8b04377979c1e8b89138c3cb2f47bf9fa862e63f902f66dd539c2b1f7c55633b

Analysis

user interaction
yes
max time kernel
150s
max time network
156s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 20:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
wt.exe
Size 21.4MB
Sample260809-y4rcnavfqd
SHA256 8b04377979c1e8b89138c3cb2f47bf9fa862e63f902f66dd539c2b1f7c55633b
MD5 cd89bd09620b76dd8abf671cf64bae27
SHA1 b6f485a6512d9b8b4cb2a62d44c3ee550dede56c
SHA512 ac14a4dca4e24e678e6c82f5094b2293daa46533cc87bb0ccfcd6a261d7ffa27fe3c40a1979bad196b99d2c4ab0a69a69bae1973c0006ae5b961048abd9c6b71
SSDEEP 393216:i8KRoH0eXhb6/D2XfUvOG2PwrmHoH0eXhb6/D2XfUvOG2p:i8KkXh6L2XfUvuPwrm6Xh6L2XfUvup
TLSH
T15A37CE53F26280FCC56AC135C25A6273FA217C494B353AEB5BE04B253E69F906B3DB14
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution trojan

Malware Config

Signatures

Downloads MZ/PE file 58 IoCs

flow	pid	Process
122	4396	WolfLegend.exe
122	4396	WolfLegend.exe
122	4396	WolfLegend.exe
122	4396	WolfLegend.exe
122	4396	WolfLegend.exe
122	4396	WolfLegend.exe
122	4396	WolfLegend.exe
122	4396	WolfLegend.exe
122	4396	WolfLegend.exe
122	4396	WolfLegend.exe
122	4396	WolfLegend.exe
122	4396	WolfLegend.exe
122	4396	WolfLegend.exe
122	4396	WolfLegend.exe
122	4396	WolfLegend.exe
122	4396	WolfLegend.exe
122	4396	WolfLegend.exe
122	4396	WolfLegend.exe
122	4396	WolfLegend.exe
122	4396	WolfLegend.exe
122	4396	WolfLegend.exe
122	4396	WolfLegend.exe
122	4396	WolfLegend.exe
122	4396	WolfLegend.exe
122	4396	WolfLegend.exe
122	4396	WolfLegend.exe
122	4396	WolfLegend.exe
122	4396	WolfLegend.exe
122	4396	WolfLegend.exe
122	4396	WolfLegend.exe
122	4396	WolfLegend.exe
122	4396	WolfLegend.exe
122	4396	WolfLegend.exe
122	4396	WolfLegend.exe
122	4396	WolfLegend.exe
122	4396	WolfLegend.exe
122	4396	WolfLegend.exe
122	4396	WolfLegend.exe
122	4396	WolfLegend.exe
122	4396	WolfLegend.exe
122	4396	WolfLegend.exe
122	4396	WolfLegend.exe
122	4396	WolfLegend.exe
122	4396	WolfLegend.exe
122	4396	WolfLegend.exe
122	4396	WolfLegend.exe
122	4396	WolfLegend.exe
122	4396	WolfLegend.exe
122	4396	WolfLegend.exe
122	4396	WolfLegend.exe
122	4396	WolfLegend.exe
122	4396	WolfLegend.exe
122	4396	WolfLegend.exe
122	4396	WolfLegend.exe
122	4396	WolfLegend.exe
122	4396	WolfLegend.exe
122	4396	WolfLegend.exe
122	4396	WolfLegend.exe

Executes dropped EXE 1 IoCs

pid	Process
4396	WolfLegend.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	wt.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	WolfLegend.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Discovers running processes 1 TTPs 46 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
1520	tasklist.exe
1852	tasklist.exe
548	tasklist.exe
7008	tasklist.exe
4112	tasklist.exe
2516	tasklist.exe
7104	tasklist.exe
6152	tasklist.exe
2216	tasklist.exe
6712	tasklist.exe
5296	tasklist.exe
5664	tasklist.exe
1000	tasklist.exe
3272	tasklist.exe
6668	tasklist.exe
4088	tasklist.exe
292	tasklist.exe
1208	tasklist.exe
6440	tasklist.exe
5488	tasklist.exe
6720	tasklist.exe
4240	tasklist.exe
4624	tasklist.exe
2884	tasklist.exe
4224	tasklist.exe
1084	tasklist.exe
4900	tasklist.exe
4352	tasklist.exe
2772	tasklist.exe
4800	tasklist.exe
2672	tasklist.exe
6432	tasklist.exe
2376	tasklist.exe
2708	tasklist.exe
6936	tasklist.exe
3912	tasklist.exe
4728	tasklist.exe
5856	tasklist.exe
6052	tasklist.exe
6368	tasklist.exe
864	tasklist.exe
4728	tasklist.exe
4348	tasklist.exe
4140	tasklist.exe
3492	tasklist.exe
6396	tasklist.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\WolfLegend\avital\pic\bg.png.part	WolfLegend.exe
File opened for modification	C:\Program Files\WolfLegend\avital\wolf64.sys.part	WolfLegend.exe
File opened for modification	C:\Program Files\WolfLegend\Img\id.bmp.part	WolfLegend.exe
File opened for modification	C:\Program Files\WolfLegend\Img\settings-over.bmp.part	WolfLegend.exe
File opened for modification	C:\Program Files\WolfLegend\lib_torrent.dll.part	WolfLegend.exe
File opened for modification	C:\Program Files\WolfLegend\apl001.sys.part	WolfLegend.exe
File opened for modification	C:\Program Files\WolfLegend\avital\SysControl.lua.part	WolfLegend.exe
File opened for modification	C:\Program Files\WolfLegend\cltgp.dat.part	WolfLegend.exe
File opened for modification	C:\Program Files\WolfLegend\Img\background-image.bmp.part	WolfLegend.exe
File opened for modification	C:\Program Files\WolfLegend\avital\childprocboot.xoe.part	WolfLegend.exe
File opened for modification	C:\Program Files\WolfLegend\dbghelp.dll.part	WolfLegend.exe
File opened for modification	C:\Program Files\WolfLegend\Img\IDPWbox.bmp.part	WolfLegend.exe
File opened for modification	C:\Program Files\WolfLegend\Img\servernotice\NoticeVersion.txt.part	WolfLegend.exe
File opened for modification	C:\Program Files\WolfLegend\avital\AXUP\update.u.part	WolfLegend.exe
File opened for modification	C:\Program Files\WolfLegend\avital\parentprocboot.xoe.part	WolfLegend.exe
File opened for modification	C:\Program Files\WolfLegend\avital\usedrv.xoe.part	WolfLegend.exe
File opened for modification	C:\Program Files\WolfLegend\Img\button_normal.bmp.part	WolfLegend.exe
File opened for modification	C:\Program Files\WolfLegend\Img\login_text_id_password.bmp.part	WolfLegend.exe
File opened for modification	C:\Program Files\WolfLegend\Img\selectgame_versioncheck.bmp.part	WolfLegend.exe
File opened for modification	C:\Program Files\WolfLegend\avital\pic\icon.ico.part	WolfLegend.exe
File opened for modification	C:\Program Files\WolfLegend\msseax.flt.part	WolfLegend.exe
File opened for modification	C:\Program Files\WolfLegend\avital\axPack.xse.part	WolfLegend.exe
File opened for modification	C:\Program Files\WolfLegend\Img\servernotice\sl_notice3.png.part	WolfLegend.exe
File opened for modification	C:\Program Files\WolfLegend\Img\startbutton-normal.bmp.part	WolfLegend.exe
File opened for modification	C:\Program Files\WolfLegend\mssdsp.flt.part	WolfLegend.exe
File opened for modification	C:\Program Files\WolfLegend\nyxlauncherenc.xfs.part	WolfLegend.exe
File opened for modification	C:\Program Files\WolfLegend\avital\packmodboot.xoe.part	WolfLegend.exe
File opened for modification	C:\Program Files\WolfLegend\avital\vssver2.scc.part	WolfLegend.exe
File opened for modification	C:\Program Files\WolfLegend\Img\button_start_over.bmp.part	WolfLegend.exe
File opened for modification	C:\Program Files\WolfLegend\Img\selectgame_comingsoon.bmp.part	WolfLegend.exe
File opened for modification	C:\Program Files\WolfLegend\NyxLauncher.ini.part	WolfLegend.exe
File opened for modification	C:\Program Files\WolfLegend\Img\artii\taksim..part	WolfLegend.exe
File opened for modification	C:\Program Files\WolfLegend\Img\selectgame_regist.bmp.part	WolfLegend.exe
File opened for modification	C:\Program Files\WolfLegend\license agreement.rtf.part	WolfLegend.exe
File opened for modification	C:\Program Files\WolfLegend\avital\pic\trdlg_cfg.ini.part	WolfLegend.exe
File opened for modification	C:\Program Files\WolfLegend\Img\selectgame_option.bmp.part	WolfLegend.exe
File opened for modification	C:\Program Files\WolfLegend\Img\torrent-over.bmp.part	WolfLegend.exe
File opened for modification	C:\Program Files\WolfLegend\mssdolby.flt.part	WolfLegend.exe
File opened for modification	C:\Program Files\WolfLegend\NyxLauncher.exe.part	WolfLegend.exe
File opened for modification	C:\Program Files\WolfLegend\Img\sys.bmp.part	WolfLegend.exe
File opened for modification	C:\Program Files\WolfLegend\Img\button_-over.bmp.part	WolfLegend.exe
File opened for modification	C:\Program Files\WolfLegend\MFC71.dll.part	WolfLegend.exe
File opened for modification	C:\Program Files\WolfLegend\server.dll.part	WolfLegend.exe
File opened for modification	C:\Program Files\WolfLegend\avital\pic\config.lua.part	WolfLegend.exe
File opened for modification	C:\Program Files\WolfLegend\bdcap32.dll.part	WolfLegend.exe
File opened for modification	C:\Program Files\WolfLegend\Img\servernotice\sl_notice2.png.part	WolfLegend.exe
File opened for modification	C:\Program Files\WolfLegend\msssrs.flt.part	WolfLegend.exe
File opened for modification	C:\Program Files\WolfLegend\avital\pic\errconfig.ini.part	WolfLegend.exe
File opened for modification	C:\Program Files\WolfLegend\avital\SysDownLoad.dll.part	WolfLegend.exe
File opened for modification	C:\Program Files\WolfLegend\avital\webd.xoe.part	WolfLegend.exe
File opened for modification	C:\Program Files\WolfLegend\Img\button_home.bmp.part	WolfLegend.exe
File opened for modification	C:\Program Files\WolfLegend\ltmsg.dll.part	WolfLegend.exe
File opened for modification	C:\Program Files\WolfLegend\Replacer.exe.part	WolfLegend.exe
File opened for modification	C:\Program Files\WolfLegend\avital\AXCMN_DRVMAIN.XSE.part	WolfLegend.exe
File opened for modification	C:\Program Files\WolfLegend\avital\TrayDlg.dll.part	WolfLegend.exe
File opened for modification	C:\Program Files\WolfLegend\Img\artii\paien_lab..part	WolfLegend.exe
File opened for modification	C:\Program Files\WolfLegend\Img\selectgame_start.bmp.part	WolfLegend.exe
File opened for modification	C:\Program Files\WolfLegend\msvcp71.dll.part	WolfLegend.exe
File opened for modification	C:\Program Files\WolfLegend\avital\ApexProgress.da_.part	WolfLegend.exe
File opened for modification	C:\Program Files\WolfLegend\avital\Config.ini.part	WolfLegend.exe
File opened for modification	C:\Program Files\WolfLegend\avital\wolfsken64.sys.part	WolfLegend.exe
File opened for modification	C:\Program Files\WolfLegend\Img\button_start_click.bmp.part	WolfLegend.exe
File opened for modification	C:\Program Files\WolfLegend\Img\button_start_normal.bmp.part	WolfLegend.exe
File opened for modification	C:\Program Files\WolfLegend\Img\selectgame_gunboundimg.bmp.part	WolfLegend.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3280_1092352173\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3280_1092352173\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3280_1092352173\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3280_1092352173\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3280_509432404\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3280_509432404\protocols.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3280_509432404\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3280_1092352173\keys.json	msedgewebview2.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
7032	powershell.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
6360	powershell.exe
3584	powershell.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5124	chrome.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134307805098749468"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
7032	powershell.exe
7032	powershell.exe
7032	powershell.exe
6360	powershell.exe
6360	powershell.exe
6360	powershell.exe
3584	powershell.exe
3584	powershell.exe
3584	powershell.exe
948	chrome.exe
948	chrome.exe
1256	msedgewebview2.exe
1256	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 21 IoCs

pid	Process
2492	msedgewebview2.exe
3280	msedgewebview2.exe
948	chrome.exe
948	chrome.exe
948	chrome.exe
948	chrome.exe
948	chrome.exe
948	chrome.exe
948	chrome.exe
948	chrome.exe
948	chrome.exe
948	chrome.exe
948	chrome.exe
948	chrome.exe
948	chrome.exe
948	chrome.exe
948	chrome.exe
948	chrome.exe
948	chrome.exe
948	chrome.exe
948	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	7032	powershell.exe
Token: SeIncreaseQuotaPrivilege	7032	powershell.exe
Token: SeSecurityPrivilege	7032	powershell.exe
Token: SeTakeOwnershipPrivilege	7032	powershell.exe
Token: SeLoadDriverPrivilege	7032	powershell.exe
Token: SeSystemProfilePrivilege	7032	powershell.exe
Token: SeSystemtimePrivilege	7032	powershell.exe
Token: SeProfSingleProcessPrivilege	7032	powershell.exe
Token: SeIncBasePriorityPrivilege	7032	powershell.exe
Token: SeCreatePagefilePrivilege	7032	powershell.exe
Token: SeBackupPrivilege	7032	powershell.exe
Token: SeRestorePrivilege	7032	powershell.exe
Token: SeShutdownPrivilege	7032	powershell.exe
Token: SeDebugPrivilege	7032	powershell.exe
Token: SeSystemEnvironmentPrivilege	7032	powershell.exe
Token: SeRemoteShutdownPrivilege	7032	powershell.exe
Token: SeUndockPrivilege	7032	powershell.exe
Token: SeManageVolumePrivilege	7032	powershell.exe
Token: 33	7032	powershell.exe
Token: 34	7032	powershell.exe
Token: 35	7032	powershell.exe
Token: 36	7032	powershell.exe
Token: SeDebugPrivilege	6360	powershell.exe
Token: SeDebugPrivilege	3584	powershell.exe
Token: SeDebugPrivilege	6440	tasklist.exe
Token: SeDebugPrivilege	4728	tasklist.exe
Token: SeDebugPrivilege	1520	tasklist.exe
Token: SeDebugPrivilege	2708	tasklist.exe
Token: SeDebugPrivilege	1852	tasklist.exe
Token: SeDebugPrivilege	5488	tasklist.exe
Token: SeDebugPrivilege	2216	tasklist.exe
Token: SeDebugPrivilege	4900	tasklist.exe
Token: SeDebugPrivilege	6720	tasklist.exe
Token: SeShutdownPrivilege	948	chrome.exe
Token: SeCreatePagefilePrivilege	948	chrome.exe
Token: SeDebugPrivilege	4348	tasklist.exe
Token: SeShutdownPrivilege	948	chrome.exe
Token: SeCreatePagefilePrivilege	948	chrome.exe
Token: SeShutdownPrivilege	948	chrome.exe
Token: SeCreatePagefilePrivilege	948	chrome.exe
Token: SeShutdownPrivilege	948	chrome.exe
Token: SeCreatePagefilePrivilege	948	chrome.exe
Token: SeDebugPrivilege	548	tasklist.exe
Token: SeShutdownPrivilege	948	chrome.exe
Token: SeCreatePagefilePrivilege	948	chrome.exe
Token: SeShutdownPrivilege	948	chrome.exe
Token: SeCreatePagefilePrivilege	948	chrome.exe
Token: SeShutdownPrivilege	948	chrome.exe
Token: SeCreatePagefilePrivilege	948	chrome.exe
Token: SeDebugPrivilege	5856	tasklist.exe
Token: SeShutdownPrivilege	948	chrome.exe
Token: SeCreatePagefilePrivilege	948	chrome.exe
Token: SeShutdownPrivilege	948	chrome.exe
Token: SeCreatePagefilePrivilege	948	chrome.exe
Token: SeShutdownPrivilege	948	chrome.exe
Token: SeCreatePagefilePrivilege	948	chrome.exe
Token: SeShutdownPrivilege	948	chrome.exe
Token: SeCreatePagefilePrivilege	948	chrome.exe
Token: SeDebugPrivilege	6936	tasklist.exe
Token: SeShutdownPrivilege	948	chrome.exe
Token: SeCreatePagefilePrivilege	948	chrome.exe
Token: SeShutdownPrivilege	948	chrome.exe
Token: SeCreatePagefilePrivilege	948	chrome.exe
Token: SeDebugPrivilege	7008	tasklist.exe

Suspicious use of FindShellTrayWindow 37 IoCs

pid	Process
4968	wt.exe
4396	WolfLegend.exe
948	chrome.exe
948	chrome.exe
948	chrome.exe
948	chrome.exe
948	chrome.exe
948	chrome.exe
948	chrome.exe
948	chrome.exe
948	chrome.exe
948	chrome.exe
948	chrome.exe
948	chrome.exe
948	chrome.exe
948	chrome.exe
948	chrome.exe
948	chrome.exe
948	chrome.exe
948	chrome.exe
948	chrome.exe
948	chrome.exe
948	chrome.exe
948	chrome.exe
948	chrome.exe
948	chrome.exe
948	chrome.exe
948	chrome.exe
948	chrome.exe
948	chrome.exe
948	chrome.exe
948	chrome.exe
948	chrome.exe
948	chrome.exe
948	chrome.exe
948	chrome.exe
948	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
948	chrome.exe
948	chrome.exe
948	chrome.exe
948	chrome.exe
948	chrome.exe
948	chrome.exe
948	chrome.exe
948	chrome.exe
948	chrome.exe
948	chrome.exe
948	chrome.exe
948	chrome.exe
948	chrome.exe
948	chrome.exe
948	chrome.exe
948	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4968 wrote to memory of 2492	4968	wt.exe	90
PID 2492 wrote to memory of 4840	2492	msedgewebview2.exe	91
PID 2492 wrote to memory of 6828	2492	msedgewebview2.exe	92
PID 2492 wrote to memory of 6828	2492	msedgewebview2.exe	92
PID 2492 wrote to memory of 6828	2492	msedgewebview2.exe	92
PID 2492 wrote to memory of 6828	2492	msedgewebview2.exe	92
PID 2492 wrote to memory of 5204	2492	msedgewebview2.exe	93
PID 2492 wrote to memory of 6796	2492	msedgewebview2.exe	94
PID 2492 wrote to memory of 6796	2492	msedgewebview2.exe	94
PID 2492 wrote to memory of 6796	2492	msedgewebview2.exe	94
PID 2492 wrote to memory of 6732	2492	msedgewebview2.exe	95
PID 2492 wrote to memory of 6732	2492	msedgewebview2.exe	95
PID 2492 wrote to memory of 6732	2492	msedgewebview2.exe	95
PID 2492 wrote to memory of 6732	2492	msedgewebview2.exe	95
PID 2492 wrote to memory of 6732	2492	msedgewebview2.exe	95
PID 4968 wrote to memory of 7032	4968	wt.exe	96
PID 4968 wrote to memory of 6360	4968	wt.exe	100
PID 4968 wrote to memory of 3584	4968	wt.exe	102
PID 4968 wrote to memory of 4396	4968	wt.exe	105
PID 4396 wrote to memory of 3280	4396	WolfLegend.exe	106
PID 3280 wrote to memory of 4076	3280	msedgewebview2.exe	107
PID 3280 wrote to memory of 3216	3280	msedgewebview2.exe	108
PID 3280 wrote to memory of 3216	3280	msedgewebview2.exe	108
PID 3280 wrote to memory of 3216	3280	msedgewebview2.exe	108
PID 3280 wrote to memory of 3216	3280	msedgewebview2.exe	108
PID 3280 wrote to memory of 3496	3280	msedgewebview2.exe	109
PID 3280 wrote to memory of 5000	3280	msedgewebview2.exe	110
PID 3280 wrote to memory of 5000	3280	msedgewebview2.exe	110
PID 3280 wrote to memory of 5000	3280	msedgewebview2.exe	110
PID 3280 wrote to memory of 1456	3280	msedgewebview2.exe	111
PID 3280 wrote to memory of 1456	3280	msedgewebview2.exe	111
PID 3280 wrote to memory of 1456	3280	msedgewebview2.exe	111
PID 3280 wrote to memory of 1456	3280	msedgewebview2.exe	111
PID 3280 wrote to memory of 1456	3280	msedgewebview2.exe	111
PID 4396 wrote to memory of 6440	4396	WolfLegend.exe	112
PID 4396 wrote to memory of 4728	4396	WolfLegend.exe	114
PID 4396 wrote to memory of 1520	4396	WolfLegend.exe	116
PID 4396 wrote to memory of 2708	4396	WolfLegend.exe	118
PID 4396 wrote to memory of 1852	4396	WolfLegend.exe	120
PID 4396 wrote to memory of 5488	4396	WolfLegend.exe	122
PID 4396 wrote to memory of 2216	4396	WolfLegend.exe	125
PID 4396 wrote to memory of 4900	4396	WolfLegend.exe	127
PID 4396 wrote to memory of 6720	4396	WolfLegend.exe	129
PID 948 wrote to memory of 5376	948	chrome.exe	132
PID 948 wrote to memory of 5124	948	chrome.exe	133
PID 948 wrote to memory of 1652	948	chrome.exe	134
PID 948 wrote to memory of 1652	948	chrome.exe	134
PID 948 wrote to memory of 5656	948	chrome.exe	136
PID 948 wrote to memory of 5656	948	chrome.exe	136
PID 948 wrote to memory of 6872	948	chrome.exe	138
PID 948 wrote to memory of 5668	948	chrome.exe	137
PID 948 wrote to memory of 6872	948	chrome.exe	138
PID 948 wrote to memory of 5668	948	chrome.exe	137
PID 948 wrote to memory of 1500	948	chrome.exe	139
PID 948 wrote to memory of 1500	948	chrome.exe	139
PID 948 wrote to memory of 6900	948	chrome.exe	140
PID 948 wrote to memory of 6900	948	chrome.exe	140
PID 4396 wrote to memory of 4348	4396	WolfLegend.exe	141
PID 948 wrote to memory of 1996	948	chrome.exe	143
PID 948 wrote to memory of 4652	948	chrome.exe	145
PID 948 wrote to memory of 1896	948	chrome.exe	144
PID 948 wrote to memory of 4652	948	chrome.exe	145
PID 948 wrote to memory of 1896	948	chrome.exe	144
PID 4396 wrote to memory of 548	4396	WolfLegend.exe	146

C:\Users\Admin\AppData\Local\Temp\wt.exe
"C:\Users\Admin\AppData\Local\Temp\wt.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4968
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=wt.exe --webview-exe-version=0.1.0 --user-data-dir="C:\Users\Admin\AppData\Local\com.wolflegend.launcher\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=4968.5660.14226236566469222830 /pfhostedapp:b02565f216fb816e80de2797132874186a02130e
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:2492
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.wolflegend.launcher\EBWebView /prefetch:4 /pfhostedapp:b02565f216fb816e80de2797132874186a02130e --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.wolflegend.launcher\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ffa5fbc5fd8,0x7ffa5fbc5fe4,0x7ffa5fbc5ff0
    3⤵
    PID:4840
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.wolflegend.launcher\EBWebView" --webview-exe-name=wt.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1720 --field-trial-handle=1724,i,16384427372150137527,624298799872091305,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:b02565f216fb816e80de2797132874186a02130e
    3⤵
    PID:6828
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.wolflegend.launcher\EBWebView" --webview-exe-name=wt.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2228 --field-trial-handle=1724,i,16384427372150137527,624298799872091305,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:b02565f216fb816e80de2797132874186a02130e
    3⤵
    PID:5204
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.wolflegend.launcher\EBWebView" --webview-exe-name=wt.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2428 --field-trial-handle=1724,i,16384427372150137527,624298799872091305,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:b02565f216fb816e80de2797132874186a02130e
    3⤵
    PID:6796
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.wolflegend.launcher\EBWebView" --webview-exe-name=wt.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3516 --field-trial-handle=1724,i,16384427372150137527,624298799872091305,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:b02565f216fb816e80de2797132874186a02130e /prefetch:1
    3⤵
    PID:6732
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -STA -NonInteractive -Command "(Get-PSDrive -Name 'C' -ErrorAction SilentlyContinue).Free"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:7032
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "$WshShell = New-Object -comObject WScript.Shell; $Shortcut = $WshShell.CreateShortcut('C:\Users\Admin\Desktop\WolfLegend.lnk'); $Shortcut.TargetPath = 'C:\Program Files\WolfLegend\WolfLegend.exe'; $Shortcut.WorkingDirectory = 'C:\Program Files\WolfLegend'; $Shortcut.Save();"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:6360
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "$WshShell = New-Object -comObject WScript.Shell; $Shortcut = $WshShell.CreateShortcut('C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WolfLegend.lnk'); $Shortcut.TargetPath = 'C:\Program Files\WolfLegend\WolfLegend.exe'; $Shortcut.WorkingDirectory = 'C:\Program Files\WolfLegend'; $Shortcut.Save();"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3584
- C:\Program Files\WolfLegend\WolfLegend.exe
  "C:\Program Files\WolfLegend\WolfLegend.exe"
  2⤵
  - Downloads MZ/PE file
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Drops file in Program Files directory
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4396
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=WolfLegend.exe --webview-exe-version=0.1.0 --user-data-dir="C:\Users\Admin\AppData\Local\com.wolflegend.launcher\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=4396.2184.6099874763646945639 /pfhostedapp:b02565f216fb816e80de2797132874186a02130e
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:3280
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.wolflegend.launcher\EBWebView /prefetch:4 /pfhostedapp:b02565f216fb816e80de2797132874186a02130e --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.wolflegend.launcher\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x164,0x198,0x7ffa5fbc5fd8,0x7ffa5fbc5fe4,0x7ffa5fbc5ff0
      4⤵
      PID:4076
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.wolflegend.launcher\EBWebView" --webview-exe-name=WolfLegend.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1800 --field-trial-handle=1804,i,8508958812335036274,4247902952673666141,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:b02565f216fb816e80de2797132874186a02130e
      4⤵
      PID:3216
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.wolflegend.launcher\EBWebView" --webview-exe-name=WolfLegend.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2420 --field-trial-handle=1804,i,8508958812335036274,4247902952673666141,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:b02565f216fb816e80de2797132874186a02130e
      4⤵
      PID:3496
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.wolflegend.launcher\EBWebView" --webview-exe-name=WolfLegend.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2456 --field-trial-handle=1804,i,8508958812335036274,4247902952673666141,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:b02565f216fb816e80de2797132874186a02130e
      4⤵
      PID:5000
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.wolflegend.launcher\EBWebView" --webview-exe-name=WolfLegend.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3604 --field-trial-handle=1804,i,8508958812335036274,4247902952673666141,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:b02565f216fb816e80de2797132874186a02130e /prefetch:1
      4⤵
      PID:1456
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.wolflegend.launcher\EBWebView" --webview-exe-name=WolfLegend.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4028 --field-trial-handle=1804,i,8508958812335036274,4247902952673666141,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:b02565f216fb816e80de2797132874186a02130e
      4⤵
      PID:200
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.wolflegend.launcher\EBWebView" --webview-exe-name=WolfLegend.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4020 --field-trial-handle=1804,i,8508958812335036274,4247902952673666141,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:b02565f216fb816e80de2797132874186a02130e
      4⤵
      PID:5784
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.wolflegend.launcher\EBWebView" --webview-exe-name=WolfLegend.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4020 --field-trial-handle=1804,i,8508958812335036274,4247902952673666141,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:b02565f216fb816e80de2797132874186a02130e
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1256
- - C:\Windows\system32\tasklist.exe
    "tasklist" /fo csv /nh
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:6440
- - C:\Windows\system32\tasklist.exe
    "tasklist" /fo csv /nh
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4728
- - C:\Windows\system32\tasklist.exe
    "tasklist" /fo csv /nh
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:1520
- - C:\Windows\system32\tasklist.exe
    "tasklist" /fo csv /nh
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2708
- - C:\Windows\system32\tasklist.exe
    "tasklist" /fo csv /nh
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:1852
- - C:\Windows\system32\tasklist.exe
    "tasklist" /fo csv /nh
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:5488
- - C:\Windows\system32\tasklist.exe
    "tasklist" /fo csv /nh
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2216
- - C:\Windows\system32\tasklist.exe
    "tasklist" /fo csv /nh
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4900
- - C:\Windows\system32\tasklist.exe
    "tasklist" /fo csv /nh
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:6720
- - C:\Windows\system32\tasklist.exe
    "tasklist" /fo csv /nh
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4348
- - C:\Windows\system32\tasklist.exe
    "tasklist" /fo csv /nh
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:548
- - C:\Windows\system32\tasklist.exe
    "tasklist" /fo csv /nh
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:5856
- - C:\Windows\system32\tasklist.exe
    "tasklist" /fo csv /nh
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:6936
- - C:\Windows\system32\tasklist.exe
    "tasklist" /fo csv /nh
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:7008
- - C:\Windows\system32\tasklist.exe
    "tasklist" /fo csv /nh
    3⤵
    - Discovers running processes
    PID:6712
- - C:\Windows\system32\tasklist.exe
    "tasklist" /fo csv /nh
    3⤵
    - Discovers running processes
    PID:4352
- - C:\Windows\system32\tasklist.exe
    "tasklist" /fo csv /nh
    3⤵
    - Discovers running processes
    PID:2772
- - C:\Windows\system32\tasklist.exe
    "tasklist" /fo csv /nh
    3⤵
    - Discovers running processes
    PID:6052
- - C:\Windows\system32\tasklist.exe
    "tasklist" /fo csv /nh
    3⤵
    - Discovers running processes
    PID:4140
- - C:\Windows\system32\tasklist.exe
    "tasklist" /fo csv /nh
    3⤵
    - Discovers running processes
    PID:4240
- - C:\Windows\system32\tasklist.exe
    "tasklist" /fo csv /nh
    3⤵
    - Discovers running processes
    PID:1000
- - C:\Windows\system32\tasklist.exe
    "tasklist" /fo csv /nh
    3⤵
    - Discovers running processes
    PID:4800
- - C:\Windows\system32\tasklist.exe
    "tasklist" /fo csv /nh
    3⤵
    - Discovers running processes
    PID:2672
- - C:\Windows\system32\tasklist.exe
    "tasklist" /fo csv /nh
    3⤵
    - Discovers running processes
    PID:6368
- - C:\Windows\system32\tasklist.exe
    "tasklist" /fo csv /nh
    3⤵
    - Discovers running processes
    PID:3272
- - C:\Windows\system32\tasklist.exe
    "tasklist" /fo csv /nh
    3⤵
    - Discovers running processes
    PID:3912
- - C:\Windows\system32\tasklist.exe
    "tasklist" /fo csv /nh
    3⤵
    - Discovers running processes
    PID:6432
- - C:\Windows\system32\tasklist.exe
    "tasklist" /fo csv /nh
    3⤵
    - Discovers running processes
    PID:3492
- - C:\Windows\system32\tasklist.exe
    "tasklist" /fo csv /nh
    3⤵
    - Discovers running processes
    PID:2376
- - C:\Windows\system32\tasklist.exe
    "tasklist" /fo csv /nh
    3⤵
    - Discovers running processes
    PID:4112
- - C:\Windows\system32\tasklist.exe
    "tasklist" /fo csv /nh
    3⤵
    - Discovers running processes
    PID:4624
- - C:\Windows\system32\tasklist.exe
    "tasklist" /fo csv /nh
    3⤵
    - Discovers running processes
    PID:2516
- - C:\Windows\system32\tasklist.exe
    "tasklist" /fo csv /nh
    3⤵
    - Discovers running processes
    PID:7104
- - C:\Windows\system32\tasklist.exe
    "tasklist" /fo csv /nh
    3⤵
    - Discovers running processes
    PID:2884
- - C:\Windows\system32\tasklist.exe
    "tasklist" /fo csv /nh
    3⤵
    - Discovers running processes
    PID:4224
- - C:\Windows\system32\tasklist.exe
    "tasklist" /fo csv /nh
    3⤵
    - Discovers running processes
    PID:864
- - C:\Windows\system32\tasklist.exe
    "tasklist" /fo csv /nh
    3⤵
    - Discovers running processes
    PID:6152
- - C:\Windows\system32\tasklist.exe
    "tasklist" /fo csv /nh
    3⤵
    - Discovers running processes
    PID:6668
- - C:\Windows\system32\tasklist.exe
    "tasklist" /fo csv /nh
    3⤵
    - Discovers running processes
    PID:5296
- - C:\Windows\system32\tasklist.exe
    "tasklist" /fo csv /nh
    3⤵
    - Discovers running processes
    PID:5664
- - C:\Windows\system32\tasklist.exe
    "tasklist" /fo csv /nh
    3⤵
    - Discovers running processes
    PID:4088
- - C:\Windows\system32\tasklist.exe
    "tasklist" /fo csv /nh
    3⤵
    - Discovers running processes
    PID:6396
- - C:\Windows\system32\tasklist.exe
    "tasklist" /fo csv /nh
    3⤵
    - Discovers running processes
    PID:4728
- - C:\Windows\system32\tasklist.exe
    "tasklist" /fo csv /nh
    3⤵
    - Discovers running processes
    PID:292
- - C:\Windows\system32\tasklist.exe
    "tasklist" /fo csv /nh
    3⤵
    - Discovers running processes
    PID:1084
- - C:\Windows\system32\tasklist.exe
    "tasklist" /fo csv /nh
    3⤵
    - Discovers running processes
    PID:1208

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4264

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffa5d85c728,0x7ffa5d85c734,0x7ffa5d85c740
  2⤵
  PID:5376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1536,i,10848145805642200403,675145273650047160,524288 --field-trial-handle=2008,i,16895249214890019460,13609015041331156221,262144 --variations-seed-version --mojo-platform-channel-handle=2036 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1708,i,17289728518075928434,4192892681636358819,262144 --field-trial-handle=2008,i,16895249214890019460,13609015041331156221,262144 --variations-seed-version --mojo-platform-channel-handle=2004 /prefetch:2
  2⤵
  PID:1652
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2336,i,16952387927865090592,4329801708393219607,524288 --field-trial-handle=2008,i,16895249214890019460,13609015041331156221,262144 --variations-seed-version --mojo-platform-channel-handle=2152 /prefetch:13
  2⤵
  PID:5656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3276,i,16487327087163661819,14664279367197113276,2097152 --field-trial-handle=2008,i,16895249214890019460,13609015041331156221,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:5668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3328,i,10617064746179958164,3225800306826684295,2097152 --field-trial-handle=2008,i,16895249214890019460,13609015041331156221,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:6872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4752,i,12428201479050391093,10221203482919626745,2097152 --field-trial-handle=2008,i,16895249214890019460,13609015041331156221,262144 --variations-seed-version --mojo-platform-channel-handle=4760 /prefetch:1
  2⤵
  PID:1500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4880,i,9294865227326443644,7476640057796609821,524288 --field-trial-handle=2008,i,16895249214890019460,13609015041331156221,262144 --variations-seed-version --mojo-platform-channel-handle=4892 /prefetch:14
  2⤵
  PID:6900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5016,i,14341750242678957348,15065269455124616999,524288 --field-trial-handle=2008,i,16895249214890019460,13609015041331156221,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:14
  2⤵
  PID:1996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5512,i,15568025093560128323,8814965365344286820,2097152 --field-trial-handle=2008,i,16895249214890019460,13609015041331156221,262144 --variations-seed-version --mojo-platform-channel-handle=5560 /prefetch:1
  2⤵
  PID:1896
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5500,i,2253134973922031041,11869266462910753176,2097152 --field-trial-handle=2008,i,16895249214890019460,13609015041331156221,262144 --variations-seed-version --mojo-platform-channel-handle=5540 /prefetch:1
  2⤵
  PID:4652
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5588,i,5806878895333282341,7357240249363144789,524288 --field-trial-handle=2008,i,16895249214890019460,13609015041331156221,262144 --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:14
  2⤵
  PID:460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5808,i,936548722059780377,9799760868426882041,2097152 --field-trial-handle=2008,i,16895249214890019460,13609015041331156221,262144 --variations-seed-version --mojo-platform-channel-handle=5692 /prefetch:1
  2⤵
  PID:4148
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5980,i,18167307193605994286,8367857522533272552,2097152 --field-trial-handle=2008,i,16895249214890019460,13609015041331156221,262144 --variations-seed-version --mojo-platform-channel-handle=5684 /prefetch:1
  2⤵
  PID:2700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5484,i,13073856434025188379,16595796964759820142,2097152 --field-trial-handle=2008,i,16895249214890019460,13609015041331156221,262144 --variations-seed-version --mojo-platform-channel-handle=5480 /prefetch:1
  2⤵
  PID:3500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6276,i,14317273335929138728,570353807545124208,2097152 --field-trial-handle=2008,i,16895249214890019460,13609015041331156221,262144 --variations-seed-version --mojo-platform-channel-handle=5980 /prefetch:1
  2⤵
  PID:2616
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5816,i,2690853463613257384,13846167113730101902,2097152 --field-trial-handle=2008,i,16895249214890019460,13609015041331156221,262144 --variations-seed-version --mojo-platform-channel-handle=3980 /prefetch:1
  2⤵
  PID:1820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=5604,i,281156857408794143,15503413959531491609,2097152 --field-trial-handle=2008,i,16895249214890019460,13609015041331156221,262144 --variations-seed-version --mojo-platform-channel-handle=5700 /prefetch:1
  2⤵
  PID:6796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=5836,i,15280015047981732473,3198191640842235024,2097152 --field-trial-handle=2008,i,16895249214890019460,13609015041331156221,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:1
  2⤵
  PID:5704
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=3148,i,16209293997736120838,4704575396532022440,524288 --field-trial-handle=2008,i,16895249214890019460,13609015041331156221,262144 --variations-seed-version --mojo-platform-channel-handle=6532 /prefetch:14
  2⤵
  PID:5744
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6520,i,2082026748436695826,13290452966358417897,2097152 --field-trial-handle=2008,i,16895249214890019460,13609015041331156221,262144 --variations-seed-version --mojo-platform-channel-handle=5572 /prefetch:1
  2⤵
  PID:1980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=6332,i,8540829320180122990,11420667017871193525,2097152 --field-trial-handle=2008,i,16895249214890019460,13609015041331156221,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:1
  2⤵
  PID:6096
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=3956,i,139616388379849567,17246245505473511994,524288 --field-trial-handle=2008,i,16895249214890019460,13609015041331156221,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:14
  2⤵
  PID:4328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=5556,i,14119087376109562169,14643944932564307044,2097152 --field-trial-handle=2008,i,16895249214890019460,13609015041331156221,262144 --variations-seed-version --mojo-platform-channel-handle=6512 /prefetch:1
  2⤵
  PID:3832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=6120,i,1297234545415223165,6339663882124935031,2097152 --field-trial-handle=2008,i,16895249214890019460,13609015041331156221,262144 --variations-seed-version --mojo-platform-channel-handle=4776 /prefetch:9
  2⤵
  PID:4836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=3704,i,18113332852424688886,3396438283627102635,2097152 --field-trial-handle=2008,i,16895249214890019460,13609015041331156221,262144 --variations-seed-version --mojo-platform-channel-handle=3752 /prefetch:1
  2⤵
  PID:4224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=3732,i,9950827425943212420,7584402454824524515,2097152 --field-trial-handle=2008,i,16895249214890019460,13609015041331156221,262144 --variations-seed-version --mojo-platform-channel-handle=6820 /prefetch:1
  2⤵
  PID:6224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=6444,i,7595597136358328511,16527753609816387212,2097152 --field-trial-handle=2008,i,16895249214890019460,13609015041331156221,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:2888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=3672,i,11704590248698874149,10652259621349429458,524288 --field-trial-handle=2008,i,16895249214890019460,13609015041331156221,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:12
  2⤵
  PID:3932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3608,i,573950545608713114,17535112946949039909,524288 --field-trial-handle=2008,i,16895249214890019460,13609015041331156221,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:14
  2⤵
  PID:6380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6536,i,292805795078720473,7313278277832780652,524288 --field-trial-handle=2008,i,16895249214890019460,13609015041331156221,262144 --variations-seed-version --mojo-platform-channel-handle=6724 /prefetch:14
  2⤵
  PID:6740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3644,i,11403539060480166976,2365127675448055367,524288 --field-trial-handle=2008,i,16895249214890019460,13609015041331156221,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:14
  2⤵
  PID:2496

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3536

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5104

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:2140

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:5488

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

button_xover.bmp.part

Path C:\Program Files\WolfLegend\Img\button_xover.bmp.part
Size 7KB
SHA256 2a1252fbc17a4771a75bbf43ca9c903ac7d0a111556b9d0f794585fce0f5c05a
MD5 c0e230a1d8f99dbaa486221683540fc0
SHA1 bad6a7b0c9a221a72d3b9af13655337b9c6aa894
SHA512 f62c08574c6faa8b4be5e2934266811d7841f5c330fd2e74363a1e30b5ea771e36ef94ca1cf29d220ddb18b666b247442f1ee874118cea53e6d7350aa049a64b
SSDEEP 192:Hq4dKl0GIidPxZCI4qXmcOGX5lRxFTw8Ix0/J4pby3Xy//yEJ:Hq4dKIm5jxdX1vTXC0/wKy/t
TLSH
T127F14B612B4F7A01F72F887958F873F43912BB675AB35D2A222DB8E0C51B7E32560019
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

selectgame_fulldown.bmp.part

Path C:\Program Files\WolfLegend\Img\selectgame_fulldown.bmp.part
Size 41KB
SHA256 5a15d6e68027c6562df6a0ac9258003a5c334d913c863d8fb0aeb269ef71544c
MD5 6fedd465ba1fbc1c0dbaa828782682d0
SHA1 0541329887032f9b1b7c09640ea4b47c8bc468b6
SHA512 a2c059c331ff1e25e929858c5dba5e7e4ddccf6ddb8ad75286eefd7c8a9ffde8d918e7ebde56e09cfc476bd9ca9575eafdd34b796661a974917a3d3c5eebd119
SSDEEP 192:mUjJH/XiXYXkXNX0DnVTdIttFpoXejJ3R6K:mUdv0+yZGn/8Td3P
TLSH
T14D13049F07F658E221676F664BD8FAF10EE4BD948387A2D73C4CB9685A31DD04C1E089
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

selectgame_versioncheck.bmp.part

Path C:\Program Files\WolfLegend\Img\selectgame_versioncheck.bmp.part
Size 84KB
SHA256 a46f37c3ec1e55f243159f6e8e317177f59d1fd7a710d48e8e3b46aee57feb4c
MD5 18f8414b9115ff833a781f97c955c644
SHA1 954691f9e612b59211a654a6f1f375229901c6b5
SHA512 d01b189db2bd059ffa4d55d52b96965a15b75bc6bdc8ef12a174bfd391d8e72e7d01a56b945a7228f35ce007c9dfaa17d5ad8868ff0399e76a19b814217e5588
SSDEEP 96:G6C8AW/XDztkaXuyuprWa9mUGI0+i+3tM:GUxUj+
TLSH
T15A83198C43F074B31027EB6747D8B5B58DB50DA18646B2D2A90F3DB77431AEB0C74696
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

startbutton-over.bmp.part

Path C:\Program Files\WolfLegend\Img\startbutton-over.bmp.part
Size 32KB
SHA256 32da25fda16e6029613ec59c94412888fc551e03b387997845173b133c23995f
MD5 e894f3b278344447b5aa482d2daa0fe3
SHA1 67742018b515a2d2255e42dd45107af8620acf98
SHA512 ae8a1e25541d15c291d460dcf6007135f28869132096c562db01361efe2c6c548a7fdba9280a25a726bdb1c298b52f79518c171b1a9f4643aae46cae5a73e369
SSDEEP 384:19dejAjHJoXSDJ8eUcGJnL1bQCjmNFqLm7QJzmHORN2MBVpr6Y2UO93:gAjH1CXcGJLxjjmvqLmXHORfBr6Ysx
TLSH
T15CE243A465783182C582CC37FDB0C1EE6C225F3D65A3C20196B9DBFA7651075EE2EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WolfLegend.exe

Path C:\Program Files\WolfLegend\WolfLegend.exe
Size 11.2MB
SHA256 5d589d0f3fa321189dd7e283ebf06ed610ea8a198751ca184ad39a4f435f16a1
MD5 f871a7d1098c9b1f9d7ef981d90f7ad3
SHA1 4048de2dda268c12de78db542c846b947c176dad
SHA512 176cf7b4241b3035dfb43b809c890b6cdf81793ee390d81aca71a3381aadc31f830644969f84334ab5c8cc69017868d70751a6ff4172ec2889bed9cc8cfbe4fc
SSDEEP 196608:h0g5wC0mHoHxeaHXXhbWB/oKXGrXTbH2hnvOG2MM:rwrmHoH0eXhb6/D2XfUvOG2p
TLSH
T156C6CE53F26280FCC56AC075C25A6233FA217C494B357AEB5BE08B253E65F906B3DB14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ApexProgress.da_.part

Path C:\Program Files\WolfLegend\avital\ApexProgress.da_.part
Size 52KB
SHA256 9e7e8c5b42600481f657ca67d36873b3efa635025bafc22bb069e4cfa34f2449
MD5 1413cfdf241672a7fbd6bbef880affd4
SHA1 a44d39cb612293d71a5b427cca3e4d70ebdddb5e
SHA512 ea0eb27832a77d51d8d1cc8363e131992cc6841e8e2def6e14db8b9a38d465cb33394f9e61c1af51ae8bd66c6715347e392a3cde080413a66609bd3b6f0512e0
SSDEEP 768:ff+zG6jw+DpSjnJZrK+6z78LO+/0dyWmPzzhHZY9610QZGc7XXqcHlt:ff+Fjw+An6kLO+/8yzzY9k0QocXlt
TLSH
T137337E13B8D1C672CC0255B109794B09A777E6110BB15AC3BFA82A8DAFB23D15E373D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LoadSysControl.da_.part

Path C:\Program Files\WolfLegend\avital\LoadSysControl.da_.part
Size 76KB
SHA256 edc4c60e9d58983568228532b765fac03c7f81ed5eb0adc61265a2b5fa5526f9
MD5 5a981f5ce05a3c3a8b0732c3a53bce07
SHA1 67fa11fdbbe891228daf9471363f14f27df5d67e
SHA512 0b0319fe4f35c88cfb5a4d5ab1d89b3f9e45a71b8b0fd31a33985f5bd6270620b8decde6e9acadc922f896c284f9a335b57cc3f7056834ebe811c7fd0c2df3fd
SSDEEP 1536:m2p7OZS5kfYpOWALrGbzYCbRVMmx1NctJKWwR52lh:m2pyQbAOzYCb3IJK0lh
TLSH
T1AE739E33B9D2C1F1E94258B22CA94B1A6B77E60047B049D39768295FEF263C14E373C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000006

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000006
Size 331KB
SHA256 db4ffbf0ec662620013dc14bc1268bdad6256d19d7d511ec7eff8446887e6900
MD5 05ef8155cf66131654d3bb9c9cba5853
SHA1 e79d53fcb604921222dd1dbc2f1c10c631ff6075
SHA512 ee38793245d91683ddb1f847e5b56a09864fd32ec059055459b3ebe101abed79683ee59c80f30b8f6249d2bbd83fbf7bca83dafb4ef2b634ceff6969c80fed23
SSDEEP 6144:FljUD58FLTW53eaLkNv+Ps0dj1fpqaGjYf0NIcB3bM1rJZ24:FDm5uaLcv+PFj7ajJNImbM1rD
TLSH
T1247423A9B50E3C8AC94F9473827EAFD2A4356FF38D47BAA3634241F401874342E4676D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 936B
SHA256 8732b2ab212688f9e009c6e4091b7a84ba59534484dbcdec0f3d61b7ba86d210
MD5 8acb79d9377c6c020337e4505bf20339
SHA1 7bbcdc16a49a5cc2237b9d59b7080d7eb59cccdf
SHA512 24fc52695d40a2ce6664e303ba3fa6402fef59a717632c703988e84b959114b64eddfdbe929d10c63017ac1fdc126697842247527d497ee7670707c900f28649
TLSH
T12A11CC54C6B44278EB098DBD08E0CE86313045B6618BCF670710AFB5628B78E229759C
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 b40cfeac7808e508f9815e5c13cb977bd57620e2e7cb2a2e7fbd23f68e8277a4
MD5 9c9e8e5efe220189f4083be4f0ab0fdb
SHA1 6ca5bdddc6c2d7923df203dd5eb6a9947635c9bd
SHA512 a162f6242640e3df8fb91f16f0284550e2b6aa3a5d21c4742baf4f7d43d1f96cbcc2a478cc2c0309d1306e1486dc62a50b60490ebda18bacf33036e94f146a9a
SSDEEP 192:DxIWNNefgyyXeHSIhlkXrxHRWSFJokVkK8B1TpMeR8+K:DmWNNefgyyXeHSIhlkXrxHRWSFJokVkk
TLSH
T182F18DF7C3ED852D881152F49A15AF1FCE6A1A14932C3D26C9E8AE4F93E2472D24174F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 69baff8d08c147e34b00618261c0b27d94c4832e604ed45c869eba3a46fb6e79
MD5 dbe52f6197795e4f7546fcc56c31c79d
SHA1 a7ebf32305398e927ba73b93c393da3a4d158456
SHA512 7dd74bd0e52d529c89004a3a9e99cbc31defb8b257f56287b9212ecad0ae8fcfb45a75e620d95dd304910af0382cc1d6a6baf763ab30af2892b34ea634219c7e
TLSH
T12D214CA395BEF47710AD9A6F0D05F80656B6643105517CF5CFA6416EB0C18F32B1541F
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 8082279fd81ec63e752e7e21164aa70198fe97fac5e105c88ca8532f5f2adf83
MD5 57ed90115829ffd05f5bf7914e732df8
SHA1 efe05c34c7b08ebe0026a2e0d83cf8cd0dcce0c8
SHA512 22770f7173e5f851df8d6766aee5ceb3eb79daf522e0ed5b30c3a1b3a2674fd50aba9a7d4a63e3774a54b4db146ac293ae8b12f6252dee9693f029516f1ba449
SSDEEP 192:tRvtRDB8v7F8APRp2BwF9CHsb+WNrELxZKWS2xOQqO82VejI/aoaKVyIsnAUge:tRvtRBo59XHkwoj62/q92VadKe
TLSH
T1CC42C72EED20297BADDAC219F9227767E3F5102571D42E84EBFC892C14E79CC2227457
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 23dab011178254f7faf1b57f68ecaa921e35bf7b0d39409dbf016c6d6aed2ed0
MD5 cdfc763f012118696ab53623386f7011
SHA1 c3b34996123fb754aabe24ee68c030c2b231602f
SHA512 af476e722c57d29d66e8073e53e876792ff70484bd10b2482cae25176e2c8565b82825d492f6a8b984f03bf79d1dd2f33259d01c37090c9e17bd0ebc6ab62aa5
SSDEEP 192:tRvtRDTyv7F8APRp2BGHF9CHsb+WNCzoELxZOKOoWS2vOQqO82VejI/aoZHPyIsv:tRvtRTe59XbkwW/j602xq92VayDE
TLSH
T17B52C52BED20297BADD6C229F912B767E3F5102561D02E84EBFC9D2C10E7ACC2217457
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 3eaa85108ac75eb6c464940207f50908070544fac1dd9a284a6ae1a368067a16
MD5 d5da9dc761f1da7344e736d8019489b5
SHA1 e9a557c6aa503a212619447cf8d1fdf19e2cd6d4
SHA512 d6dd9029e776e707c3773fabbf1ee96769850a65af7d1c8e0acae8cddc484b26abe92329a8ceff43420e8269836eb3aa724507682b5ce2949380391c59f28bc3
SSDEEP 192:tRvtRDTav7F8APRp2BGHF9CHsb+WNrELxZOIY+WS2WOQqO82VejI/aoaKVyIsnAC:tRvtRT259XbkwojSm2yq92VadKe
TLSH
T1C152C52AED20297BADDBC229F912B767E3F5102561D42E84EBFC9D2C10E79CC2217457
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 826cf175b734d2646d00f85956870e3b8bf1540b59ed44704c13ca51e9f41b88
MD5 71e14ff1e15bc7bb131aea226a02f2a3
SHA1 46ceb810309ce6648830158f71d2923e939dfc92
SHA512 bc226f8674e6b7d467825b3732d6c792926b4fcb219f8ed2ed35912004b9319b433d9a54d956a789e38ad9b03ea893c9f627c4ef67e1dadb78496ca6f6dca5cc
SSDEEP 192:eI/4K6kC7KxkXqK4I40pUZNCgVLHrKHfFKslELQmXzKD/Fc+ErUkKN94nQ1XdSGx:B/jbC7KxkXqKf/pUZNCgVLH2HfgslNm+
TLSH
T18632E827948D9A3F4FD8D50DDC126F8BBCB5029672780D2497FB5C0803A978E214A6FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 e04f3b12713692ae1d25c26147d03013119b04f3b23314547fa3bf584d532839
MD5 4bfb89e69b4b3c1304d32223b32af1f0
SHA1 ff1f5164998ce8086c98065ce7f6c66881f81905
SHA512 75c9ddf889dc134969b6c5578c9d95260719f8c1fd3ade790c604c7b27c04f8f858a6a064b1f79fb6c33011fe105fe16647b4d6ba37219119d69ec86d2a37889
TLSH
T12AA00254A6C01431DD80A2B1A4B34595625248359D59938765910D5499DB6C95511105
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5ab1ec.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index~RFe5ab1ec.TMP
Size 48B
SHA256 4967d316ff6293559309f02e0f54f9eb6a87c8c475204eaa34b1347b7ea8cc1e
MD5 f8b72a1afca91456bafa850eddd483d8
SHA1 8f92a604c1605fdcde4acc3f390a7e99ecf555a5
SHA512 89b1e187d8fa153958b87348a511132277a8caa76e8b550d0f695ae9efe84ca7e993268e68f40bc2d36ca6692e5c2bd11c738723769778cf6b17aff3703429ef
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 124KB
SHA256 1b56433b3ee9cfb5e297ce131188608ad53f4245d789dc7c21e2a0f5c519aa74
MD5 6c04f865b2c79651ec670b2ed6cf1172
SHA1 e22f418997db6d3e2071d0706548bfef8ed209d5
SHA512 f4bfa0056ec062d4c7c049bd4e72bf161e5b2373f614b8b693e9a71800521bbd44a8de6cf0abe8ee3ef1b972412d8d4b62f9a3fcec3e912ff5736f7857b3167e
SSDEEP 3072:R3uVmO43mnC3wG0HtSq8ZrR4ILoh7Ft9pHvzN7lOYo8Gt:oX4NwhgqKR4ILo59R57lOYo8U
TLSH
T120C312F1E5372BE85C7ADDBF30142AA1CFF1A19CA2D8B541DAD1756D320E458830993E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 bf0bb2d8aa17bee7ebb1e91eb29ec5a8e9d531d22170c60f98d4ca08af933a61
MD5 470a239e1fcefbd2225742a837bd1653
SHA1 2e144dd95dba634255ecf408047706971d037ad4
SHA512 03a4a9577c825f680bd12074b6c3af0344928ac236ac814465d05dda7e054eae0dedf2dcd653902cd4c4bf2834287bcc0911b55ca22e655b199d8aa0dab67b4a
SSDEEP 96:MkC0d+CNkx/Fc5vBh2F8vIfjnNA8Xsr6RDotok5WVDeB6xGyv1T5tqbKv4a:MkC01N2c6AGDDUDae1U5tqbU
TLSH
T1D5A1F932582E9C7788B2C949B5532E43DEB8612BF921AF94E6DD5B0C11B70FC1381967
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 124KB
SHA256 a52ebc66596f5fc5c6a1ac762b89a816e61cdf6fd2e44f156eaac2ea07f95823
MD5 7f442d19638017b609be451eae2418d5
SHA1 8e503016b2be5b7023ba2eeb792b1fd955abcfe3
SHA512 79d6bfbbad4b0feb3ad3b33aff6f95b865fd7bcd5b02c20a89d2900883335e3ec6b9989f7a2e8abea2efb584713e339a78c99b41f13ed22397f49e22e06400ae
SSDEEP 3072:c3uVmO43mnC3wG0HtSq8ZrR4ILoh7Ft9pHvzN7lOYo8Gt:fX4NwhgqKR4ILo59R57lOYo8U
TLSH
T107C313F0E5372BE85C7ADDBF30142AA1CFF1A19CA2D8B541DAD1756D320E858830993E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 86bd6c7019f1a2444879ad1a04913b72ac99bbb860e7e872d56cb754668428a7
MD5 29896b5beb5f5d1b0e289680f290ef4e
SHA1 a7150c73ebb3bdd0b90981369171dcb669b4ede4
SHA512 294cb7a0f756407e7a4efbd44bd0b4fe557899a660eddd0ad87284e16fb5dbae33e20e54ecbe6c64d3c81e155217ce3c84b3642b8ac75104867fbd572ef5193e
TLSH
T11D315537F3DC8211C89A013A10CDAC1436BAC7DB90DEDF9B6B80E255A52F699CE60150
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 ae67fd82ea3220e38a513ecbb98101985f118ef4bb1a25af74ab60d9c7efae84
MD5 5b3623e65cbe3a2fdb10db0af035f773
SHA1 256f724b20da91faa4f645a0e09faa313b17ae8b
SHA512 bb783a0e27c41f43bd12bda39c4cd24a9aa185cacb8b0bfe28a3e7873793860d9955b8158a7465035b80c1e816189d03d9eb01f17d3469623b02576ba00867cf
TLSH
T14D115733F3CC8724DC9A403650CEEC1136B687DB409ECEABAB84D548B42F299CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_2mx42iy4.tyk.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2mx42iy4.tyk.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir948_404491716\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.wolflegend.launcher\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 014e0b8f4b02e08e707f672f5599f882d287032cbdec4d0f3b24c95db57cc4af
MD5 e566456ad58357010bd0efc24ceaddb8
SHA1 42052d834956954dcaa2a7ba0e24c343bec29e8a
SHA512 deabcf07764c2f99516a84bb3f4e4a0efbf0659ed0d6534433605778cbd778b7d6ea74efe9f6b86e6bc88e4ba20d07f1477aac87daa6568abfbcc90cb0d4b24a
TLSH
T13FD0121633118134C41021730402730A0C00C20B44054041582DC65D2B240903E02881
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.wolflegend.launcher\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 80554e61d2627f81517b731fc9e72647af643c9efed098d0172496253967cf85
MD5 eab173612eb5262d66d264e91871373c
SHA1 4f51141a9302c660c70b2d276e35f7b003125e50
SHA512 5985ac6c200f85d38362f3ae3761ee45dbe03a77653395869440207ccb664e0179f18c73f431347646b0d1bbdd0f2388a1e213b81dcd52645f4b5121913f16ea
TLSH
T147D02B6633294530C61032774481F3491800C21F040644401E3AFA5C1B510E22D81C81
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.wolflegend.launcher\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 7c58df3c7f9f074d3c619233663294e2490b7c2701e5bc78a123bd7dcc7d2523
MD5 735ce8f44b5754ba70ada9374f23c178
SHA1 161694740a2418abad16480f89be1defbe1eb093
SHA512 b9ac9fd08d96a276595888f08a3de678ba2b708c81bc3bc04c111ecf7c4a12a80495aeb9baa33b67abdaf2ac80420fd27d8ddd76ba065215c864024f29e19564
TLSH
T199D0222132154930D22022760992F29A2900D61E08068680993AF62C86410D22E81CC2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.wolflegend.launcher\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 0e895b9468c49806b4c2158c4157c1d0ba4d019e641a8e6ba1138e15d0b3d115
MD5 b659e4d6b0ff7ad703898385df85ad09
SHA1 ef6407dcda0b85543bef63ceb093d1c2efa5f179
SHA512 ab09f4acdeea0385141c653bda4afdd23c85582e00473e514e9f040e441ab7cec9e1b6ee98c202676f54701fd413072f794d1fc42d51bd339e81269489328b56
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.wolflegend.launcher\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 d0e0832d118ac1dce9653e18e44ba5a92ceee5ff10be9b3479ae8e075500650e
MD5 604ad2b11a8623bb2bcb59d955d6e808
SHA1 de7f7daea64a398cc4ef8d0e58a47eb5057e74ad
SHA512 4077b634ed036ee00b26c65656bbc41b1e6c89573fd6db76a2bc2785c2566c03cae5faf30ddc16d766fd244dfb39d70864be00af7dafcab7fa48afcf17b91b5f
TLSH
T160D0C03132154530D22033750991F3DE2A00D61E0806C7C0993FF73C8B420D32EC1CC2
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.wolflegend.launcher\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

687e97ea-d6da-471a-80f3-5f705518fea8.tmp

Path C:\Users\Admin\AppData\Local\com.wolflegend.launcher\EBWebView\Default\687e97ea-d6da-471a-80f3-5f705518fea8.tmp
Size 6KB
SHA256 7d3ad1627b429372725bbe563c2a478903eec8d3ccca065e5a18fd7e80f54586
MD5 b61a24a8b4772940549856db4caf0527
SHA1 a3a6c1c583887977a6a758e7c33b29925f91b005
SHA512 f3a75372581ae4f2f5ca08f11c0e7ef7f2eef337a0e569eba268574a9ed69ceb7b519a34b9a43d14181a8b36b88410b70a5b82082286da91ad3caed4ca1b58e1
SSDEEP 96:st8P/dq4y5bDykRk+Ro5h16Z0as7/x+6MhmuecJ7AMkkjeLK+gz028XM1C7K:stuIvR9onasV+Fd7Awj9yG6K
TLSH
T1C3D1A5055E24B97F4CC7E519BE36BA07E2F9603234911E68EBF8952C04EB6DC630390B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.wolflegend.launcher\EBWebView\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 ef577d45d838e4175cbfc6b976b2f6f7658137c68dbf08fd235ca15c441a1f21
MD5 31466c820612dbb55a09fce166be41db
SHA1 eb130e8037a4982b8b92c97eb62b26658759f27a
SHA512 d0a657100e5589f814c84882859fd34ecb08f6c9ff0705747ed945a7c22ea9afb05e57f8f565d20a387851f2266178b6e047c4ac64a1897fae6bbfa91604aad8
SSDEEP 3:MsFl9tlGallx912ja9ikflke/Q2lySKlH/1ViTdnE/Xl10fllZ4E:/F3XGu9Qa9ikNkgjy7HKZcX8NME
TLSH
T141134C2E56D70D46C3D27038848393759366B870D7145373B0942993104478E490D11C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.wolflegend.launcher\EBWebView\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 8a6e9eab1e885eae58aa4c81264569986a5f7637b638ce9c12bb97310c9a40eb
MD5 c6f859372eb2840abf02c7cec5402f1e
SHA1 6089faf5e4cc737d7ce0eb03e9bbe2be81023ffd
SHA512 6c72c7e8e445a6e0e872ccd2c89461e1a1c8e0e661b7db391397155f0a6d784ee6b350674ebf9cb33e5b90a4239b3bcebfb2a00d046fda2fcd455f24f8379726
SSDEEP 24:GaNCtbLw68Q9EpZM5JungTpeutN/9YdPbROFabUrm1TsdX:ClzRECugdeutNGJ80bUrMs
TLSH
T1644462AF138AC319C70043F5229AAEAE663400E416AD6743BCE9D9C248DA28AA45434D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.wolflegend.launcher\EBWebView\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 9ca543f10889d01b521c8c9bed4b92fd3038150c48e61f4cacf1ccfbb582048b
MD5 1ec522e47043c7bf7da86d6443ef565a
SHA1 b0824cac8004bc77900597ef3d7ff45ee4bf436a
SHA512 acf6d9e2bcd91f82cdd4ed1fb4f4bbf0d825bca48bf567e293f5a88d187fac08401e891fb8c0e755eef286742230bef249b788cb964805079991a3a99d30f2d9
SSDEEP 384:+uAmmMQu+JEYbhivXKjQu+JEY2EvXKjQu+JEY:+5OgMfQglfQg
TLSH
T1AE163BE74F64F942FA51DF70FBC8DD2C3C70A6E2BD969483A40681E948E0BC41B4655E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000001

Path C:\Users\Admin\AppData\Local\com.wolflegend.launcher\EBWebView\Default\Cache\Cache_Data\f_000001
Size 47KB
SHA256 3100e775e8616cd2611beecfa23a4263d7037586789b43f035236a2e6fbd4c62
MD5 260c81a4759baf163c025001c4f27872
SHA1 f11d729bb0a4d8350d2ea3d0fc062cf6ef2d5298
SHA512 9acec3e7a411a1eb6d072c3773bb14e5aa74d85d334674ec0fb018b7937174d5b612b756b2ce7aa3993d31dfe172516e7aaec79c7dd209eac5fd15d9aea077e9
SSDEEP 768:Gp4Wb3wv+eCLRZRtq9uGHpHveBOX5qw/14X+5edVWK4afHSTle4MRhVUNMT/TQDt:Gp483wdmXRtqhJPeByj/f4WK4mHIj8xw
TLSH
T1BE2302DF9E4D72D29271267045338383798E2D8A50AAE7A1061C0FE6DE05B69D31FB9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000002

Path C:\Users\Admin\AppData\Local\com.wolflegend.launcher\EBWebView\Default\Cache\Cache_Data\f_000002
Size 83KB
SHA256 34b9c504cab7a73e37b746343a449132e56cf7b5481af2cb81dc74dcff25c956
MD5 1ad231aac0a8a891b8374aa5526a5813
SHA1 cf3eb50fb21014c07d4311ef4c03a4fd587889b4
SHA512 fd38626bde9bd682bfa646efc8f66d38d42699f1fb27e243fc9fe71fc40c239bda58c78c63c196c0d61ab7f190550103d98ef0d41789f5ee65e0de4512967937
SSDEEP 1536:GBMnaLH450Gij0Agt/pL69wCE0nwvpYN7Vav7weXroCxscl0UP24ly9TqJueVG:GyGHyKj0AgBpLIElvpYTajwsPxRI4lyj
TLSH
T1A98312184C2867832F6C57FA3BC18464DD51A748D0562BECC20A8BDBF4E97902F69FD8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\com.wolflegend.launcher\EBWebView\Default\Cache\Cache_Data\index
Size 256KB
SHA256 1798259402095d3564d3300ef7120e25f7d092b360ea7c5191223ca0239a81a8
MD5 461a43a3b4a62cbd52bd9e0bd5f64499
SHA1 b655ccb650e32da89c50de70fcaccf7b10d57080
SHA512 2e0a8da2fca673495af4531e4ea6bb135178fe423e9bb5fbcd4574f4860cb1b65d47527d30603f03cdf172c623f087a3b080bd8693a4901e89f52ce57369bc8c
SSDEEP 3:LsFlklNllkll/lBrbnlX011nWNl/lGNtltlXl:Lsk3lEtpjNWN
TLSH
T15844016903C50C1BCA8056BC44A3A7B02374C411CB0BD7971384022A18867940F99040
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6bf9604a0059e088_0

Path C:\Users\Admin\AppData\Local\com.wolflegend.launcher\EBWebView\Default\Code Cache\js\6bf9604a0059e088_0
Size 256B
SHA256 833d44cc5560f01abe06b8a3cbecaf877cdefbeb0555582bd1d1ef246375f919
MD5 a3287793babfe1221699f12fe92ade7e
SHA1 01041b800a3069df72f062022af5bc4f8201bea6
SHA512 8dc8f3d4c0db9c06ac4a1d23b9d4ce599bb5410ee33ea0156d1de869cfc7d46679cac7363d78305accf20e2e725136823ef4d42e8d817198fd59e870014d765a
TLSH
T103D0978F0EB98148E62C68F0C7FF891A0B0906E0061D8A130024D8527245ABDB528A18
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.wolflegend.launcher\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 5899fb803c8f9c220f90709d1816f11f15a1f733cf2715cd475b420113bedb62
MD5 888876a5ae89258e6faddce1b54178ae
SHA1 49826a070fe1bbd0aaf33fcee4a08f710d206c08
SHA512 27d78e42679c902b0790a83119ec36c6020927067ee251e8e84c3c0a4617f0b314a3fb4df9c4830d65c04db36a53132265fc010116f795c453ffdd38f8603664
TLSH
T1ABA0022542891156F219977516A14181373089365AC2B6227DA61A6E8CA52DC4311045
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.wolflegend.launcher\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 e6c81a7c4fca1843c909d37310f9b4a94cc9b47c5c0faab40d70c75ddcb4a2d5
MD5 4dd231a414c77924b4c3e6cf76acf165
SHA1 5b743325a688ad2c0670807bb844a47f9bacb79f
SHA512 fa6b14b64ca4be6da1e342e96c0806fc3b71103ba2dff88c208748acc188d1b1e94af2272e161f9185102deee0ad9621be438435eb05f7c0388aa3acc790dbf6
TLSH
T1BEB0110322022202F30AA3B822E28080323208320203FC20ABA088AAA2A838C8322008
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59d548.TMP

Path C:\Users\Admin\AppData\Local\com.wolflegend.launcher\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe59d548.TMP
Size 48B
SHA256 0becfb792d1426f25676e24ae63bf488e2fdbdb4d45a46c77e87bc1515274045
MD5 6421e821a37abe79209098aa3b13cdff
SHA1 9f8990d100c7c068d04e076668c01fa6beb9cf7e
SHA512 19da074d8fb64948928b4d6a07dc2fdeedf4ae291108cf35d09743541ee63beb4bb592a186b80c5ead6fc8d8aef16b10123341b5be8e0707676ca41eb8030979
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\com.wolflegend.launcher\EBWebView\Default\Code Cache\wasm\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.wolflegend.launcher\EBWebView\Default\Code Cache\wasm\index-dir\the-real-index
Size 48B
SHA256 a63991935446a68b93c3d3c3346933c2dee2085e9d80346c0390ec674d9be2e8
MD5 5ebeedca4d5d91b1bbcb1a4f36a1db2c
SHA1 ed675a9a1227d4faee2200214f31d238ef7129aa
SHA512 c5feefd3ec83d7d47efb18050a781b9050bba5bb650cc1e9334fa80b4d1ca1ecd8949ca9c8d16c50c5ec7a5fdaceabaefefb0c9fceb1dd969a2a3fd98df08fb4
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\com.wolflegend.launcher\EBWebView\Default\Extension State\000003.log
Size 114B
SHA256 e2610960c3757d1757f206c7b84378efa22d86dcf161a98096a5f0e56e1a367e
MD5 891a884b9fa2bff4519f5f56d2a25d62
SHA1 b54a3c12ee78510cb269fb1d863047dd8f571dea
SHA512 cd50c3ee4dfb9c4ec051b20dd1e148a5015457ee0c1a29fff482e62291b32097b07a069db62951b32f209fd118fd77a46b8e8cc92da3eaae6110735d126a90ee
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\com.wolflegend.launcher\EBWebView\Default\Extension State\LOG
Size 299B
SHA256 54f9360ea41bb2b1ed9300b48ac5b8154df3fc86af329368dfd39d63da21bd0b
MD5 c81cd23feb0498192ee48be81d2d63a4
SHA1 a3351ec7cb74dc384a25c0bdcd03cbba06ee8d42
SHA512 0ab69962d045089a4bc8f00aa14541d095aa64b2de8980219e326fd281e2525504dfee08406b9c2b27bdac8c06c53e6fd247e07bbdda5d3ae1f846f9a544471c
TLSH
T136E0C21554C986678868CCB79F7E031ACBA0B01CFBD9370B4F5DEA48346B08CB984B10
MD5 SHA1 SHA512 TLSH

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\com.wolflegend.launcher\EBWebView\Default\Favicons
Size 20KB
SHA256 2db221a44885c046a4b116717721b688f9a026c4cae3a17cf61ba9bef3ad97f4
MD5 b40e1be3d7543b6678720c3aeaf3dec3
SHA1 7758593d371b07423ba7cb84f99ebe3416624f56
SHA512 fb0664c1c83043f7c41fd0f1cc0714d81ecd71a07041233fb16fefeb25a3e182a77ac8af9910eff81716b1cceee8a7ee84158a564143b0e0d99e00923106cc16
SSDEEP 24:LLiXxh0GY/l1rWR1PmCx9fZjsBX+T6UwcE85fBmI:iBmw6fU1zBmI
TLSH
T1AA92EE075E383407DBA10E7D266B187A8E3FE26C5FA29C94347410618CF9482D5394FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\com.wolflegend.launcher\EBWebView\Default\History
Size 164KB
SHA256 7b4d8b970df82e83575a21587ad5163e058ac86902b23638b9bf378624d43c91
MD5 7e964eb79b3d54006c8b0ad8ba10ad42
SHA1 186c67b6c395759a0749986bde1c0ac7c29cc457
SHA512 331730f013382ec070023dd53614b502e8b96eac3d503f53765ddeba093431c1281e683b4607370138de88903d9303f1d230ff2e6a5c4ba4ddccc258ae346927
SSDEEP 96:8BWspsLqL/uejzH+bF+UIYysX0fxQp97DEHt/DfLVVVN6zRk/E0fK:8BWBqL/tH+bF+UI3iWGVDWNVVV63j
TLSH
T18DF30A5E5F243612CDBD923768E749B3587CF03F872366866C6204B1CEE2656B02C4BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\com.wolflegend.launcher\EBWebView\Default\Network\Cookies
Size 20KB
SHA256 0628922305d2478ba75a48efadf932d439616eaf1ff908be334793f7bde28107
MD5 91dbaf73c1a8c55254d90272f998e412
SHA1 2b86b31c8c00c937291e5ac3b1d134a5df959acf
SHA512 109f4f59616cc1d1682b4d9468804f7668c77ce1878afec06a57037193f31a9c1c39f5d269277462936373b129d26488cddcc34d455c27185534e7754baaa988
SSDEEP 24:TLWr6bXYFpFNYJqH1kwIY6UwpQ9YH8rwZ6HfB:T+6LopFS+awWUOh8B
TLSH
T126926B4E5F346221C0F48B36EDE1855B2F7C201CD3B32655DA5860F3DE9299BF10956A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\com.wolflegend.launcher\EBWebView\Default\Network\Network Persistent State
Size 821B
SHA256 026225c0f1c6be79daf111f68d05853e307b8b32f272f9d77223df9403976d78
MD5 9404e1dd21945c17f045f3e4e52a18ab
SHA1 4a2e4a5ebe448e9e557b53402eda74237d31d7e8
SHA512 4112273642faa1072478e5f850d4797737db6d1fc610dfd8dac652cf17a2781e808b236ae1aefa39fcff565a2f4c042f1763303e60fe341cdc84ee04fff94af0
TLSH
T1470182A2C3D4C5BD4A4116E02B347813CD2E051D52346D2BCDE9EFDA57D1471D11150F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe59d632.TMP

Path C:\Users\Admin\AppData\Local\com.wolflegend.launcher\EBWebView\Default\Network\Network Persistent State~RFe59d632.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

Reporting and NEL

Path C:\Users\Admin\AppData\Local\com.wolflegend.launcher\EBWebView\Default\Network\Reporting and NEL
Size 36KB
SHA256 fc6a32c2d75151e18d2ce9a90af17e227bb139c362901c81e38307895a0bf6ab
MD5 704ce413db36c42df2aacc944313ec1f
SHA1 68b6d3d2782faa336fe9332a97e480fd0cc406ee
SHA512 e306a333c060e9842cb97a123ebe66581d7a14b79402e95f4a3daded608ca9101e90598c33cdf838f50ba04f04029268100e03a2b3faf5cc38891d40b490f327
SSDEEP 48:T0IopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSBaK:YIEumQv8m1ccnvS6Z
TLSH
T1DEF28ADE0B18B614C4E49578E6800DC7BD3E142D8B96AFC59EFC06F1FF821B2A538219
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\com.wolflegend.launcher\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\com.wolflegend.launcher\EBWebView\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\com.wolflegend.launcher\EBWebView\Default\Network\TransportSecurity
Size 356B
SHA256 1061584f073f43e2e08fe0d1152ffdfaf05bd693567b6bd2fb22da2d0eda460f
MD5 d264f7ff1f7905964c569a13cea4475e
SHA1 723da74a512286c4d70bc9c08d51540e259d74be
SHA512 e04d7154f1a5294133a194673a1ed2bbbcd12bdbb9a7cf58729b133f45c74d7915432a10d68364f37ac71bad8a1c69207640f906b28fa98344a756974fd112fb
TLSH
T1CEE0DFF740FBA4372028AA660990BC419B36B179819058E8DB9245ADE0C05F6AA1A867
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\com.wolflegend.launcher\EBWebView\Default\Network\TransportSecurity
Size 356B
SHA256 0d76a5de7455a6290c4c01691e56ce57bdea1da49202a4c2f518190102a9ef56
MD5 8b29e54f87d389b875fb70baff6faed1
SHA1 766a3cd324e0c96c65aed982ddbbbd1d9f4bb17f
SHA512 fb58d5de57e71be4f64c0991d3bc5f74cded4e62310b0a016842f3af81240faef8f146cd492f4dedf26bf2019f57c3efbaceea4358bc244a2e3b1761cc788a78
TLSH
T11EE026E340FBF6371028AB361980BC425B36A134415098F8DF93496DE0C09B7AA1A43B
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.wolflegend.launcher\EBWebView\Default\Preferences
Size 6KB
SHA256 2837bcccc24c491f463b3e2be65cfa61f6db78dcff3b50d5ed69c622863b63c4
MD5 99a05a240a39ae7d606d284cf015310e
SHA1 e4f1685c71268fc529460b6861583b95b822b519
SHA512 250755511592953a125c1fe5b12b1dd3863ecf3e9fc3c2e1887316a7559d9f5e4696731fc9e77cc6bbc1d75fb223d261e246902b40baf79815e356a94b1c4048
SSDEEP 96:st8P/dq4JG5bDykRk+Ro5h16Z0as7/x+6MhmuecJrxYfjeLK+gx+728XM7C7K:stuI9R9onasV+Fdrxaj9HgG0K
TLSH
T1DDE197065E24B97F4CD7E51DBA3ABA13E2F9503265911E58EBF8991C04EB6DC230390B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.wolflegend.launcher\EBWebView\Default\Preferences
Size 6KB
SHA256 dc90958a97b88cec8917d1d7a9a3e29bfd722db1d87d062a2498ec6761d25d2f
MD5 f13d2087a431d2c5a12a7a0a27193388
SHA1 7703d0bdc7e1334069b1b39ee395fc7270407e0f
SHA512 a914bce4472fd5f1e126d346f04fa12578f87f3b2346d24eef42601f99d8d92512cebdb931eaee7755f55de20aa6068b8843f93e5f49553044205faff83c7fc3
SSDEEP 96:st8P/dDT4ylb9ykRk+Io5h16Z0js7/x+6MhmuecJuN1ejeLK+gLi34I8XM1C7K:stu9xRUonjsV+FduNQj9Zg6K
TLSH
T1CFD1A7455E24B97B4CC7E119FA36BA17F2F9603234911E68E7F9852C04EB6DC630790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe59d548.TMP

Path C:\Users\Admin\AppData\Local\com.wolflegend.launcher\EBWebView\Default\Preferences~RFe59d548.TMP
Size 6KB
SHA256 4f7a6db2e61ab95611444fe2407b7e31b17aec4bb58c2ab51d99609c0d2d1a08
MD5 c03eec85bac7ba42d11829124e241d04
SHA1 773f70dfa7a6f78ceaa3fe70e8d42e42be3c0e2d
SHA512 ecd9d40b9f260d9f7970fdcb978ab7aa2cb3253fcc1a8ddecbae2126017e087fde3c960b4d1dfa4bc3017773ba53fe0847d911b24aa8662f5a2924a0b9538972
SSDEEP 96:st8P/dDT4ylb9ykRkMo5h16Z0js7/x+6MhmuecJuN1ejeLK+gLiZ28XM1C7K:stu9xRlonjsV+FduNQj9+G6K
TLSH
T1ADD1B7455E24B97B4CC6E209FA35BA07E2F9603225D51E68E7F9852C04EB6DC630790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\com.wolflegend.launcher\EBWebView\Default\Secure Preferences
Size 6KB
SHA256 e11faca76cb329ebf095f4e6fe3c394a8c000665e51b63a6ed3b1f0356232bb1
MD5 5e8cc380731909269af45d5a579628e5
SHA1 3bf0397d6d8d4c97e610fe8d51930074a4b2d4cf
SHA512 fd5c5b307e06633bacda42523dd63591bae877192fff8acc61ff51a5dead1b9c8e0462f7c10f9562ee2624ab668cd20497c9bee8274acf4a9278ac3c5e7ae61e
SSDEEP 96:vViXPlf/ROo1pkF5d1oil7VaTEv9V5h5pg5+e0dcbwu4SKEqAkDXIm9Iir:UXvET9lKiSKZAkD445
TLSH
T1C6C1B8A3092DC574EF444BEBDD397ACB9CAA01DF8DC5481696E6C58C02C2EFC21DA4D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.wolflegend.launcher\EBWebView\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 48B
SHA256 314e4476d496b57de04823f674988935c51066992ea294135db1daa4bcc00204
MD5 54e9488c74f51825e1018e1baa011c01
SHA1 a773f3d1906a5f5fd86980cfd13144eaa7b6e726
SHA512 5439e3030bc5afdb762d822f5c878e5bebd209252814fdc5bca97d1aa8c09afb8908dcad73155cf6222f140335c501bc8637e08d4c642b3f7864fa80e3312b16
MD5 SHA1 SHA512

Submit Download

Path C:\Users\Admin\AppData\Local\com.wolflegend.launcher\EBWebView\Default\Shared Dictionary\db
Size 44KB
SHA256 79b107307408e5ad9a145c87533316174fd13f4ad943497d079522fbe325b3b1
MD5 71ccdda9f3186c8e729bb559f93bb992
SHA1 3712c11bb21b8e2a74bb879d47b2819ed1ac14a8
SHA512 19f8134fcd1211964111b07884b52878b1649644b6ec623bb586df1a9b7dabc7f8c8a755d2a52c908b563bdd968135f4f703cc35103696e40d0ab0020c8dc4bd
SSDEEP 24:TL6iuaJhPwMuz6G0ZestjteXUSQeCl7ZIeNa6+6Uwg8hPq81fBG:T2TaOk17ZfnUdoqSB
TLSH
T1B0139A0F2E587564D1BD0635E9A34E6B2B7E30489B8329D125F02AF24DE251C5D2F27F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\com.wolflegend.launcher\EBWebView\Default\Site Characteristics Database\000003.log
Size 112B
SHA256 362b2acdb21c2dc7f77d2a6eb9f5bbb054c15d75856b899c2d574c1c7720c7f4
MD5 687c6758b114955912c6c1e784dc7d6c
SHA1 9640a1b0948f26a9e620182af7d70437f0a31b7c
SHA512 79ae8e2c1719c44188ae28b2768129ccefd31a109732861e73af4d575b6c8df60bac83e909dbe7b8fb95808ad974c2cefb23ca24e5e16b10a15b9f348cfe7122
TLSH
T1E5B012C4BB01B12BCAD80E3D0284DBE07724E703A50118035844CF211EB63E82E409D6
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\com.wolflegend.launcher\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\com.wolflegend.launcher\EBWebView\Default\Site Characteristics Database\LOG
Size 327B
SHA256 4a6522cf9000b87baa3ab9330a6bd69ae999a9f7326ef3a29e837c1ccb80fbef
MD5 2bc0c379cc17be98856806150db09f40
SHA1 6eb1dae2b5fa158a9031043d7fd0e2fdee3a0e7f
SHA512 99711bb14637ea9f8f7d7d21654e33c92e2fe1bc61e5dcba9ea2d2aff7503b37465df8476d32cc3bd06f406958464c1f670338935922b7102c0aa2a79998f41a
TLSH
T1E4E0201154C98727054544DF6A3BA31DC661B00CFAD966120F19F380155F0487482B10
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\com.wolflegend.launcher\EBWebView\Default\Sync Data\LevelDB\000003.log
Size 46B
SHA256 a2ca52e34b6138624ac2dd20349cde28482143b837db40a7f0fbda023077c26a
MD5 90881c9c26f29fca29815a08ba858544
SHA1 06fee974987b91d82c2839a4bb12991fa99e1bdd
SHA512 15f7f8197b4fc46c4c5c2570fb1f6dd73cb125f9ee53dfa67f5a0d944543c5347bdab5cce95e91dd6c948c9023e23c7f9d76cff990e623178c92f8d49150a625
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\com.wolflegend.launcher\EBWebView\Default\Sync Data\LevelDB\LOG
Size 303B
SHA256 de6e48441e513dab08ed0548abe5a9f3c2cb5e274a69e3adddde8463701e39ab
MD5 5e0838864d836f9e3e4ca1a11a4664bd
SHA1 1f8e2510fcd511cc600d77e40ea1502f30d6d24d
SHA512 97920b608dbff13230f7c45e48ff1644ce2ed5a6c7ffbdf5d7b6d5db0539342464f6d5a0cafdf1677572ee859d0ae180704a7049b5d4f71360ed36fcb3709820
TLSH
T1A3E0C27194C687774844C8D79A7A572FC6B4B80DEBC9374A8F0CE648295B088B9A0E61
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.wolflegend.launcher\EBWebView\Default\Sync Data\LevelDB\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Visited Links

Path C:\Users\Admin\AppData\Local\com.wolflegend.launcher\EBWebView\Default\Visited Links
Size 128KB
SHA256 e02f13bd8c894d489bd50cfcf37835634f513c25303a07e3d077a34856d1b494
MD5 7ea3e8d11cb9261a2115817ec2df90da
SHA1 70581044f6541c3eed45b2467691bb4d7fdef565
SHA512 3f755d85eced6736f9eee50499dd800a3bb58df19fcebc84b3882ed68765b26b9d5878f57cdb6eb4f77cd3ed766cd6f7d60d80b33c537fa74906c12829c7aa94
SSDEEP 3:ImtVub1Y/lll8dH:IiVuO/l/y
TLSH
T1C7D3040547110400CF554030C5100D5754D1C40173D1400707741D4FCC54035C70371C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\com.wolflegend.launcher\EBWebView\Default\Web Data
Size 210KB
SHA256 db93cc6874e6ae80c9a151c1dd6a326ffee07b127e5899438873c19399c79b85
MD5 de64b3487ba692a60d246d8fecc05bbb
SHA1 e2c1d6c0c2ef943be79fee667d2895d5579f279f
SHA512 13e75703aa5562b559896e564a264385fddfcde4ca29de673c1ba7582425776f51c6aeda5a324d89207b0d69b0c915284a1290577774220302a45d3b0fae8f1a
SSDEEP 384:FihpPI2DnEDsKc1IysvHEBMehIv0QKIqJOw:wzPDDnEAKc1Iys/LIIvfKIqJOw
TLSH
T1A724554A7B746100DDE2D9B21CB080771A3CB16D8F22E6925DB264694DF7853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\com.wolflegend.launcher\EBWebView\Default\shared_proto_db\metadata\LOG
Size 317B
SHA256 f3c143855925ee5e40e9542b98b9d85466bb766b62d2b3b6e32cf5b72526bb1f
MD5 ffab74317161079d7e7cf923eaab5103
SHA1 f17f4f5b21ef1cc0ab4420398d4cb879afa4621e
SHA512 78a9270a31335515f0f65cb028917f13363ab02dc69b8e1af2e6032a427f7c533841bfbc6be73f63d92acea4652815f2a4dcd4ad0acd6d3dc5cf6c159d363f22
TLSH
T14EE07D01F8C582AB441084D7697B539AD710744DFFD82F060F05DB44192B08CB885711
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.wolflegend.launcher\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.wolflegend.launcher\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.wolflegend.launcher\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.wolflegend.launcher\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\com.wolflegend.launcher\EBWebView\Last Version
Size 14B
SHA256 d75607a88bb0f572f8863a3ea4737b635664178e97e0b7cb057887f2736fe3fe
MD5 3b746b6e8b8e101ee7cd41df1bb565d0
SHA1 ff5ff645ada097814fb4890d00dba8a309e1a506
SHA512 71d487cff7f744f046d993889c770a877075378b8d47d6c2f80fd94a5c1150a627f4a69d9e55f272f3aa4257e5dbb5296643591d5d23804a95550a3f2d91e2d9
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.wolflegend.launcher\EBWebView\Local State
Size 16KB
SHA256 bbd41722b429f1639c045a2639203a35200d542eeba6ccbb651a1106dc216e55
MD5 f6bd34a2a0afc7405371878c8a8b4414
SHA1 dd6532ed2dc3ecb5eb9250d45b7e565e829e13e8
SHA512 3f790f753cc1b64e0028f250103a13322cad3ce5a908b2e10008552cb2bd3cb366ca9a25bb205c412b463045aa85f482e17806b2ee38677869e5afe32dac7817
SSDEEP 384:b+aQikB+z/xvxjg/qhEo3NBSo4EBRYsbcAVdpS+puuDzd9z4:6/UxvxjgC+oR4MBcU13F4
TLSH
T11272AF1B6869BD73A5F3EA047A6D0B8FDAF8947250C12E744AFD6F0D12D72941343C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.wolflegend.launcher\EBWebView\Local State
Size 2KB
SHA256 d213e5fac0478a3f57faa41c32400e31c44111f8e3963970fad15538680b994e
MD5 94b4fc6de875ebf85a7c2d8ad413a27f
SHA1 a072f2abbb4ca42d03ffc1271bd2a6afa434d249
SHA512 b58d5affdc37c8b18058b0ef5c3c4caba8fa720523b37174efe3d1f0f96ba422bbc06710660154ca08c28027e623b2842dde660c8f61e94ca742274f57c6028c
TLSH
T1465183737D25AB3798F28B047A4B3A27EA7590A19A922F20D6ED0B0800FB51C2341C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.wolflegend.launcher\EBWebView\Local State
Size 3KB
SHA256 ce1e279665d161036ff8f134620ba9b398bbf73da309c53e4659041cc7d2f89f
MD5 a0b28b99083871c54b729c8524de040e
SHA1 7bffe0284e316c211625eb1566739928d6b04684
SHA512 0f53aa1ed23d7e45486d6eb065645e5077f1d8ce47a38c4ebae42501096ec71adb11c169af930ec44eef437072e55da7ddca6de493b0da0653fd9fa33672de4b
TLSH
T1E46150766D75EA378DF2DA0479872B1BB6A59032A5913F64D6EC0F0C01FB2881341C26
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.wolflegend.launcher\EBWebView\Local State
Size 15KB
SHA256 295510c7897048e83b063f3f415b6ce54ce18e1a4c65da08c6fd64a9eacd901e
MD5 a78eb1778f183a54dbfc78c464f3614e
SHA1 2d5e85ac918b890888752b9f235fa9803d02cb6e
SHA512 0a24267979204205d11241eb378d010d11c6edf44b44d056cc5f8c7f5b647f39559834b3261684d6135d16739078d065708b7a5fa7136f183333ead58c9eae3a
SSDEEP 384:p+aQikB+z/xvxjg/qhEwNBSo4EmAYsqKAVdpS+q9zF:U/UxvxjgC+Q4uwKU1qFF
TLSH
T16072AF2B69797E33A5F3EA04795D078BDAB8D47250C12E784AFD6F0D06D72941341C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.wolflegend.launcher\EBWebView\Local State
Size 15KB
SHA256 f8088918f70d9980aa44062f4f625835252270b0c6ef949125eb17153ef580fd
MD5 33523e1eb1999235c7f35d563843990f
SHA1 7ceba3cde85f75fa2ebf5598110255586021022a
SHA512 c74fa391e50be5a4fca12b5ec2c212d3cc2f1bda25751f05029af4e007c3817498798e2ef0288db4b6ab77f6c1d8eb8d346222b151419753a7639844b9bbcb1b
SSDEEP 384:d+aQikB+z/xvxjg/qhEb3NBSo4EmxYsqEAVdpS+q9zF:o/UxvxjgC+bR4LwEU1qFF
TLSH
T1DE72AF2769797E33A5F3EA04395D4B8FDBB8947250C12EB44AFD6F0D06D72981341C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.wolflegend.launcher\EBWebView\Local State
Size 16KB
SHA256 b849cfa6fa83e8c08f8500819944387f0af2f856beffc1a8110fdaee6c9b5228
MD5 14cdee77967d9d94fb351b2a037e9858
SHA1 6254ff65df1ac5fcd1760f0617129c76bf56a90c
SHA512 22e8fcafcd8c52339e1f1a1dc6b36517e6d1c75aaea50d362a591fc3d326648109198b3d88d94ed8a1ae8a84748c254973167a63be17fa76fa146d24995cf1d3
SSDEEP 384:I+aQikB+z/xvxjg/qhEo3NBSo4EBRYsbcAVdpS+puuDzd9z4:H/UxvxjgC+oR4MBcU13F4
TLSH
T1CE72A01B6869BD73A5F3EA047A6D0B8FDAF8947250C12E744AFD6F0D12D72941343C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe59aa50.TMP

Path C:\Users\Admin\AppData\Local\com.wolflegend.launcher\EBWebView\Local State~RFe59aa50.TMP
Size 1KB
SHA256 2648fecd9c352184283fe6c4d9a180ec17641e0b8794843a59602b2a809350ab
MD5 7786bc06318e8f9db9a78847ae03943f
SHA1 9341357f649ec0b1f638452272d5715f3ebb0677
SHA512 fed09c8d3be90f43c9ca6ea025bdc19919ef0ae0786d0ab635d43923f4226ecd134e7098874e3efc8a67762eacc2dbc42d2b94ac39b85008a8f2dd13d638b157
TLSH
T1232165F3B8798B33ACE19B4522577AAB7E7090A741514F00A1EE8B1D01F714CD665832
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.wolflegend.launcher\EBWebView\ShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\com.wolflegend.launcher\EBWebView\ShaderCache\index
Size 256KB
SHA256 19d8c534bcc07683fc1d8e6e04e315ca3c5f2934d7d26b955358e12cfb97ed68
MD5 d0c474707cb5825534fa19a893251420
SHA1 8f0b3f3b1c3873bb67d72826b9004352157780b6
SHA512 9f1eae2967917af0499080322304b8d0e0362a9af268d48d960dbb73b7cf0f583571d6437360f5bb08bd11ea302cc366d2e6470ca0832e4cd43d0f23392040bf
SSDEEP 3:LsOllllklkXlpi:LsUlPpi
MD5 SHA1 SHA512 SSDEEP

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\com.wolflegend.launcher\EBWebView\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

default.exc

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.exc
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

memory/200-1416-0x00007FFA821C0000-0x00007FFA821C1000-memory.dmp

Download

memory/200-1417-0x00007FFA81880000-0x00007FFA81881000-memory.dmp

Download

memory/1256-1955-0x000001B48F710000-0x000001B48F711000-memory.dmp

Download

memory/1256-1962-0x000001B48F710000-0x000001B48F711000-memory.dmp

Download

memory/1256-1959-0x000001B48F710000-0x000001B48F711000-memory.dmp

Download

memory/1256-1960-0x000001B48F710000-0x000001B48F711000-memory.dmp

Download

memory/1256-1953-0x000001B48F710000-0x000001B48F711000-memory.dmp

Download

memory/1256-1961-0x000001B48F710000-0x000001B48F711000-memory.dmp

Download

memory/1256-1964-0x000001B48F710000-0x000001B48F711000-memory.dmp

Download

memory/1256-1963-0x000001B48F710000-0x000001B48F711000-memory.dmp

Download

memory/1456-1414-0x00000126D3570000-0x00000126D3619000-memory.dmp

Download

memory/1456-488-0x00000126D3570000-0x00000126D3619000-memory.dmp

Download

memory/1456-1102-0x00000126D3570000-0x00000126D3619000-memory.dmp

Download

memory/3216-487-0x000001E9E48F0000-0x000001E9E4999000-memory.dmp

Download

memory/3216-1101-0x000001E9E48F0000-0x000001E9E4999000-memory.dmp

Download

memory/6732-207-0x000002114C7C0000-0x000002114C869000-memory.dmp

Download

memory/6732-112-0x00007FFA81670000-0x00007FFA81671000-memory.dmp

Download

memory/6828-373-0x0000014F86420000-0x0000014F864C9000-memory.dmp

Download

memory/6828-206-0x0000014F86420000-0x0000014F864C9000-memory.dmp

Download

memory/6828-24-0x00007FFA81670000-0x00007FFA81671000-memory.dmp

Download

memory/7032-169-0x000001A778ED0000-0x000001A778EF2000-memory.dmp

Download

memory/7032-172-0x000001A779180000-0x000001A77919E000-memory.dmp

Download

memory/7032-173-0x000001A7791A0000-0x000001A779252000-memory.dmp

Download

memory/7032-174-0x000001A779360000-0x000001A77936A000-memory.dmp

Download

memory/7032-175-0x000001A7794F0000-0x000001A77951A000-memory.dmp

Download

memory/7032-176-0x000001A7794F0000-0x000001A779514000-memory.dmp

Download