd85746d091071bbecd59

SHA512
3ed900b83dd178637c2fd4e8444a899f17f12c4ec92a6f4de4fe544fe8d41b521c69b8f348343cb397d0e160f23e27429042d758b5fa5acac0bab5c3584bace4

Download Submit
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe

Filesize
61KB

MD5
a6279ec92ff948760ce53bba817d6a77

SHA1
5345505e12f9e4c6d569a226d50e71b5a572dce2

SHA256
8b581869bf8944a8e0aa169adea2a4afe47434123da477132880aff6a5032181

SHA512
213cb374f1273c899e0c88a20c0101a7c28024ce5046a2e0d7898bd182d918288bb80367fea4454c437c057ff9ed4fffd42be48a13ca73653021a6d63e1cfa9c

Download Submit
C:\Users\Admin\AppData\Local\Temp\pub2.exe

Filesize
214KB

MD5
1a1ea56ab621b6302509b15c30af87f3

SHA1
6249a3c2f4336a828d59b07724ae9983a3eef264

SHA256
5d3685c1a78ebb08d03a5de627bba9c55f0e7bfbd6d5efa61c6ad26d111bb2c4

SHA512
66a7c29bc1f0e573c24af632edf1250ae50517c37cd5d2560e0f8619ebb76f26137bd234f504501dd4a79ad7779a17e3e83951cb907f92174102fa3811d48a90

Download Submit
C:\Users\Admin\Documents\VlcpVideoV1.0.1\md9_1sjm.exe

Filesize
891KB

MD5
8e33397689414f30209a555b0ae1fe5c

SHA1
b915a1cb575c181c01b11a0f6b8a5e00e946e9c3

SHA256
45b8610362cb8b8948f0a3a193daaeca16a13798921573cd708450f478079976

SHA512
f8bfab698890515c7df76d6147e423faacd0e6d58b9e5ba9b891b56c5b62e0d1798165d510fa22b9a453e80a7e9eb511418c00158126b89aacbd7c7a43873b84

Download Submit
memory/376-161-0x0000022213670000-0x00000222136E1000-memory.dmp

Filesize
452KB

Download
memory/748-98-0x00000202AAE20000-0x00000202AAE30000-memory.dmp

Filesize
64KB

Download
memory/748-133-0x00000202A84A0000-0x00000202A84A2000-memory.dmp

Filesize
8KB

Download
memory/748-114-0x00000202AAF20000-0x00000202AAF30000-memory.dmp

Filesize
64KB

Download
memory/1224-179-0x0000028D0C570000-0x0000028D0C5E1000-memory.dmp

Filesize
452KB

Download
memory/1428-312-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/1428-304-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/2400-167-0x00000205C2680000-0x00000205C26F1000-memory.dmp

Filesize
452KB

Download
memory/2428-173-0x0000012248D30000-0x0000012248DA1000-memory.dmp

Filesize
452KB

Download
memory/2604-137-0x000001302A220000-0x000001302A26C000-memory.dmp

Filesize
304KB

Download
memory/2604-142-0x000001302A400000-0x000001302A471000-memory.dmp

Filesize
452KB

Download
memory/2604-144-0x000001302A220000-0x000001302A26C000-memory.dmp

Filesize
304KB

Download
memory/3700-154-0x0000028A76B80000-0x0000028A76BF1000-memory.dmp

Filesize
452KB

Download
memory/4048-73-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/4048-65-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/4132-1805-0x0000000000400000-0x000000000060D000-memory.dmp

Filesize
2.1MB

Download
memory/4132-82-0x0000000000400000-0x000000000060D000-memory.dmp

Filesize
2.1MB

Download
memory/4132-81-0x0000000000400000-0x000000000060D000-memory.dmp

Filesize
2.1MB

Download
memory/4132-1340-0x0000000000400000-0x000000000060D000-memory.dmp

Filesize
2.1MB

Download
memory/4668-58-0x0000000000F70000-0x0000000000F98000-memory.dmp

Filesize
160KB

Download
memory/4668-36-0x00000000007A0000-0x00000000007DA000-memory.dmp

Filesize
232KB

Download
memory/4668-34-0x00007FF820573000-0x00007FF820574000-memory.dmp

Filesize
4KB

Download
memory/4880-148-0x000002A530640000-0x000002A5306B1000-memory.dmp

Filesize
452KB

Download
memory/4924-74-0x0000000000850000-0x00000000008DA000-memory.dmp

Filesize
552KB

Download
memory/4924-2036-0x00000000050C0000-0x00000000050E8000-memory.dmp

Filesize
160KB

Download