Overview

overview

7

Static

static

1

URLScan

urlscan

1

https://alh.app/RV6b...

windows10-2004-x64

7

https://alh.app/RV6b...

windows10-ltsc_2021-x64

7

https://alh.app/RV6b...

windows11-21h2-x64

7

https://alh.app/RV6b...

windows11-ltsc_2024-x64

7

Analysis

  • user interaction
    yes
  • max time kernel
    300s
  • max time network
    301s
  • platform
    windows10-ltsc_2021_x64
  • resource
    win10ltsc2021-20260513-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
  • submitted
    22/07/2026, 16:26

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    https://alh.app/RV6bj6L5
  • Sample260722-txmnnsvxgz
Score
7/10
defense_evasiondiscoverypersistenceprivilege_escalationransomwarespywaretrojan

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 6 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 34 IoCs
  • Loads dropped DLL 64 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Windows directory 64 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Time Discovery 1 TTPs 2 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Modifies data under HKEY_USERS 3 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 8 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 54 IoCs
  • Suspicious use of SendNotifyMessage 32 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://alh.app/RV6bj6L5
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3032
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x270,0x7ff8a647c188,0x7ff8a647c194,0x7ff8a647c1a0
      2⤵
        PID:892
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1996,i,14182361021935320388,8714401400688304924,524288 --field-trial-handle=2856,i,9520661710819782890,15713371523006718289,262144 --variations-seed-version --mojo-platform-channel-handle=2924 /prefetch:3
        2⤵
        • System Time Discovery
        PID:4584
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1852,i,5775484349771474201,2364566391396013543,262144 --field-trial-handle=2856,i,9520661710819782890,15713371523006718289,262144 --variations-seed-version --mojo-platform-channel-handle=2884 /prefetch:2
        2⤵
          PID:4132
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2316,i,12563212473374221453,1015199257610921215,524288 --field-trial-handle=2856,i,9520661710819782890,15713371523006718289,262144 --variations-seed-version --mojo-platform-channel-handle=2672 /prefetch:8
          2⤵
            PID:3568
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3504,i,2684846592253034694,2888095147761245887,2097152 --field-trial-handle=2856,i,9520661710819782890,15713371523006718289,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
            2⤵
              PID:4676
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3524,i,12990262521911349473,17732828830411024073,2097152 --field-trial-handle=2856,i,9520661710819782890,15713371523006718289,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
              2⤵
                PID:2216
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4128,i,16438263715637850534,9587596925593470802,2097152 --field-trial-handle=2856,i,9520661710819782890,15713371523006718289,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:1
                2⤵
                  PID:4700
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4200,i,15680164171914921066,14000696119129094312,2097152 --field-trial-handle=2856,i,9520661710819782890,15713371523006718289,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:2
                  2⤵
                    PID:5060
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5152,i,4550646150382354052,13751002489094657821,2097152 --field-trial-handle=2856,i,9520661710819782890,15713371523006718289,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:1
                    2⤵
                      PID:4288
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=3580,i,11217961422503868825,3360239578462432092,2097152 --field-trial-handle=2856,i,9520661710819782890,15713371523006718289,262144 --variations-seed-version --mojo-platform-channel-handle=3788 /prefetch:1
                      2⤵
                        PID:4180
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5288,i,9346584999961551753,4974090354696691081,524288 --field-trial-handle=2856,i,9520661710819782890,15713371523006718289,262144 --variations-seed-version --mojo-platform-channel-handle=5284 /prefetch:8
                        2⤵
                          PID:2412
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5332,i,17094767332962587185,9794937788933473526,524288 --field-trial-handle=2856,i,9520661710819782890,15713371523006718289,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:8
                          2⤵
                            PID:2300
                          • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6012,i,12471173633434963108,16016057095778173686,524288 --field-trial-handle=2856,i,9520661710819782890,15713371523006718289,262144 --variations-seed-version --mojo-platform-channel-handle=5992 /prefetch:8
                            2⤵
                              PID:1528
                            • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6012,i,12471173633434963108,16016057095778173686,524288 --field-trial-handle=2856,i,9520661710819782890,15713371523006718289,262144 --variations-seed-version --mojo-platform-channel-handle=5992 /prefetch:8
                              2⤵
                                PID:5024
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6540,i,8598095606145651159,11903865878913888255,524288 --field-trial-handle=2856,i,9520661710819782890,15713371523006718289,262144 --variations-seed-version --mojo-platform-channel-handle=6556 /prefetch:8
                                2⤵
                                  PID:1848
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6560,i,16814907877355908871,14350556343400074622,2097152 --field-trial-handle=2856,i,9520661710819782890,15713371523006718289,262144 --variations-seed-version --mojo-platform-channel-handle=6600 /prefetch:1
                                  2⤵
                                    PID:3968
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4296,i,9677581619115644576,13897697069854008632,524288 --field-trial-handle=2856,i,9520661710819782890,15713371523006718289,262144 --variations-seed-version --mojo-platform-channel-handle=5992 /prefetch:8
                                    2⤵
                                      PID:2484
                                    • C:\Users\Admin\Downloads\aloha_setup64.exe
                                      "C:\Users\Admin\Downloads\aloha_setup64.exe"
                                      2⤵
                                      • Executes dropped EXE
                                      • Suspicious use of AdjustPrivilegeToken
                                      • Suspicious use of WriteProcessMemory
                                      PID:4412
                                      • C:\Users\Admin\Downloads\CR_1629E.tmp\setup.exe
                                        "C:\Users\Admin\Downloads\CR_1629E.tmp\setup.exe" --install-archive="C:\Users\Admin\Downloads\CR_1629E.tmp\ALOHA.PACKED.7Z"
                                        3⤵
                                        • Checks computer location settings
                                        • Executes dropped EXE
                                        • Loads dropped DLL
                                        • Modifies registry class
                                        • Modifies system certificate store
                                        • Suspicious use of WriteProcessMemory
                                        PID:2260
                                        • C:\Users\Admin\Downloads\CR_1629E.tmp\setup.exe
                                          C:\Users\Admin\Downloads\CR_1629E.tmp\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Aloha Mobile\Aloha\User Data\Crashpad" --annotation=device_id=0895fc6e-6546-4d70-b570-138ffc41998a --annotation=format=minidump --annotation=is_debug=false --annotation=is_release=true --annotation=plat=Win64 --annotation=prod=Aloha --annotation=product_version=4.20.0.0 --annotation=token=9e03b2e36605d475196bcb6e61ae3a9157de20aa775eeae07c234f3b16008d28 --annotation=user_hostname=VCGDLOYN --annotation=user_id=0895fc6e-6546-4d70-b570-138ffc41998a --annotation=ver=4.20.0.0 --initial-client-data=0x6c8,0x6b0,0x654,0x6d8,0x63c,0x7ff693f801f8,0x7ff693f80204,0x7ff693f80210
                                          4⤵
                                          • Executes dropped EXE
                                          PID:4428
                                        • C:\Users\Admin\AppData\Local\Aloha Mobile\Aloha\Application\4.20.0.0\vpn_installer.exe
                                          "C:\Users\Admin\AppData\Local\Aloha Mobile\Aloha\Application\4.20.0.0\vpn_installer.exe" install "C:\Users\Admin\AppData\Local\Aloha Mobile\Aloha\Application" 4.20.0.0
                                          4⤵
                                          • Checks computer location settings
                                          • Executes dropped EXE
                                          • Suspicious use of WriteProcessMemory
                                          PID:1508
                                          • C:\Users\Admin\AppData\Local\Aloha Mobile\Aloha\Application\4.20.0.0\aloha_service.exe
                                            "C:\Users\Admin\AppData\Local\Aloha Mobile\Aloha\Application\4.20.0.0\aloha_service.exe" stop
                                            5⤵
                                            • Executes dropped EXE
                                            PID:1968
                                          • C:\Users\Admin\AppData\Local\Aloha Mobile\Aloha\Application\4.20.0.0\aloha_service.exe
                                            "C:\Users\Admin\AppData\Local\Aloha Mobile\Aloha\Application\4.20.0.0\aloha_service.exe" delete
                                            5⤵
                                            • Executes dropped EXE
                                            PID:1884
                                          • C:\Windows\System32\certutil.exe
                                            "C:\Windows\System32\certutil.exe" -delstore -enterprise root "Aloha Mobile Root CA"
                                            5⤵
                                              PID:224
                                            • C:\Windows\System32\certutil.exe
                                              "C:\Windows\System32\certutil.exe" -verifystore -enterprise root "Aloha Mobile Root CA"
                                              5⤵
                                                PID:5048
                                              • C:\Windows\System32\certutil.exe
                                                "C:\Windows\System32\certutil.exe" -addstore -f -enterprise -user root "C:\Users\Admin\AppData\Local\Aloha Mobile\Aloha\Application\4.20.0.0\strongswanCert.der"
                                                5⤵
                                                  PID:3660
                                                • C:\Windows\System32\certutil.exe
                                                  "C:\Windows\System32\certutil.exe" -verifystore -enterprise root "Aloha Mobile Root CA"
                                                  5⤵
                                                    PID:2836
                                                  • C:\Users\Admin\AppData\Local\Aloha Mobile\Aloha\Application\4.20.0.0\aloha_service.exe
                                                    "C:\Users\Admin\AppData\Local\Aloha Mobile\Aloha\Application\4.20.0.0\aloha_service.exe" install
                                                    5⤵
                                                    • Executes dropped EXE
                                                    PID:4644
                                                  • C:\Users\Admin\AppData\Local\Aloha Mobile\Aloha\Application\4.20.0.0\aloha_service.exe
                                                    "C:\Users\Admin\AppData\Local\Aloha Mobile\Aloha\Application\4.20.0.0\aloha_service.exe" start
                                                    5⤵
                                                    • Executes dropped EXE
                                                    PID:4736
                                                • C:\Users\Admin\Downloads\CR_1629E.tmp\setup.exe
                                                  "C:\Users\Admin\Downloads\CR_1629E.tmp\setup.exe" --verbose-logging --create-shortcuts=0 --install-level=0
                                                  4⤵
                                                  • Executes dropped EXE
                                                  • Drops file in Windows directory
                                                  • Modifies registry class
                                                  • Suspicious use of FindShellTrayWindow
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:1528
                                                  • C:\Users\Admin\Downloads\CR_1629E.tmp\setup.exe
                                                    C:\Users\Admin\Downloads\CR_1629E.tmp\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Aloha Mobile\Aloha\User Data\Crashpad" --annotation=device_id=0895fc6e-6546-4d70-b570-138ffc41998a --annotation=format=minidump --annotation=is_debug=false --annotation=is_release=true --annotation=plat=Win64 --annotation=prod=Aloha --annotation=product_version=4.20.0.0 --annotation=token=9e03b2e36605d475196bcb6e61ae3a9157de20aa775eeae07c234f3b16008d28 --annotation=user_hostname=VCGDLOYN --annotation=user_id=0895fc6e-6546-4d70-b570-138ffc41998a --annotation=ver=4.20.0.0 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2a0,0x2d0,0x7ff693f801f8,0x7ff693f80204,0x7ff693f80210
                                                    5⤵
                                                    • Executes dropped EXE
                                                    PID:5004
                                                • C:\Users\Admin\AppData\Local\Aloha Mobile\Aloha\Application\aloha.exe
                                                  "C:\Users\Admin\AppData\Local\Aloha Mobile\Aloha\Application\aloha.exe" --from-installer
                                                  4⤵
                                                  • Checks computer location settings
                                                  • Executes dropped EXE
                                                  • Loads dropped DLL
                                                  • Drops file in Windows directory
                                                  • Checks processor information in registry
                                                  • Enumerates system info in registry
                                                  • Modifies data under HKEY_USERS
                                                  • Modifies registry class
                                                  • Suspicious behavior: AddClipboardFormatListener
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  • Suspicious use of FindShellTrayWindow
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:1564
                                                  • C:\Users\Admin\AppData\Local\Aloha Mobile\Aloha\Application\aloha.exe
                                                    "C:\Users\Admin\AppData\Local\Aloha Mobile\Aloha\Application\aloha.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Aloha Mobile\Aloha\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Aloha Mobile\Aloha\User Data\Crashpad" --annotation=device_id=0895fc6e-6546-4d70-b570-138ffc41998a --annotation=format=minidump --annotation=is_debug=false --annotation=is_release=true --annotation=plat=Win64 --annotation=prod=Aloha --annotation=product_version=4.20.0.0 --annotation=token=9e03b2e36605d475196bcb6e61ae3a9157de20aa775eeae07c234f3b16008d28 --annotation=user_hostname=VCGDLOYN --annotation=user_id=0895fc6e-6546-4d70-b570-138ffc41998a --annotation=ver= --initial-client-data=0x13c,0x140,0x144,0xf8,0x148,0x7ff89701a9f0,0x7ff89701a9fc,0x7ff89701aa08
                                                    5⤵
                                                    • Executes dropped EXE
                                                    • Loads dropped DLL
                                                    PID:4780
                                                  • C:\Users\Admin\AppData\Local\Aloha Mobile\Aloha\Application\aloha.exe
                                                    "C:\Users\Admin\AppData\Local\Aloha Mobile\Aloha\Application\aloha.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --start-stack-profiler --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2028,i,8167164666759491226,4549076947829365999,262144 --disable-features=CalculateNativeWinOcclusion,IPH_ReadingListEntryPoint,Journeys,LensOverlay,LensStandalone,LiveCaptionAutomaticLanguageDownload,LiveCaptionExperimentalLanguages,LiveCaptionLogFlickerRate,LiveCaptionMultiLanguage,LiveCaptionRightClick,LiveCaptionUseGreedyTextStabilizer,LiveCaptionUseWaitK,LiveCaptionWebAudio,LiveTranslate,NtpOneGoogleBar --variations-seed-version --mojo-platform-channel-handle=2024 /prefetch:2
                                                    5⤵
                                                    • Executes dropped EXE
                                                    • Loads dropped DLL
                                                    PID:224
                                                  • C:\Users\Admin\AppData\Local\Aloha Mobile\Aloha\Application\aloha.exe
                                                    "C:\Users\Admin\AppData\Local\Aloha Mobile\Aloha\Application\aloha.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --start-stack-profiler --field-trial-handle=2028,i,8167164666759491226,4549076947829365999,262144 --disable-features=CalculateNativeWinOcclusion,IPH_ReadingListEntryPoint,Journeys,LensOverlay,LensStandalone,LiveCaptionAutomaticLanguageDownload,LiveCaptionExperimentalLanguages,LiveCaptionLogFlickerRate,LiveCaptionMultiLanguage,LiveCaptionRightClick,LiveCaptionUseGreedyTextStabilizer,LiveCaptionUseWaitK,LiveCaptionWebAudio,LiveTranslate,NtpOneGoogleBar --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:3
                                                    5⤵
                                                    • Executes dropped EXE
                                                    • Loads dropped DLL
                                                    • System Time Discovery
                                                    PID:5128
                                                  • C:\Users\Admin\AppData\Local\Aloha Mobile\Aloha\Application\aloha.exe
                                                    "C:\Users\Admin\AppData\Local\Aloha Mobile\Aloha\Application\aloha.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --field-trial-handle=2028,i,8167164666759491226,4549076947829365999,262144 --disable-features=CalculateNativeWinOcclusion,IPH_ReadingListEntryPoint,Journeys,LensOverlay,LensStandalone,LiveCaptionAutomaticLanguageDownload,LiveCaptionExperimentalLanguages,LiveCaptionLogFlickerRate,LiveCaptionMultiLanguage,LiveCaptionRightClick,LiveCaptionUseGreedyTextStabilizer,LiveCaptionUseWaitK,LiveCaptionWebAudio,LiveTranslate,NtpOneGoogleBar --variations-seed-version --mojo-platform-channel-handle=2636 /prefetch:8
                                                    5⤵
                                                    • Executes dropped EXE
                                                    • Loads dropped DLL
                                                    PID:5240
                                                  • C:\Users\Admin\AppData\Local\Aloha Mobile\Aloha\Application\aloha.exe
                                                    "C:\Users\Admin\AppData\Local\Aloha Mobile\Aloha\Application\aloha.exe" --type=renderer --force-high-res-timeticks=disabled --start-stack-profiler --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=2028,i,8167164666759491226,4549076947829365999,262144 --disable-features=CalculateNativeWinOcclusion,IPH_ReadingListEntryPoint,Journeys,LensOverlay,LensStandalone,LiveCaptionAutomaticLanguageDownload,LiveCaptionExperimentalLanguages,LiveCaptionLogFlickerRate,LiveCaptionMultiLanguage,LiveCaptionRightClick,LiveCaptionUseGreedyTextStabilizer,LiveCaptionUseWaitK,LiveCaptionWebAudio,LiveTranslate,NtpOneGoogleBar --variations-seed-version --mojo-platform-channel-handle=2520 /prefetch:1
                                                    5⤵
                                                    • Checks computer location settings
                                                    • Executes dropped EXE
                                                    • Loads dropped DLL
                                                    PID:5976
                                                  • C:\Users\Admin\AppData\Local\Aloha Mobile\Aloha\Application\aloha.exe
                                                    "C:\Users\Admin\AppData\Local\Aloha Mobile\Aloha\Application\aloha.exe" --type=renderer --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=2028,i,8167164666759491226,4549076947829365999,262144 --disable-features=CalculateNativeWinOcclusion,IPH_ReadingListEntryPoint,Journeys,LensOverlay,LensStandalone,LiveCaptionAutomaticLanguageDownload,LiveCaptionExperimentalLanguages,LiveCaptionLogFlickerRate,LiveCaptionMultiLanguage,LiveCaptionRightClick,LiveCaptionUseGreedyTextStabilizer,LiveCaptionUseWaitK,LiveCaptionWebAudio,LiveTranslate,NtpOneGoogleBar --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:1
                                                    5⤵
                                                    • Checks computer location settings
                                                    • Executes dropped EXE
                                                    • Loads dropped DLL
                                                    PID:6000
                                                  • C:\Users\Admin\AppData\Local\Aloha Mobile\Aloha\Application\aloha.exe
                                                    "C:\Users\Admin\AppData\Local\Aloha Mobile\Aloha\Application\aloha.exe" --type=renderer --force-high-res-timeticks=disabled --start-stack-profiler --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=2028,i,8167164666759491226,4549076947829365999,262144 --disable-features=CalculateNativeWinOcclusion,IPH_ReadingListEntryPoint,Journeys,LensOverlay,LensStandalone,LiveCaptionAutomaticLanguageDownload,LiveCaptionExperimentalLanguages,LiveCaptionLogFlickerRate,LiveCaptionMultiLanguage,LiveCaptionRightClick,LiveCaptionUseGreedyTextStabilizer,LiveCaptionUseWaitK,LiveCaptionWebAudio,LiveTranslate,NtpOneGoogleBar --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:1
                                                    5⤵
                                                    • Checks computer location settings
                                                    • Executes dropped EXE
                                                    • Loads dropped DLL
                                                    PID:6008
                                                  • C:\Users\Admin\AppData\Local\Aloha Mobile\Aloha\Application\aloha.exe
                                                    "C:\Users\Admin\AppData\Local\Aloha Mobile\Aloha\Application\aloha.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --field-trial-handle=2028,i,8167164666759491226,4549076947829365999,262144 --disable-features=CalculateNativeWinOcclusion,IPH_ReadingListEntryPoint,Journeys,LensOverlay,LensStandalone,LiveCaptionAutomaticLanguageDownload,LiveCaptionExperimentalLanguages,LiveCaptionLogFlickerRate,LiveCaptionMultiLanguage,LiveCaptionRightClick,LiveCaptionUseGreedyTextStabilizer,LiveCaptionUseWaitK,LiveCaptionWebAudio,LiveTranslate,NtpOneGoogleBar --variations-seed-version --mojo-platform-channel-handle=6456 /prefetch:8
                                                    5⤵
                                                    • Executes dropped EXE
                                                    PID:6328
                                                  • C:\Users\Admin\AppData\Local\Aloha Mobile\Aloha\Application\aloha.exe
                                                    "C:\Users\Admin\AppData\Local\Aloha Mobile\Aloha\Application\aloha.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --field-trial-handle=2028,i,8167164666759491226,4549076947829365999,262144 --disable-features=CalculateNativeWinOcclusion,IPH_ReadingListEntryPoint,Journeys,LensOverlay,LensStandalone,LiveCaptionAutomaticLanguageDownload,LiveCaptionExperimentalLanguages,LiveCaptionLogFlickerRate,LiveCaptionMultiLanguage,LiveCaptionRightClick,LiveCaptionUseGreedyTextStabilizer,LiveCaptionUseWaitK,LiveCaptionWebAudio,LiveTranslate,NtpOneGoogleBar --variations-seed-version --mojo-platform-channel-handle=5624 /prefetch:8
                                                    5⤵
                                                    • Executes dropped EXE
                                                    PID:7060
                                                  • C:\Users\Admin\AppData\Local\Aloha Mobile\Aloha\Application\aloha.exe
                                                    "C:\Users\Admin\AppData\Local\Aloha Mobile\Aloha\Application\aloha.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --field-trial-handle=2028,i,8167164666759491226,4549076947829365999,262144 --disable-features=CalculateNativeWinOcclusion,IPH_ReadingListEntryPoint,Journeys,LensOverlay,LensStandalone,LiveCaptionAutomaticLanguageDownload,LiveCaptionExperimentalLanguages,LiveCaptionLogFlickerRate,LiveCaptionMultiLanguage,LiveCaptionRightClick,LiveCaptionUseGreedyTextStabilizer,LiveCaptionUseWaitK,LiveCaptionWebAudio,LiveTranslate,NtpOneGoogleBar --variations-seed-version --mojo-platform-channel-handle=5656 /prefetch:8
                                                    5⤵
                                                    • Executes dropped EXE
                                                    PID:7068
                                                  • C:\Users\Admin\AppData\Local\Aloha Mobile\Aloha\Application\aloha.exe
                                                    "C:\Users\Admin\AppData\Local\Aloha Mobile\Aloha\Application\aloha.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --field-trial-handle=2028,i,8167164666759491226,4549076947829365999,262144 --disable-features=CalculateNativeWinOcclusion,IPH_ReadingListEntryPoint,Journeys,LensOverlay,LensStandalone,LiveCaptionAutomaticLanguageDownload,LiveCaptionExperimentalLanguages,LiveCaptionLogFlickerRate,LiveCaptionMultiLanguage,LiveCaptionRightClick,LiveCaptionUseGreedyTextStabilizer,LiveCaptionUseWaitK,LiveCaptionWebAudio,LiveTranslate,NtpOneGoogleBar --variations-seed-version --mojo-platform-channel-handle=5772 /prefetch:8
                                                    5⤵
                                                    • Executes dropped EXE
                                                    PID:7076
                                                  • C:\Users\Admin\AppData\Local\Aloha Mobile\Aloha\Application\aloha.exe
                                                    "C:\Users\Admin\AppData\Local\Aloha Mobile\Aloha\Application\aloha.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --field-trial-handle=2028,i,8167164666759491226,4549076947829365999,262144 --disable-features=CalculateNativeWinOcclusion,IPH_ReadingListEntryPoint,Journeys,LensOverlay,LensStandalone,LiveCaptionAutomaticLanguageDownload,LiveCaptionExperimentalLanguages,LiveCaptionLogFlickerRate,LiveCaptionMultiLanguage,LiveCaptionRightClick,LiveCaptionUseGreedyTextStabilizer,LiveCaptionUseWaitK,LiveCaptionWebAudio,LiveTranslate,NtpOneGoogleBar --variations-seed-version --mojo-platform-channel-handle=6544 /prefetch:8
                                                    5⤵
                                                    • Executes dropped EXE
                                                    PID:6276
                                                  • C:\Users\Admin\AppData\Local\Aloha Mobile\Aloha\Application\aloha.exe
                                                    "C:\Users\Admin\AppData\Local\Aloha Mobile\Aloha\Application\aloha.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --field-trial-handle=2028,i,8167164666759491226,4549076947829365999,262144 --disable-features=CalculateNativeWinOcclusion,IPH_ReadingListEntryPoint,Journeys,LensOverlay,LensStandalone,LiveCaptionAutomaticLanguageDownload,LiveCaptionExperimentalLanguages,LiveCaptionLogFlickerRate,LiveCaptionMultiLanguage,LiveCaptionRightClick,LiveCaptionUseGreedyTextStabilizer,LiveCaptionUseWaitK,LiveCaptionWebAudio,LiveTranslate,NtpOneGoogleBar --variations-seed-version --mojo-platform-channel-handle=6000 /prefetch:8
                                                    5⤵
                                                    • Executes dropped EXE
                                                    PID:1484
                                                  • C:\Users\Admin\AppData\Local\Aloha Mobile\Aloha\Application\aloha.exe
                                                    "C:\Users\Admin\AppData\Local\Aloha Mobile\Aloha\Application\aloha.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --field-trial-handle=2028,i,8167164666759491226,4549076947829365999,262144 --disable-features=CalculateNativeWinOcclusion,IPH_ReadingListEntryPoint,Journeys,LensOverlay,LensStandalone,LiveCaptionAutomaticLanguageDownload,LiveCaptionExperimentalLanguages,LiveCaptionLogFlickerRate,LiveCaptionMultiLanguage,LiveCaptionRightClick,LiveCaptionUseGreedyTextStabilizer,LiveCaptionUseWaitK,LiveCaptionWebAudio,LiveTranslate,NtpOneGoogleBar --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:8
                                                    5⤵
                                                    • Executes dropped EXE
                                                    PID:3904
                                                  • C:\Users\Admin\AppData\Local\Aloha Mobile\Aloha\Application\aloha.exe
                                                    "C:\Users\Admin\AppData\Local\Aloha Mobile\Aloha\Application\aloha.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --field-trial-handle=2028,i,8167164666759491226,4549076947829365999,262144 --disable-features=CalculateNativeWinOcclusion,IPH_ReadingListEntryPoint,Journeys,LensOverlay,LensStandalone,LiveCaptionAutomaticLanguageDownload,LiveCaptionExperimentalLanguages,LiveCaptionLogFlickerRate,LiveCaptionMultiLanguage,LiveCaptionRightClick,LiveCaptionUseGreedyTextStabilizer,LiveCaptionUseWaitK,LiveCaptionWebAudio,LiveTranslate,NtpOneGoogleBar --variations-seed-version --mojo-platform-channel-handle=5612 /prefetch:8
                                                    5⤵
                                                    • Executes dropped EXE
                                                    PID:4824
                                                  • C:\Users\Admin\AppData\Local\Aloha Mobile\Aloha\Application\aloha.exe
                                                    "C:\Users\Admin\AppData\Local\Aloha Mobile\Aloha\Application\aloha.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --start-stack-profiler --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2028,i,8167164666759491226,4549076947829365999,262144 --disable-features=CalculateNativeWinOcclusion,IPH_ReadingListEntryPoint,Journeys,LensOverlay,LensStandalone,LiveCaptionAutomaticLanguageDownload,LiveCaptionExperimentalLanguages,LiveCaptionLogFlickerRate,LiveCaptionMultiLanguage,LiveCaptionRightClick,LiveCaptionUseGreedyTextStabilizer,LiveCaptionUseWaitK,LiveCaptionWebAudio,LiveTranslate,NtpOneGoogleBar --variations-seed-version --mojo-platform-channel-handle=6632 /prefetch:8
                                                    5⤵
                                                    • Executes dropped EXE
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    PID:6960
                                                  • C:\Users\Admin\AppData\Local\Aloha Mobile\Aloha\Application\aloha.exe
                                                    "C:\Users\Admin\AppData\Local\Aloha Mobile\Aloha\Application\aloha.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --field-trial-handle=2028,i,8167164666759491226,4549076947829365999,262144 --disable-features=CalculateNativeWinOcclusion,IPH_ReadingListEntryPoint,Journeys,LensOverlay,LensStandalone,LiveCaptionAutomaticLanguageDownload,LiveCaptionExperimentalLanguages,LiveCaptionLogFlickerRate,LiveCaptionMultiLanguage,LiveCaptionRightClick,LiveCaptionUseGreedyTextStabilizer,LiveCaptionUseWaitK,LiveCaptionWebAudio,LiveTranslate,NtpOneGoogleBar --variations-seed-version --mojo-platform-channel-handle=6616 /prefetch:8
                                                    5⤵
                                                    • Executes dropped EXE
                                                    PID:1856
                                                  • C:\Users\Admin\AppData\Local\Aloha Mobile\Aloha\Application\aloha.exe
                                                    "C:\Users\Admin\AppData\Local\Aloha Mobile\Aloha\Application\aloha.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --field-trial-handle=2028,i,8167164666759491226,4549076947829365999,262144 --disable-features=CalculateNativeWinOcclusion,IPH_ReadingListEntryPoint,Journeys,LensOverlay,LensStandalone,LiveCaptionAutomaticLanguageDownload,LiveCaptionExperimentalLanguages,LiveCaptionLogFlickerRate,LiveCaptionMultiLanguage,LiveCaptionRightClick,LiveCaptionUseGreedyTextStabilizer,LiveCaptionUseWaitK,LiveCaptionWebAudio,LiveTranslate,NtpOneGoogleBar --variations-seed-version --mojo-platform-channel-handle=5684 /prefetch:8
                                                    5⤵
                                                    • Executes dropped EXE
                                                    PID:6016
                                                  • C:\Users\Admin\AppData\Local\Aloha Mobile\Aloha\Application\aloha.exe
                                                    "C:\Users\Admin\AppData\Local\Aloha Mobile\Aloha\Application\aloha.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --field-trial-handle=2028,i,8167164666759491226,4549076947829365999,262144 --disable-features=CalculateNativeWinOcclusion,IPH_ReadingListEntryPoint,Journeys,LensOverlay,LensStandalone,LiveCaptionAutomaticLanguageDownload,LiveCaptionExperimentalLanguages,LiveCaptionLogFlickerRate,LiveCaptionMultiLanguage,LiveCaptionRightClick,LiveCaptionUseGreedyTextStabilizer,LiveCaptionUseWaitK,LiveCaptionWebAudio,LiveTranslate,NtpOneGoogleBar --variations-seed-version --mojo-platform-channel-handle=5632 /prefetch:8
                                                    5⤵
                                                    • Executes dropped EXE
                                                    PID:3980
                                                  • C:\Users\Admin\AppData\Local\Aloha Mobile\Aloha\Application\aloha.exe
                                                    "C:\Users\Admin\AppData\Local\Aloha Mobile\Aloha\Application\aloha.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --field-trial-handle=2028,i,8167164666759491226,4549076947829365999,262144 --disable-features=CalculateNativeWinOcclusion,IPH_ReadingListEntryPoint,Journeys,LensOverlay,LensStandalone,LiveCaptionAutomaticLanguageDownload,LiveCaptionExperimentalLanguages,LiveCaptionLogFlickerRate,LiveCaptionMultiLanguage,LiveCaptionRightClick,LiveCaptionUseGreedyTextStabilizer,LiveCaptionUseWaitK,LiveCaptionWebAudio,LiveTranslate,NtpOneGoogleBar --variations-seed-version --mojo-platform-channel-handle=6564 /prefetch:8
                                                    5⤵
                                                    • Executes dropped EXE
                                                    PID:6192
                                                  • C:\Users\Admin\AppData\Local\Aloha Mobile\Aloha\Application\aloha.exe
                                                    "C:\Users\Admin\AppData\Local\Aloha Mobile\Aloha\Application\aloha.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --field-trial-handle=2028,i,8167164666759491226,4549076947829365999,262144 --disable-features=CalculateNativeWinOcclusion,IPH_ReadingListEntryPoint,Journeys,LensOverlay,LensStandalone,LiveCaptionAutomaticLanguageDownload,LiveCaptionExperimentalLanguages,LiveCaptionLogFlickerRate,LiveCaptionMultiLanguage,LiveCaptionRightClick,LiveCaptionUseGreedyTextStabilizer,LiveCaptionUseWaitK,LiveCaptionWebAudio,LiveTranslate,NtpOneGoogleBar --variations-seed-version --mojo-platform-channel-handle=6668 /prefetch:8
                                                    5⤵
                                                    • Executes dropped EXE
                                                    PID:6356
                                                  • C:\Users\Admin\AppData\Local\Aloha Mobile\Aloha\Application\aloha.exe
                                                    "C:\Users\Admin\AppData\Local\Aloha Mobile\Aloha\Application\aloha.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --field-trial-handle=2028,i,8167164666759491226,4549076947829365999,262144 --disable-features=CalculateNativeWinOcclusion,IPH_ReadingListEntryPoint,Journeys,LensOverlay,LensStandalone,LiveCaptionAutomaticLanguageDownload,LiveCaptionExperimentalLanguages,LiveCaptionLogFlickerRate,LiveCaptionMultiLanguage,LiveCaptionRightClick,LiveCaptionUseGreedyTextStabilizer,LiveCaptionUseWaitK,LiveCaptionWebAudio,LiveTranslate,NtpOneGoogleBar --variations-seed-version --mojo-platform-channel-handle=552 /prefetch:8
                                                    5⤵
                                                    • Executes dropped EXE
                                                    PID:6684
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6368,i,17293332823511805696,5834000248563871216,524288 --field-trial-handle=2856,i,9520661710819782890,15713371523006718289,262144 --variations-seed-version --mojo-platform-channel-handle=7156 /prefetch:8
                                              2⤵
                                                PID:1944
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3556,i,13057492129532828926,1137378627311190305,524288 --field-trial-handle=2856,i,9520661710819782890,15713371523006718289,262144 --variations-seed-version --mojo-platform-channel-handle=6900 /prefetch:8
                                                2⤵
                                                  PID:3660
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6896,i,3247928531259523918,15343780915290363755,524288 --field-trial-handle=2856,i,9520661710819782890,15713371523006718289,262144 --variations-seed-version --mojo-platform-channel-handle=4356 /prefetch:8
                                                  2⤵
                                                    PID:1600
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6652,i,9472411052153382966,7586832153665725523,524288 --field-trial-handle=2856,i,9520661710819782890,15713371523006718289,262144 --variations-seed-version --mojo-platform-channel-handle=6672 /prefetch:8
                                                    2⤵
                                                      PID:3080
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6432,i,15140617188837809773,13351496686934199439,524288 --field-trial-handle=2856,i,9520661710819782890,15713371523006718289,262144 --variations-seed-version --mojo-platform-channel-handle=5104 /prefetch:8
                                                      2⤵
                                                        PID:5788
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6088,i,2197918202427688536,14069663549452344534,262144 --field-trial-handle=2856,i,9520661710819782890,15713371523006718289,262144 --variations-seed-version --mojo-platform-channel-handle=6260 /prefetch:8
                                                        2⤵
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        PID:4664
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5092,i,1030814079873811771,2110289859371134820,524288 --field-trial-handle=2856,i,9520661710819782890,15713371523006718289,262144 --variations-seed-version --mojo-platform-channel-handle=5816 /prefetch:8
                                                        2⤵
                                                          PID:6940
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6584,i,7996287585227946819,14163244098467003905,524288 --field-trial-handle=2856,i,9520661710819782890,15713371523006718289,262144 --variations-seed-version --mojo-platform-channel-handle=6604 /prefetch:8
                                                          2⤵
                                                            PID:6944
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5512,i,2931339393645026612,813040382795769616,524288 --field-trial-handle=2856,i,9520661710819782890,15713371523006718289,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:8
                                                            2⤵
                                                              PID:7024
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                            1⤵
                                                              PID:3612
                                                            • C:\Users\Admin\AppData\Local\Aloha Mobile\Aloha\Application\4.20.0.0\aloha_service.exe
                                                              "C:\Users\Admin\AppData\Local\Aloha Mobile\Aloha\Application\4.20.0.0\aloha_service.exe"
                                                              1⤵
                                                              • Executes dropped EXE
                                                              • Loads dropped DLL
                                                              PID:4172
                                                            • C:\Windows\system32\svchost.exe
                                                              C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                                              1⤵
                                                                PID:6484

                                                              Network

                                                                    MITRE ATT&CK Enterprise v16

                                                                    Replay Monitor

                                                                    Loading Replay Monitor...

                                                                    Downloads

                                                                    Qt6Core.dll
                                                                    • Path C:\Users\Admin\AppData\Local\Aloha Mobile\Aloha\Application\4.20.0.0\Qt6Core.dll
                                                                    • Size 5.5MB
                                                                    • SHA256 238b6dad34d40eb3e1c4999ecd224be2ef0fff3cc7b2587d6b4d9dd260effa49
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    Qt6Gui.dll
                                                                    • Path C:\Users\Admin\AppData\Local\Aloha Mobile\Aloha\Application\4.20.0.0\Qt6Gui.dll
                                                                    • Size 7.4MB
                                                                    • SHA256 1c7b79a164335b8c43d7267fa8a0ee43a2bdeb957aef167b38bfedda21cff825
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    Qt6Network.dll
                                                                    • Path C:\Users\Admin\AppData\Local\Aloha Mobile\Aloha\Application\4.20.0.0\Qt6Network.dll
                                                                    • Size 1.3MB
                                                                    • SHA256 298257eb27353c47fcd811e8202f03aa7ea2eef0bcb6f3ee71e8060508b29d49
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    Qt6OpenGL.dll
                                                                    • Path C:\Users\Admin\AppData\Local\Aloha Mobile\Aloha\Application\4.20.0.0\Qt6OpenGL.dll
                                                                    • Size 1.8MB
                                                                    • SHA256 0e6af576615ae16a57b2e33f9085c7fd6ae7039e2e6c444ff848bece1fac8deb
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    Qt6Qml.dll
                                                                    • Path C:\Users\Admin\AppData\Local\Aloha Mobile\Aloha\Application\4.20.0.0\Qt6Qml.dll
                                                                    • Size 4.4MB
                                                                    • SHA256 b8f20b42e29325b86f466ef65ca6bc528979bf8c35976c87bc19fadd3eecaa66
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    Qt6QmlModels.dll
                                                                    • Path C:\Users\Admin\AppData\Local\Aloha Mobile\Aloha\Application\4.20.0.0\Qt6QmlModels.dll
                                                                    • Size 669KB
                                                                    • SHA256 e5be90d5be5af8d00c76ea14031da2101d1820011954ac0fe61ec56e3ee9d677
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    Qt6Quick.dll
                                                                    • Path C:\Users\Admin\AppData\Local\Aloha Mobile\Aloha\Application\4.20.0.0\Qt6Quick.dll
                                                                    • Size 5.0MB
                                                                    • SHA256 7e5adecb6c8b9d04b41bbd409184f5df2044d271380fb16e71a5eae36b85fba6
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    aloha_VPN.dll
                                                                    • Path C:\Users\Admin\AppData\Local\Aloha Mobile\Aloha\Application\4.20.0.0\aloha_VPN.dll
                                                                    • Size 378KB
                                                                    • SHA256 ba821fc9242f79af12a0cd24f46b71e7954f803db4a4a95f41c96eb3266d3c4b
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    aloha_elf.dll
                                                                    • Path C:\Users\Admin\AppData\Local\Aloha Mobile\Aloha\Application\4.20.0.0\aloha_elf.dll
                                                                    • Size 4.6MB
                                                                    • SHA256 a7b4335f3eef79aca0cab28671a3c324272e3f17e1630ecfc8854aa87a74ba7e
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    aloha_qt6_ui.dll
                                                                    • Path C:\Users\Admin\AppData\Local\Aloha Mobile\Aloha\Application\4.20.0.0\aloha_qt6_ui.dll
                                                                    • Size 747KB
                                                                    • SHA256 b94e17e9667737944850a63ba29b478ddf6345e454699a8058887df5e194df0c
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    aloha_service.exe
                                                                    • Path C:\Users\Admin\AppData\Local\Aloha Mobile\Aloha\Application\4.20.0.0\aloha_service.exe
                                                                    • Size 533KB
                                                                    • SHA256 189500479f165eeba1bc3cf8af3dd7bef3f9b6c6637ce18c7dee8a935c8cf727
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    d3dcompiler_47.dll
                                                                    • Path C:\Users\Admin\AppData\Local\Aloha Mobile\Aloha\Application\4.20.0.0\d3dcompiler_47.dll
                                                                    • Size 4.5MB
                                                                    • SHA256 c8e25abd3d45dfb55966a74613258c39b4a83ea2ac77f2f80903499f4d5c03f0
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    libGLESv2.dll
                                                                    • Path C:\Users\Admin\AppData\Local\Aloha Mobile\Aloha\Application\4.20.0.0\libGLESv2.dll
                                                                    • Size 7.5MB
                                                                    • SHA256 89729ecc1b13c7a3db755eecb5473382e90117ad92f4514ba26cf5a24103d6f4
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    vpn_installer.exe
                                                                    • Path C:\Users\Admin\AppData\Local\Aloha Mobile\Aloha\Application\4.20.0.0\vpn_installer.exe
                                                                    • Size 87KB
                                                                    • SHA256 648b6b13192e1d6122bea12a40211a89fcf72997482170cbfcec2cdbd927262c
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    aloha.exe
                                                                    • Path C:\Users\Admin\AppData\Local\Aloha Mobile\Aloha\Application\aloha.exe
                                                                    • Size 5.9MB
                                                                    • SHA256 d17c425d7f9c4f64586f237b2210db9215c60846e374372ceeca43824cb3eca4
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    settings.dat
                                                                    • Path C:\Users\Admin\AppData\Local\Aloha Mobile\Aloha\User Data\Crashpad\settings.dat
                                                                    • Size 40B
                                                                    • SHA256 d8a83f81d2d6abd461053c18a098c93366304bb60f788cd8db03604aae2973b1
                                                                    • MD5 SHA1 SHA512
                                                                    Submit Download

                                                                    43f5f5e9-95b2-496c-8a18-ee519a24a76e.tmp
                                                                    • Path C:\Users\Admin\AppData\Local\Aloha Mobile\Aloha\User Data\Default\43f5f5e9-95b2-496c-8a18-ee519a24a76e.tmp
                                                                    • Size 157KB
                                                                    • SHA256 1063a1f66cceff427a0dd29dd801f9c1ac8e60597e5bc6e2bcc120f3a854209a
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    data_2
                                                                    • Path C:\Users\Admin\AppData\Local\Aloha Mobile\Aloha\User Data\Default\DawnGraphiteCache\data_2
                                                                    • Size 8KB
                                                                    • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                    Submit Download

                                                                    data_3
                                                                    • Path C:\Users\Admin\AppData\Local\Aloha Mobile\Aloha\User Data\Default\DawnGraphiteCache\data_3
                                                                    • Size 8KB
                                                                    • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                    Submit Download

                                                                    Network Persistent State
                                                                    • Path C:\Users\Admin\AppData\Local\Aloha Mobile\Aloha\User Data\Default\Network\Network Persistent State
                                                                    • Size 1KB
                                                                    • SHA256 8a67140173631aebbd60553e4e1e3f98778389b0f251bfab939f96fb770bb18e
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    Network Persistent State~RFe5a88aa.TMP
                                                                    • Path C:\Users\Admin\AppData\Local\Aloha Mobile\Aloha\User Data\Default\Network\Network Persistent State~RFe5a88aa.TMP
                                                                    • Size 59B
                                                                    • SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    Preferences
                                                                    • Path C:\Users\Admin\AppData\Local\Aloha Mobile\Aloha\User Data\Default\Preferences
                                                                    • Size 10KB
                                                                    • SHA256 ff5c2b5e47f3fcba66557ff714893da9050304184f403e95a5adc701993fc42e
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    Preferences
                                                                    • Path C:\Users\Admin\AppData\Local\Aloha Mobile\Aloha\User Data\Default\Preferences
                                                                    • Size 8KB
                                                                    • SHA256 813192f1f562490e3c386537df7a1b466aa6a6e28dc215cbc1b93c9d6c31f99b
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    Preferences
                                                                    • Path C:\Users\Admin\AppData\Local\Aloha Mobile\Aloha\User Data\Default\Preferences
                                                                    • Size 9KB
                                                                    • SHA256 789f886f10727ccb80a1282adeb7d0c87fa14ceec5569d46dda02fd1b758e1c0
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    Preferences~RFe59740d.TMP
                                                                    • Path C:\Users\Admin\AppData\Local\Aloha Mobile\Aloha\User Data\Default\Preferences~RFe59740d.TMP
                                                                    • Size 8KB
                                                                    • SHA256 d72590ab445451e2d099f96fee1292958dfce2cd7f4ec6d6034f69d376c1dc86
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    Secure Preferences
                                                                    • Path C:\Users\Admin\AppData\Local\Aloha Mobile\Aloha\User Data\Default\Secure Preferences
                                                                    • Size 6KB
                                                                    • SHA256 28a29c40de2dac401f3fbd9f6aa8e1ee371994b502e3cef8f12dc8c1053fccd3
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    Secure Preferences~RFe5a0f34.TMP
                                                                    • Path C:\Users\Admin\AppData\Local\Aloha Mobile\Aloha\User Data\Default\Secure Preferences~RFe5a0f34.TMP
                                                                    • Size 5KB
                                                                    • SHA256 04628ec573432b0b4d899f2076aa0acc4a1e27e08f130c4c55c45aa6c2dc9679
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    CURRENT
                                                                    • Path C:\Users\Admin\AppData\Local\Aloha Mobile\Aloha\User Data\Default\Site Characteristics Database\CURRENT
                                                                    • Size 16B
                                                                    • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                                                    • MD5 SHA1 SHA512
                                                                    Submit Download

                                                                    MANIFEST-000001
                                                                    • Path C:\Users\Admin\AppData\Local\Aloha Mobile\Aloha\User Data\Default\Site Characteristics Database\MANIFEST-000001
                                                                    • Size 41B
                                                                    • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                                                                    • MD5 SHA1 SHA512
                                                                    Submit Download

                                                                    data_0
                                                                    • Path C:\Users\Admin\AppData\Local\Aloha Mobile\Aloha\User Data\GrShaderCache\data_0
                                                                    • Size 8KB
                                                                    • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                    Submit Download

                                                                    Local State
                                                                    • Path C:\Users\Admin\AppData\Local\Aloha Mobile\Aloha\User Data\Local State
                                                                    • Size 5KB
                                                                    • SHA256 503ae4e7accb636ac988f6fa557811a4571b66a94a6fe6a9c1c9c2496c3995a5
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    Local State
                                                                    • Path C:\Users\Admin\AppData\Local\Aloha Mobile\Aloha\User Data\Local State
                                                                    • Size 8KB
                                                                    • SHA256 b0a839f349b0dfd3a297bad56cefb3bf6623788994bd68c4fd40bdcbb3e89c69
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    Local State
                                                                    • Path C:\Users\Admin\AppData\Local\Aloha Mobile\Aloha\User Data\Local State
                                                                    • Size 9KB
                                                                    • SHA256 2526f3d0fa7a81cd2b6197d601bc51355712672b38c9d679180a707f467f1c42
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    Local State
                                                                    • Path C:\Users\Admin\AppData\Local\Aloha Mobile\Aloha\User Data\Local State
                                                                    • Size 3KB
                                                                    • SHA256 bddfbd10865f583b40c1c75e965b85ab8c61fed48018ebfa7be89bdb56c9f36f
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    Local State
                                                                    • Path C:\Users\Admin\AppData\Local\Aloha Mobile\Aloha\User Data\Local State
                                                                    • Size 3KB
                                                                    • SHA256 8619509605b15c3492506f1d64f095f8a028659cd6cc2cc00b32668c073179bb
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    Local State
                                                                    • Path C:\Users\Admin\AppData\Local\Aloha Mobile\Aloha\User Data\Local State
                                                                    • Size 9KB
                                                                    • SHA256 3f9ae655e9e1db530cdc68b427fffe4e0ca920d020d438cf59a04b85cacbe537
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    Local State
                                                                    • Path C:\Users\Admin\AppData\Local\Aloha Mobile\Aloha\User Data\Local State
                                                                    • Size 8KB
                                                                    • SHA256 ede743abb421e696257a298393a82617c5ec6fa3c27e6ec465503cf507f99fb0
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    Local State~RFe599486.TMP
                                                                    • Path C:\Users\Admin\AppData\Local\Aloha Mobile\Aloha\User Data\Local State~RFe599486.TMP
                                                                    • Size 1KB
                                                                    • SHA256 a394d1ddb8d667222dbbc25926050b65c0ef81355bcb01740607c28af3beea27
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    metadata.json
                                                                    • Path C:\Users\Admin\AppData\Local\Aloha Mobile\Aloha\User Data\component_crx_cache\metadata.json
                                                                    • Size 252B
                                                                    • SHA256 42effbfd6ea74a229ef914e039f796348b086469a4e08b4a2a52a4cab8de365b
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    metadata.json
                                                                    • Path C:\Users\Admin\AppData\Local\Aloha Mobile\Aloha\User Data\component_crx_cache\metadata.json
                                                                    • Size 372B
                                                                    • SHA256 aa3bcb93b3c6d3d8d4c2f3dc195f997595be734f9aec72a590cc1159b0493a25
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    metadata.json
                                                                    • Path C:\Users\Admin\AppData\Local\Aloha Mobile\Aloha\User Data\component_crx_cache\metadata.json
                                                                    • Size 492B
                                                                    • SHA256 aef6eab345ef2d11139649621c3c5c2822336686fe4df443be5f448b21e90bb5
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    metadata.json
                                                                    • Path C:\Users\Admin\AppData\Local\Aloha Mobile\Aloha\User Data\component_crx_cache\metadata.json
                                                                    • Size 732B
                                                                    • SHA256 89b2e28353fca7db9b1d805c6f9a29c477d4bf6bbe68c56f9a2fdd936b8440ce
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    metadata.json
                                                                    • Path C:\Users\Admin\AppData\Local\Aloha Mobile\Aloha\User Data\component_crx_cache\metadata.json
                                                                    • Size 612B
                                                                    • SHA256 948075c89061d60733066cdb5af31b3d54eb75b3c60c6ac4957549b8b086a019
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    metadata.json
                                                                    • Path C:\Users\Admin\AppData\Local\Aloha Mobile\Aloha\User Data\component_crx_cache\metadata.json
                                                                    • Size 132B
                                                                    • SHA256 cba79c07474a5dcb415d6ef5432cc24674239dde2efb46c38222ea37a5e15de1
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    blocklist
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
                                                                    • Size 105KB
                                                                    • SHA256 bba2e49c11cb10e1da3782e96a0839de38ec558ccceb0d68515b04792179f852
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    settings.dat
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                    • Size 280B
                                                                    • SHA256 6a64f2ae6a6617d628aecf24522b5fc03d56fd3b87da29c09e359aa8c784278c
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    settings.dat
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                    • Size 280B
                                                                    • SHA256 5c85913b3d3cab7ba2879d18441341b2b4fd7ad9ce12d0c3ebfe421e6267c647
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    LOG.old
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
                                                                    • Size 6KB
                                                                    • SHA256 0c48faa6348787be2039bb293a71a25762331e962019f0383baab854ccda15a5
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    MANIFEST-000001
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
                                                                    • Size 158B
                                                                    • SHA256 f803625f7089762ff6faeb3ece82729aca5f5a8ea6348ac385095f4ef1109a96
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    BookmarkMergedSurfaceOrdering
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
                                                                    • Size 6B
                                                                    • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                                    • MD5 SHA1 SHA512
                                                                    Submit Download

                                                                    the-real-index
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                    • Size 3KB
                                                                    • SHA256 088b5bba2a3aff06b759dc0849f3fa08de4b924070ce777e506b85f7ba0cb3f2
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    the-real-index~RFe58f0b4.TMP
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58f0b4.TMP
                                                                    • Size 3KB
                                                                    • SHA256 a8e153ced0e5b88a840f04f24d1ee0aa5a35d74da27fcfc30bc8702b813c3a79
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    SiteList-Enterprise.json
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
                                                                    • Size 2B
                                                                    • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                                    • MD5 SHA1 SHA512
                                                                    Submit Download

                                                                    Edge Profile.ico
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
                                                                    • Size 70KB
                                                                    • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    Network Persistent State
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                    • Size 111B
                                                                    • SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    Network Persistent State
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                    • Size 2KB
                                                                    • SHA256 9c89dbe9a99def98d76bd5a22357e7d0c6d27f7f46ae178f908cad8889ade128
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    SCT Auditing Pending Reports
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
                                                                    • Size 2B
                                                                    • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                    • MD5 SHA1 SHA512
                                                                    Submit Download

                                                                    Preferences
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                    • Size 13KB
                                                                    • SHA256 fb2af5ce418f5bb10babf35c5ed25b047385e7e74a4053ee8dec87782d0115e4
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    Preferences
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                    • Size 14KB
                                                                    • SHA256 f26039acc650b27451c0e01193b69a3f42184484eb8ab3c466d583a6c1633539
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    Secure Preferences
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                                    • Size 30KB
                                                                    • SHA256 b479f524b51f81445d82d1591e92e1cff3780dad01f1336cba61bd748a970c97
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    sync_diagnostic.log
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
                                                                    • Size 7KB
                                                                    • SHA256 f04d9a3866afeb19b07897df9d972d91ab1a128c848fe84a8bdc3cfe4609c191
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    191b55ef-8f49-4b1d-b0e4-68816ca5d25b.tmp
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\191b55ef-8f49-4b1d-b0e4-68816ca5d25b.tmp
                                                                    • Size 22KB
                                                                    • SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    Local State
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                    • Size 19KB
                                                                    • SHA256 3bffa710987531bc10ec9e3632c9deba01914e3ad81e1b3a9070933cd94cbf44
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    Local State
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                    • Size 8KB
                                                                    • SHA256 b7279fef4ce91b37f23b3a79c7701231622e1aa5d38b800da3ff02983c508670
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    Local State
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                    • Size 27KB
                                                                    • SHA256 865ce9da89e888077b949512826bf0023e18377d4de04707b5e2ce189bcfdad2
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    Local State
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                    • Size 19KB
                                                                    • SHA256 51ab06eb163b740492f8e06d11cc7ae80e38855a9195fd565bed4929cfc10d51
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    Local State
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                    • Size 8KB
                                                                    • SHA256 07c7a9e610aa69f9d874d393dbd2f397ef1ff420616df462ce7aa6546252a525
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    96a9b97d-8eef-4d52-bc85-badae0d3b2dd.tmp
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\96a9b97d-8eef-4d52-bc85-badae0d3b2dd.tmp
                                                                    • Size 13B
                                                                    • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                                                    • MD5 SHA1 SHA512
                                                                    Submit Download

                                                                    5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
                                                                    • Size 2KB
                                                                    • SHA256 b5e42fb227328b2c363986e301de0da88abdb19fccaa2744ebdb723b99c07e93
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    aloha_service.log
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\aloha_service.log
                                                                    • Size 258B
                                                                    • SHA256 2b2f8196976773988fd54d24145f682143ad8d6766551d0c64c4555cfe153891
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    aloha_service.log
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\aloha_service.log
                                                                    • Size 325B
                                                                    • SHA256 48d09ee3bd74daa4adf4ad184a0e9cacc152d1176e0a99bc46dff1b931292aa0
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    aloha_service.log
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\aloha_service.log
                                                                    • Size 451B
                                                                    • SHA256 6ca9d3afb1d6569bd2c11c59da0ae4b57f8c4d187eada1809b8ae935e164c6ca
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    aloha_vpn.log
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\aloha_vpn.log
                                                                    • Size 129B
                                                                    • SHA256 ac2a64bb7f32b10c64f40783c11d8cf1e4f78e40f10e24229103063730dd97ac
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    aloha_vpn.log
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\aloha_vpn.log
                                                                    • Size 2KB
                                                                    • SHA256 491afb3b5ba2417bd2a4be990a107a926b1663960eda05f854c5754f2300badb
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    Aloha.lnk
                                                                    • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Aloha.lnk
                                                                    • Size 2KB
                                                                    • SHA256 1b0665c4cbe9948c4cdb2726185f1a7806a9e4a89a5cc2a6d00a6a80ce8341d7
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    Aloha.lnk
                                                                    • Path C:\Users\Admin\Desktop\Aloha.lnk
                                                                    • Size 2KB
                                                                    • SHA256 eb867e07b97e8e3caa68a8751017830376d062c5993f1729e0ba014a863e1d4d
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    setup.exe
                                                                    • Path C:\Users\Admin\Downloads\CR_1629E.tmp\setup.exe
                                                                    • Size 6.5MB
                                                                    • SHA256 eee0c236a826ec317574835579e4daadb3207a0191ff6c8b4bcb0c7c88fd0374
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    hyph-bn.hyb
                                                                    • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1564_1375403903\hyph-bn.hyb
                                                                    • Size 703B
                                                                    • SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    hyph-mr.hyb
                                                                    • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1564_1375403903\hyph-mr.hyb
                                                                    • Size 687B
                                                                    • SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    hyph-nn.hyb
                                                                    • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1564_1375403903\hyph-nn.hyb
                                                                    • Size 141KB
                                                                    • SHA256 5bcbb58eaf65f13f6d039244d942f37c127344e3a0a2e6c32d08236945132809
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    memory/1564-1002-0x000001EE648E0000-0x000001EE648E1000-memory.dmp
                                                                    Download

                                                                    memory/1564-978-0x000001EE63900000-0x000001EE63901000-memory.dmp
                                                                    Download

                                                                    memory/1564-991-0x000001EE650F0000-0x000001EE650F2000-memory.dmp
                                                                    Download

                                                                    memory/1564-993-0x000001EE65100000-0x000001EE65101000-memory.dmp
                                                                    Download

                                                                    memory/1564-994-0x000001EE63900000-0x000001EE63901000-memory.dmp
                                                                    Download

                                                                    memory/1564-452-0x00007FF895460000-0x00007FF895958000-memory.dmp
                                                                    Download

                                                                    memory/1564-454-0x00007FF895460000-0x00007FF895958000-memory.dmp
                                                                    Download

                                                                    memory/1564-995-0x000001EE65100000-0x000001EE65101000-memory.dmp
                                                                    Download

                                                                    memory/1564-997-0x000001EE65110000-0x000001EE65111000-memory.dmp
                                                                    Download

                                                                    memory/1564-466-0x000001EE199F0000-0x000001EE19E32000-memory.dmp
                                                                    Download

                                                                    memory/1564-998-0x000001EE650F0000-0x000001EE650F2000-memory.dmp
                                                                    Download

                                                                    memory/1564-999-0x000001EE63900000-0x000001EE63901000-memory.dmp
                                                                    Download

                                                                    memory/1564-1003-0x000001EE650E0000-0x000001EE650E2000-memory.dmp
                                                                    Download

                                                                    memory/1564-468-0x000001EE19E40000-0x000001EE1A042000-memory.dmp
                                                                    Download

                                                                    memory/1564-1000-0x000001EE65110000-0x000001EE65111000-memory.dmp
                                                                    Download

                                                                    memory/1564-988-0x000001EE650E0000-0x000001EE650E2000-memory.dmp
                                                                    Download

                                                                    memory/1564-986-0x000001EE63900000-0x000001EE63901000-memory.dmp
                                                                    Download

                                                                    memory/1564-985-0x000001EE63900000-0x000001EE63901000-memory.dmp
                                                                    Download

                                                                    memory/1564-987-0x000001EE63900000-0x000001EE63901000-memory.dmp
                                                                    Download

                                                                    memory/1564-984-0x000001EE63900000-0x000001EE63901000-memory.dmp
                                                                    Download

                                                                    memory/1564-983-0x000001EE63900000-0x000001EE63901000-memory.dmp
                                                                    Download

                                                                    memory/1564-982-0x000001EE63900000-0x000001EE63901000-memory.dmp
                                                                    Download

                                                                    memory/1564-981-0x000001EE63900000-0x000001EE63901000-memory.dmp
                                                                    Download

                                                                    memory/1564-980-0x000001EE63900000-0x000001EE63901000-memory.dmp
                                                                    Download

                                                                    memory/1564-979-0x000001EE63900000-0x000001EE63901000-memory.dmp
                                                                    Download

                                                                    memory/1564-989-0x000001EE650E0000-0x000001EE650E2000-memory.dmp
                                                                    Download

                                                                    memory/5240-512-0x00007FF8B63F0000-0x00007FF8B63F1000-memory.dmp
                                                                    Download

                                                                    memory/5240-513-0x00007FF8B5280000-0x00007FF8B5281000-memory.dmp
                                                                    Download

                                                                    memory/6192-1366-0x000001C606E20000-0x000001C606E22000-memory.dmp
                                                                    Download

                                                                    memory/6192-1367-0x000001C606E20000-0x000001C606E22000-memory.dmp
                                                                    Download

                                                                    memory/6192-1368-0x000001C606E20000-0x000001C606E22000-memory.dmp
                                                                    Download

                                                                    memory/6960-1265-0x0000016802AF0000-0x0000016802AF1000-memory.dmp
                                                                    Download

                                                                    memory/6960-1262-0x0000016802AF0000-0x0000016802AF1000-memory.dmp
                                                                    Download

                                                                    memory/6960-1263-0x0000016802AF0000-0x0000016802AF1000-memory.dmp
                                                                    Download

                                                                    memory/6960-1260-0x0000016802AF0000-0x0000016802AF1000-memory.dmp
                                                                    Download

                                                                    memory/6960-1256-0x0000016802AF0000-0x0000016802AF1000-memory.dmp
                                                                    Download

                                                                    memory/6960-1255-0x0000016802AF0000-0x0000016802AF1000-memory.dmp
                                                                    Download

                                                                    memory/6960-1254-0x0000016802AF0000-0x0000016802AF1000-memory.dmp
                                                                    Download

                                                                    memory/6960-1264-0x0000016802AF0000-0x0000016802AF1000-memory.dmp
                                                                    Download

                                                                    memory/6960-1261-0x0000016802AF0000-0x0000016802AF1000-memory.dmp
                                                                    Download