hxxps://topersoft[.]com/programs/launchergdpi?ysclid=ln7fvle9f4955934476

Analysis

max time kernel
260s
max time network
266s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
21-08-2024 10:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://topersoft.com/programs/launchergdpi?ysclid=ln7fvle9f4955934476

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
5260	Launcher for GoodbyeDPI.exe
4944	goodbyedpi.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 2 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\7zO8979A1DB\Launcher for GoodbyeDPI.exe:Zone.Identifier	7zFM.exe
File created	C:\Users\Admin\AppData\Local\Temp\7zO897183FB\goodbyedpi.exe:Zone.Identifier	7zFM.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Launcher for GoodbyeDPI.exe

Checks processor information in registry 2 TTPs 18 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 40 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\NodeSlot = "3"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\SniffedFolderType = "Generic"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1 = 19002f433a5c000000000000000000000000000000000000000000	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-970747758-134341002-3585657277-1000\{D4CE3BDB-DA66-4B34-A90B-2E2116E0DE8B}	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 0100000000000000ffffffff	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\MRUListEx = ffffffff	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0 = 8c003100000000000259907d110050524f4752417e310000740009000400efbec55259611559c1542e0000003f0000000000010000000000000000004a00000000007ca41700500072006f006700720061006d002000460069006c0065007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100370038003100000018000000	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\MRUListEx = 00000000ffffffff	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	OpenWith.exe

NTFS ADS 5 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\gbdpilauncher_8.2.rar:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\gbdpilauncher_8.2 (1).rar:Zone.Identifier	msedge.exe
File created	C:\Users\Admin\Downloads\gbdpilauncher_8.2(1).rar:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\AppData\Local\Temp\7zO8979A1DB\Launcher for GoodbyeDPI.exe:Zone.Identifier	7zFM.exe
File created	C:\Users\Admin\AppData\Local\Temp\7zO897183FB\goodbyedpi.exe:Zone.Identifier	7zFM.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
3608	vlc.exe
5296	vlc.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
1868	msedge.exe
1868	msedge.exe
2476	msedge.exe
2476	msedge.exe
5108	identity_helper.exe
5108	identity_helper.exe
3784	msedge.exe
3784	msedge.exe
3844	msedge.exe
3844	msedge.exe
4768	msedge.exe
4768	msedge.exe
2988	msedge.exe
2988	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
2536	msedge.exe
6040	7zFM.exe
6040	7zFM.exe
6040	7zFM.exe
6040	7zFM.exe

Suspicious behavior: GetForegroundWindowSpam 6 IoCs

pid	Process
3772	OpenWith.exe
3608	vlc.exe
4916	OpenWith.exe
2548	OpenWith.exe
5296	vlc.exe
6040	7zFM.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	1600	firefox.exe
Token: SeDebugPrivilege	1600	firefox.exe
Token: SeDebugPrivilege	1600	firefox.exe
Token: SeRestorePrivilege	6040	7zFM.exe
Token: 35	6040	7zFM.exe
Token: SeSecurityPrivilege	6040	7zFM.exe
Token: SeSecurityPrivilege	6040	7zFM.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
3608	vlc.exe
3608	vlc.exe
3608	vlc.exe
3608	vlc.exe
1600	firefox.exe
1600	firefox.exe
1600	firefox.exe
1600	firefox.exe
1600	firefox.exe
1600	firefox.exe
1600	firefox.exe
1600	firefox.exe
1600	firefox.exe
1600	firefox.exe
1600	firefox.exe
1600	firefox.exe
1600	firefox.exe
1600	firefox.exe
1600	firefox.exe
1600	firefox.exe
1600	firefox.exe

Suspicious use of SendNotifyMessage 29 IoCs

pid	Process
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
3608	vlc.exe
3608	vlc.exe
3608	vlc.exe
5296	vlc.exe
5296	vlc.exe
5296	vlc.exe
5296	vlc.exe
5296	vlc.exe
5296	vlc.exe
5296	vlc.exe
5296	vlc.exe
5296	vlc.exe
5296	vlc.exe
5296	vlc.exe
5296	vlc.exe
5296	vlc.exe
5296	vlc.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
3772	OpenWith.exe
3772	OpenWith.exe
3772	OpenWith.exe
3772	OpenWith.exe
3772	OpenWith.exe
3772	OpenWith.exe
3772	OpenWith.exe
3772	OpenWith.exe
3772	OpenWith.exe
3808	OpenWith.exe
3808	OpenWith.exe
3808	OpenWith.exe
3808	OpenWith.exe
3808	OpenWith.exe
3608	vlc.exe
4916	OpenWith.exe
4916	OpenWith.exe
4916	OpenWith.exe
4916	OpenWith.exe
4916	OpenWith.exe
4916	OpenWith.exe
4916	OpenWith.exe
4916	OpenWith.exe
4916	OpenWith.exe
4916	OpenWith.exe
4916	OpenWith.exe
4916	OpenWith.exe
4916	OpenWith.exe
4916	OpenWith.exe
4916	OpenWith.exe
4916	OpenWith.exe
4916	OpenWith.exe
4916	OpenWith.exe
4916	OpenWith.exe
4916	OpenWith.exe
4916	OpenWith.exe
4916	OpenWith.exe
4916	OpenWith.exe
4916	OpenWith.exe
2548	OpenWith.exe
2548	OpenWith.exe
2548	OpenWith.exe
2548	OpenWith.exe
2548	OpenWith.exe
2548	OpenWith.exe
2548	OpenWith.exe
2548	OpenWith.exe
2548	OpenWith.exe
2548	OpenWith.exe
2548	OpenWith.exe
2548	OpenWith.exe
2548	OpenWith.exe
2548	OpenWith.exe
2548	OpenWith.exe
2548	OpenWith.exe
2548	OpenWith.exe
2548	OpenWith.exe
2548	OpenWith.exe
2548	OpenWith.exe
2548	OpenWith.exe
2548	OpenWith.exe
2548	OpenWith.exe
2548	OpenWith.exe
2548	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2476 wrote to memory of 5092	2476	msedge.exe	80
PID 2476 wrote to memory of 5092	2476	msedge.exe	80
PID 2476 wrote to memory of 1776	2476	msedge.exe	81
PID 2476 wrote to memory of 1776	2476	msedge.exe	81
PID 2476 wrote to memory of 1776	2476	msedge.exe	81
PID 2476 wrote to memory of 1776	2476	msedge.exe	81
PID 2476 wrote to memory of 1776	2476	msedge.exe	81
PID 2476 wrote to memory of 1776	2476	msedge.exe	81
PID 2476 wrote to memory of 1776	2476	msedge.exe	81
PID 2476 wrote to memory of 1776	2476	msedge.exe	81
PID 2476 wrote to memory of 1776	2476	msedge.exe	81
PID 2476 wrote to memory of 1776	2476	msedge.exe	81
PID 2476 wrote to memory of 1776	2476	msedge.exe	81
PID 2476 wrote to memory of 1776	2476	msedge.exe	81
PID 2476 wrote to memory of 1776	2476	msedge.exe	81
PID 2476 wrote to memory of 1776	2476	msedge.exe	81
PID 2476 wrote to memory of 1776	2476	msedge.exe	81
PID 2476 wrote to memory of 1776	2476	msedge.exe	81
PID 2476 wrote to memory of 1776	2476	msedge.exe	81
PID 2476 wrote to memory of 1776	2476	msedge.exe	81
PID 2476 wrote to memory of 1776	2476	msedge.exe	81
PID 2476 wrote to memory of 1776	2476	msedge.exe	81
PID 2476 wrote to memory of 1776	2476	msedge.exe	81
PID 2476 wrote to memory of 1776	2476	msedge.exe	81
PID 2476 wrote to memory of 1776	2476	msedge.exe	81
PID 2476 wrote to memory of 1776	2476	msedge.exe	81
PID 2476 wrote to memory of 1776	2476	msedge.exe	81
PID 2476 wrote to memory of 1776	2476	msedge.exe	81
PID 2476 wrote to memory of 1776	2476	msedge.exe	81
PID 2476 wrote to memory of 1776	2476	msedge.exe	81
PID 2476 wrote to memory of 1776	2476	msedge.exe	81
PID 2476 wrote to memory of 1776	2476	msedge.exe	81
PID 2476 wrote to memory of 1776	2476	msedge.exe	81
PID 2476 wrote to memory of 1776	2476	msedge.exe	81
PID 2476 wrote to memory of 1776	2476	msedge.exe	81
PID 2476 wrote to memory of 1776	2476	msedge.exe	81
PID 2476 wrote to memory of 1776	2476	msedge.exe	81
PID 2476 wrote to memory of 1776	2476	msedge.exe	81
PID 2476 wrote to memory of 1776	2476	msedge.exe	81
PID 2476 wrote to memory of 1776	2476	msedge.exe	81
PID 2476 wrote to memory of 1776	2476	msedge.exe	81
PID 2476 wrote to memory of 1776	2476	msedge.exe	81
PID 2476 wrote to memory of 1868	2476	msedge.exe	82
PID 2476 wrote to memory of 1868	2476	msedge.exe	82
PID 2476 wrote to memory of 3296	2476	msedge.exe	83
PID 2476 wrote to memory of 3296	2476	msedge.exe	83
PID 2476 wrote to memory of 3296	2476	msedge.exe	83
PID 2476 wrote to memory of 3296	2476	msedge.exe	83
PID 2476 wrote to memory of 3296	2476	msedge.exe	83
PID 2476 wrote to memory of 3296	2476	msedge.exe	83
PID 2476 wrote to memory of 3296	2476	msedge.exe	83
PID 2476 wrote to memory of 3296	2476	msedge.exe	83
PID 2476 wrote to memory of 3296	2476	msedge.exe	83
PID 2476 wrote to memory of 3296	2476	msedge.exe	83
PID 2476 wrote to memory of 3296	2476	msedge.exe	83
PID 2476 wrote to memory of 3296	2476	msedge.exe	83
PID 2476 wrote to memory of 3296	2476	msedge.exe	83
PID 2476 wrote to memory of 3296	2476	msedge.exe	83
PID 2476 wrote to memory of 3296	2476	msedge.exe	83
PID 2476 wrote to memory of 3296	2476	msedge.exe	83
PID 2476 wrote to memory of 3296	2476	msedge.exe	83
PID 2476 wrote to memory of 3296	2476	msedge.exe	83
PID 2476 wrote to memory of 3296	2476	msedge.exe	83
PID 2476 wrote to memory of 3296	2476	msedge.exe	83

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://topersoft.com/programs/launchergdpi?ysclid=ln7fvle9f4955934476
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffee0fe3cb8,0x7ffee0fe3cc8,0x7ffee0fe3cd8
  2⤵
  PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1900,7892054441923703476,12892335188169495086,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1912 /prefetch:2
  2⤵
  PID:1776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1900,7892054441923703476,12892335188169495086,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1900,7892054441923703476,12892335188169495086,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2676 /prefetch:8
  2⤵
  PID:3296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,7892054441923703476,12892335188169495086,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,7892054441923703476,12892335188169495086,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:2240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,7892054441923703476,12892335188169495086,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4080 /prefetch:1
  2⤵
  PID:4080
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1900,7892054441923703476,12892335188169495086,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5984 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1900,7892054441923703476,12892335188169495086,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3952 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,7892054441923703476,12892335188169495086,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5880 /prefetch:1
  2⤵
  PID:2288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,7892054441923703476,12892335188169495086,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5220 /prefetch:1
  2⤵
  PID:2000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,7892054441923703476,12892335188169495086,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5560 /prefetch:1
  2⤵
  PID:1948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,7892054441923703476,12892335188169495086,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5592 /prefetch:1
  2⤵
  PID:3032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,7892054441923703476,12892335188169495086,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5732 /prefetch:1
  2⤵
  PID:2412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1900,7892054441923703476,12892335188169495086,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5468 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:3844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1900,7892054441923703476,12892335188169495086,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6252 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:4768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,7892054441923703476,12892335188169495086,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5508 /prefetch:1
  2⤵
  PID:1452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,7892054441923703476,12892335188169495086,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6744 /prefetch:1
  2⤵
  PID:3620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1900,7892054441923703476,12892335188169495086,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5068 /prefetch:8
  2⤵
  PID:2580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1900,7892054441923703476,12892335188169495086,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5584 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:2988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,7892054441923703476,12892335188169495086,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6728 /prefetch:1
  2⤵
  PID:424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,7892054441923703476,12892335188169495086,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1236 /prefetch:1
  2⤵
  PID:3816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,7892054441923703476,12892335188169495086,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7060 /prefetch:1
  2⤵
  PID:4396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,7892054441923703476,12892335188169495086,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5284 /prefetch:1
  2⤵
  PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,7892054441923703476,12892335188169495086,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6748 /prefetch:1
  2⤵
  PID:3232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,7892054441923703476,12892335188169495086,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6088 /prefetch:1
  2⤵
  PID:3924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1900,7892054441923703476,12892335188169495086,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5360 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2536

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3024

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1264

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3772

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3684

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3808
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\gbdpilauncher_8.2.rar"
  2⤵
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:3608

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4916

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2548
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\Downloads\gbdpilauncher_8.2.rar"
  2⤵
  PID:3524
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url C:\Users\Admin\Downloads\gbdpilauncher_8.2.rar
    3⤵
    - Checks processor information in registry
    - Modifies registry class
    - NTFS ADS
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    PID:1600
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1964 -parentBuildID 20240401114208 -prefsHandle 1892 -prefMapHandle 1872 -prefsLen 23678 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4d699ebf-8dd4-445a-9ffe-8d86718834ee} 1600 "\\.\pipe\gecko-crash-server-pipe.1600" gpu
      4⤵
      PID:4164
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2384 -parentBuildID 20240401114208 -prefsHandle 2376 -prefMapHandle 2364 -prefsLen 24598 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {80520053-1c0a-46d2-9802-3b4c081c97a8} 1600 "\\.\pipe\gecko-crash-server-pipe.1600" socket
      4⤵
      Checks processor information in registry
      PID:2620
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3128 -childID 1 -isForBrowser -prefsHandle 2972 -prefMapHandle 3164 -prefsLen 24739 -prefMapSize 244658 -jsInitHandle 1228 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0cc16ed3-eed6-469f-aa81-92a61b0af987} 1600 "\\.\pipe\gecko-crash-server-pipe.1600" tab
      4⤵
      PID:2952
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3576 -childID 2 -isForBrowser -prefsHandle 3648 -prefMapHandle 3644 -prefsLen 29088 -prefMapSize 244658 -jsInitHandle 1228 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0f2b6fb5-0213-4085-b6b2-0da48dbcf8f7} 1600 "\\.\pipe\gecko-crash-server-pipe.1600" tab
      4⤵
      PID:4916
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5088 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 5084 -prefMapHandle 5068 -prefsLen 29088 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {44f1772a-2bd3-446e-ae86-2541516e125e} 1600 "\\.\pipe\gecko-crash-server-pipe.1600" utility
      4⤵
      Checks processor information in registry
      PID:5784
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5436 -childID 3 -isForBrowser -prefsHandle 5428 -prefMapHandle 5424 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1228 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {29f7a0ff-4a63-4ed9-884e-b5155536712b} 1600 "\\.\pipe\gecko-crash-server-pipe.1600" tab
      4⤵
      PID:6096
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5664 -childID 4 -isForBrowser -prefsHandle 5584 -prefMapHandle 5592 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1228 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {42a8f64e-cc29-475b-b29f-bb45654853f5} 1600 "\\.\pipe\gecko-crash-server-pipe.1600" tab
      4⤵
      PID:6108
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5784 -childID 5 -isForBrowser -prefsHandle 5860 -prefMapHandle 5856 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1228 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e2721bc8-ef62-4ac9-af2d-96e0081e7104} 1600 "\\.\pipe\gecko-crash-server-pipe.1600" tab
      4⤵
      PID:6120

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" C:\Users\Admin\Downloads\gbdpilauncher_8.2.rar
1⤵
PID:5512
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" C:\Users\Admin\Downloads\gbdpilauncher_8.2.rar
  2⤵
  - Checks processor information in registry
  PID:5492

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\gbdpilauncher_8.2(1).rar"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SendNotifyMessage
PID:5296

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\gbdpilauncher_8.2.rar"
1⤵
- Subvert Trust Controls: Mark-of-the-Web Bypass
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:6040
- C:\Users\Admin\AppData\Local\Temp\7zO8979A1DB\Launcher for GoodbyeDPI.exe
  "C:\Users\Admin\AppData\Local\Temp\7zO8979A1DB\Launcher for GoodbyeDPI.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5260
- C:\Users\Admin\AppData\Local\Temp\7zO897183FB\goodbyedpi.exe
  "C:\Users\Admin\AppData\Local\Temp\7zO897183FB\goodbyedpi.exe"
  2⤵
  - Executes dropped EXE
  PID:4944

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8276eab0f8f0c0bb325b5b8c329f64f

SHA1
8ce681e4056936ca8ccd6f487e7cd7cccbae538b

SHA256
847f60e288d327496b72dbe1e7aa1470a99bf27c0a07548b6a386a6188cd72da

SHA512
42f91bf90e92220d0731fa4279cc5773d5e9057a9587f311bee0b3f7f266ddceca367bd0ee7f1438c3606598553a2372316258c05e506315e4e11760c8f13918

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
058032c530b52781582253cb245aa731

SHA1
7ca26280e1bfefe40e53e64345a0d795b5303fab

SHA256
1c3a7192c514ef0d2a8cf9115cfb44137ca98ec6daa4f68595e2be695c7ed67e

SHA512
77fa3cdcd53255e7213bb99980049e11d6a2160f8130c84bd16b35ba9e821a4e51716371526ec799a5b4927234af99e0958283d78c0799777ab4dfda031f874f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index

Filesize
744B

MD5
b9cdfa367d5081130681e9791793c142

SHA1
1caef731f3791d9db0f82de224d8d9bfa7f0f50f

SHA256
80b2ec092968da4d6f7fae64312b326e740db04e4ce06d04dc650cccbc577850

SHA512
107fbc19c019fc99f4b4bdb35ca7bc2ab4561e8584303c89b1ace5101520599c90b1aea9e88447fb42d3ce742d42e2b4114bc5e77be153cc406831dafef2dad1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
9a4e7654986e82892e91ff0278bcbbd9

SHA1
119c20e5700d43f4e9ee629d97f0cbe9a6406092

SHA256
4fcf329da38330a889a3e1df952de84605369a12e2f4a1af7406c271eb612064

SHA512
7add24c8692376ea82536b5becbd9f5c9533c8bbf56fe9da09a8c4c6cfe700325d5739a7999cf6c920c7f5c77c8960f1d35c349022c0f118d49d26975e308928

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\000\t\Paths\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
aab2b5f4913168b2236d0ad17f6abaab

SHA1
025b441f4c57d04e855581736a7c550bbc785fb1

SHA256
e5dc53c0fcd4166efd071e94dd350435d49ff98131b6bd324709964ade0927cd

SHA512
073185a3e7f72702f59e8296c7cf79729d14892f66273d7601970e6e8b2d5dc2cb98b23f222adf8f5aef632bf20a3aafbe922aed0f61e70e86aaa40f84dbe6dd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
1fb8a82dcc9ed0a8f83d26257dbc238a

SHA1
48c5fa5785ad0d96d574d846d3235ee5f8ba91bb

SHA256
638b78679f4847504e20a8d4078fc661296628d39fba3f371aea57fbcbb1cf11

SHA512
2a3e6a2461242884d08dd4c3844e053c1d179dc93f88c93692aa12d7e7ca3464e769e3c70890b966ded8bb6f88f7391aff3f54cb01925ed98ef7d7a5eb3c6d6c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
abe5eec3bd1302d30ea273d1f32c0f30

SHA1
72a4e1fbd488badc015ab48aa38514c0d33a3d29

SHA256
8e59281de6dfcf756cf9e2b6d448de7498309551e170129cbae02c1dc854d5db

SHA512
7b113c833dfdbb5fa7a1fbcd3b48b71270d0d6673db1b629c672351f20712f074096c53260f4bd6310e3df5b1ab29a361ab43a6e2057cb2d8c58c8ef301ab54f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
47475816fc4680d1f76de03c9d646cef

SHA1
1446b8eeb476adde01871b975dae524fea7ac3f6

SHA256
51d71be8957ba310933061e406921db60a7a167bb2a2b939a08256255268fa9b

SHA512
ba14db6abc3f4f7ee6652019792fd2c3c2ba1570e4346ca23a62df842f8a58eae13cae48fb402534903284939cfd7ece6c06e32007ca842a8295a953b156a071

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
a3303a4328e15101ba06e3955d6ba700

SHA1
c4fd32bbed505be2cbbfd2a6846e2d40afe970f1

SHA256
57e92fa41e6ea90d7fd5824a01af9a5cff443dc68e95140dc920d40e6c02e7d7

SHA512
9c0a78d89b0725a57a3b57549437f130eaec749ee3d762399daa3831b82239ae5d8fa137b51932bbd44d1c21bba42f9b613f2e880d9d35af9d30830dde3f97f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
20487db6aa42ffb9a9031a840486b8dd

SHA1
3dcbbf10ad34f032edaa083a7dc573d63cabf581

SHA256
ce4119b62286b7ccc9a1e1b6159d3541ea6aa15c7c7ea71291e7c6b01a57dc05

SHA512
83f972b8a0b0c19a4c00fff66b2c7ac0d0edc83278ac71ec1070d2a3a308fe877b371ac6f1912ca0ae58881f800bf399d86f31b1ba8d93c703d82ee2202c4816

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
fc9e348ae456e19867ac135706d8a0ee

SHA1
dd723e6d31391d74e94c576982b63e98281d05c9

SHA256
77a2f01fe90af6ead929245eb018884746226aa9976790e2b0895916cfab3821

SHA512
b9e9c59456336ee59a918f113be7bdf54e873e83dd4897fc3b2ccf710b17feb3cb38c5e9875754fc58d1f27d165ba1903503651f2b8087426212c2053ee112e5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
31f21ad68071c5726175f6420bc2db7a

SHA1
47a8891a3a6a7703d3aec12438e7d39729735836

SHA256
df2135ca963ae956f49046e1b1d4c8c4a8951cc3ac0112fe4dbeb3fce69cf855

SHA512
d64e43b760e6c68fb730596a31a3429a87f6f3c4409b0e710bcdd9fc4a327da3c1151f823b677047df301fb0b5217902c901172708e8ff0144e2e1db149210d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
1fe6f787121da2c6b5481b8a300108fe

SHA1
6fe819b4f42c85fce0c8f9b23208521496e62238

SHA256
a242077a359b7537c65a30b51e18bed75ca2260c7261b1b5f91f6565006c751d

SHA512
aa2b5bf79db52e13ccf399ceb1d394a447eea694b43bed567d03e76253ec660b1d255a303864316d4a7b8aaf6415c9512035e5b9d2dffd9d84295ca792316a34

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
c5a0b9ad39a8c1772a67b436596dfcaa

SHA1
e4b2cf1964684b58de7f0c6aba010044e3ac9791

SHA256
6eff9ffb2a358b1d88f646ec3ef0ce6a8490f0ee2f3d8bd3d9a2e2104511195d

SHA512
a5f07794496e8ffb651d2ad8c7b5f8f9400bcfaaae86a6208af9623fe2f01fb0263abbf71d65654679dd9fcc09db1c7cb7f24a5c4076b1317d58347b46a169d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
6ffe893fb8cd13b68b4d375317bb5fb9

SHA1
79df39f925969e69092237226d3ca27c807ff691

SHA256
7e91c3340ad42cc06b5a3414e6da9d5a6dfcbed6c7bbae29e272d608c43684d1

SHA512
9f9b96121cee0e6cb5c07416ae3c9ad61dcfdc7b7a83b3e1bb9eb3f0d41c0f7760abee24d28e9c6418cae0a152b90b18ed75d98839ae78984ae4c818de343d64

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
35f1ff97e38a2d4d96ba923d4cc046db

SHA1
5fa95112458cd483d48f5f198e6dd560a1026e26

SHA256
bb2964cfd6361f3a468c78703880029309804d58d3569fe3891bfd1b9c36b8e1

SHA512
120dff00f56e96c83cd3d4c79f49479f467c4f5231e8e5f0fcc382f151541f617ac0abc1483bf5aa7d7c8f6ffc93069f62471c1f78de3719380cf37d5824f1ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
e1621fe62e2b7a925efe2bd39b98d9a7

SHA1
9e5101406f5556707429ea0a7bf10523f58ace5a

SHA256
8bd66acd0968a6fe692366562dcb099440ff3cdee753b1665aab54b7341d6312

SHA512
fd7f36dce6ed261782cf940f693510ef13f4b1d4e1f9b8d144fdba356214a0313f3971ecd8e684200f283c30630fca66bd5f64036def07db91d611ced99ec9f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
dfa1ef9d6993ae4a2fde7b3c3039dcab

SHA1
bded758711b518555cf52747cb84585e4ed062ac

SHA256
34132d212eaf1e2d447ebc647c4494bb3247737931c02fe2418c1dfc492b40ce

SHA512
29a7e3d9174a773be023c6e1ce4edb2785337696a43ff72d6e0e79d3df50c405eb075ef0310342298ea84ecdc16325d9320f2bfc250d34a7d7ca2a922c6c379c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5849a6.TMP

Filesize
1KB

MD5
92372374f40dc62f7235fd0ca526fb7e

SHA1
597e57eebde3afa3e680c65dcfdb2f83d63148d3

SHA256
b8783a1c4b619cae1225008315d56e73935b9be90a8d4c19c9a7f6aed2ec831c

SHA512
feac2ed17b856a2339a594e55eb7b2e1b0d99fcbbb620aaa88a7b851acd7caae0bf8d2d750bca643eaf7d47817cadd820b81a478a3b1bddaba85d0642b42244a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
539c927c40f5ea288490163c30c43f82

SHA1
ea1a78f21724aba1c5034a6c4e46b3a6bc373e36

SHA256
cb55b33f9493a15e25105bcb88b4619840109521f7745c3a86448855cebd8b11

SHA512
68bd56a6f5cdd87839d0f0e8d9db8d4d74472c449ea91d9328a20507f17265934e0423a795321f0f25697336091d293eac0d57bde6413d40f76c1ebf88f40703

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
88570133dba09f4e90d997103ae2919c

SHA1
0fe7c4592651d3b4c9515e60bd4bca8214af7b32

SHA256
3e72fa7765db1c12717f2356759ccc4293f487478aa829e986bb90ae972239d5

SHA512
4e3cbdd5b53a09e874f82a1194be6e75cf41acd7241860623eed5215ad9b4d38868fc86b2d49f6fc0d94add3bdc21bb8e2f8e159512b9f072e12efd2ed5b7248

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
2e077db410016103b607b59a097dd8d1

SHA1
8a3a05754137f8526126ab815f0ff71bd6f75ed0

SHA256
5922fd4ff467d820822e438a22cb1c14fa7fd43b52fa6904b322e5d4a62f2e88

SHA512
68526dadc0937afd83def5c4e202d8db85284e8342b2d8ccd92ba61fc93f8da08ec4d54245d296947a8849f093197d52d2bb19f891dce308aaa7e07dc4dbeac0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
21fb43463a9659ff3ceef6c57cdb6802

SHA1
8d4188d225eeda07e2b4cc3096dd80ca481bced2

SHA256
b9a6aec40ebd5e9a8931cbef08ad0862a839372b61f525133433267baf421e05

SHA512
15fc3afc2262a6951f186baa5e09c996ff8214b27b929b67b5f0aef827ff62cdd3cb4b168c8e1ee19d7336956b9919b7531eff917585043290fa3eafff5dcad2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db

Filesize
28KB

MD5
94a18f4e846c0cd617bd96bfed6649dd

SHA1
1511a8110d0117b7b270437f8796272ba985c7f9

SHA256
d9f5a683b13d5aecb2a1c021295c14a2ffb3c944fc06b387d2f0b8bb9141b2d1

SHA512
7769bce8d8bd9ece7280153e2e8dea7f2ac1e5daf059cc3a2e4fcc565e902e5d548212874b0b440895e7ecc7420af038a551bd4493cdcd4f4f3570f1db540d1e

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\zgr882s2.default-release\activity-stream.discovery_stream.json

Filesize
30KB

MD5
141e04dfe6e35eda87bdd6242a1b1695

SHA1
bfe3ccc79ff70f96aa1d0544fe015a42b350a6c1

SHA256
6cd0eec2e3fcb6890c0a6841943897acd577f7d903f632217c34417e9e4eceae

SHA512
d3327a70d5c6aabbc56bdc569c089bb2f4e9162c2544c709ec33842540ca1312ed51e8c77ccbe86cb427d478ceccdb66159bd72f4902cb538cb12d972907c5fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zO897183FB\goodbyedpi.exe

Filesize
95KB

MD5
fd680538c2a80dc54c63ae39c3563fbd

SHA1
34fc71b71ab4361a68bf8355e9b2f54dd8cf910f

SHA256
fa9a32ae6eb24e2290941ea60f80e914168e1f84e900293bffd4393fb9a8fae2

SHA512
8bae7d75dcaf708433504e8b725da41f051fdaffccfc2e27e2450f89866b8d113a2782a11c54e1dbf03e5db22b883eaf7bea8cfd2472e67c7eebabc9de2ef838

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zO8979A1DB\Launcher for GoodbyeDPI.exe

Filesize
1.6MB

MD5
7f4e9cecbc182eb805e22c495651b7cb

SHA1
39c77851ec355194c9a5c2fa0d5aa3023e6c4edc

SHA256
4a621bd812df42fd1074840056333814f7b862343d1bfbe18251de1171b5b751

SHA512
bbf15e6c5595cc344b962253154b8b2e7954f6ccdd0cdf4eaec801cd9025b1f5a44b145443d5199f7bf1ccb0f5085e86d7b282139eb894261f2ca2790cc02b3c

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zO8979A1DB\Launcher for GoodbyeDPI.exe:Zone.Identifier

Filesize
137B

MD5
0a3d1fb22960b810106d5409a4524d15

SHA1
8d62ef3250a3d40b25449a5f2d4be770c8a86f0f

SHA256
55cb91f49093d3ebc49354a35b234afd14a7f2659e69ffecd735d788f70af1ce

SHA512
8679f304c820862ea8c6ce61fd8161fa90a98c9b086ca96326e047597fe7f79b66c00c2ac289d2e0c7f4d290f4de3c4c56fb38bcabfa0c26594d8812d823f41d

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
479KB

MD5
09372174e83dbbf696ee732fd2e875bb

SHA1
ba360186ba650a769f9303f48b7200fb5eaccee1

SHA256
c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

SHA512
b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
13.8MB

MD5
0a8747a2ac9ac08ae9508f36c6d75692

SHA1
b287a96fd6cc12433adb42193dfe06111c38eaf0

SHA256
32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

SHA512
59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zgr882s2.default-release\AlternateServices.bin

Filesize
8KB

MD5
5d6ab1aee8abf3a9d558b0a37c8942da

SHA1
1285b58334427d7c29fc609e52b83e7a30102405

SHA256
e138a36eef807fa47970e0d8ac21a74260cf14814628234cf0c5e84d80b0a5f7

SHA512
6619b112cb4bdfa806b576d8ed5a00b43896ee39044685b880bd0e34a34955912a0bbe89e5895042b54da62f680a7438bebdf7024ae1f6636effb8468e8f0549

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zgr882s2.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
562e0224d47a419defa18c09a3a9d645

SHA1
5aa4879f539bb6013fe77993ef837c61f69f3e63

SHA256
584065935399e2e0a0250b5a03a5ad23acda07630810451e017ce7ffa508b96a

SHA512
c34c02e10f3c2053706023a9a70ef30540e9a279164946f62378ec841c5987985c65ef8a9f1b79a6f22ab4ca3a99b9385e6e3e5f55ec80d14fdf27aca800f245

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zgr882s2.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
2e4306c23cd0c49e18647549ecf2c91b

SHA1
00d650a5efc9d000c44d4a0284448fa534814001

SHA256
d7639018d06ea0dec7a242d4cc273c9b54be8115251a42f43f2cf074abbdd080

SHA512
b6feca8d05f21953f949618f589d9404885131c0ac12193967e913ee39a06418007d241184da72b5b3e096fb6934ae30c009a28abbbb3965049719aba370c6f7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zgr882s2.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
d0cc3d0394c1eca34cd0f00eedb861e2

SHA1
631a7db1d71ea4c743c6f7ee461c184acf482f3e

SHA256
b3c49c3382bb0f49fed1fa227bd3fa670408c7c4f41309bb22b79d4338781289

SHA512
e98e739c14997949f68f4471fdb58b8c33c70112ba03116b4be0c1acdbc0a87c3f0f0c7aeaafa1837f6d7b6659d883c5070e5fa89169dd226cb95bca115b8d47

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zgr882s2.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
ca14c05dbdc435735761576bdfb40cc3

SHA1
b7ff32bf383fed6f2da96b9bbb86123dbc55d38b

SHA256
c4372e877d7ece5fecd935df16e5abbd7161bdefd0f6a065d9018bff8bbb7b18

SHA512
944fef5e6bae294e3bd23921d1f8708c4b002e7bcb24306f2b44a7651e265877ed898c4e79ab50c5bb173ba5a9af71c48ea5128df7b6a829e163c075373eec33

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zgr882s2.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
1856d6c05204c8bdba82a413d90d3a9e

SHA1
59bf53f22bf190013ea74644aae7fc01d5b01dc5

SHA256
196f28e0be2977d8bb01c98c64af5d383abc827ced7f7915a8c444a73eb610dd

SHA512
bdb829de3750df9ee1e124e48e72edfd606b0f26e1c70946d446206c4bd518e90dc13c3e1eff6692cfe5d197a04de7e8cff0fe942411a2a089db6a98c257d941

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zgr882s2.default-release\datareporting\glean\pending_pings\bb5dc568-4562-4492-949e-57e88d91743b

Filesize
24KB

MD5
7fb78bb61e866e5b0ab289efac4a3f80

SHA1
e980348de2df06a731702a159037051961db787e

SHA256
9f4d74d0da8d1944c7eac309807bb8039fc6414eea0d39f242f84e20c1a2c929

SHA512
a99a32449d8e922c52a4f6ec9b3a8465e451da7b36d7719e5b632e1a4eb26e52aa3fd8818ac26a425480af38221a4a20e0be612a89c54f9afdde7c060c5d3730

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zgr882s2.default-release\datareporting\glean\pending_pings\d2a0d9c0-ed08-4d1e-9cb2-588dea18c735

Filesize
671B

MD5
2d6fe5b64096bbcc7f7f03d7b797bb08

SHA1
29b33ae680ca565f19813f36c0d3644687422e9b

SHA256
78b229f7c263dbdbc5d7e1c9b775f786effd1c7e72be04ee8e034fdd0a65d65e

SHA512
7cfecc55c56084805c360598f27ec570ba210f3138a10bf5af16d9453fba8ca7346c946972a1a59b77438edf5cb2a29ec6df1a1dd0d4d1d327c8321336c02611

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zgr882s2.default-release\datareporting\glean\pending_pings\d5b9edf6-7b4d-43fd-a0ca-7177a3ca73af

Filesize
982B

MD5
797f05538eca45b47a5d5d0253af958b

SHA1
b46db27f237c88c82e906f1e73856e413dc47cef

SHA256
d8c5c0faff3fa58749b8efccf1308cde5af518b4d00dad23c341b1489738bde0

SHA512
3f7a1cee64982fa15230ea48cd22f623f9eca662f1b2e01a1d6664c30c23467f629d74165cdcdadbc388087c03bf2a49163e6e42cbaf072715b7c4037f0da62c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zgr882s2.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

Filesize
1.1MB

MD5
842039753bf41fa5e11b3a1383061a87

SHA1
3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

SHA256
d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

SHA512
d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zgr882s2.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

Filesize
116B

MD5
2a461e9eb87fd1955cea740a3444ee7a

SHA1
b10755914c713f5a4677494dbe8a686ed458c3c5

SHA256
4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

SHA512
34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zgr882s2.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

Filesize
372B

MD5
bf957ad58b55f64219ab3f793e374316

SHA1
a11adc9d7f2c28e04d9b35e23b7616d0527118a1

SHA256
bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

SHA512
79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zgr882s2.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

Filesize
17.8MB

MD5
daf7ef3acccab478aaa7d6dc1c60f865

SHA1
f8246162b97ce4a945feced27b6ea114366ff2ad

SHA256
bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

SHA512
5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zgr882s2.default-release\prefs-1.js

Filesize
12KB

MD5
b75d363ceac1bd7428b9c13b6c95c358

SHA1
f8d2567f20c7b21abaddfb05112f79004e8d2eab

SHA256
cdaa2d16f12b869d1c5d7f036335b8c6f27cbeb0dbef45fc90d484131802e0ce

SHA512
7e5a75124d18688ce47fa0e28ee19600c11af27724502478d8c0708b3bba3a1bc682a700d260492c1bd12835f1d113467269780b7e2eb93c420baa3bc51e3298

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zgr882s2.default-release\prefs-1.js

Filesize
11KB

MD5
6a148fd9210c604b6ee23692caaa0c25

SHA1
736573befd2cd29600e02cd012f0a043b5bbb22f

SHA256
185532bf11d7f4ade14f87bd02940fd2b006fada8548bb56196d4e99b22075f8

SHA512
73fd5d64937ec1323d1c2e5df302e7e6fb9ee4bd66d5f125d761efd847cd4c6059ba854475c47fc4714045765852eab967541bd5b67e94c822528eaa613aa430

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zgr882s2.default-release\prefs.js

Filesize
10KB

MD5
463d5446ff9e81e3555043db51d8f6a7

SHA1
289857f91b4c3d0a795353ddbe83c6770c5ba31c

SHA256
ff255908ae1eb5e585416c84421e351aa2752d6fccf2288df3b0ceb0dfb5dca7

SHA512
cf7be756ae89bd3bb03e04f392a9091a9c04399a51058ca654cd75d7b6cdc52cf4228741e1de77348e524109835170f9f03330cfa67d1b2fca9da2b41bb59daa

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zgr882s2.default-release\sessionCheckpoints.json.tmp

Filesize
288B

MD5
948a7403e323297c6bb8a5c791b42866

SHA1
88a555717e8a4a33eccfb7d47a2a4aa31038f9c0

SHA256
2fca1f29b73dd5b4159fa1eb16e69276482f5224ba7d2219a547039129a51f0e

SHA512
17e2f65c33f47c8bb4beca31db2aff3d4bbb6c2d36924057f9f847e207bdcb85ffcbb32c80dd06862ffc9b7f0bd3f5e2e65b48bb1bc3363732751101d5596b1a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zgr882s2.default-release\sessionstore-backups\recovery.baklz4

Filesize
1KB

MD5
873d4e51898e678f09b7df06185f6339

SHA1
1653b72f91fab2f8858bd313981b09648b833854

SHA256
aefac0be8a832b3c7f58880f1ab84d913380d777b525ba375d3cadff38bada7e

SHA512
8293585db5b7ef214103629e4ec739037672468aaa02e34e9a6f2ba290618b0fdf44d6859570e40feac1d6c3a11f3c0bf8b3917e2cbcba39c6cfa5862adfe5ca

Download Submit
C:\Users\Admin\AppData\Roaming\vlc\ml.xspf

Filesize
304B

MD5
781602441469750c3219c8c38b515ed4

SHA1
e885acd1cbd0b897ebcedbb145bef1c330f80595

SHA256
81970dbe581373d14fbd451ac4b3f96e5f69b79645f1ee1ca715cff3af0bf20d

SHA512
2b0a1717d96edb47bdf0ffeb250a5ec11f7d0638d3e0a62fbe48c064379b473ca88ffbececb32a72129d06c040b107834f1004ccda5f0f35b8c3588034786461

Download Submit
C:\Users\Admin\AppData\Roaming\vlc\vlc-qt-interface.ini

Filesize
498B

MD5
6dad9362c473438326f37814160d657a

SHA1
3c137404bc2263d0eb0cbd6f7893952490d76b35

SHA256
95ae84e8b1cb583852152a96c84922f53d701c9fa070e6da15db5ec54b01ecfe

SHA512
d2d4ed8649ee4f59d4b0d336e6650629dcdb8f1e3e07d6cf3cafc9a52700e1bfd0a3961030d03fc6e200289e8fb75b94b1b8e48f2bfca2378b759e549b3fbc0b

Download Submit
C:\Users\Admin\Downloads\gbdpilauncher_8.2 (1).rar:Zone.Identifier

Filesize
62B

MD5
f4c49900568c6539ad240b00d771df7c

SHA1
77543183260fccfea7789c462ec3cf2747906892

SHA256
cb532b915af7fe056cbe293dd709aca9dcd4b39ba8b367cd0b30d795f9e90514

SHA512
c93024cfe810e4a21b9747c7fbd5fa0262979a887a95eec692863a85a2bd3d6ad4624d9f7e462bb121b8e224dac4742ae7b223013d2bc2fe068d758f649cdc37

Download Submit
C:\Users\Admin\Downloads\gbdpilauncher_8.2.rar

Filesize
7.6MB

MD5
765e1ad56227a28034e4ce3b9b5cade2

SHA1
0e89888d70de51bc9eda8f05b5c072092d4121b2

SHA256
41192e72582e3c745fe003690242c5efd1e3d5efebe6f0acb4ac3933db5a5a7a

SHA512
f96db7b60161b5e390dd5e0f7dddcf7ea4cad3226d9a3ddaa43b47ce217d9250f1abc0b5534597c2260db4e348ffde939af366bcca588395d69db1b99e5665c9

Download Submit
C:\Users\Admin\Downloads\gbdpilauncher_8.2.rar:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
memory/3608-535-0x00007FFECB390000-0x00007FFECC440000-memory.dmp

Filesize
16.7MB

Download
memory/3608-534-0x00007FFECC770000-0x00007FFECCA26000-memory.dmp

Filesize
2.7MB

Download
memory/3608-533-0x00007FFED6C60000-0x00007FFED6C94000-memory.dmp

Filesize
208KB

Download
memory/3608-532-0x00007FF73E860000-0x00007FF73E958000-memory.dmp

Filesize
992KB

Download
memory/5296-1022-0x00007FFED5530000-0x00007FFED554B000-memory.dmp

Filesize
108KB

Download
memory/5296-1018-0x00007FFEDC9C0000-0x00007FFEDC9D8000-memory.dmp

Filesize
96KB

Download
memory/5296-1036-0x00007FFECDD10000-0x00007FFECDD21000-memory.dmp

Filesize
68KB

Download
memory/5296-1035-0x00007FFECDD30000-0x00007FFECDD47000-memory.dmp

Filesize
92KB

Download
memory/5296-1030-0x00007FFECA440000-0x00007FFECA5C0000-memory.dmp

Filesize
1.5MB

Download
memory/5296-1029-0x00007FFECDD50000-0x00007FFECDD61000-memory.dmp

Filesize
68KB

Download
memory/5296-1028-0x00007FFECE3A0000-0x00007FFECE3B1000-memory.dmp

Filesize
68KB

Download
memory/5296-1027-0x00007FFECD930000-0x00007FFECD9AC000-memory.dmp

Filesize
496KB

Download
memory/5296-1025-0x00007FFECE150000-0x00007FFECE180000-memory.dmp

Filesize
192KB

Download
memory/5296-1024-0x00007FFED4350000-0x00007FFED4368000-memory.dmp

Filesize
96KB

Download
memory/5296-1023-0x00007FFED5510000-0x00007FFED5521000-memory.dmp

Filesize
68KB

Download
memory/5296-1038-0x00007FFECD7E0000-0x00007FFECD7F1000-memory.dmp

Filesize
68KB

Download
memory/5296-1021-0x00007FFED5670000-0x00007FFED5681000-memory.dmp

Filesize
68KB

Download
memory/5296-1020-0x00007FFED5690000-0x00007FFED56A1000-memory.dmp

Filesize
68KB

Download
memory/5296-1019-0x00007FFED6780000-0x00007FFED6791000-memory.dmp

Filesize
68KB

Download
memory/5296-1037-0x00007FFECD800000-0x00007FFECD81D000-memory.dmp

Filesize
116KB

Download
memory/5296-1017-0x00007FFEDBF70000-0x00007FFEDBF91000-memory.dmp

Filesize
132KB

Download
memory/5296-1015-0x00007FFECA5C0000-0x00007FFECA7CB000-memory.dmp

Filesize
2.0MB

Download
memory/5296-1016-0x00007FFECDDE0000-0x00007FFECDE21000-memory.dmp

Filesize
260KB

Download
memory/5296-1011-0x00007FFECA7D0000-0x00007FFECAA86000-memory.dmp

Filesize
2.7MB

Download
memory/5296-1014-0x00007FFEDC9E0000-0x00007FFEDC9F1000-memory.dmp

Filesize
68KB

Download
memory/5296-1013-0x00007FFEE0890000-0x00007FFEE08A7000-memory.dmp

Filesize
92KB

Download
memory/5296-1012-0x00007FFEE0B00000-0x00007FFEE0B18000-memory.dmp

Filesize
96KB

Download
memory/5296-1095-0x00007FFEE0600000-0x00007FFEE0634000-memory.dmp

Filesize
208KB

Download
memory/5296-1096-0x00007FFECA7D0000-0x00007FFECAA86000-memory.dmp

Filesize
2.7MB

Download
memory/5296-1097-0x00007FFECD820000-0x00007FFECD92E000-memory.dmp

Filesize
1.1MB

Download
memory/5296-1094-0x00007FF73E860000-0x00007FF73E958000-memory.dmp

Filesize
992KB

Download
memory/5296-1034-0x00007FFECD820000-0x00007FFECD92E000-memory.dmp

Filesize
1.1MB

Download
memory/5296-1026-0x00007FFECDD70000-0x00007FFECDDD7000-memory.dmp

Filesize
412KB

Download
memory/5296-1010-0x00007FFEE0600000-0x00007FFEE0634000-memory.dmp

Filesize
208KB

Download
memory/5296-1009-0x00007FF73E860000-0x00007FF73E958000-memory.dmp

Filesize
992KB

Download