f89a6d082f5b8720ee1458de47c3b3a7a4744c70e108f4f5d8c7d016265e87a6

Analysis

max time kernel
150s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/09/2026, 09:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-11_6751f9037f09bfe9730bacce5cb8478c_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Size 955KB
Sample260912-ldevqaek7s
SHA256 f89a6d082f5b8720ee1458de47c3b3a7a4744c70e108f4f5d8c7d016265e87a6
MD5 6751f9037f09bfe9730bacce5cb8478c
SHA1 d68976af87a4c5b01c4787704aca0db5d0779569
SHA512 3e90629fea58e331ce82df9efc52e6d1248784ebe82075321f364fa12bb234e350c774fb3bae9b684b8510b6f6996c02dbe6206cc3cfc31bbc308766ef24a8ab
SSDEEP 12288:pmiMZvN43+u85Bpw+YMRkc9U4cwqnMjnatT6bV9lBVVW:cnvS+55BpfRX9U4cSatshG
TLSH
T16925D134A6F8C1E8E0A6B174DD47B4F19622FC05C6609D4F3E987E5A3A32290F93571E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

adware discovery execution installer spyware upx

Malware Config

Signatures

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c463-58.dat	UPX

Downloads MZ/PE file 3 IoCs

flow	pid	Process
19	6108	chrome.exe
19	6108	chrome.exe
19	6108	chrome.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000d00000001c463-58.dat	upx

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 8 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4928	cmd.exe
3444	cmd.exe
4648	cmd.exe
784	cmd.exe
764	cmd.exe
2120	cmd.exe
5712	cmd.exe
1220	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
6108	chrome.exe

Inno Setup is an open-source installation builder for Windows applications. 1 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/files/0x000d00000001c462-48.dat	innosetup

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Modifies data under HKEY_USERS 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-461973139-3212354679-1508698038-1000\{29A6CFFE-DB5B-4D1C-8D48-875BC399E3E5}	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 25 IoCs

pid	Process
6096	chrome.exe
6096	chrome.exe
6096	chrome.exe
2056	AcroRd32.exe
2056	AcroRd32.exe
2056	AcroRd32.exe
2056	AcroRd32.exe
2056	AcroRd32.exe
2056	AcroRd32.exe
2056	AcroRd32.exe
2056	AcroRd32.exe
2056	AcroRd32.exe
2056	AcroRd32.exe
2056	AcroRd32.exe
2056	AcroRd32.exe
2056	AcroRd32.exe
2056	AcroRd32.exe
2056	AcroRd32.exe
2056	AcroRd32.exe
2056	AcroRd32.exe
2056	AcroRd32.exe
6096	chrome.exe
6096	chrome.exe
4220	chrome.exe
4220	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 19 IoCs

pid	Process
6096	chrome.exe
6096	chrome.exe
6096	chrome.exe
6096	chrome.exe
6096	chrome.exe
6096	chrome.exe
6096	chrome.exe
6096	chrome.exe
6096	chrome.exe
6096	chrome.exe
6096	chrome.exe
6096	chrome.exe
6096	chrome.exe
6096	chrome.exe
6096	chrome.exe
6096	chrome.exe
6096	chrome.exe
6096	chrome.exe
6096	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	6096	chrome.exe
Token: SeCreatePagefilePrivilege	6096	chrome.exe
Token: SeShutdownPrivilege	6096	chrome.exe
Token: SeCreatePagefilePrivilege	6096	chrome.exe
Token: SeShutdownPrivilege	6096	chrome.exe
Token: SeCreatePagefilePrivilege	6096	chrome.exe
Token: SeShutdownPrivilege	6096	chrome.exe
Token: SeCreatePagefilePrivilege	6096	chrome.exe
Token: SeShutdownPrivilege	6096	chrome.exe
Token: SeCreatePagefilePrivilege	6096	chrome.exe
Token: SeShutdownPrivilege	6096	chrome.exe
Token: SeCreatePagefilePrivilege	6096	chrome.exe
Token: SeShutdownPrivilege	6096	chrome.exe
Token: SeCreatePagefilePrivilege	6096	chrome.exe
Token: SeShutdownPrivilege	6096	chrome.exe
Token: SeCreatePagefilePrivilege	6096	chrome.exe
Token: SeShutdownPrivilege	6096	chrome.exe
Token: SeCreatePagefilePrivilege	6096	chrome.exe
Token: SeShutdownPrivilege	6096	chrome.exe
Token: SeCreatePagefilePrivilege	6096	chrome.exe
Token: SeShutdownPrivilege	6096	chrome.exe
Token: SeCreatePagefilePrivilege	6096	chrome.exe
Token: SeShutdownPrivilege	6096	chrome.exe
Token: SeCreatePagefilePrivilege	6096	chrome.exe
Token: SeShutdownPrivilege	6096	chrome.exe
Token: SeCreatePagefilePrivilege	6096	chrome.exe
Token: SeShutdownPrivilege	6096	chrome.exe
Token: SeCreatePagefilePrivilege	6096	chrome.exe
Token: SeShutdownPrivilege	6096	chrome.exe
Token: SeCreatePagefilePrivilege	6096	chrome.exe
Token: SeShutdownPrivilege	6096	chrome.exe
Token: SeCreatePagefilePrivilege	6096	chrome.exe
Token: SeShutdownPrivilege	6096	chrome.exe
Token: SeCreatePagefilePrivilege	6096	chrome.exe
Token: SeShutdownPrivilege	6096	chrome.exe
Token: SeCreatePagefilePrivilege	6096	chrome.exe
Token: SeShutdownPrivilege	6096	chrome.exe
Token: SeCreatePagefilePrivilege	6096	chrome.exe
Token: SeShutdownPrivilege	6096	chrome.exe
Token: SeCreatePagefilePrivilege	6096	chrome.exe
Token: SeShutdownPrivilege	6096	chrome.exe
Token: SeCreatePagefilePrivilege	6096	chrome.exe
Token: SeShutdownPrivilege	6096	chrome.exe
Token: SeCreatePagefilePrivilege	6096	chrome.exe
Token: SeShutdownPrivilege	6096	chrome.exe
Token: SeCreatePagefilePrivilege	6096	chrome.exe
Token: SeShutdownPrivilege	6096	chrome.exe
Token: SeCreatePagefilePrivilege	6096	chrome.exe
Token: SeShutdownPrivilege	6096	chrome.exe
Token: SeCreatePagefilePrivilege	6096	chrome.exe
Token: SeShutdownPrivilege	6096	chrome.exe
Token: SeCreatePagefilePrivilege	6096	chrome.exe
Token: SeShutdownPrivilege	6096	chrome.exe
Token: SeCreatePagefilePrivilege	6096	chrome.exe
Token: SeShutdownPrivilege	6096	chrome.exe
Token: SeCreatePagefilePrivilege	6096	chrome.exe
Token: SeShutdownPrivilege	6096	chrome.exe
Token: SeCreatePagefilePrivilege	6096	chrome.exe
Token: SeShutdownPrivilege	6096	chrome.exe
Token: SeCreatePagefilePrivilege	6096	chrome.exe
Token: SeShutdownPrivilege	6096	chrome.exe
Token: SeCreatePagefilePrivilege	6096	chrome.exe
Token: SeShutdownPrivilege	6096	chrome.exe
Token: SeCreatePagefilePrivilege	6096	chrome.exe

Suspicious use of FindShellTrayWindow 59 IoCs

pid	Process
6096	chrome.exe
6096	chrome.exe
6096	chrome.exe
6096	chrome.exe
6096	chrome.exe
6096	chrome.exe
6096	chrome.exe
6096	chrome.exe
6096	chrome.exe
6096	chrome.exe
6096	chrome.exe
6096	chrome.exe
6096	chrome.exe
6096	chrome.exe
6096	chrome.exe
6096	chrome.exe
6096	chrome.exe
6096	chrome.exe
6096	chrome.exe
6096	chrome.exe
6096	chrome.exe
6096	chrome.exe
6096	chrome.exe
6096	chrome.exe
6096	chrome.exe
6096	chrome.exe
6096	chrome.exe
6096	chrome.exe
6096	chrome.exe
6096	chrome.exe
6096	chrome.exe
6096	chrome.exe
6096	chrome.exe
6096	chrome.exe
6096	chrome.exe
6096	chrome.exe
6096	chrome.exe
6096	chrome.exe
6096	chrome.exe
6096	chrome.exe
6096	chrome.exe
6096	chrome.exe
6096	chrome.exe
6096	chrome.exe
6096	chrome.exe
6096	chrome.exe
6096	chrome.exe
6096	chrome.exe
6096	chrome.exe
6096	chrome.exe
6096	chrome.exe
6096	chrome.exe
6096	chrome.exe
6096	chrome.exe
6096	chrome.exe
6096	chrome.exe
6096	chrome.exe
6096	chrome.exe
6096	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
6096	chrome.exe
6096	chrome.exe
6096	chrome.exe
6096	chrome.exe
6096	chrome.exe
6096	chrome.exe
6096	chrome.exe
6096	chrome.exe
6096	chrome.exe
6096	chrome.exe
6096	chrome.exe
6096	chrome.exe
6096	chrome.exe
6096	chrome.exe
6096	chrome.exe
6096	chrome.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
2056	AcroRd32.exe
2056	AcroRd32.exe
2056	AcroRd32.exe
2056	AcroRd32.exe
2056	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4152 wrote to memory of 5712	4152	2026-09-11_6751f9037f09bfe9730bacce5cb8478c_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_stealc.exe	88
PID 4152 wrote to memory of 1220	4152	2026-09-11_6751f9037f09bfe9730bacce5cb8478c_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_stealc.exe	90
PID 1220 wrote to memory of 2056	1220	cmd.exe	92
PID 4152 wrote to memory of 4928	4152	2026-09-11_6751f9037f09bfe9730bacce5cb8478c_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_stealc.exe	93
PID 4928 wrote to memory of 6096	4928	cmd.exe	95
PID 6096 wrote to memory of 5332	6096	chrome.exe	96
PID 4152 wrote to memory of 3444	4152	2026-09-11_6751f9037f09bfe9730bacce5cb8478c_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_stealc.exe	97
PID 6096 wrote to memory of 1540	6096	chrome.exe	99
PID 6096 wrote to memory of 6108	6096	chrome.exe	100
PID 6096 wrote to memory of 1540	6096	chrome.exe	99
PID 6096 wrote to memory of 2860	6096	chrome.exe	101
PID 6096 wrote to memory of 2860	6096	chrome.exe	101
PID 6096 wrote to memory of 2040	6096	chrome.exe	102
PID 6096 wrote to memory of 2040	6096	chrome.exe	102
PID 6096 wrote to memory of 2312	6096	chrome.exe	103
PID 6096 wrote to memory of 2312	6096	chrome.exe	103
PID 3444 wrote to memory of 2652	3444	cmd.exe	104
PID 2652 wrote to memory of 2716	2652	chrome.exe	105
PID 6096 wrote to memory of 4248	6096	chrome.exe	106
PID 6096 wrote to memory of 4248	6096	chrome.exe	106
PID 4152 wrote to memory of 4648	4152	2026-09-11_6751f9037f09bfe9730bacce5cb8478c_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_stealc.exe	107
PID 6096 wrote to memory of 3484	6096	chrome.exe	109
PID 6096 wrote to memory of 3484	6096	chrome.exe	109
PID 6096 wrote to memory of 880	6096	chrome.exe	110
PID 6096 wrote to memory of 880	6096	chrome.exe	110
PID 4648 wrote to memory of 2772	4648	cmd.exe	111
PID 2772 wrote to memory of 4544	2772	chrome.exe	112
PID 6096 wrote to memory of 4960	6096	chrome.exe	113
PID 6096 wrote to memory of 4960	6096	chrome.exe	113
PID 4152 wrote to memory of 784	4152	2026-09-11_6751f9037f09bfe9730bacce5cb8478c_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_stealc.exe	114
PID 784 wrote to memory of 5912	784	cmd.exe	116
PID 5912 wrote to memory of 4308	5912	chrome.exe	117
PID 6096 wrote to memory of 6008	6096	chrome.exe	119
PID 6096 wrote to memory of 6008	6096	chrome.exe	119
PID 4152 wrote to memory of 764	4152	2026-09-11_6751f9037f09bfe9730bacce5cb8478c_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_stealc.exe	118
PID 764 wrote to memory of 4412	764	cmd.exe	121
PID 4412 wrote to memory of 5452	4412	chrome.exe	122
PID 4152 wrote to memory of 2120	4152	2026-09-11_6751f9037f09bfe9730bacce5cb8478c_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_stealc.exe	123
PID 6096 wrote to memory of 4256	6096	chrome.exe	124
PID 6096 wrote to memory of 4256	6096	chrome.exe	124
PID 2120 wrote to memory of 4712	2120	cmd.exe	126
PID 4712 wrote to memory of 4800	4712	chrome.exe	127
PID 6096 wrote to memory of 4420	6096	chrome.exe	128
PID 6096 wrote to memory of 4420	6096	chrome.exe	128
PID 2056 wrote to memory of 5408	2056	AcroRd32.exe	129
PID 5408 wrote to memory of 3592	5408	RdrCEF.exe	130
PID 5408 wrote to memory of 4572	5408	RdrCEF.exe	131
PID 5408 wrote to memory of 4572	5408	RdrCEF.exe	131
PID 5408 wrote to memory of 4300	5408	RdrCEF.exe	134
PID 5408 wrote to memory of 4728	5408	RdrCEF.exe	136
PID 5408 wrote to memory of 3616	5408	RdrCEF.exe	138
PID 6096 wrote to memory of 4220	6096	chrome.exe	140
PID 6096 wrote to memory of 1092	6096	chrome.exe	141
PID 6096 wrote to memory of 1092	6096	chrome.exe	141
PID 6096 wrote to memory of 5676	6096	chrome.exe	142
PID 6096 wrote to memory of 5676	6096	chrome.exe	142
PID 6096 wrote to memory of 2764	6096	chrome.exe	146
PID 6096 wrote to memory of 4536	6096	chrome.exe	147
PID 6096 wrote to memory of 2184	6096	chrome.exe	148
PID 6096 wrote to memory of 1160	6096	chrome.exe	149
PID 6096 wrote to memory of 2764	6096	chrome.exe	146
PID 6096 wrote to memory of 4536	6096	chrome.exe	147
PID 6096 wrote to memory of 2184	6096	chrome.exe	148
PID 6096 wrote to memory of 1160	6096	chrome.exe	149

C:\Users\Admin\AppData\Local\Temp\2026-09-11_6751f9037f09bfe9730bacce5cb8478c_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-11_6751f9037f09bfe9730bacce5cb8478c_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4152
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c start Acrobat.exe "C:\Documento.pdf
  2⤵
  - Executes a command shell one-liner
  PID:5712
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c start AcroRd32.exe "C:\Documento.pdf
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1220
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Documento.pdf
    3⤵
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    - Modifies Internet Explorer settings
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2056
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5408
    - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=2E0BCBF39118A0C0E34C4DDCAC90E4D2 --mojo-platform-channel-handle=1780 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3592
    - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=7E73D068E5CBB4A356712A797262527E --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=7E73D068E5CBB4A356712A797262527E --renderer-client-id=2 --mojo-platform-channel-handle=1788 --allow-no-sandbox-job /prefetch:1
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4572
    - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=F5C247EC928C10B2FD605EF379841CC2 --mojo-platform-channel-handle=2384 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4300
    - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=2D8610CACD08910619189C1DA95F067A --mojo-platform-channel-handle=1964 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4728
    - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=66C80890A5B5E040E029F022BFE9A9D9 --mojo-platform-channel-handle=2408 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3616
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c start chrome.exe --single-argument https://www.youtube.com/results?search_query=Alice+Mii+Living+The+Dream
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4928
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --single-argument https://www.youtube.com/results?search_query=Alice+Mii+Living+The+Dream
    3⤵
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:6096
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffd5197c728,0x7ffd5197c734,0x7ffd5197c740
      4⤵
      PID:5332
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1604,i,12844678564329904269,17557388033347182695,262144 --field-trial-handle=2408,i,8261813122304396587,8764133301255093335,262144 --variations-seed-version --mojo-platform-channel-handle=2404 /prefetch:2
      4⤵
      PID:1540
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1676,i,518602141974356826,6465306045447412082,524288 --field-trial-handle=2408,i,8261813122304396587,8764133301255093335,262144 --variations-seed-version --mojo-platform-channel-handle=2436 /prefetch:11
      4⤵
      Downloads MZ/PE file
      System Time Discovery
      PID:6108
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=2016,i,7069080670756295644,13403805342866717005,524288 --field-trial-handle=2408,i,8261813122304396587,8764133301255093335,262144 --variations-seed-version --mojo-platform-channel-handle=2548 /prefetch:13
      4⤵
      PID:2860
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3248,i,15554904969940448719,4230545064992820454,2097152 --field-trial-handle=2408,i,8261813122304396587,8764133301255093335,262144 --variations-seed-version --mojo-platform-channel-handle=3264 /prefetch:1
      4⤵
      PID:2040
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3252,i,3901764135222860326,14128954289328882419,2097152 --field-trial-handle=2408,i,8261813122304396587,8764133301255093335,262144 --variations-seed-version --mojo-platform-channel-handle=3308 /prefetch:1
      4⤵
      PID:2312
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4672,i,10557443814980130145,3637167154535512287,2097152 --field-trial-handle=2408,i,8261813122304396587,8764133301255093335,262144 --variations-seed-version --mojo-platform-channel-handle=4676 /prefetch:1
      4⤵
      PID:4248
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4716,i,3675994151954926840,17724293592936391143,2097152 --field-trial-handle=2408,i,8261813122304396587,8764133301255093335,262144 --variations-seed-version --mojo-platform-channel-handle=4856 /prefetch:1
      4⤵
      PID:3484
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5036,i,15270222744947055391,13767214686163986750,524288 --field-trial-handle=2408,i,8261813122304396587,8764133301255093335,262144 --variations-seed-version --mojo-platform-channel-handle=4828 /prefetch:14
      4⤵
      PID:880
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5188,i,867067861814857153,10968373028808404218,2097152 --field-trial-handle=2408,i,8261813122304396587,8764133301255093335,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:1
      4⤵
      PID:4960
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3124,i,10357590180850878184,6144362133892159041,2097152 --field-trial-handle=2408,i,8261813122304396587,8764133301255093335,262144 --variations-seed-version --mojo-platform-channel-handle=5236 /prefetch:1
      4⤵
      PID:6008
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5520,i,3566797166596017109,4892069835944988006,2097152 --field-trial-handle=2408,i,8261813122304396587,8764133301255093335,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:1
      4⤵
      PID:4256
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5324,i,438116388223946607,9945394520742659949,2097152 --field-trial-handle=2408,i,8261813122304396587,8764133301255093335,262144 --variations-seed-version --mojo-platform-channel-handle=5644 /prefetch:1
      4⤵
      PID:4420
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5184,i,3520067328316239942,5924064913140492506,524288 --field-trial-handle=2408,i,8261813122304396587,8764133301255093335,262144 --variations-seed-version --mojo-platform-channel-handle=6600 /prefetch:14
      4⤵
      PID:4220
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=4856,i,16417303725521755919,13249155905603571918,2097152 --field-trial-handle=2408,i,8261813122304396587,8764133301255093335,262144 --variations-seed-version --mojo-platform-channel-handle=5472 /prefetch:1
      4⤵
      PID:1092
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=3308,i,5363913526772174374,2702895719955364093,2097152 --field-trial-handle=2408,i,8261813122304396587,8764133301255093335,262144 --variations-seed-version --mojo-platform-channel-handle=5604 /prefetch:1
      4⤵
      PID:5676
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6744,i,1845042174691872148,15903205251989135046,2097152 --field-trial-handle=2408,i,8261813122304396587,8764133301255093335,262144 --variations-seed-version --mojo-platform-channel-handle=3304 /prefetch:1
      4⤵
      PID:2764
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6660,i,15321714996940244265,9979846552959922647,2097152 --field-trial-handle=2408,i,8261813122304396587,8764133301255093335,262144 --variations-seed-version --mojo-platform-channel-handle=3312 /prefetch:1
      4⤵
      PID:4536
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6736,i,8525835911081329284,4024967418962988267,524288 --field-trial-handle=2408,i,8261813122304396587,8764133301255093335,262144 --variations-seed-version --mojo-platform-channel-handle=6696 /prefetch:14
      4⤵
      PID:2184
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=5340,i,18292768904641182791,6841397927880449649,2097152 --field-trial-handle=2408,i,8261813122304396587,8764133301255093335,262144 --variations-seed-version --mojo-platform-channel-handle=3308 /prefetch:1
      4⤵
      PID:1160
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=5496,i,1629443863900312319,14342949181829574732,2097152 --field-trial-handle=2408,i,8261813122304396587,8764133301255093335,262144 --variations-seed-version --mojo-platform-channel-handle=5256 /prefetch:1
      4⤵
      PID:3392
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5160,i,17141391045073284300,7299415310468580439,524288 --field-trial-handle=2408,i,8261813122304396587,8764133301255093335,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:14
      4⤵
      PID:4764
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=6728,i,18398216593409225370,15820326456471435805,2097152 --field-trial-handle=2408,i,8261813122304396587,8764133301255093335,262144 --variations-seed-version --mojo-platform-channel-handle=5248 /prefetch:1
      4⤵
      PID:3916
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=7060,i,2134416296449800682,6026836786645723731,524288 --field-trial-handle=2408,i,8261813122304396587,8764133301255093335,262144 --variations-seed-version --mojo-platform-channel-handle=6880 /prefetch:14
      4⤵
      PID:5968
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=6612,i,7370077102439969809,14320733320335683091,2097152 --field-trial-handle=2408,i,8261813122304396587,8764133301255093335,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:1
      4⤵
      PID:2864
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=5148,i,14827772316101982477,18157970785828990461,2097152 --field-trial-handle=2408,i,8261813122304396587,8764133301255093335,262144 --variations-seed-version --mojo-platform-channel-handle=5100 /prefetch:1
      4⤵
      PID:4196
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=7124,i,4966763010252765875,804828975685840203,524288 --field-trial-handle=2408,i,8261813122304396587,8764133301255093335,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:14
      4⤵
      Modifies registry class
      PID:5132
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=6672,i,10355723225881897702,11934259547625645838,2097152 --field-trial-handle=2408,i,8261813122304396587,8764133301255093335,262144 --variations-seed-version --mojo-platform-channel-handle=3268 /prefetch:1
      4⤵
      PID:1616
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=5580,i,8297433470700308221,14302183624568265281,2097152 --field-trial-handle=2408,i,8261813122304396587,8764133301255093335,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:9
      4⤵
      PID:2988
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=7112,i,6379423733734435251,8018587750400344938,524288 --field-trial-handle=2408,i,8261813122304396587,8764133301255093335,262144 --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:12
      4⤵
      PID:3740
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4832,i,7702738736511320606,11324877034291205956,524288 --field-trial-handle=2408,i,8261813122304396587,8764133301255093335,262144 --variations-seed-version --mojo-platform-channel-handle=6188 /prefetch:14
      4⤵
      PID:4548
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5260,i,11904119938343024895,11529276132230764820,524288 --field-trial-handle=2408,i,8261813122304396587,8764133301255093335,262144 --variations-seed-version --mojo-platform-channel-handle=5088 /prefetch:14
      4⤵
      PID:2620
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5320,i,15288471308078634570,2722398521551323862,524288 --field-trial-handle=2408,i,8261813122304396587,8764133301255093335,262144 --variations-seed-version --mojo-platform-channel-handle=7076 /prefetch:14
      4⤵
      PID:5932
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=7088,i,2442674136878358442,3815348511092184934,262144 --field-trial-handle=2408,i,8261813122304396587,8764133301255093335,262144 --variations-seed-version --mojo-platform-channel-handle=6564 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4220
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c start chrome.exe --single-argument https://www.pdf2exe.com/pdf2exe.exe
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3444
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --single-argument https://www.pdf2exe.com/pdf2exe.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2652
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffd5197c728,0x7ffd5197c734,0x7ffd5197c740
      4⤵
      PID:2716
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c start chrome.exe --single-argument https://www.pdf2exe.com/pdf2exe.exe
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4648
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --single-argument https://www.pdf2exe.com/pdf2exe.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2772
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffd5197c728,0x7ffd5197c734,0x7ffd5197c740
      4⤵
      PID:4544
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c start chrome.exe --single-argument https://www.pdf2exe.com/CoolPDFReader.exe
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:784
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --single-argument https://www.pdf2exe.com/CoolPDFReader.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5912
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffd5197c728,0x7ffd5197c734,0x7ffd5197c740
      4⤵
      PID:4308
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c start chrome.exe --single-argument https://www.pdf2exe.com/CoolPDFReaderInstaller.exe
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:764
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --single-argument https://www.pdf2exe.com/CoolPDFReaderInstaller.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4412
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffd5197c728,0x7ffd5197c734,0x7ffd5197c740
      4⤵
      PID:5452
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c start chrome.exe --single-argument https://www.pdf2exe.com/CoolPDFReaderSetup.exe
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2120
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --single-argument https://www.pdf2exe.com/CoolPDFReaderSetup.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4712
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffd5197c728,0x7ffd5197c734,0x7ffd5197c740
      4⤵
      PID:4800

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4104

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:2092

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 36KB
SHA256 b1b77e96279ead2b460de3de70e2ea4f5ad1b853598a4e27a5caf3f1a32cc4f3
MD5 b30d3becc8731792523d599d949e63f5
SHA1 19350257e42d7aee17fb3bf139a9d3adb330fad4
SHA512 523f54895fb07f62b9a5f72c8b62e83d4d9506bda57b183818615f6eb7286e3b9c5a50409bc5c5164867c3ccdeae88aa395ecca6bc7e36d991552f857510792e
SSDEEP 24:TLiXlzkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf9Mzm+Zs3tGl:TqlmFTIF3XmHjBoGGR+jMz+LhT
TLSH
T178F21D566E241E3CCA9EC336340836C34D78023DACF3B762A58A719747AD181E37D6E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 56KB
SHA256 111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131
MD5 752a1f26b18748311b691c7d8fc20633
SHA1 c1f8e83eebc1cc1e9b88c773338eb09ff82ab862
SHA512 a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5
SSDEEP 192:wedRBvVrThe4p4/KhTB4p4CitZtkZsLRGVDbw6H3ph+v3YQa9:weZdThkKhBvkZsLRGlzh+vS9
TLSH
T1C94379DF2A348110CA0768BABD71771BB655D0BFC1C2F0A87AD68A1780B463CE775687
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 64KB
SHA256 1ac560c8eea05bb9eb37ada844c56fe8f650d6eee978a6d45bbfe711e4fb0bcf
MD5 223214d3c2982ee48f28a61e2844bd3b
SHA1 21a58416af500d5927221ccda305f6568b254f9f
SHA512 2e78a0e00f7e8d051678b35f38df0b234ab777084d8250a38d28d80a137838fb2e105489443acbac428010641c4666c4129faa2f11167e7d642b06ccf5534e2f
SSDEEP 384:yeRdThatELJ8SWvDTuGmQgZsLglKhubvGZsLRZh+vS4:Y+eUZsLQCZsL3hUS4
TLSH
T12853CBDB26348040CA07A8BBADB5731BB662D0BFC1C6F1E87E858A1780F453D9775687
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 685b74ac6b47cc67ae7434a98329f9111a7b5c168707e70b55be1a68d729ec12
MD5 0a5be5c7ba33a6c408691d82d7affa3e
SHA1 dd80476f918154cb44942aa2c9ec051f46116136
SHA512 a8a03053cc90b92445b36b42d8981d02fe131d68edfa6911d6a648f7e0a1f636527df56b572083d39d96fc22e9ad9ddce1f824c8f584aa04165b938020cd20fb
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000003

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000003
Size 1.6MB
SHA256 49b2d6e65f063080520dc54e048a71efb791dd4227cbce07fd1a58be260e9194
MD5 2a5ff22a064c325a68f66a675426b956
SHA1 bfc916297e3f631a73ed010d8911e2221a758190
SHA512 58d2b26eb84a77cf2a23afb343242649600189e3751075faf129bc910258c65dc75b66bb96519dcd13d441a4bbdc4693104ce00e70c5780c8d6b6dcec710ed47
SSDEEP 24576:5nam4MC35D6Nqep82XRGjEr6dDhQQbwHAHicsj4EpaPgma1VLbajL3G9MgXijG38:5auW2cPDhQQbIRjpaPiSv3G3SjG3LrP8
TLSH
T1A975331BD6E3493AF5A1A7702F33861DABB339230A78196532DC1FDF1B229547604E63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 480B
SHA256 aaf0d9aa600b4fb14a20335688e06603e800628ff2dde108a1cb2c40970f1cc6
MD5 bbbb2e393d62b330e7e4331e66a1dc50
SHA1 b1cb246788c428a76ae1f8b24e2385bca1d97705
SHA512 458dadb5afcdb4b65df8640a8579639c09b88a556771fcc110ad8231226a23f1f099af49f3f3dc6e5f8e15696c7ddb7d5d44f8766c66997bb1c80439dd1ce63a
TLSH
T13DF068E0ADE531A4FFC8127315DCBA43B7F59108603F8F7319B1E074041A3A90032920
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 9922f641874eb1be2fa158f8ddda7f84dbdc262096bec74c972a2d65504fab34
MD5 8d3d3184a3600b4e87ac2daf60ea8c5f
SHA1 02289abf126e1e746996f1c76f0d4a6bf773a259
SHA512 a9795a14c124a00bf12605104e94fcb48a5be94bb5c9eaeda766b844fe9317b20da290aadb2985afed4844edeae988d7f96b384a2f1a85556fb8af4d1718f54f
SSDEEP 96:DuMVVuIu+xtlFuduauTuEu+ujmuEuaugz6uPp:DXVdtxtlFmh2JR4mFBX6o
TLSH
T1AFA19BF7C3D8C63DC81156F8AB157E1BCE6A0E2493283C66C9D5AE4B53E58B1D38064E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 42aaca67687c922de0c9ab0d923e352b5777eac21a5ea761bc6c03020bd73bd9
MD5 c2be0a0d2c31da832a995b21fed93aae
SHA1 809b5c15a7a4445f93499d64c83b3e7e7cf8c80c
SHA512 797eb1dd844c2951c5e339409419c179f30bb6601d639d63d5dbdb55c818b3af786bd2ee30d4a3859f150044664f74af32b9ecd73468d4d4e4a40b6010c186eb
SSDEEP 192:gR6QiKv7cvAPRp2TArXsb+WNnxBYSBUDw2WCiyIsnAUgR:gR6QiGA6XZXwnvv2IR
TLSH
T10222732EAD14B53F5CDAD22AFA367767E2F5103124942E80D6F9893D21E79CC6217407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 715b0d61249a4148bace8a65681d937fee5b11876d6b3854e6b0ac2abd31b9c3
MD5 878a656c1006ae3904aee372806a5405
SHA1 2595ad9bc11686679ae8a6c6b455edc060e38bf3
SHA512 a66174e0b31ec24462e26f23654a4999cf98acdea8815eac7dda9cc1639e9e8cc94365f932b263414a4092d70e605d259fac72830345d5b97b81531d79b8a359
SSDEEP 192:gR6QTVKv7TQv3PRp3UrArXsb+WNnxBYSBUDw2COiyIsnAUgE:gR6QRGA3XjXwnvv22E
TLSH
T19732942EAD14B53F5CDAD219FA367B67E3F5103164942E80E6FD892D21E79CCA217007
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 7e6b5c216c0be40b56d8c5a2161c61d7d5fd8633b15aaeace419caf249290dfa
MD5 1a2e4977fac7bcf3ad922383081dab7e
SHA1 a8c41798ecb3259650339a1475fa37eff2e469e7
SHA512 b8b811c00b1c5e2411696499f7b69131649d58b890d7739ae19f2a2633f04d4f8a1e2ae1599b9d901f2e34ea5c80cb4b2a46d9f991f2eea43f0926fa1cb7ea06
SSDEEP 192:gR6QTVKv7TQvAPRp2UrArXsb+WNnxBYSBUDw2uMiyIsnAUgE:gR6QRGA6XIXwnvv2+E
TLSH
T1A432942EAD14B53F9CDAD21AFA367A67E3F5102164D42E80D6FDC92D21E79CCA213407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 eed669348a499c68df259a9fb00e5df7639b970ca08fe0ee7cca3c996ef10bc0
MD5 a34965c73d88dfeb146374e6a3832352
SHA1 8918bd2b330384b6bd11068bfd8b199de6569b77
SHA512 e84d05bbe7afe4cffb85e69bce69f1a775d0d7240865d42f85d94227102a85ff831331fa9a197df1508b7b7443e7a0923cbbf820bbcbe2ca093c53dc9feccb33
SSDEEP 192:gR6QiKv7TQvAPRp2TArXsb+WNnxBYSBUDw2WCiyIsnAUge:gR6QiGA6XZXwnvv2Ie
TLSH
T1C432832EAD14B53F5CDBD21AFA367A67E2F5103164942E80E6FD882D21E79CCA217407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 137d576280928f0d8269c25ae71716d2f8c5daef6e56eb990301d9297f29e779
MD5 c0ba5f0a5a5f8f0e42ba2218e3c4f93d
SHA1 98d38e6180f272b46b334c7ebd76ac42b8833c78
SHA512 977fab8188c12b0604966d252aa50614a5875fbb5b0bc115dac2595110ddbca990ec76946c8a2f006335c4f9cb3d3a2b01b2cc071f4ac949d2294b07e9a5f116
SSDEEP 192:ens4K6fb7KxkXqK4I40pUZNCgVLHrKHfFKslESfFXzKD/wX+ErUkKN9MY2ACkoPC:usjYb7KxkXqKf/pUZNCgVLH2HfgslzF6
TLSH
T1C832E92BA48D9A3F4FE8D51DDC136F4FADB502966228096497FB9C0803F578E114A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\97c80623-b816-4adf-b67a-4e2e2cec9f66\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 214B
SHA256 95e40d07f4e69e2bf24cc2bc7ed9b535960115974d68c267462c1cdd1b1fb399
MD5 04e3532efec00c54829198b611407eba
SHA1 0b29c6fa59560e08847a584197130fd1b8b2572e
SHA512 5d1da35bf11ca223e8da1eff26ad1252c438a6a23f15ef5ff361a56213e9d13d00a42adeef6ee8b7021e099c7cca0b38af69c3efcf9e75073d161b377dd6582e
TLSH
T113D023D695714A961F30AE84D034612F90D7DC09D4C4CCF46D14B17130FCD03C401972
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 130B
SHA256 b1f42e96bb7a18c19fb17e320711b53294c5f88807cdcc97885c5b9471e26d7a
MD5 2a71d88fd9b7b0b02e91b23280f2ff9d
SHA1 642e786026f9e21432d5657bd31f922115c67e13
SHA512 bfaf92026d2fc06d34ace46ab648ea68677d868a71d31c99df58794c6c5df81f668d10b5a6e1e60e376d2e7102dcbdee8520408cba0c478703d6185bf88b498d
TLSH
T17BC09BD25550879B4E349EC86034772DD59F854CC5C4DCF4B514514534789174451965
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe59ef86.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt~RFe59ef86.TMP
Size 137B
SHA256 27b61126db403ac03e8c7ff32306ff8151ad5b9fff6674916b73547ef5addb2e
MD5 28b301331ae49f6df1c52d6544966886
SHA1 0898966f211a25e3b4d558ced1a5587b1030ae6d
SHA512 c187933d2a87af6be78208076c8b3a626461abdb71d23c93cd00c6888190f3dd7b4bf24895afabfce6a3bb0cffdbeac6d9f990e289228782b9622e1b51f567bb
TLSH
T199C02BD254208B874F305DC45034322DD0DF8C0CC8C4CCE4B104704130389138000861
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 e34028603a0a9ca44b47515d7bbdd1922922f521478eb844c62faefdf167b7c2
MD5 da42a93e50590c0ea6f2f05d1e551c18
SHA1 cbf7fdc9e7d840aa5029166aad957f1d348977f5
SHA512 f5e982712c3a86544debceeb8f131642752dce3809417777399bc4839bbdebefc93cbc0689db2738b5741c060b56bc72c9699cf8315c2631162065e7218af22a
TLSH
T1B6B01200804F1504CC4085B025081C4831005F71C1012282A3E4E5D59C430F02318A94
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 c872856240c17e503b307b121407160b6d73f74a6276806247e8b882a08521b4
MD5 c3f57dddc1584f748837347c89e34854
SHA1 d38447a06bfc2fc51db9716cc60b3ce91e3e45d5
SHA512 02e1ac9a671ec54f1a1de87e1a8ed3d4fe2e40ecb12333e4d7cd0251b5b7329a00e302126dfde1fc91a4508fc3ec21b3f85b4c038296fd6edbaf2706c4f9ae15
TLSH
T187A002E05AC00815EDE14670B4660D612B9188591A6683135492C454CD9B1C5A5E6904
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a3133.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index~RFe5a3133.TMP
Size 48B
SHA256 31e4960c8658b8fa1a1729c6cfd531ad80022bc62c74245227280df519ac32c5
MD5 2b37b44f7773507c0b476ee5bb2536af
SHA1 9271524d37b4b2b9da74e63b546ea30539bce968
SHA512 63984f070b8cd9bb01fac5bc0bcb0b97ad34b94af09121023bd2d17e18dfe94ce978c4ff2afdca8ebcc229e074f91763666037d4e55177586d7a86eb0c4c4e10
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 132KB
SHA256 518c104186fa14aefedecfbda7fe26efcf45dfae2faa8a4f9836852dfea156ea
MD5 7191c387b27446c2bf0aea9738f053fc
SHA1 7837cb8e17c3bc079f6873e70fc32b7bce2ac515
SHA512 8d2385fa3edb0dee8338b7c378246d2e14e5d21677ab7f4676dc577c7d85e241d70b9967fc0755908fdddd990bd002029a0e14527e136c5ba32abe3d96b056a1
SSDEEP 3072:L2vyBkjartaCCMcsOE/HPRJQdHJ6E3i0pdhtn7rMm4Gcvj:xPtbC4OYH5J66E3i0vvN4Gk
TLSH
T1B0D31220309DAB17EF05C16852231E029CF8DD79867E9AEDC5EABC0C49E3B5D074647B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 133KB
SHA256 1d0fb18b9606724369b6f327e3e8eb92c69c376b6f0212089cd440805e6a343e
MD5 b1e69e159ffbe9dedb0ac9fc72f3e4e3
SHA1 c9b1df5f178bf247f64eb1631ecbfa64986ea900
SHA512 d6b7404c9b0921f02d1c6639201a561cb8fe49e7b8e94861ddf5ffcdb5a926f7568714500a6de99e29f5d2973d0012a2b260da41b89e6ea60032e9035eaef63c
SSDEEP 3072:qC2vyBkjartaCCMcsOE/HPRJQdHJ6E3i0pdhtn7rMm4Gcvj:qgPtbC4OYH5J66E3i0vvN4Gk
TLSH
T1B4D31235344DAB17EE06816C11122D028CF8EF7AD67E9EDCD5EDBC0889E7A5D0A0647B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 132KB
SHA256 84db86db111cbadbefa7bb7c23ea474d158220e3998e03e1c9a081fa382088f7
MD5 ef01b6b3f5cd82c4ad0fb52e3fe0b078
SHA1 a44b115ad165d82512483ed697f54da7979d8e6b
SHA512 251f5ea746c583056a94c4b05a008a17744f0805b3bbaab8272b20f1138ad554aaa2b728eb24da2b028610414a36dc6d52975adfea8b49d3bdae44239a79a8fc
SSDEEP 3072:a2vyBkjartaCCMcsOE/HPRJQdHJ6E3i0pdhtn7rMm4Gcvj:IPtbC4OYH5J66E3i0vvN4Gk
TLSH
T128D31220309DAB17EF05D16852222E029CF8DD79827E9AE9C5EABC0C49E3B5D074647B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 ab824220e0e9257c373f5f16cce87d87bcedc0b2c508dd9d4f7dc10fd6185c99
MD5 92c8f9b9054992fef09cce974eaff0e0
SHA1 4ff8792c060b159ca4b9fd8f3fcfe2a919bd3fca
SHA512 3862e19d6730772108193c4bae8d44e32d447bc49cb0a921c52b24a581f1ba9cec3e5cff58d54851e64989f8181333d2758b468c25aedfc91cceadf2a9e6aae2
SSDEEP 96:CC6sd+TWqN/K890wxi+9M7fX3urjUBdyRDotok5Ap0cDyB6vGyvtBWG0c23bOv4a:CCnoWqNVVxi+9oP8DUDe0KSDeW9c23bQ
TLSH
T127A11831B879997789F6C484B1122E538F7860ABA522DFC8E8EE5A0C20B309C0342627
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6096_2045325951\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

Unconfirmed 257973.crdownload

Path C:\Users\Admin\Downloads\Unconfirmed 257973.crdownload
Size 3.2MB
SHA256 34071c688ff669cd87d5a69e421559fc94b88c125d31f94adfd5f5cdec752b31
MD5 5a041d8cc0965600d35436fe77476f0a
SHA1 d7f75977ba68f1419fb4a9f388ac49d8ecf1f980
SHA512 db2493bc3e22a4a679de24b5ff92a4858cdaed44122e00aa91a39b43a051e9f9cade83e6278b5d2c05bc98a61a4f8eb96ce60ca248c8c29ffa3c4ccfbe62f463
SSDEEP 98304:k+Oin0pJWnlAzCeuA9IIEomreVz2+xUKY6v:k+Oi6WOmzAWI4rIaGU
TLSH
T13EF5330AA7C00EADDA85E538138B4A1CD72FE67D34097EAB5704147C8877265F73E7A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2056-698-0x000000000B590000-0x000000000BC9F000-memory.dmp

Download

memory/2056-695-0x000000000B590000-0x000000000B83B000-memory.dmp

Download

memory/2056-697-0x000000000B590000-0x000000000BC82000-memory.dmp

Download