d95ae7b09fc599fa5ef99c04131117f9b8f9432b3b4aa9cf8492535f8d71ceae

user interaction
yes
max time kernel
185s
max time network
206s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/08/2026, 17:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
fcd1cdfe358c3b7c95e10cf72dbf727f_JaffaCakes118.pdf
Size 93KB
Sample260824-warp8a1fmd
SHA256 d95ae7b09fc599fa5ef99c04131117f9b8f9432b3b4aa9cf8492535f8d71ceae
MD5 fcd1cdfe358c3b7c95e10cf72dbf727f
SHA1 7c5c487471db6b1702085fd880a931a819baa264
SHA512 30ca7a429aa4b1b3a877c6b8b83e3f957c2cb5a7a06d2ad63e0be5e85ade27f0d3255d8c0c671150013c01546369052882f5db77997f3980148a8b7a3a47caa6
SSDEEP 1536:UHedaEV1N3QjlwBgiZDASIKwJJYut9OLod6/d3Vb4fcXwWx+7oRW8pO+W/O:Kedai/3ywBgirIBL1qd3VbrXp+7ow+D
TLSH
T14493D0BEF64D4CCCE0E3CB86DB32F9AD467E721759CE20C035340A93B4691A956462DB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

adware discovery persistence spyware

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2032	chrome.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134320670198696743"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
5964	chrome.exe
5964	chrome.exe
3452	AcroRd32.exe
3452	AcroRd32.exe
3452	AcroRd32.exe
3452	AcroRd32.exe
3452	AcroRd32.exe
3452	AcroRd32.exe
3452	AcroRd32.exe
3452	AcroRd32.exe
3452	AcroRd32.exe
3452	AcroRd32.exe
3452	AcroRd32.exe
3452	AcroRd32.exe
3452	AcroRd32.exe
3452	AcroRd32.exe
3452	AcroRd32.exe
3452	AcroRd32.exe
3452	AcroRd32.exe
3452	AcroRd32.exe
5964	chrome.exe
5964	chrome.exe
5680	chrome.exe
5680	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs

pid	Process
5964	chrome.exe
5964	chrome.exe
5964	chrome.exe
5964	chrome.exe
5964	chrome.exe
5964	chrome.exe
5964	chrome.exe
5964	chrome.exe
5964	chrome.exe
5964	chrome.exe
5964	chrome.exe
5964	chrome.exe
5964	chrome.exe
5964	chrome.exe
5964	chrome.exe
5964	chrome.exe
5964	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5964	chrome.exe
Token: SeCreatePagefilePrivilege	5964	chrome.exe
Token: SeShutdownPrivilege	5964	chrome.exe
Token: SeCreatePagefilePrivilege	5964	chrome.exe
Token: SeShutdownPrivilege	5964	chrome.exe
Token: SeCreatePagefilePrivilege	5964	chrome.exe
Token: SeShutdownPrivilege	5964	chrome.exe
Token: SeCreatePagefilePrivilege	5964	chrome.exe
Token: SeShutdownPrivilege	5964	chrome.exe
Token: SeCreatePagefilePrivilege	5964	chrome.exe
Token: SeShutdownPrivilege	5964	chrome.exe
Token: SeCreatePagefilePrivilege	5964	chrome.exe
Token: SeShutdownPrivilege	5964	chrome.exe
Token: SeCreatePagefilePrivilege	5964	chrome.exe
Token: SeShutdownPrivilege	5964	chrome.exe
Token: SeCreatePagefilePrivilege	5964	chrome.exe
Token: SeShutdownPrivilege	5964	chrome.exe
Token: SeCreatePagefilePrivilege	5964	chrome.exe
Token: SeShutdownPrivilege	5964	chrome.exe
Token: SeCreatePagefilePrivilege	5964	chrome.exe
Token: SeShutdownPrivilege	5964	chrome.exe
Token: SeCreatePagefilePrivilege	5964	chrome.exe
Token: SeShutdownPrivilege	5964	chrome.exe
Token: SeCreatePagefilePrivilege	5964	chrome.exe
Token: SeShutdownPrivilege	5964	chrome.exe
Token: SeCreatePagefilePrivilege	5964	chrome.exe
Token: SeShutdownPrivilege	5964	chrome.exe
Token: SeCreatePagefilePrivilege	5964	chrome.exe
Token: SeShutdownPrivilege	5964	chrome.exe
Token: SeCreatePagefilePrivilege	5964	chrome.exe
Token: SeShutdownPrivilege	5964	chrome.exe
Token: SeCreatePagefilePrivilege	5964	chrome.exe
Token: SeShutdownPrivilege	5964	chrome.exe
Token: SeCreatePagefilePrivilege	5964	chrome.exe
Token: SeShutdownPrivilege	5964	chrome.exe
Token: SeCreatePagefilePrivilege	5964	chrome.exe
Token: SeShutdownPrivilege	5964	chrome.exe
Token: SeCreatePagefilePrivilege	5964	chrome.exe
Token: SeShutdownPrivilege	5964	chrome.exe
Token: SeCreatePagefilePrivilege	5964	chrome.exe
Token: SeShutdownPrivilege	5964	chrome.exe
Token: SeCreatePagefilePrivilege	5964	chrome.exe
Token: SeShutdownPrivilege	5964	chrome.exe
Token: SeCreatePagefilePrivilege	5964	chrome.exe
Token: SeShutdownPrivilege	5964	chrome.exe
Token: SeCreatePagefilePrivilege	5964	chrome.exe
Token: SeShutdownPrivilege	5964	chrome.exe
Token: SeCreatePagefilePrivilege	5964	chrome.exe
Token: SeShutdownPrivilege	5964	chrome.exe
Token: SeCreatePagefilePrivilege	5964	chrome.exe
Token: SeShutdownPrivilege	5964	chrome.exe
Token: SeCreatePagefilePrivilege	5964	chrome.exe
Token: SeShutdownPrivilege	5964	chrome.exe
Token: SeCreatePagefilePrivilege	5964	chrome.exe
Token: SeShutdownPrivilege	5964	chrome.exe
Token: SeCreatePagefilePrivilege	5964	chrome.exe
Token: SeShutdownPrivilege	5964	chrome.exe
Token: SeCreatePagefilePrivilege	5964	chrome.exe
Token: SeShutdownPrivilege	5964	chrome.exe
Token: SeCreatePagefilePrivilege	5964	chrome.exe
Token: SeShutdownPrivilege	5964	chrome.exe
Token: SeCreatePagefilePrivilege	5964	chrome.exe
Token: SeShutdownPrivilege	5964	chrome.exe
Token: SeCreatePagefilePrivilege	5964	chrome.exe

Suspicious use of FindShellTrayWindow 51 IoCs

pid	Process
5964	chrome.exe
5964	chrome.exe
5964	chrome.exe
5964	chrome.exe
5964	chrome.exe
5964	chrome.exe
5964	chrome.exe
5964	chrome.exe
5964	chrome.exe
5964	chrome.exe
5964	chrome.exe
5964	chrome.exe
5964	chrome.exe
5964	chrome.exe
5964	chrome.exe
5964	chrome.exe
5964	chrome.exe
5964	chrome.exe
5964	chrome.exe
5964	chrome.exe
5964	chrome.exe
5964	chrome.exe
5964	chrome.exe
5964	chrome.exe
5964	chrome.exe
5964	chrome.exe
5964	chrome.exe
5964	chrome.exe
5964	chrome.exe
5964	chrome.exe
5964	chrome.exe
5964	chrome.exe
5964	chrome.exe
5964	chrome.exe
3452	AcroRd32.exe
5964	chrome.exe
5964	chrome.exe
5964	chrome.exe
5964	chrome.exe
5964	chrome.exe
5964	chrome.exe
5964	chrome.exe
5964	chrome.exe
5964	chrome.exe
5964	chrome.exe
5964	chrome.exe
5964	chrome.exe
5964	chrome.exe
5964	chrome.exe
5964	chrome.exe
5964	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5964	chrome.exe
5964	chrome.exe
5964	chrome.exe
5964	chrome.exe
5964	chrome.exe
5964	chrome.exe
5964	chrome.exe
5964	chrome.exe
5964	chrome.exe
5964	chrome.exe
5964	chrome.exe
5964	chrome.exe
5964	chrome.exe
5964	chrome.exe
5964	chrome.exe
5964	chrome.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
3452	AcroRd32.exe
3452	AcroRd32.exe
3452	AcroRd32.exe
3452	AcroRd32.exe
3452	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5964 wrote to memory of 1260	5964	chrome.exe	89
PID 5964 wrote to memory of 2032	5964	chrome.exe	90
PID 5964 wrote to memory of 5608	5964	chrome.exe	91
PID 5964 wrote to memory of 5608	5964	chrome.exe	91
PID 5964 wrote to memory of 4540	5964	chrome.exe	93
PID 5964 wrote to memory of 4540	5964	chrome.exe	93
PID 5964 wrote to memory of 2676	5964	chrome.exe	94
PID 5964 wrote to memory of 2676	5964	chrome.exe	94
PID 5964 wrote to memory of 3056	5964	chrome.exe	95
PID 5964 wrote to memory of 3056	5964	chrome.exe	95
PID 5964 wrote to memory of 3556	5964	chrome.exe	96
PID 5964 wrote to memory of 3556	5964	chrome.exe	96
PID 5964 wrote to memory of 2660	5964	chrome.exe	97
PID 5964 wrote to memory of 2660	5964	chrome.exe	97
PID 5964 wrote to memory of 1572	5964	chrome.exe	98
PID 5964 wrote to memory of 2684	5964	chrome.exe	99
PID 5964 wrote to memory of 2684	5964	chrome.exe	99
PID 5964 wrote to memory of 5060	5964	chrome.exe	100
PID 5964 wrote to memory of 5060	5964	chrome.exe	100
PID 5964 wrote to memory of 5448	5964	chrome.exe	102
PID 5964 wrote to memory of 5448	5964	chrome.exe	102
PID 5964 wrote to memory of 3740	5964	chrome.exe	103
PID 5964 wrote to memory of 3740	5964	chrome.exe	103
PID 5964 wrote to memory of 2972	5964	chrome.exe	104
PID 5964 wrote to memory of 2972	5964	chrome.exe	104
PID 5964 wrote to memory of 8	5964	chrome.exe	105
PID 5964 wrote to memory of 8	5964	chrome.exe	105
PID 5964 wrote to memory of 1396	5964	chrome.exe	106
PID 5964 wrote to memory of 1396	5964	chrome.exe	106
PID 5964 wrote to memory of 5004	5964	chrome.exe	107
PID 5964 wrote to memory of 5004	5964	chrome.exe	107
PID 3452 wrote to memory of 5624	3452	AcroRd32.exe	108
PID 5624 wrote to memory of 2068	5624	RdrCEF.exe	111
PID 5624 wrote to memory of 2068	5624	RdrCEF.exe	111
PID 5624 wrote to memory of 1384	5624	RdrCEF.exe	112
PID 5964 wrote to memory of 4768	5964	chrome.exe	113
PID 5964 wrote to memory of 4768	5964	chrome.exe	113
PID 5624 wrote to memory of 1900	5624	RdrCEF.exe	114
PID 5624 wrote to memory of 1900	5624	RdrCEF.exe	114
PID 5624 wrote to memory of 1352	5624	RdrCEF.exe	116
PID 5624 wrote to memory of 1548	5624	RdrCEF.exe	120
PID 5624 wrote to memory of 1400	5624	RdrCEF.exe	121
PID 5964 wrote to memory of 5448	5964	chrome.exe	122
PID 5964 wrote to memory of 5448	5964	chrome.exe	122
PID 5964 wrote to memory of 1884	5964	chrome.exe	123
PID 5964 wrote to memory of 1884	5964	chrome.exe	123
PID 5964 wrote to memory of 3236	5964	chrome.exe	124
PID 5964 wrote to memory of 3236	5964	chrome.exe	124
PID 5964 wrote to memory of 5880	5964	chrome.exe	125
PID 5964 wrote to memory of 5880	5964	chrome.exe	125
PID 5964 wrote to memory of 3456	5964	chrome.exe	126
PID 5964 wrote to memory of 3456	5964	chrome.exe	126
PID 5964 wrote to memory of 4776	5964	chrome.exe	128
PID 5964 wrote to memory of 2316	5964	chrome.exe	129
PID 5964 wrote to memory of 1844	5964	chrome.exe	130
PID 5964 wrote to memory of 3236	5964	chrome.exe	131
PID 5964 wrote to memory of 3236	5964	chrome.exe	131
PID 5964 wrote to memory of 5680	5964	chrome.exe	132
PID 5964 wrote to memory of 2576	5964	chrome.exe	133
PID 5964 wrote to memory of 2576	5964	chrome.exe	133
PID 5964 wrote to memory of 3536	5964	chrome.exe	134
PID 5964 wrote to memory of 3536	5964	chrome.exe	134
PID 5964 wrote to memory of 1636	5964	chrome.exe	135
PID 5964 wrote to memory of 1636	5964	chrome.exe	135

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\fcd1cdfe358c3b7c95e10cf72dbf727f_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3452
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5624
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=B19C1A32A27C5C73E93B2DE787E073ED --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=B19C1A32A27C5C73E93B2DE787E073ED --renderer-client-id=2 --mojo-platform-channel-handle=1780 --allow-no-sandbox-job /prefetch:1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2068
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=D339AD8103E7B8C97AEFC012CFB12B0A --mojo-platform-channel-handle=1788 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1384
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=F5CC0C5AE291F025FCF417A288187A3F --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=F5CC0C5AE291F025FCF417A288187A3F --renderer-client-id=4 --mojo-platform-channel-handle=2368 --allow-no-sandbox-job /prefetch:1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1900
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=822CD81DAC8BC3EC26B7577BD7D34E75 --mojo-platform-channel-handle=2776 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1352
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=B5535FDCBBAA4FF7D77C5D37F621114E --mojo-platform-channel-handle=2092 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1548
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=F7FB4F8B172CB4491F149959631A5F20 --mojo-platform-channel-handle=1788 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1400

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffea16cc728,0x7ffea16cc734,0x7ffea16cc740
  2⤵
  PID:1260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1892,i,9090483765706141540,6121099604125351996,524288 --field-trial-handle=1804,i,12462028146625496861,3726485487745930143,262144 --variations-seed-version --mojo-platform-channel-handle=1952 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1612,i,7587177301117213108,3259480620415297321,262144 --field-trial-handle=1804,i,12462028146625496861,3726485487745930143,262144 --variations-seed-version --mojo-platform-channel-handle=1800 /prefetch:2
  2⤵
  PID:5608
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2328,i,5818769683413587326,8857496701569264373,524288 --field-trial-handle=1804,i,12462028146625496861,3726485487745930143,262144 --variations-seed-version --mojo-platform-channel-handle=2360 /prefetch:13
  2⤵
  PID:4540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3260,i,6995733576400794166,8105052706234915902,2097152 --field-trial-handle=1804,i,12462028146625496861,3726485487745930143,262144 --variations-seed-version --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:2676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3288,i,6388396854483529285,15313452475603167837,2097152 --field-trial-handle=1804,i,12462028146625496861,3726485487745930143,262144 --variations-seed-version --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:3056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4684,i,11272191656391126020,9080082438068099130,2097152 --field-trial-handle=1804,i,12462028146625496861,3726485487745930143,262144 --variations-seed-version --mojo-platform-channel-handle=4712 /prefetch:1
  2⤵
  PID:3556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=3240,i,14199760326936357345,11805996315547074350,524288 --field-trial-handle=1804,i,12462028146625496861,3726485487745930143,262144 --variations-seed-version --mojo-platform-channel-handle=4856 /prefetch:14
  2⤵
  PID:2660
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5424,i,13801794653167316129,10313601032516572152,524288 --field-trial-handle=1804,i,12462028146625496861,3726485487745930143,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:14
  2⤵
  PID:1572
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5508,i,5697327434311604947,6494315515119790049,2097152 --field-trial-handle=1804,i,12462028146625496861,3726485487745930143,262144 --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:1
  2⤵
  PID:2684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5520,i,3670422631635059478,3327935109880543276,2097152 --field-trial-handle=1804,i,12462028146625496861,3726485487745930143,262144 --variations-seed-version --mojo-platform-channel-handle=5564 /prefetch:1
  2⤵
  PID:5060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5808,i,13915342193940676320,12642079204150356562,2097152 --field-trial-handle=1804,i,12462028146625496861,3726485487745930143,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:1
  2⤵
  PID:5448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5612,i,1574173658841080800,8679215344644969361,2097152 --field-trial-handle=1804,i,12462028146625496861,3726485487745930143,262144 --variations-seed-version --mojo-platform-channel-handle=5512 /prefetch:1
  2⤵
  PID:3740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5524,i,2089064389154075114,4328307256730390687,2097152 --field-trial-handle=1804,i,12462028146625496861,3726485487745930143,262144 --variations-seed-version --mojo-platform-channel-handle=5808 /prefetch:1
  2⤵
  PID:2972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6208,i,3885463269754870016,2707623119422198042,2097152 --field-trial-handle=1804,i,12462028146625496861,3726485487745930143,262144 --variations-seed-version --mojo-platform-channel-handle=5612 /prefetch:1
  2⤵
  PID:8
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6344,i,14772208590121774257,3735015091813606986,2097152 --field-trial-handle=1804,i,12462028146625496861,3726485487745930143,262144 --variations-seed-version --mojo-platform-channel-handle=5524 /prefetch:1
  2⤵
  PID:1396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6496,i,5941690403649402060,4078607163976650250,2097152 --field-trial-handle=1804,i,12462028146625496861,3726485487745930143,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:1
  2⤵
  PID:5004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6464,i,3016671946859003148,7893173352390782726,2097152 --field-trial-handle=1804,i,12462028146625496861,3726485487745930143,262144 --variations-seed-version --mojo-platform-channel-handle=5572 /prefetch:1
  2⤵
  PID:4768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=3404,i,11771705462508031945,375687494878036065,524288 --field-trial-handle=1804,i,12462028146625496861,3726485487745930143,262144 --variations-seed-version --mojo-platform-channel-handle=3388 /prefetch:14
  2⤵
  PID:5448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=3456,i,12907581587032700268,7266610463573431574,524288 --field-trial-handle=1804,i,12462028146625496861,3726485487745930143,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:14
  2⤵
  PID:1884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=3496,i,2763844812174605447,9557253666041287575,524288 --field-trial-handle=1804,i,12462028146625496861,3726485487745930143,262144 --variations-seed-version --mojo-platform-channel-handle=5076 /prefetch:14
  2⤵
  PID:3236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=3452,i,9953911666099703401,12972674372206924754,2097152 --field-trial-handle=1804,i,12462028146625496861,3726485487745930143,262144 --variations-seed-version --mojo-platform-channel-handle=3420 /prefetch:1
  2⤵
  PID:5880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=3396,i,4700725861502344228,15293450192368764242,2097152 --field-trial-handle=1804,i,12462028146625496861,3726485487745930143,262144 --variations-seed-version --mojo-platform-channel-handle=4724 /prefetch:9
  2⤵
  PID:3456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6360,i,10536536920796123362,2000013798638605639,524288 --field-trial-handle=1804,i,12462028146625496861,3726485487745930143,262144 --variations-seed-version --mojo-platform-channel-handle=5716 /prefetch:14
  2⤵
  PID:4776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5808,i,8859282211030658743,12904874553568060889,524288 --field-trial-handle=1804,i,12462028146625496861,3726485487745930143,262144 --variations-seed-version --mojo-platform-channel-handle=3268 /prefetch:14
  2⤵
  PID:2316
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5936,i,10153401939491537581,12360383650155104894,524288 --field-trial-handle=1804,i,12462028146625496861,3726485487745930143,262144 --variations-seed-version --mojo-platform-channel-handle=5756 /prefetch:14
  2⤵
  PID:1844
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=5784,i,11360907240752904413,14287502058478412961,2097152 --field-trial-handle=1804,i,12462028146625496861,3726485487745930143,262144 --variations-seed-version --mojo-platform-channel-handle=4732 /prefetch:1
  2⤵
  PID:3236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=3304,i,15925626147102812261,18245284202522409214,262144 --field-trial-handle=1804,i,12462028146625496861,3726485487745930143,262144 --variations-seed-version --mojo-platform-channel-handle=3308 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=5860,i,4981949811104146687,11725217962903360317,2097152 --field-trial-handle=1804,i,12462028146625496861,3726485487745930143,262144 --variations-seed-version --mojo-platform-channel-handle=5796 /prefetch:1
  2⤵
  PID:2576
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --metrics-shmem-handle=6168,i,17506177758875096791,9327582338671621429,2097152 --field-trial-handle=1804,i,12462028146625496861,3726485487745930143,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:1
  2⤵
  PID:3536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=6444,i,14637453636281899782,17731878669170942733,524288 --field-trial-handle=1804,i,12462028146625496861,3726485487745930143,262144 --variations-seed-version --mojo-platform-channel-handle=6876 /prefetch:14
  2⤵
  PID:1636
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=7020,i,6392686818696238687,377738537724091185,524288 --field-trial-handle=1804,i,12462028146625496861,3726485487745930143,262144 --variations-seed-version --mojo-platform-channel-handle=7032 /prefetch:14
  2⤵
  PID:5828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --metrics-shmem-handle=7100,i,11940013436384489479,10440380935152128650,2097152 --field-trial-handle=1804,i,12462028146625496861,3726485487745930143,262144 --variations-seed-version --mojo-platform-channel-handle=7056 /prefetch:1
  2⤵
  PID:4720

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2384

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:916

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:5136

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3300

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 36KB
SHA256 b1b77e96279ead2b460de3de70e2ea4f5ad1b853598a4e27a5caf3f1a32cc4f3
MD5 b30d3becc8731792523d599d949e63f5
SHA1 19350257e42d7aee17fb3bf139a9d3adb330fad4
SHA512 523f54895fb07f62b9a5f72c8b62e83d4d9506bda57b183818615f6eb7286e3b9c5a50409bc5c5164867c3ccdeae88aa395ecca6bc7e36d991552f857510792e
SSDEEP 24:TLiXlzkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf9Mzm+Zs3tGl:TqlmFTIF3XmHjBoGGR+jMz+LhT
TLSH
T178F21D566E241E3CCA9EC336340836C34D78023DACF3B762A58A719747AD181E37D6E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 56KB
SHA256 111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131
MD5 752a1f26b18748311b691c7d8fc20633
SHA1 c1f8e83eebc1cc1e9b88c773338eb09ff82ab862
SHA512 a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5
SSDEEP 192:wedRBvVrThe4p4/KhTB4p4CitZtkZsLRGVDbw6H3ph+v3YQa9:weZdThkKhBvkZsLRGlzh+vS9
TLSH
T1C94379DF2A348110CA0768BABD71771BB655D0BFC1C2F0A87AD68A1780B463CE775687
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 64KB
SHA256 8f738be31097baa2bebfcc983aec03bfa39ac12a03f107fafb30507af399eef9
MD5 6a20dff48af651fb6b43f871d7b90a10
SHA1 9bbbf98689d518bf004840b0dec03d4e6a289439
SHA512 dff7e8c62a003022054638fb8ee97d9562667becd5cfd037ac3cc691037e556776d8d668fe66e0d9c2d1e763a76603775ea16e54ce08d600cdb2c70bd6aa188a
SSDEEP 384:yeddThatELJ8SWvDTuGmQgZsLglKhubvGZsLRZh+vS4:E+eUZsLQCZsL3hUS4
TLSH
T1AA53CBDB26348040CA07A8BBADB5731BB662D0BFC1C6F1E87E858A1780F453D9775687
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000006

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000006
Size 312KB
SHA256 0b6251fd38152a7a7319d54a8e993417dfe359650a9581c135c3950fe5704861
MD5 932d4b5eb7460fda1f102de6f7149790
SHA1 fadbac31c043b89a72bf3abf502f9ee53ccbf86c
SHA512 eaad89143b37482972189a3ff86698a7ae3332c42248d177fc74e0ec6aa9e1756a0699cb77d3b83cd815e2651df267c0cca4e9866d7a59a26d0dbeadb060189d
SSDEEP 6144:Y87U1JYBYrHsCcjPUrsgrwz9Ot6mjoSF7SI/5Czsl/sfz+IeJqJi:REJYqaQ8QN7p5Cz0jqJi
TLSH
T1786423C8B9A7916BD9F3FEECE0C64958B3FE733433C684798421915B87122D882E45D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 168B
SHA256 27005eff8b46c6708341cc83df26d7b0775997ccb5c7069d6be7e03f1f3415b5
MD5 0813e34aec65e09423960bb1849b20dc
SHA1 43a83c29ee28880b9bf42221d249c9b4585fc4ee
SHA512 6b8520ab27669e228fb9eabb83dc1eddc4c1e5590a95ea2d75a1a72e531bb548902037d7a69c58edada100f63e263f3531322e35a95fb249efb1396f9ebfa2c1
TLSH
T1AAC09B5556903C4EF79C11F364EC4D3334B2297A11919A524DA8E66F4553AB15163481
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 144B
SHA256 0b315f07902d7d1bba1cce4172638ddf3ea093f8f6f3077de3ebfad29892e29a
MD5 d19a264141b2207a083a7999ee35f86f
SHA1 f9546aef7acff7d39b634c6fdf0e13ddde065a68
SHA512 17020da336123a32cf85cf77aa6b1d01912d11969f7c2edb6588c61ab4245c15d1392e769838825f78fc1452686127bf46138b3abdf411854f89347493b5adc0
TLSH
T1CAC01265D180144FFB8411F120D5447334F1292135529ED2CCB853AF4AE3BF09477CC0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 1268a77ed3fe1b5b8bce5cb16abb25f067aca326f9a687661c1fcd4a8253706b
MD5 25be5c0c7a22e75bb3a493c8a7494fcc
SHA1 f2eb69fd93f07772808a551ec6891a802f0bc709
SHA512 672772a7dc6e78a7c04192f5b4f2858d7ff5f3d0b3c26823efceca74363cc0da170aafa98494251fce64978f69dd7a2fab3a6a6110d6796fe83335c7cb479fa0
TLSH
T1FD21C64210DE703FFFE12D3A10AC8C3E32710D04E9476F43086588BB606FB992396819
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 10KB
SHA256 addd33a40a294a5b1e0ed2300632ec8251bb1ae0d4ce45a38c1f5999a0a61f37
MD5 4d1b98c0db7c98375dbe9dbd079bd8c7
SHA1 8c3bb66dada423d995ce73c318a4f9abe8f86c8f
SHA512 e302bf67153f3ed218c01b8b97fff8ac60a87f8a74cf8db32a09750a8e5f009635282085eb644eb6d931aea6abd75f186cea3654a7b25f8f5f4d90468fc5619d
SSDEEP 192:Dwfimruy3lUVGaIZ6wZjDFglUgYgOVIpPXwuq10v3Mgsmf1Dfa0J5Un6c:Dwfimruy3lUVGaIZ6wZjDFglUgYgOVIC
TLSH
T16E228CF7C7E8A62D8E2155F4AB256E1ECE1D0A64431C3C6BC8D8AF1B53E1471D210B5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 12KB
SHA256 a78f0440a36f6f3f0d77b8e993d21caddba403404a13b91b77ea3dbdef275d3c
MD5 0fb8e9c3df231b0903a10bae5038275e
SHA1 74771dcfab7211332a7a6fec268496c0e77f7cbc
SHA512 25a330cf7bf066767ccd253da5eb530476860ed0dc662c1ee5da6dc584c05f338a643e2c9a8370a6848a769abd1801ace8b5d5c80471b222a0ed131e62620c8f
SSDEEP 384:Dwfimruy3lUVGi+tj6/IZ6wZjLUgYgOVInX7q10NMgsmwa0J51UuW916QzY3TEg8:dq9L
TLSH
T183429BF7C7E8A62D8E2156F4AB256E1FCD1D0924432C3C6B88D8AF5B53E1471E211B4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 40c0d6525555fe10b5a1d6b743ae6444d84435176ef683167bcd72e8c4b02c8d
MD5 b7707874a0b304829a5369cf24b837b1
SHA1 8ab0c8e29e93b59969e53712613d81c7e83beaa5
SHA512 cb33597e500915c1877f2128b623ac1e2610ed014c098be547bc58e3803658899bba4a1a4564b55857bf35815d6203bb8748c68f196f45923022a9f161a2cb68
TLSH
T18C717CF7C7E4C56D891156F49B217F2FCD290A24422C3C66C8D8AF5B53E2872D21175E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 baf2bd3a1426597d976c19ff1ae44a0bcec6b2ad7a81876fa74dac7d032ec8bd
MD5 4dc32fe34905d64e7aa1c7d9550322fd
SHA1 c2e00eedfdf5db5fd44db6b16d9156663739fc4e
SHA512 5502863ef931f430a84d3d0c630b03e7a2e62d0fa934ecc893225ef60bcbe32b32b62ad07138421146e56c43f4b76f5fe63240ebe2546beeaac961d6f540a642
SSDEEP 192:mRcj7F1v7+TAPRp2/dF9pHsb+WNneG97ey2SX284e5meC582+VyIsnAUge:mRcjBF3XuTwekf2Y284e5OG22e
TLSH
T15B42C82FA9106A7BADCFD219F9657B57E3F9002225942E80E7FC892C24E79CC3217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 5b1a576c1e2999a81302fefc34a838da2ad99770c36791e99da9c1f20ce3b99d
MD5 054e8c4283fa1b5435e4aa8df93fe4d3
SHA1 40a87a40a8ba3fed4a38872c5040f40b9515e508
SHA512 6990c4d5c208e49d1234ae3f900ba876377282ac432ffb66628b56c880aeb4fa398ca85df95173ba67ddeaa4021ee984a2f36553d09f40f87e00456e4d66aa66
SSDEEP 192:mRcj7F1v7+TePRpi/dF9pHsb+WNneG97lCc3X284e5meC5a2+VyIsnAUgE:mRcjBFhXqTwekwcH284e5OQ22E
TLSH
T1C842DB2FA9106A7BADCFD219F9557B57E3F9102225942E84E7FC892C24E7ACC3217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 85a08c88ee663c626ca9566c9e5222a51bda4d61e54d051d666a088c0834b4e3
MD5 d76a6b1d321d97d55d7875da75c73bab
SHA1 146010fc9da7a46b3a320965032bde2f681efcc9
SHA512 81a2563115feeaffc1023d06ed7117dbb78cf184047c9dd4e3af0662d73443afc6c60aa76038c8210658f550a0843f06d519eafb79fff79c5576ace18ff443d1
SSDEEP 192:mR8cBzj7wTv7+TePRpivKglMUb9pHsb+WNXEOF1eG97TIm8X284e5meC5a2+8yI4:mR8mzjcrhXcTw3EkImq284e5OQ25E
TLSH
T14752DB6FA9106A7BADDFD219F9557B57E3F9102221942E80E7FC8A2C14E7ACC3217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 131527a6618cd35c21adebc907e14339e7db8c3044bd200a6286281e93133ddd
MD5 e7fb8b5231d15cddcd3356365d5c86cc
SHA1 5d1d2cb668502d9880e7de35759c6db19bf0d513
SHA512 bbd3156e3c9833c2f9729c15dda7302cce15ef2a69eb9712fbd3e9243e0be836417c32f98fbb8b436e2d63ab91aad71e4b6e1b2a8492b0c74407083a2e89979b
SSDEEP 192:mR8cBzj7w1v7+TePRpivKglMUb9pHsb+WNXyeG97TImRX284e5meC5a2+8yIsnAI:mR8mzjcFhXcTw1kImh284e5OQ25E
TLSH
T1C352DA6FA9102A7BADDFD219F9557B57E3F9102225942E80E7FC8A2C14E7ACC3217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 ea4efd11027bc615835a3c05a5d723eebf6683834f11b8230667e01ea8c6a98e
MD5 c194acc222c2408dc9a8cb330959cf58
SHA1 a6d02c4c143a57e25208f7880666dcbb5865e59b
SHA512 6142da156dd64b21c10f307369ee0b0127f754779927564f9d049a7773143da3b19ac4b6a686007086fb0f713ca30cd266f2881fd2c648c4c1e2a6d801a4cb1c
SSDEEP 192:mR8cBzj7F1v7+TePRpi/nUb9pHsb+WNXyeG97TImRX284e5meC5a2+8yIsnAUgE:mR8mzjBFhX7Tw1kImh284e5OQ25E
TLSH
T11952DA2FA9106A7BADDFD219F9557B57E3F9102221942E80E7FC8A2C14E7ACC3217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 fb377604f2eff03c4677a647c8c94a33496bb6a03f2ca3b617f73d6d02079dca
MD5 c879080c9ba72d4bd02fa06950d0d4da
SHA1 51eeebb8e8d90b5930e9e2aca5c65a6a5e11bd40
SHA512 b3049b1fedf12cf8e69c46588916533fc10ffee805ef2066c1e5abada55bbd8178d890f43ff726bdcb387c44a2df1d11d1ba3d3d6ee4537f088d19751b4a55f8
SSDEEP 192:eLE4K6Xn7KxkXqK4I40pUZNCgVLHrKHfFKslEiTtXzKD/ML+ErUkKNxn50i4S+h:uEjEn7KxkXqKf/pUZNCgVLH2HfgslLth
TLSH
T11532C727A48E9E7F4FD8E51CDC477F4B6CB502567378082896FB9C0403AA78A214A1A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 96B
SHA256 66b3cefa86cd0706a0188bf9d603351513f5dd2a02beeb0052850b3935e40bd0
MD5 b00dde1f989059ed2facd1cf952a7b6e
SHA1 3c2ee1f06cb112b9248c48f4d8afd5995c2cb70a
SHA512 bd5547ac3a1b0184ded8148e47a6d8bf05576f416ce91b18f2129fa5ca20b4566892989ecd9f51cf532ad095ce51e358f191bf7d923703fbf3ac35ea4abc40ab
TLSH
T121B01100B000080BEA8203B880F28A8233203C2002A2A28230A820A882A22028A8B800
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 9ef29e191adb5cb38ddb98ef6110fa2a491a2bf8e35c68cde400e5d39f9edd4f
MD5 1cb6d2c29775ce587eed01c8f64ee8b0
SHA1 00fa2b2d26237cce360174109ef18f8cacefbc28
SHA512 ff7f9af8242c9550c1448002fbca3427aeaffc617940db21655424cac5cdfdb964210e600c7f304b17372acd3d0d5368b8361cefb5f456b27204fb138b438bed
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 55108e6b15a96bde48e5f76b2b6ae2edfb52983606dd18e8cd743e35e9fdcb76
MD5 eb759c4af32e9a7e202aac6b7f324317
SHA1 a4d732548f89ece25ca4999d15971cd624854081
SHA512 e03997e7630ff43026acb594affdc696726772448bded8fb5b060bf90cf32c8b8abea57d88a5f09b22823949566337044805de935889f5ea0aa1b47a01cb362e
TLSH
T161A0026042D40471DE11837070B9056526725C5925714303D4D604488D6B1D48F16500
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 129KB
SHA256 03e9b978d647749995958f916b7d6576d25f1aad63f335bf245171e14ce11ec2
MD5 f3589db3f63892394a8937f3cb16ac48
SHA1 22e82361d64b130a323912f0f00cbed735b48959
SHA512 925cabf80402bb013479aed8e75e9acca180193e4ce295771a5b09d16c66054b1a8d0fced8ed7eccb7384c2c087325215796b469b28b4394a5e7315c27c5afad
SSDEEP 3072:IdloqJIFcQInLb5P8ykbnSM+2eKYlT68mWV8vLngS9P:coqy/WwnA4FFLgeP
TLSH
T11DD31272482D9C573F7E877C0208A91EAE80832F06455D80FD7E3E6C92974E58B6BE71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 128KB
SHA256 2d66d6ec7fb9fa520eb3c33db3555d43fb4817527888a8cd921c70585c5f7cba
MD5 a4c9aed406a8f3471b435e85edefcbaf
SHA1 d0d9fe6bdeca1af91b561e1ba51e82fc2f6897fc
SHA512 bdf47c6cdce3b75d787af80d9b918cf3cad014e99f008b0780d7213fc2447a9e5b43bb78dbe1e6db04b1bfdeea1c2ba6ef88b9cad4fb11ae844419cfaff523ba
SSDEEP 3072:LJqJIFcQInLb5P8ykbnSM+2eKYlT68mWV8vLngS9P:Nqy/WwnA4FFLgeP
TLSH
T108D31272887D98533B7E83B9030C955EAF40422E02465D81EE7E2E7C82975E197BAE31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 129KB
SHA256 bc5bc4a1845ddcbbf811e2bea3cab7c875774d6a7b60bb2778e333146b73cde9
MD5 a74017f762fd6f07452be8028a50b481
SHA1 b49b03c60066c781f3e3160188c844005c911496
SHA512 394d535774dc93ce659d0c361a1b6b46cb6cbf437072f26b7f7dcf0f2e416460385a68b9223da9e44b596e0bae61f0b7c151ba7b203ccd0f9b04991fe4d3889f
SSDEEP 3072:MLloqJIFcQInLb5P8ykbnSM+2eKYlT68mWV8vLngS9P:yoqy/WwnA4FFLgeP
TLSH
T113D31272482D9C573F7E877C0208A91E6E80832F06455D81FD7D3E6C82974E58B6BE61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 128KB
SHA256 d1e7d01bd4dd71916d50475bb488dc78b045ab9827870d51e1a8752c897ae4df
MD5 e69d3a1733de2ffe86730c1c07e86a8c
SHA1 811903122097fa59273aa836f2e0db85bbd907b5
SHA512 8713f2e4f42f5a54900b8436145ceae6db87d21357bc1b16a28f3f85d46f2b4e1437f9cf32dd463bd5e917027b35c1a4f9084877d4a11fba6c39036d337861fd
SSDEEP 3072:IJqJIFcQInLb5P8ykbnSM+2eKYlT68mWV8vLngS9P:2qy/WwnA4FFLgeP
TLSH
T199D31272887D98533B7E83B90308955EBE40422E02465D81EE7E2E7C82975E197BAF31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 688d8e7790c897871e155de0b36db6fef804fa0a5d5aaca5580f55719f6943e9
MD5 32fe275167d65535d6b9486eb96ae8c8
SHA1 0270b1c39ec81ac614839a3228de3588acdf2175
SHA512 4d9bb36458b2cc66318e0be08680faef0c413a9d55fc25856614c6eb710dc944aceef1f8ef5f8934769bfbba6017429e2d5d899b2fb0346171a131a8a372b2c2
SSDEEP 96:mC0d+Ar2aetJRxW2rgj0+f+U+/EfezeRDotok5eVDVZB6JGyvTNm6zjd+PEhiv4a:mC0Nr7OJRPrL9/EtDUDIV/9Imgjd+shM
TLSH
T11BA12932647E5CF799B38545F1563B03CFA8717B5A21BF4099ED1B0C20A70DC1382A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 129KB
SHA256 5d8e57194f3498791f15da6a6c87cbeb019544dc17cd6fe6d45c01a877788538
MD5 7ec82d78f6c7e3cf4aaa49d1c3f84b61
SHA1 7f7249b8248eb5462f10cba9be90f537ce71e36b
SHA512 e9f4501980c6613cb2c9c284ec2093c81a6d1c7d26debbf99b41fd7a84b5709cf7e2df6ce86372117deb218f9af3d28a300fcfd9cd123fcb9f1db8cd5c8b217f
SSDEEP 3072:IYloqJIFcQInLb5P8ykbnSM+2eKYlT68mWV8vLngS9P:Zoqy/WwnA4FFLgeP
TLSH
T17DD31272482D9C573F7E877C0208A91EAE80832F06455D80FD7E3E6C92974F58B6BE61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5964_2009213205\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

default.exc

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.exc
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

memory/3452-560-0x000000000ED70000-0x000000000F462000-memory.dmp

Download