881fc31ab407d9615a84cd967ba7d61958958996f804605a11c1c501303b7a8d

Analysis

user interaction
yes
max time kernel
271s
max time network
270s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/08/2026, 13:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
App Launcher.exe
Size 2.5MB
Sample260825-raqqpsap9w
SHA256 881fc31ab407d9615a84cd967ba7d61958958996f804605a11c1c501303b7a8d
MD5 b0aff322a43c49c3c23ece17cc66eb06
SHA1 1a2c1733fe05eaec36d3508432b21ce22042459a
SHA512 4df1cbb9231830a2c73f1bf7eacc9d9436d867aa41e97c6e36774fc6989c045dee19246fb1025f8819c2402d66f224763156052f3f3cd232abc19d997c06559d
SSDEEP 49152:adEMhOqvCgJp8ehSJ6kGLvHDZkBfUfz1Zbflqj+jzbPU1aHm5R9Tj0a3gu2U:5MOimSZ1Zbflqj+jzb5Hm50pU
TLSH
T15EC5AF5B967801FCD077D1B8CA62D607E7B2B05903306ADB03D08ABA2F576E15E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

adware discovery execution spyware

Malware Config

Signatures

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4660_1102150492\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4660_1102150492\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4660_1102150492\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4660_1102150492\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4660_1102150492\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4660_1102150492\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4660_1102150492\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4660_1102150492\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4660_1102150492\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4660_1102150492\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4660_1102150492\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4660_1102150492\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4660_1102150492\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4660_1102150492\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4660_1102150492\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4660_1102150492\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4660_1102150492\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4660_1102150492\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4660_1102150492\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4660_1102150492\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4660_1102150492\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4660_1102150492\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4660_1102150492\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4660_1102150492\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4660_1102150492\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4660_1102150492\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4660_1102150492\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4660_1102150492\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4660_1102150492\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4660_1102150492\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4660_1189035703\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4660_1102150492\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_4660_990056803\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_109_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4660_1102150492\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4660_1102150492\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4660_1102150492\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4660_1102150492\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4660_1102150492\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4660_1102150492\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4660_1102150492\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4660_1102150492\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4660_1102150492\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4660_1102150492\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4660_1102150492\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4660_1102150492\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4660_1102150492\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4660_1102150492\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4660_1102150492\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4660_1102150492\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4660_1102150492\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4660_1102150492\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4660_1102150492\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4660_1102150492\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4660_1102150492\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4660_1102150492\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4660_1102150492\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4660_1102150492\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4660_1102150492\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4660_1102150492\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4660_1102150492\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4660_1102150492\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4660_1102150492\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4660_1102150492\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4660_1102150492\_locales\el\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5184	cmd.exe
4208	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5352	chrome.exe
3908	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Modifies data under HKEY_USERS 14 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134321400828619079"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1738198120-2966725515-3980530802-1000\{5C495EDE-45E9-46B4-AAF0-A751D12C25A0}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings	OpenWith.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 27 IoCs

pid	Process
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe
4660	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5684	chrome.exe
Token: SeCreatePagefilePrivilege	5684	chrome.exe
Token: SeShutdownPrivilege	5684	chrome.exe
Token: SeCreatePagefilePrivilege	5684	chrome.exe
Token: SeShutdownPrivilege	5684	chrome.exe
Token: SeCreatePagefilePrivilege	5684	chrome.exe
Token: SeShutdownPrivilege	5684	chrome.exe
Token: SeCreatePagefilePrivilege	5684	chrome.exe
Token: SeShutdownPrivilege	5684	chrome.exe
Token: SeCreatePagefilePrivilege	5684	chrome.exe
Token: SeShutdownPrivilege	5684	chrome.exe
Token: SeCreatePagefilePrivilege	5684	chrome.exe
Token: SeShutdownPrivilege	5684	chrome.exe
Token: SeCreatePagefilePrivilege	5684	chrome.exe
Token: SeShutdownPrivilege	5684	chrome.exe
Token: SeCreatePagefilePrivilege	5684	chrome.exe
Token: SeShutdownPrivilege	5684	chrome.exe
Token: SeCreatePagefilePrivilege	5684	chrome.exe
Token: SeShutdownPrivilege	5684	chrome.exe
Token: SeCreatePagefilePrivilege	5684	chrome.exe
Token: SeShutdownPrivilege	5684	chrome.exe
Token: SeCreatePagefilePrivilege	5684	chrome.exe
Token: SeShutdownPrivilege	5684	chrome.exe
Token: SeCreatePagefilePrivilege	5684	chrome.exe
Token: SeShutdownPrivilege	5684	chrome.exe
Token: SeCreatePagefilePrivilege	5684	chrome.exe
Token: SeShutdownPrivilege	5684	chrome.exe
Token: SeCreatePagefilePrivilege	5684	chrome.exe
Token: SeShutdownPrivilege	5684	chrome.exe
Token: SeCreatePagefilePrivilege	5684	chrome.exe
Token: SeShutdownPrivilege	5684	chrome.exe
Token: SeCreatePagefilePrivilege	5684	chrome.exe
Token: SeShutdownPrivilege	5684	chrome.exe
Token: SeCreatePagefilePrivilege	5684	chrome.exe
Token: SeShutdownPrivilege	5684	chrome.exe
Token: SeCreatePagefilePrivilege	5684	chrome.exe
Token: SeShutdownPrivilege	5684	chrome.exe
Token: SeCreatePagefilePrivilege	5684	chrome.exe
Token: SeShutdownPrivilege	5684	chrome.exe
Token: SeCreatePagefilePrivilege	5684	chrome.exe
Token: SeShutdownPrivilege	5684	chrome.exe
Token: SeCreatePagefilePrivilege	5684	chrome.exe
Token: SeShutdownPrivilege	5684	chrome.exe
Token: SeCreatePagefilePrivilege	5684	chrome.exe
Token: SeShutdownPrivilege	5684	chrome.exe
Token: SeCreatePagefilePrivilege	5684	chrome.exe
Token: SeShutdownPrivilege	5684	chrome.exe
Token: SeCreatePagefilePrivilege	5684	chrome.exe
Token: SeShutdownPrivilege	5684	chrome.exe
Token: SeCreatePagefilePrivilege	5684	chrome.exe
Token: SeShutdownPrivilege	5684	chrome.exe
Token: SeCreatePagefilePrivilege	5684	chrome.exe
Token: SeShutdownPrivilege	5684	chrome.exe
Token: SeCreatePagefilePrivilege	5684	chrome.exe
Token: SeShutdownPrivilege	5684	chrome.exe
Token: SeCreatePagefilePrivilege	5684	chrome.exe
Token: SeShutdownPrivilege	5684	chrome.exe
Token: SeCreatePagefilePrivilege	5684	chrome.exe
Token: SeShutdownPrivilege	5684	chrome.exe
Token: SeCreatePagefilePrivilege	5684	chrome.exe
Token: SeShutdownPrivilege	5684	chrome.exe
Token: SeCreatePagefilePrivilege	5684	chrome.exe
Token: SeShutdownPrivilege	5684	chrome.exe
Token: SeCreatePagefilePrivilege	5684	chrome.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
4660	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe
5684	chrome.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3488	OpenWith.exe
4824	AcroRd32.exe
4824	AcroRd32.exe
4824	AcroRd32.exe
4824	AcroRd32.exe
1120	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5684 wrote to memory of 3684	5684	chrome.exe	93
PID 5684 wrote to memory of 5352	5684	chrome.exe	94
PID 5684 wrote to memory of 4792	5684	chrome.exe	95
PID 5684 wrote to memory of 4792	5684	chrome.exe	95
PID 5684 wrote to memory of 5520	5684	chrome.exe	97
PID 5684 wrote to memory of 5520	5684	chrome.exe	97
PID 5684 wrote to memory of 5652	5684	chrome.exe	99
PID 5684 wrote to memory of 5700	5684	chrome.exe	98
PID 5684 wrote to memory of 5652	5684	chrome.exe	99
PID 5684 wrote to memory of 5700	5684	chrome.exe	98
PID 5684 wrote to memory of 2572	5684	chrome.exe	100
PID 5684 wrote to memory of 2572	5684	chrome.exe	100
PID 5684 wrote to memory of 5772	5684	chrome.exe	101
PID 5684 wrote to memory of 5772	5684	chrome.exe	101
PID 5684 wrote to memory of 5300	5684	chrome.exe	102
PID 5684 wrote to memory of 5300	5684	chrome.exe	102
PID 5684 wrote to memory of 3672	5684	chrome.exe	103
PID 5684 wrote to memory of 2396	5684	chrome.exe	104
PID 5684 wrote to memory of 2396	5684	chrome.exe	104
PID 5684 wrote to memory of 4284	5684	chrome.exe	105
PID 5684 wrote to memory of 4284	5684	chrome.exe	105
PID 5684 wrote to memory of 5900	5684	chrome.exe	107
PID 5684 wrote to memory of 5900	5684	chrome.exe	107
PID 5684 wrote to memory of 3356	5684	chrome.exe	108
PID 5684 wrote to memory of 3356	5684	chrome.exe	108
PID 5684 wrote to memory of 3760	5684	chrome.exe	109
PID 5684 wrote to memory of 3760	5684	chrome.exe	109
PID 5684 wrote to memory of 4092	5684	chrome.exe	110
PID 5684 wrote to memory of 4092	5684	chrome.exe	110
PID 5684 wrote to memory of 3840	5684	chrome.exe	111
PID 5684 wrote to memory of 3840	5684	chrome.exe	111
PID 5684 wrote to memory of 4740	5684	chrome.exe	112
PID 5684 wrote to memory of 4740	5684	chrome.exe	112
PID 5684 wrote to memory of 4732	5684	chrome.exe	113
PID 5684 wrote to memory of 4732	5684	chrome.exe	113
PID 5684 wrote to memory of 5596	5684	chrome.exe	116
PID 5684 wrote to memory of 5596	5684	chrome.exe	116
PID 5684 wrote to memory of 5980	5684	chrome.exe	117
PID 5684 wrote to memory of 5980	5684	chrome.exe	117
PID 5684 wrote to memory of 2116	5684	chrome.exe	119
PID 5684 wrote to memory of 4864	5684	chrome.exe	118
PID 5684 wrote to memory of 2116	5684	chrome.exe	119
PID 5684 wrote to memory of 4864	5684	chrome.exe	118
PID 5684 wrote to memory of 5716	5684	chrome.exe	120
PID 5684 wrote to memory of 5716	5684	chrome.exe	120
PID 5684 wrote to memory of 4924	5684	chrome.exe	121
PID 5684 wrote to memory of 4940	5684	chrome.exe	122
PID 5684 wrote to memory of 1472	5684	chrome.exe	123
PID 5684 wrote to memory of 5992	5684	chrome.exe	124
PID 5684 wrote to memory of 5992	5684	chrome.exe	124
PID 5684 wrote to memory of 5700	5684	chrome.exe	125
PID 5684 wrote to memory of 5700	5684	chrome.exe	125
PID 5684 wrote to memory of 5868	5684	chrome.exe	126
PID 5684 wrote to memory of 5868	5684	chrome.exe	126
PID 5684 wrote to memory of 3260	5684	chrome.exe	127
PID 5684 wrote to memory of 3260	5684	chrome.exe	127
PID 4660 wrote to memory of 4120	4660	msedge.exe	129
PID 4660 wrote to memory of 2288	4660	msedge.exe	130
PID 4660 wrote to memory of 3908	4660	msedge.exe	131
PID 4660 wrote to memory of 2288	4660	msedge.exe	130
PID 4660 wrote to memory of 2288	4660	msedge.exe	130
PID 4660 wrote to memory of 4540	4660	msedge.exe	132
PID 4660 wrote to memory of 4540	4660	msedge.exe	132
PID 4660 wrote to memory of 4664	4660	msedge.exe	134

C:\Users\Admin\AppData\Local\Temp\App Launcher.exe
"C:\Users\Admin\AppData\Local\Temp\App Launcher.exe"
1⤵
PID:2824

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ff80c3cc728,0x7ff80c3cc734,0x7ff80c3cc740
  2⤵
  PID:3684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1480,i,6240216106779873304,12254593533417913144,524288 --field-trial-handle=2092,i,4029451636597910354,9094479282535510535,262144 --variations-seed-version --mojo-platform-channel-handle=2156 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5352
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1620,i,6231150819154236926,5481030708987881765,262144 --field-trial-handle=2092,i,4029451636597910354,9094479282535510535,262144 --variations-seed-version --mojo-platform-channel-handle=2088 /prefetch:2
  2⤵
  PID:4792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2316,i,4755390548237368613,4071501790580868802,524288 --field-trial-handle=2092,i,4029451636597910354,9094479282535510535,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:13
  2⤵
  PID:5520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3280,i,10621265614186430391,1036868978795644061,2097152 --field-trial-handle=2092,i,4029451636597910354,9094479282535510535,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:5700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3368,i,3950984312973802098,10120576517753085741,2097152 --field-trial-handle=2092,i,4029451636597910354,9094479282535510535,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:5652
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4732,i,13003245945082971667,16105904645271309971,2097152 --field-trial-handle=2092,i,4029451636597910354,9094479282535510535,262144 --variations-seed-version --mojo-platform-channel-handle=4748 /prefetch:1
  2⤵
  PID:2572
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4904,i,13062022456918306279,1495312600575241687,524288 --field-trial-handle=2092,i,4029451636597910354,9094479282535510535,262144 --variations-seed-version --mojo-platform-channel-handle=4916 /prefetch:14
  2⤵
  PID:5772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4924,i,10609359271296090089,18336988058935138869,2097152 --field-trial-handle=2092,i,4029451636597910354,9094479282535510535,262144 --variations-seed-version --mojo-platform-channel-handle=4968 /prefetch:1
  2⤵
  PID:5300
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6140,i,2130995903896709553,4340750932498031605,524288 --field-trial-handle=2092,i,4029451636597910354,9094479282535510535,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:14
  2⤵
  PID:3672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=6204,i,15557472738860538875,17050867954496328055,2097152 --field-trial-handle=2092,i,4029451636597910354,9094479282535510535,262144 --variations-seed-version --mojo-platform-channel-handle=6248 /prefetch:1
  2⤵
  PID:2396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=6276,i,3430375699990408844,8357208511714010098,2097152 --field-trial-handle=2092,i,4029451636597910354,9094479282535510535,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:1
  2⤵
  PID:4284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=6616,i,1487033398656004806,8103067687248326470,2097152 --field-trial-handle=2092,i,4029451636597910354,9094479282535510535,262144 --variations-seed-version --mojo-platform-channel-handle=6204 /prefetch:1
  2⤵
  PID:5900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6656,i,11165139462869903419,15077660620107097701,2097152 --field-trial-handle=2092,i,4029451636597910354,9094479282535510535,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:1
  2⤵
  PID:3356
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6700,i,13421970419827328838,9223100495279585228,2097152 --field-trial-handle=2092,i,4029451636597910354,9094479282535510535,262144 --variations-seed-version --mojo-platform-channel-handle=6616 /prefetch:1
  2⤵
  PID:3760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6580,i,3198898879216178595,2753822540692785207,2097152 --field-trial-handle=2092,i,4029451636597910354,9094479282535510535,262144 --variations-seed-version --mojo-platform-channel-handle=6656 /prefetch:1
  2⤵
  PID:4092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=7064,i,4755360285121642198,15841483000766611846,2097152 --field-trial-handle=2092,i,4029451636597910354,9094479282535510535,262144 --variations-seed-version --mojo-platform-channel-handle=6700 /prefetch:1
  2⤵
  PID:3840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=7188,i,7986398323819558402,5666636137310585916,2097152 --field-trial-handle=2092,i,4029451636597910354,9094479282535510535,262144 --variations-seed-version --mojo-platform-channel-handle=7204 /prefetch:1
  2⤵
  PID:4740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=7224,i,9936129659336588858,11391990006464805101,524288 --field-trial-handle=2092,i,4029451636597910354,9094479282535510535,262144 --variations-seed-version --mojo-platform-channel-handle=7344 /prefetch:14
  2⤵
  PID:4732
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5156,i,4584873987556929418,5157998396838944134,524288 --field-trial-handle=2092,i,4029451636597910354,9094479282535510535,262144 --variations-seed-version --mojo-platform-channel-handle=6944 /prefetch:14
  2⤵
  PID:5596
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6236,i,757172179610163632,5020807572018353144,524288 --field-trial-handle=2092,i,4029451636597910354,9094479282535510535,262144 --variations-seed-version --mojo-platform-channel-handle=6244 /prefetch:14
  2⤵
  PID:5980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=7484,i,5758261593743750262,2352585169093355317,2097152 --field-trial-handle=2092,i,4029451636597910354,9094479282535510535,262144 --variations-seed-version --mojo-platform-channel-handle=7176 /prefetch:1
  2⤵
  PID:4864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=7180,i,11619068181109786823,7316050840674071875,2097152 --field-trial-handle=2092,i,4029451636597910354,9094479282535510535,262144 --variations-seed-version --mojo-platform-channel-handle=7148 /prefetch:9
  2⤵
  PID:2116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=4684,i,1264869278535156610,11452171939401523462,2097152 --field-trial-handle=2092,i,4029451636597910354,9094479282535510535,262144 --variations-seed-version --mojo-platform-channel-handle=4888 /prefetch:1
  2⤵
  PID:5716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=7564,i,2137399407945583455,11872900367926640926,524288 --field-trial-handle=2092,i,4029451636597910354,9094479282535510535,262144 --variations-seed-version --mojo-platform-channel-handle=5008 /prefetch:14
  2⤵
  PID:4924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4972,i,3122237435195809392,14380610762829665203,524288 --field-trial-handle=2092,i,4029451636597910354,9094479282535510535,262144 --variations-seed-version --mojo-platform-channel-handle=7576 /prefetch:14
  2⤵
  PID:4940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4956,i,5081724932835988359,13123709586886879629,524288 --field-trial-handle=2092,i,4029451636597910354,9094479282535510535,262144 --variations-seed-version --mojo-platform-channel-handle=6400 /prefetch:14
  2⤵
  PID:1472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=7588,i,16716084750012938672,15585124456327012911,2097152 --field-trial-handle=2092,i,4029451636597910354,9094479282535510535,262144 --variations-seed-version --mojo-platform-channel-handle=7328 /prefetch:1
  2⤵
  PID:5992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=6316,i,12867035282998758039,17365664112047411567,2097152 --field-trial-handle=2092,i,4029451636597910354,9094479282535510535,262144 --variations-seed-version --mojo-platform-channel-handle=7436 /prefetch:1
  2⤵
  PID:5700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --metrics-shmem-handle=6288,i,4639692913081520830,11801528315519624263,2097152 --field-trial-handle=2092,i,4029451636597910354,9094479282535510535,262144 --variations-seed-version --mojo-platform-channel-handle=6244 /prefetch:1
  2⤵
  PID:5868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --metrics-shmem-handle=7124,i,5361286514924382648,2681174167994743116,2097152 --field-trial-handle=2092,i,4029451636597910354,9094479282535510535,262144 --variations-seed-version --mojo-platform-channel-handle=7440 /prefetch:1
  2⤵
  PID:3260

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4504

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5280

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:4512

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2c8,0x304,0x7ff81261c188,0x7ff81261c194,0x7ff81261c1a0
  2⤵
  PID:4120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1972,i,1293537009304181372,7864133777713666000,262144 --field-trial-handle=2404,i,1323423746946390043,4714804006742866321,262144 --variations-seed-version --mojo-platform-channel-handle=2400 /prefetch:2
  2⤵
  PID:2288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2128,i,8861160938284378333,6731711709265868468,524288 --field-trial-handle=2404,i,1323423746946390043,4714804006742866321,262144 --variations-seed-version --mojo-platform-channel-handle=2440 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2676,i,11008576248157909651,1998428168132670783,524288 --field-trial-handle=2404,i,1323423746946390043,4714804006742866321,262144 --variations-seed-version --mojo-platform-channel-handle=3204 /prefetch:13
  2⤵
  PID:4540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3552,i,13646293354775766114,12427499853252836280,2097152 --field-trial-handle=2404,i,1323423746946390043,4714804006742866321,262144 --variations-seed-version --mojo-platform-channel-handle=3828 /prefetch:1
  2⤵
  PID:4664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3588,i,6727852865772319373,825739883676761510,2097152 --field-trial-handle=2404,i,1323423746946390043,4714804006742866321,262144 --variations-seed-version --mojo-platform-channel-handle=3832 /prefetch:1
  2⤵
  PID:4492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4136,i,13395387688089048748,12497934549490314322,2097152 --field-trial-handle=2404,i,1323423746946390043,4714804006742866321,262144 --variations-seed-version --mojo-platform-channel-handle=4644 /prefetch:1
  2⤵
  PID:1192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4144,i,563633951513297256,10438234966255594727,2097152 --field-trial-handle=2404,i,1323423746946390043,4714804006742866321,262144 --variations-seed-version --mojo-platform-channel-handle=4660 /prefetch:9
  2⤵
  PID:3108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5196,i,6375543561709784375,6086470751854716794,524288 --field-trial-handle=2404,i,1323423746946390043,4714804006742866321,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:14
  2⤵
  PID:1876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5460,i,12290889625295429252,8918542489449881833,524288 --field-trial-handle=2404,i,1323423746946390043,4714804006742866321,262144 --variations-seed-version --mojo-platform-channel-handle=5300 /prefetch:14
  2⤵
  PID:1156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5464,i,6213267172927762099,8415058571740530816,524288 --field-trial-handle=2404,i,1323423746946390043,4714804006742866321,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:14
  2⤵
  PID:788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6180,i,5606830797391495747,18348507540509073269,524288 --field-trial-handle=2404,i,1323423746946390043,4714804006742866321,262144 --variations-seed-version --mojo-platform-channel-handle=6188 /prefetch:14
  2⤵
  PID:4952
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6348,i,7970361644893043623,6966436718651086541,524288 --field-trial-handle=2404,i,1323423746946390043,4714804006742866321,262144 --variations-seed-version --mojo-platform-channel-handle=6364 /prefetch:14
  2⤵
  PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6348,i,7970361644893043623,6966436718651086541,524288 --field-trial-handle=2404,i,1323423746946390043,4714804006742866321,262144 --variations-seed-version --mojo-platform-channel-handle=6364 /prefetch:14
  2⤵
  PID:3504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6448,i,4242147109521715184,866919874689970469,2097152 --field-trial-handle=2404,i,1323423746946390043,4714804006742866321,262144 --variations-seed-version --mojo-platform-channel-handle=6556 /prefetch:1
  2⤵
  PID:1652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6592,i,13587943871288933222,12527394855954616289,2097152 --field-trial-handle=2404,i,1323423746946390043,4714804006742866321,262144 --variations-seed-version --mojo-platform-channel-handle=6564 /prefetch:1
  2⤵
  PID:5040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7012,i,6477005438313112248,13057406067983459482,524288 --field-trial-handle=2404,i,1323423746946390043,4714804006742866321,262144 --variations-seed-version --mojo-platform-channel-handle=6832 /prefetch:14
  2⤵
  PID:768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6792,i,15087490628597496867,3003549991832482537,524288 --field-trial-handle=2404,i,1323423746946390043,4714804006742866321,262144 --variations-seed-version --mojo-platform-channel-handle=6848 /prefetch:14
  2⤵
  PID:3556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7048,i,16878756446450965860,11330643300823026128,524288 --field-trial-handle=2404,i,1323423746946390043,4714804006742866321,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:14
  2⤵
  PID:2360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=4272,i,12883538231759771445,13146103369799031263,2097152 --field-trial-handle=2404,i,1323423746946390043,4714804006742866321,262144 --variations-seed-version --mojo-platform-channel-handle=4808 /prefetch:1
  2⤵
  PID:3848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1272,i,11435532512580074537,14978103316434541786,524288 --field-trial-handle=2404,i,1323423746946390043,4714804006742866321,262144 --variations-seed-version --mojo-platform-channel-handle=1404 /prefetch:14
  2⤵
  PID:4652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1276,i,307341507242223091,4687983341455840059,524288 --field-trial-handle=2404,i,1323423746946390043,4714804006742866321,262144 --variations-seed-version --mojo-platform-channel-handle=1412 /prefetch:14
  2⤵
  PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1280,i,1373166009841907722,2308898757785418418,524288 --field-trial-handle=2404,i,1323423746946390043,4714804006742866321,262144 --variations-seed-version --mojo-platform-channel-handle=6772 /prefetch:14
  2⤵
  PID:752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5716,i,12097880640940250314,16211679979551806653,524288 --field-trial-handle=2404,i,1323423746946390043,4714804006742866321,262144 --variations-seed-version --mojo-platform-channel-handle=5704 /prefetch:14
  2⤵
  PID:2588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6500,i,4560714001721457243,4102939834426364889,524288 --field-trial-handle=2404,i,1323423746946390043,4714804006742866321,262144 --variations-seed-version --mojo-platform-channel-handle=6768 /prefetch:14
  2⤵
  PID:3996

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1664

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1348

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5700

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5460

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\OpenSync.bat" "
1⤵
- Executes a command shell one-liner
PID:5184

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004F8 0x00000000000004F0
1⤵
PID:4748

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\OpenSync.bat" "
1⤵
- Executes a command shell one-liner
PID:4208

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3488
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\Downloads\ExitRestart.dxf"
  2⤵
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:4824
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4612
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=26DF98475E58E4EB1EB5DCC8D1E12C96 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=26DF98475E58E4EB1EB5DCC8D1E12C96 --renderer-client-id=2 --mojo-platform-channel-handle=1776 --allow-no-sandbox-job /prefetch:1
      4⤵
      System Location Discovery: System Language Discovery
      PID:2148
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=203C5A47296E87E5A0FB0B1639C92CBA --mojo-platform-channel-handle=1784 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      PID:5316
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=9A40A1E7316AA1D048DDE2CB870B655A --mojo-platform-channel-handle=2460 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      PID:924
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=905D03BD67BC0E9E26DBC09E92B518B0 --mojo-platform-channel-handle=2092 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      PID:4696
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=27FE89E78DC96F889AE83705AA2F464D --mojo-platform-channel-handle=2096 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      PID:1412

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa39b3055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:1120

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k CameraMonitor
1⤵
PID:1600

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1a243add-d71e-4922-9cac-7ee537fb543b.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\1a243add-d71e-4922-9cac-7ee537fb543b.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 46d800070eba160d2222e0fc47ee6ea4ac6fec6757ae0667b8bd31d8427bf35e
MD5 877c044e361fd063d0e254fabf4be132
SHA1 1fc84353df833352fbf6b7336fc623a9383f9f8c
SHA512 bad24c5b47ccd03a6be25c44c3cc058177c5a97a5fbda49a36d8b36c6266faf0b461f4c13d7e02ad1502d7f1aa7770488224b818f7b09ed5c50f275b08c90eb0
TLSH
T17A518CF7D3E4867D841156E49B216E2FCE2D0A25121C3C62C8E4AF5B53E2872D21138E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 2873b68c86348d1234b5c6ba998376cf93e07f66dd59738c46878509e45832bb
MD5 27eca8e385c3445aec8ab5a79727930a
SHA1 6bd759d23fb493266e60534f93cb62b82c1381f8
SHA512 100b5b6ced895f64ffa3d7d49c2168c2f7e8770dbc96916b150dfeaa89a85a8e37c20d841312fec1faaf426deafb8100d710699cb0dce1079fcb5da245a37f5e
TLSH
T1C0518CF7D3E49A7D841156E89B216E2FCE2D0A25121C3C62C8E4AF5B53E2972D21138E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 523B
SHA256 17e219fd60ce6e7ca6a58b9f357fe774d0bb011ac9f33f1f43ce9cc7b5df56ea
MD5 bc132c1f8b0d50644aa156855d0ba3de
SHA1 3a335ab68421779b63c6cc3bc266fb4c4d1047e0
SHA512 c6fdcdf0c4a6165b7f662893028a8dd9e9bb2fbcc3b39ec260c1eec046b3c5f8272c2bbaa22e1dc2fe77523f914ce02f188cf94a5e8555bf7c6bc0b4387ea488
TLSH
T1BEF0C0A3A6B9B813207941BE1D00B8065AB1E4350651DDF9CE97422CD1820E70B01453
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 a644895113cb2fafdbfe3117300f393918880b40fa60e84c6929eaaeb56c9f92
MD5 7fa37e3bba42e9902b7d953304272924
SHA1 930eeefb2b2fdd8b800febc7316da64e22c2c61d
SHA512 efe2a73050011d2a865f1d7534140d81f6801765a7d7a1eb62ff22cf122ffab32c0ba7dd6cb98b56c4bea367738b8963dbb0486145de4935b66ea7c6df0add7a
SSDEEP 192:4RKBa+1v7pAPRp2o9XxHsb+WNn8r0+U9gdHkw3yI4WVyIsnAUge:4RKBtFAXjfwA0P9aHCoe
TLSH
T15D42A52EBE14693B6CCBD62AFA517753D7F6102221D52E84E6F8893C15D75CD222700B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 dbfffa8f90dbc1c492fbeaa68d72605deeee79557231d98dd78fcb1d3a595da3
MD5 5b03c621e81ac5db6ebad332b58df279
SHA1 beb2f27f3a164dec7976ea727765c0b6fa64eced
SHA512 8d2a413104a7f40eec61f7fece56fab5484777ba7a2aeb1f777084b67cfad3792f24e8d4cce72cc872ebb1799a76d5d1a90c4ce5f3b31a888e5c120c2b3ceae6
SSDEEP 192:4RA0BaGJdv7pLPRpHAG9XxHsb+WNn8r4432VU9gdHkw3yI4CVyIsnAUgE:4RA0BpdhXjfwAX2C9aHCoE
TLSH
T1A142C62ABD14693B6CCBD62AFA557B53D7F6102221D12E84E7FC8A3C15E75CD222700B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 e21ce2edcada04b62f42e299135707187308e0a3ff0ab687f1ea6686ce25030c
MD5 6fa599ec9ba22628e831a6add2ab355c
SHA1 44ad9fe4c3e9b5478b346c6ff5635250137792d9
SHA512 8d5fee8981f5515ef46ad4bd117a375e4953506de97831c26523513c46788310ed93335c31868074bc46a95d15f96722c9f36b796830882c5bafdf23c62e7b33
SSDEEP 192:4RRBa+1v7pAPRp2AG9XxHsb+WNn8r4kz2mU9gdHkw3yI4WVyIsnAUge:4RRBtFAXyfwAX239aHCoe
TLSH
T1C442B52ABE14693B6CCBC62AFA617753D7F6102221D52E84EBFC893C11D75CD222700B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 7fb0dee267f0644468428ab0af28fe04029ed50b570023ba45fe1974119a6348
MD5 3fe3badb705dfb5755e881e306fc7bc8
SHA1 b2f86622ebed096a696800bff69f510d67176f1f
SHA512 824d49e4d69183880c12cbe6130fe7d95e267eeb126b54d1ecfd2e8c4cec06333ded5de373fbd940707e18d4b276d0ac89f350a48eeafdc4cb53d513276c68c3
SSDEEP 192:4RA0BaGJ3v7pLPRpHAs9XxHsb+WNn8rkYvOdzoWU9gdHkw3yI4DPyIsnAUgx:4RA0BpfhXhfwA7Ion9aHCBx
TLSH
T1BB52C72ABD14693BACCBD61AFA557B53D7F6202221D12E84E7FC8A3C15D75CD2227007
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 85802161da87db630af99c039556ae9b08485d0e03007ab3551004868dc5b457
MD5 1e8fdc29613f2bcb79ab33a1936bca67
SHA1 5cd39e395b9ffc02e3aaaa029b3dc91d08410947
SHA512 287283c137a8d072e95d26b9b6fdef87cce3b41a014ae9e589fc28cac9d49b191ecec016aadf88422000c8c36fcc2cec59f4b4e9af6094bbd0a2c157e50adf2d
SSDEEP 192:4RA0BaGJ1v7pAPRp2AG9XxHsb+WNn8r4432dU9gdHkw3yI4MVyIsnAUgE:4RA0BpFAXyfwAX2q9aHCuE
TLSH
T1B242B52ABE14693B6DCBD62AFA517753D7F6102221D12E84EBFC8A3C11D75CD222700B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 ad06f2d2e1de0b23d2e407fa32b40a051faa70b67f744a29e416005611403202
MD5 f16b2e478f53e4a88d753f58fea12d0c
SHA1 3b8e7642f34e6d063b2e9748c219b1d2eeee4de9
SHA512 f7d754db33968934f05050be2a954d778987bbe4daab616cdbd27630b15c924cf0f41cae0063ce7ea53d32415eb62ae63b6fe189ffd322661603e4b95d84fc47
SSDEEP 192:e294K6vX7KxkXqK4I40pUZNCgVLHrKHfFKslEClTXzKD/cb+ErUkKN9x6jBTK8ie:/9j0X7KxkXqKf/pUZNCgVLH2HfgslNTf
TLSH
T1DB32D727A48D9A3F4FD8D519DC036F8B6DF5029672780D24A7FF5D0403A978E214A2EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 513904aacf6efaccd8d740b48c48b8cfbb894ce5fa5252ca576d9e1e90407624
MD5 c5a465c937643ea4e29a1e4d97277727
SHA1 b5ac25e0daedb03637dacac61f5e417076662835
SHA512 ee3499421d6a2410fed4a8683dc04f05fd854da43cac26582ffd36565e42cb195dc8c3b12ad8f756dd3b00750ed6a9ef60e722db621fb31b082a8352a72ef3d4
TLSH
T13CA0021181C01559DE01C3F870A3975126F7A824BE524703B49528548BDB1C0D926140
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5acc4a.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index~RFe5acc4a.TMP
Size 48B
SHA256 0c288dc69559c7593be55d49b6d1d91503231ff79066e6e2a895f3e168bf05ed
MD5 c0a3b0244b35c60ced82458ff507a7a0
SHA1 405a1ed1a1293c600199b36c86a106f924d064c8
SHA512 8f7dff2ca239dda3b08f65390bd9579c2cf605cc39a332b17e42633fc53d7aae7b3df83ebe471f679c1f091c0153a5f4f4b003b7e4e1a080ae65c51e1d3e64e3
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5b96be.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network\Network Persistent State~RFe5b96be.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 129KB
SHA256 b1f74292a7ef5762b6b0e78a923d2849a114d2c9bb5cfcc55817cd940febd3df
MD5 59c0f2052f3784871585425b23f42027
SHA1 d1a2086572e73136f11cbc4462b8a58faf8f41ed
SHA512 252d0a2e154480cbc26c6336df69cecfd203c92e26afa2f6465f9408f7536bc281d4eee580a56f9a43262acc7d48c5580d4fd5f69cd78e6182efc1440981491f
SSDEEP 3072:U1QJ7MqvXQbxWriuUB7YFCrn6vukqqwoPjmNRYeV+ui:Uq1MqKAM7YMrAukqqwEKTYeV4
TLSH
T17AD3124AB62C671726D7DB16B72B1DDB8E1E74CC8105C9E42B874C13836A7AD031BE35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 129KB
SHA256 f50d88a9292fddcde06a418dd64a711f7eedaf82331e3cfb8b6b0249140d72da
MD5 2cd1b535d1329ff8785b552b0ab471c4
SHA1 de1f87eb123bbceee2466be77479995c4056791b
SHA512 40f022180681a0887be4cae65378b5df8af2664b25bf254db181728915c16209b7dfcceb85a905505dae8d04963479939b8229d35411d0d828b5b5fd78761584
SSDEEP 3072:rQJ7MqvXQbxWriuUB7YFCrn6vukqqwoPjmNRYeV+ui:s1MqKAM7YMrAukqqwEKTYeV4
TLSH
T1CDD31266B66C66571AE3CB06671B1DC78D1EB4CE8605C9E82F875C03826A7ED030BE35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 129KB
SHA256 9389cf3b1ab35c19c196c116cbb72740d0b6dbd6e807ccad466dbeabfec67b9a
MD5 db30dae655b448209cc0a0c3b40cf79c
SHA1 f240993b343cda84b5992956ed76d11c01c948d7
SHA512 71f853182b17536d897594a4f7016e0406a08ece8613f97e4fece2e1725dd9a4d0c74142e71d1803243d63806fdacbeb891a3d663d2ab378700ebe3b50d02f4e
SSDEEP 3072:J1QJ7MqvXQbxWriuUB7YFCrn6vukqqwoPjmNRYeV+ui:Jq1MqKAM7YMrAukqqwEKTYeV4
TLSH
T1FAD3124AB62C671726D7DB16A72B1DDB8E1E74CC8105C9E42B874C13C36A7AD031BE35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 143KB
SHA256 6b097a0acabe069599f748a04a0976d3f5fd641073f793e8880b4a2a996335c6
MD5 0eb75af5001cabe69af34823dbba64a5
SHA1 2335ec169360f912f805dce12f246efcfa6b093e
SHA512 a5677d85c44dab01a4f3eb0b52e1ec591477bfa1c6ef20d013cffb1385b42b019046e46a24599df8318f5e5b4de9007927b9eac3d9f46ef2910c820d1079059a
SSDEEP 3072:E7Zt/5RQJ7MqvXQbxWriuUB7YFCrn6vukqqwoPjmNRYeV+ui:E73/5u1MqKAM7YMrAukqqwEKTYeV4
TLSH
T10FE31266B66C63272EA3CA0673161EC74D5D74CE8615C9BC2B8B5C03C36A79D0307E76
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 130KB
SHA256 de2e257afef0950a21caff572a8accfaf534bd31f04087917b71b631e174257a
MD5 5e7d7652a3ad7ed284b8d6fd4e078db7
SHA1 d81da9bb9cc172b0183a69b978a123f446d15d1c
SHA512 3d0ab6342060fe31b74659398252bfa13dece976479c237903b5750fdef9cc3afb8d2c2988f0638b939420d68c093d05346e21c8afbdcaf185ba55f892c18d6d
SSDEEP 3072:aQJ7MqvXQbxWriuUB7YFCrn6vukqqwoPjmNRYeV+ui:P1MqKAM7YMrAukqqwEKTYeV4
TLSH
T1D4D31266B62C26571AA3CB06631B1EC78D5EB4CE8505C9EC2B875C03C26A7ED030BE35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 4e323563655f1e06d119b96373b0c9dbce6b5a929624af48cd1955280e1d9852
MD5 ce80d9cac98573425bca77b2c6de6e65
SHA1 cc1015afa9e4b40d5f76c048d5163b5bdd54121e
SHA512 1749cccd5f9b4da411f6aea4d69e00daa2858272d584b7add14e929af73c385a8e5a676dafd90d0a70a0c6fdc119c46396fbf4a9274b6ca2564a264239fb66be
SSDEEP 96:xC0d+r2io+TJ/E0f6m934zM4RDotok5nmDyB6nGyvn0b4T8+ybJv4a:xC0ITo+TQ0InDUDASPPb4T8+ybl
TLSH
T107A10935A0285DB75476D446F1622A43CFB97067E972AF90EAD90E0D14F74EC1342A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c95a47aec5edba88214fad580cb869417b6620a91d8ee97e2d0b7801d3372be5
MD5 aad5f2ca0dd16bb2ea6c7757ea569c50
SHA1 5228b0b132542be004ea1bb32f3748964d065af5
SHA512 9d59c0291d741bd9d6cf50c22972d4baef00e7c1a48d6a3311a6cc82c04ceeba6e2be9458334cb954878915cc9eb91a8fd8bc4a47c966d57a2a05d6ee8211640
TLSH
T1D4D09BE177A19D18C545353567D1522591416D31451927194241E13D9D7E2C3455F0AA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ac1b1f93ff87eb876027f4166d705375c0f5d3d22dcb03f6a66f6100e88dd10f
MD5 b99f03c5cfe71b03836f8b5fcf09425b
SHA1 8a5078499c0b5ea40183efb77f9c1028c196409c
SHA512 6b9feec4ead7bf05f67d0d480907e21a3b770d8d12dedd2b0d785904186eac7448583e61abacb23582948de55c8ea2043bfd6908efd7faecdd82cee91404cfe6
TLSH
T16DD02BE037909D18C440353163D0122091006C30880923090100A02C8D3E2C3054F0BE
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 02e14a6630c5c9badaeaa42c2a37660ce9e3470ba3eb9a18e807d9aa6a5ec0de
MD5 d9d9e6f201004d5d915ce25486df8d0d
SHA1 536dbc3acdaa7337d3a731da1d998ede1a2a264a
SHA512 6e39884ec4b711c3a967cd3b54f35fdda6062883c60d6a91a90e6ed307d8d2d23fb44e04a8917a803a36ed5778b17a3a7ef55205ea2006a829a5ca40d94efab2
TLSH
T1567134218FEC64EFDF5E59B52FA12E1D3AB651067B0F1F03069895B425A7BF70AD000A
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 b20dbf995ed801964775e78f3ecee934932f7158e963765335a923d387c8ed6c
MD5 0423a8905516a0d799bdc0b9a56324d9
SHA1 b7dea90d79c0b9f0e7cfede00d855ec71684fe77
SHA512 ff156ff2387a1032c0de430638483663362bf2a6158910f4bcd0ea3d458bb1b80e0a4f46925b5241f8ad65dd76639d793d40b9a1c21037ae660282bdc3970fb7
SSDEEP 96:D9OvDIZVa1rzDaG9z5cHvhE5cZBpI/twQ:DQvDyVa1rXa4z5cPhE5cZBW/tT
TLSH
T10891CCF7C3F5862DC91195F0AA146F2BCE1C0552436C3C4A85E4AF1BA3F28B1E141A9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 d2c89020abb85bd9194d0dfb0ff4c9fd2a7aa3bf88d3c2f93399f22362464996
MD5 84952c050f6629d29f4fa7724baa67df
SHA1 a7bd71d6acf6c5feda2906d65e6de2e03fa31668
SHA512 a8468692be37f13fb1f39070ef57b0289b0f3d248c227c2bfa5871f8652c500d8c9a99477097eda71cbc919d30646586aee977370361049a09a2ed394ede2695
SSDEEP 96:D9OvDIZVa1rzDaG9z5cHkE5cZBpI/pGwQ:DQvDyVa1rXa4z5cEE5cZBW/pGT
TLSH
T14291CCF7C3F5862DC91195F0AA146F2BCE1C0552436C3C4A85E4AF1BA3F28B1E141A9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 34c53ada73d4174de0d3675b7c62ee1b4207fa96c568c4b49e488ce4a058f097
MD5 31a4af477ad267b2739379dc009bab52
SHA1 76ebd1573d73c7275216ff4f982395d6d0081af5
SHA512 4b8d185d2bb622ae8758b5dacf2ad58eacebeab20199a255b434b9c3159d17c6144426daef37527a4894f894ff037ee158c686478d16e20b44775622c73918cd
SSDEEP 192:sxR9ReCR/fTsmUeZurbXuGbT82oA8pJCM5/g6+WNPnD/YgHWOY8GcIgDYGu5h9+d:sxR9TR/fTsmUYurb7iV/5r/bV00d
TLSH
T1CE62D8166918983B8CC7DA19FE357F53D7F8103398955E4CA6FCC91C04EA6DE220B81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 52c5c0cd4e3387af7f40955131b8ec70fa3dc1be7601af605ef13f7b57f7d912
MD5 5a93dde8bd172966dd551eb5c2e514aa
SHA1 18160ce78a970bed77de7a2625d54266784ba24c
SHA512 85646548cb600042f14e02987de1e0e0a8c9467fab568bf2470f808eab2f3793866b0eb3f5eb3957dae208acb2ab58976929924cbf5dc01263a95cb94ab61ace
SSDEEP 192:sxR9ReYR/fTsmUeZurbXuGbT82oA8pXCM5/g6+WNPnD/YgHDOY8GcIgDYGu5h9+d:sxR99R/fTsmUYurb7iv/5r/6V00d
TLSH
T12272D816A918993B8CC7DA19FE357F53D7F8103398955E4CAAFCC91C04EA6DE120B81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 2ccfe83b1f89f28746c6476c3826f6ddb76eacf5e895c15d58f70074c1b0f2cb
MD5 7b66a8a0477333c18b33ec3954721f48
SHA1 c60c88d336b17f8d4fdbf4597df8aaf8d5819d5f
SHA512 69390048c7d30bd99ff0836ef391079c263970eaf24b36cf9bfdd6b52249f78752a4f755943436c50956a3bf8f5586515badef234af56cd356f165c5de458208
SSDEEP 192:sxR9ReCR/fTsm1eZurbXuGbT82oA8pJCE/g6+WNPnD/YgrYOY8GcIgDCGu5h9+AO:sxR9TR/fTsm1Yurb7id/5r/tV60d
TLSH
T18D62D7066928993B8CC7DA19FE357F53D7F9103298955E4CAAFCC91C04EA6DE120B81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 1962568feea70305cedf0118c0ae9f168e78ec5ff6c5c5b623671cfde99f381a
MD5 ef6ed2776553193e2683fed8b074a3d8
SHA1 1580fbe318351cf8dc752263f9c01d9adb5f4380
SHA512 36ab1bc82f0e0d28676761cf1959ef1c233af1cc3e0a75901ce7b6bd302998a3df88f3a098650d0fadf0d18fe11a600fd23addf1f52be3c6a17b7e46bf2e8dc0
SSDEEP 192:sxRmReCR/fTsU1eZurbXuGbT82oA8pJCE/g6+WNPnD/YgrYOY8GcIgVGu5h9+AO:sxRmTR/fTsU1Yurb7id/5r/tVR0d
TLSH
T10162C7066918993B8CC7DA19FE357F53D7F9103398955E4CAAFCC91C04EA6EE120B81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 e8bc3563bf1ab46797479ae43621ed0152212dc4ebb62ec2687e473a3453e792
MD5 e7a57f554c6761b431f7363781d72c34
SHA1 526b191ca27f6de54dffab7e31231c31c2f64b0f
SHA512 2dd26d3777e631021bb2c641e0935d8e67e6662d2d2cf133d8e7892949289e5b061417cf45657212f62f249df17c6b51b80c79c88e6665eb9ba89179037c3fcd
SSDEEP 768:j26HXA7pLuLz6RWgs2f028F1+UoAYDCx9Tuqh0VfUC9xbog/OVKMBVuw6ro9se0f:j26HXMEz6RWgs2f02u1jaNMB4wxbA
TLSH
T186D2DB7B640DCABE4F804ADDDC197E9F6D6802CB9698CD8047F9941C02C6BEA51164DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\d882babc-dd79-4e5c-b090-bfed299242d7\index-dir\the-real-index
Size 3KB
SHA256 fc00188f55cde5cbd2ccf827c8febc0213bf5a8771f2b2db67ed22af608b32bd
MD5 b2247c6092569cb9ebe55455077036a0
SHA1 e507dbb898e0a0c1594cce4714cf7a513efc0543
SHA512 77706eec75e1d52a5e47818845d54f6374ec32148114f9d96d93b1739782354220f6cd0998b3a6a135fba8ef2f37e74059b351e3f54b3f01e651101bc0b5c3b6
TLSH
T15C51F78F8E0A1D5EC9AC02B229FA11A133B91CFE4750CA872ADCA171B8D33391D0D219
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5c52da.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\d882babc-dd79-4e5c-b090-bfed299242d7\index-dir\the-real-index~RFe5c52da.TMP
Size 48B
SHA256 9c178db0d2abb7175da6d8a28308ac18602609d05bbcf84a8ccea551ac414b8e
MD5 a9809a51439c22fa0e88c47171bd77f3
SHA1 bd24f7d5548e5405c4325d969397d62f5ef33ab8
SHA512 77eac0e94e455c7843493a04f7831957fb5c8b3a1dacc6e697d34d52d4fae0b07c07b5629c3bef6a97c9b9b95fad337e92e358b92b9e31a4329be27da548ae45
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\e0a1eae2-cf16-490c-8857-199f41dae341\index-dir\the-real-index
Size 72B
SHA256 1ca94173c3a2042148ce1dbd96c6ee35db0ceebcc0edda1929c37447c5dacbbf
MD5 9f496afc0b83de28cfa06fb4a2e757ce
SHA1 087d6c0dc8531d180533bd441ea3e06fd8d104b4
SHA512 0a81230997749549bb7793d33b3316fde55b2448c268e42c869b109ff8eda14c153104e82acce5dde1b9c3a4f5f2f8aa6eb0fcceae265f8f7330aca7c28a237a
TLSH
T10DA0022512C00203C00211B236DA416352914955B340170D81900659C992577674300C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\e0a1eae2-cf16-490c-8857-199f41dae341\index-dir\the-real-index
Size 72B
SHA256 89100b657df7b0aaf3c690fae0ae6e1b6d39a94abd66decf6041db6f53a716b0
MD5 ba531beb33d9c37a0a8402ad6ef73a08
SHA1 7864598fd47a81f903d8336aa91b42ad82e66b6e
SHA512 2bd68a603762e0cf4e895f0e97f470a7d851eb9b056eae68bd8c8b27b39b219d02b1b5baa87e09c260e194a22ce6a2848053b430d5887128d653b7e92db9eaca
TLSH
T15EA0021402D40026C00223B229AA05822324CB544201134741B85348CE615E58D8172E
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5bcc36.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\e0a1eae2-cf16-490c-8857-199f41dae341\index-dir\the-real-index~RFe5bcc36.TMP
Size 72B
SHA256 f4d7a753e114b43f52c9f937e67ce82d6cde234567257eb9ab4c132310adfca0
MD5 d23c0b2dc375e1263122f40653db12b6
SHA1 72ec726ae80cb8660f777616fdce76218511463c
SHA512 a0c302ceb0ce6f7e88ea11d88d9a4cc64193b4c56aa1027153ab1e59cfbadeb615f4db325a571e30cba691299263a28ed4902a83bf9525341114f01b9192c421
TLSH
T1F9A0021413C08216C05211B13667C2417291C9501180130E60D14454CC928D26B4200C
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 3910c93e95330be5ad326b385830043136c6836988f2a3a256a45295e3d724b3
MD5 a1bc5123f7e3f3ea473537cf12ac8e42
SHA1 1309b3924496b1bf32f01c7e2039214aaee327d8
SHA512 1855cea127bca9415cdab3304d6693e5457399043a7e5613a4f7f14d4db28037db818201a79211a231ae52ae753665acc86882a884baf694e52f1f3d74f2c282
TLSH
T19DE0D8B62ED73810ECBF93E9287094990181B958D504AC8F255ED3C750E136278A6C71
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 375B
SHA256 c98ab5a3c683d10a9c686b701a2716b505f72e780bf2509602f350098cfa4cd9
MD5 cefcb50bc455d1b34fa37d4063bf7bfa
SHA1 ea6dcd137fe67b4452851d7f117d846459c88e1e
SHA512 6cd85d50bcab9bee5e314499a28c504cf23095da3704d36827e9c55c641a094892e1394337c3d607a0b2e8884b4fc1b24dd82ae8839508326312f4321a5b68df
TLSH
T1BCE068B62ED73810ECBF93EA283054980181BC58D504ACCF261EB3C390F0322786AC31
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 106c2fb71444c3d273cf9076ad52d2275d3539ef88796c9f7e6f1ddcd6882748
MD5 243e91c68cbbeafa401d0390fb664c3e
SHA1 15f56c3424c143ea4e3548f96cb27a2dfe92e154
SHA512 5c4f6a38e1c2bb923e9f0aa78794315ea87f2b88b1ce30aabf2388251e68d1250d2c7f49821daad353a72a55bf125155d684aa8edd040b207529a6d051978387
TLSH
T1C8A002D4D946A045F5441AB03A7901CC6264DFDDC91A221180AC4066DC5015693D1550
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5c22c2.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5c22c2.TMP
Size 48B
SHA256 e0aedc0486738a6ed08c479db8b5dbd261707be9efa8530f59056e5b3cdcfb94
MD5 c6363bcd0ff4c816fccd1e80d699a95e
SHA1 638bf6dd6101c1b0d1f4173ad43bf436bd348665
SHA512 fca19d1ab2207912517c7dd58a2541f389c5ff9af10536ad318c8c6237248cd20421b0bc0f489133b01a541e3f2e27d4f761c479ea092b7c915888b9e863c07f
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 a58f069785b02d935c368e87a34d956584990d57bef4bb359de810a722cc6405
MD5 b7af20de1ecd8d16ac7dc787dfa0c9db
SHA1 673b45cf9b3f9c0293d18ad3c36450af018590fe
SHA512 a8accfd60295da18f4fd61c6db65d62ad3a4e12fbdecbf3e99c9d4fad2c7c0631c4a45399915ac8898217e36f8ebdda129d172ff45017ba1b67501abeec21242
SSDEEP 96:KRENE8EzEnE9EXErE/WEzEoEWgEvE/K4EugERE/cEVEtEgEDEbEUHEuEDESEOEoP:CENE8EzEnE9EXErE+EzEoEHEvEFEugEo
TLSH
T1C1A1E750B53A4381397D770CC8B88D5E82D2B892345DA5AB3B980665CF5FE538EFC8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5cb01d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5cb01d.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 9c41117ea051ad985f575c8428065371e03dd51dd8632c804ee00f7bd8081e5a
MD5 fd39e76850fdf15ba4b4458c4c6a5c9b
SHA1 886e6b608994ba35faae72fff70759a1691d256e
SHA512 7ae95885b5400e303eab77b80855d1582129d6f4761ab5fe040a9812a1e11994f871227bb74b44f5e9f2f646b13fc247ee120120c94de32d0c1dbf6f57f73526
SSDEEP 768:A530MH/TBOWZAGiONXyer1IRCzni9WfZlHh:A530c8SIqntfLHh
TLSH
T104F2AE30E4AA9D234CE5E386F6067393BFB8206789C84B50EED99F1D0597A5E170F817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 edcc84935b41eebaf230e3fac795c5d75af381dffbf2437d849e4b79ad31d6c7
MD5 cb0efc8a9d90c1d0e7b0ae77e3c6a31e
SHA1 d02e792d54f4edeb4077ead8d9e40ba091b625c2
SHA512 d53765f1fa873cf0fa5f585a879338abab2f37d53c9af9c8a65f96043127e2fa46cb2449d01a46a655b155a693a7233d9242b6e787aa64f5aa6f217359224cd8
SSDEEP 768:hFgD3YwgXJ4VsOWZAGVONXyer1IRCzni9WfZlHh:AD3ai6SIqntfLHh
TLSH
T12D038C36D8A9CE276CE693C6F705B347AFF4106785C89AD0EAD99F5D008759E030BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 28312ca64050c68b0045f41f169702430fd5444e0a17a694cd9c0df186864eff
MD5 cba13fd3074faa1482aa871cdf6fe200
SHA1 eff7bc2923056f4a06a921c29a62efc4ee306eee
SHA512 879c165e13fad7f82d0dad626421a07169c326a68ed4f0b78a138cb757249d3c682c70ea8fa4527629e924fd9f7ee3a1e7afdade38d889affd670cacd8ca72fd
SSDEEP 768:/i30JH/TBOWZAGEONXyer1IRCzni9WfZlHh:/i30dSSIqntfLHh
TLSH
T1B5F2AE30E4AA9D234CE5E386F6067383BFB82067C4C84B50EAD99F1D0597A5E170F827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 5f0c05f20e9535240f9c4febb125aeb494b05be82981179bd9ae5e0ef190948c
MD5 916671b97c00506e69dc1df313c8dba2
SHA1 e0d563430a203ecef46210bab41a96745fef50fc
SHA512 9646ad310fce2f8a0ab7312d8534e5b416220a838914f1dc64dac9963de3617ff0d2ec2f79b770824028556d03877106b3288f28b226076064a8367e0415fdd6
SSDEEP 768:z534MH/TBOWZAGiONXyer1IRCzni9WfZlHh:z534c8SIqntfLHh
TLSH
T103F2AE30E4AA9D234CE5E396F6067383BFB8206784C84B50AED99F1D0597A5E170F817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 8764f3452a1b4311e5bce20206a7955b7745aed8f65d24188fa5650d80bc3b7c
MD5 121ec3fa5fc526a8d132678b3957221d
SHA1 6564514c5460563182b78cab67a00fe275a2696b
SHA512 9bf0f63121777f30fc7d5e639155ea45f6395823dc449d55a2c6bb33d9204b9e890ecd44e790be32ea0ba64960ee8a36c016826367e7a88bf33e00138933ce02
SSDEEP 768:sM3FTH/TBOWZAGiONXyer1IRCzni9WfZlHh:sM3FD8SIqntfLHh
TLSH
T17DF2AE30E4AA9D234CE5E386F6067383BFB8206785C85B50EED99F1D0597A5E170B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 1edfcececf1e19e32b63efec788bc85ed1080e5cb6a93934abf01a259244a658
MD5 8021b396fed28f63d801beb0e78f1702
SHA1 fd7e6f8d9daf3a983a7cec9fa9eac9ddf33f5eb3
SHA512 17a40c40cd640c2108e6d65b2fae80e70b615852ea00ebd6815a50b87601139ae3e7b650fec1da9f8b03f6e9ec39b6adb32a964b8dfa261836200be801d4071b
SSDEEP 768:Qrv+4UNbdz3FuH/TBOWZAGiONXyer1IRCzni9W0:QbsbV3Fa8SIqnt0
TLSH
T14503BF31E4699E334CE6A296F20777837FB8206788C10B90EDD96F8D058B59E270F917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 a5b2561885f2f64a8db751e4a4dde7de8def30aa337b055e62694494a21ec45f
MD5 4044e85983b2abcd9230f2ea3f3cceff
SHA1 5f1e301d36bca1711c37fc43c3b10f374e86267d
SHA512 9a1fcbf8955c42c3c2ffbc48ec55f44a89fff07e2458e600b80c3b3effcb956eb630f2e2d1825550fba11b1fb93df56b9c33ecf3394de1106786189e08b3c3c0
SSDEEP 768:hrv+4UNbdz3E8/TBOWZAPONXyer1IRCzniBqeVH1SK7:hbsbV33CSIqnhEH1l
TLSH
T13B03BF32E4A89E334DE2A3C6B54773437FB85057C6840790EDEA2F4E069B59D130B957
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 ddfa212de0466d87917c7db0ad8503654f448b606da99bd8884934d6dd9a0fc6
MD5 5599bdfaed4ac1a663a4e1cae6cca724
SHA1 3107832da661d4b21145d2741c592d9ba92d0143
SHA512 751ad9b4f80be6c856db39a2bdceb571ac9d39b0a316d1e5cb75885e914841b90839b22300b3a174164da8ff7ad35019f58d82e27925f0ce3224817c94225cdd
SSDEEP 768:trv+4UNbdz3sV/TBOWZAGPONXyer1IRCzniwWeVH1SK7:tbsbV3ulSIqniEH1l
TLSH
T1C403BF31E1A9DE334DE6A396B147B3437FB8206789800B90EDDA6F4D069B59E130F917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

897e13ec-415f-4018-a868-b56e7db86b82.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\897e13ec-415f-4018-a868-b56e7db86b82.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
Size 154KB
SHA256 e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
MD5 a922bd2071b7aa9f2154c991d41885c7
SHA1 c88b22d16c951cbb0bfdab367232cf830e0464d1
SHA512 d8ed2d6b1c3a421a9771e3a5109eaea839bf64be7b7e672ed7b8aa47590ff35c6e78aa79712ce37801cedc56db552fc6a7c3ca55004295a438219ce4a8f007a0
SSDEEP 3072:Aj0amyoD1f5NQQHyR5nYbGnkBEGsvsq5UBkUM4RIJ+37HVeCsKkwQuBp/Z:AoHBD15HEYbQkovswoM4RIIzvXkwtBpB
TLSH
T12BF3F11D7EDAC952C40B92BD3C1AB18BC94B8F0A431674CF264D90248EA578E07E5EFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json~RFe5bea8b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json~RFe5bea8b.TMP
Size 132B
SHA256 a0b1a35a86cbd2e671521525fc6903162d450e3b301948d913d05ef458794c20
MD5 22215f69c4a5231b8c568620e783d7fe
SHA1 c64663b6efe0023ca5978374d785f1202d924d1b
SHA512 9e38513132672de4a65c01a6eca3c8c3a878cc6e11e2c0d2235798b78e3338c9a13a15d261c4b4fc6c60657f42407b98c8435aa4352366d1809843ddda068e22
TLSH
T1A5C02B79481924CC2B00043C6004012B19B0560023C413F48C1B8D80007537CD30817F
MD5 SHA1 SHA512 TLSH

Submit Download

4f93b28b-c09b-42ce-bfbe-b3a699ddbe51.tmp

Path C:\Users\Admin\AppData\Local\Temp\4f93b28b-c09b-42ce-bfbe-b3a699ddbe51.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4660_570428662\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5684_1607706557\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3504-1523-0x0000023F1D8B0000-0x0000023F1DA0F000-memory.dmp

Download

memory/3504-1746-0x0000023F1D8B0000-0x0000023F1DA0F000-memory.dmp

Download