phantomstealer | 6945230e786da1f48c3f4d9ea9fa52a73a501d343c24cc3616ad4e092b32fb5c

Analysis

max time kernel
149s
max time network
124s
platform
windows11-21h2_x64
resource
win11-20251015-en
resource tags

arch:x64arch:x86image:win11-20251015-enlocale:en-usos:windows11-21h2-x64system
submitted
24/10/2025, 10:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e-dekont.pdf.exe
Size 1.2MB
Sample251024-mqz7vsymct
SHA256 6945230e786da1f48c3f4d9ea9fa52a73a501d343c24cc3616ad4e092b32fb5c
MD5 4c7ac9b03eeb8e4ca1070b386aeaf43e
SHA1 0cc8c73ea802690126b66dc42f5fcf18458ce380
SHA512 1601af238b753d3883a501962085205415672f9a70f257dab9db5de9b2fabfdac6ab0dcb01accd4ed12a4b46c5c6762c381c3097898f26d8c30ace4eaba1d8d2
SSDEEP 24576:+DAFLQAAxHn0Ui+KH6nWyuyapu8SJLUeqlMVNpxVrmkD7XV2vB:+GpAJnC+XapuzJL7eKpx4WkvB
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

collection discovery execution phantomstealer persistence spyware stealer

Malware Config

Extracted

Family

phantomstealer

Version

v3.5.0

https://api.telegram.org/bot8311646472:AAE3y-mOoDjijqIf0ZE_lCtb8S0nWRARlUw/sendMessage?chat_id=6605246356

Mutex

TMJ1S1R5RO0YF92QPAV7

Attributes

anti_analysis
0
cb_enables_ssl
0
debug
0
keylogger
1
start_delay
0
startup
0

Signatures

Phantomstealer family
phantomstealer

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3476	powershell.exe
1044	powershell.exe
1212	powershell.exe
5168	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
1948	iutrxhkAlxJQ.exe
4168	iutrxhkAlxJQ.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1811515719-224358676-1950738906-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	e-dekont.pdf.exe
Key opened	\REGISTRY\USER\S-1-5-21-1811515719-224358676-1950738906-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	e-dekont.pdf.exe
Key opened	\REGISTRY\USER\S-1-5-21-1811515719-224358676-1950738906-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	e-dekont.pdf.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
16	icanhazip.com

SmartAssembly .NET packer 1 IoCs

Detects SmartAssembly .NET packer.

resource	yara_rule
behavioral2/memory/4816-5-0x00000000050C0000-0x00000000050D6000-memory.dmp	SmartAssembly

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4816 set thread context of 4732	4816	e-dekont.pdf.exe	89
PID 1948 set thread context of 4168	1948	iutrxhkAlxJQ.exe	180

Drops file in Windows directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp\Crashpad\metadata	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\settings.dat	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\metadata	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\settings.dat	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp\chrome_installer.log	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\chrome_installer.log	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File opened for modification	C:\Windows\SystemTemp	chrmstp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e-dekont.pdf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e-dekont.pdf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	iutrxhkAlxJQ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	iutrxhkAlxJQ.exe

Checks processor information in registry 2 TTPs 38 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	e-dekont.pdf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	e-dekont.pdf.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Enumerates system info in registry 2 TTPs 12 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 4 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134057760834045551"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	chrmstp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1811515719-224358676-1950738906-1000\{26BFCF38-EE8F-4A9A-8608-73544C24671F}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1811515719-224358676-1950738906-1000\{4D824A4A-9885-4034-B11D-92CE347F5AB0}	msedge.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4452	schtasks.exe
1600	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3476	powershell.exe
1044	powershell.exe
4816	e-dekont.pdf.exe
4816	e-dekont.pdf.exe
3476	powershell.exe
1044	powershell.exe
4732	e-dekont.pdf.exe
4732	e-dekont.pdf.exe
4468	chrome.exe
4468	chrome.exe
4732	e-dekont.pdf.exe
4732	e-dekont.pdf.exe
4732	e-dekont.pdf.exe
4732	e-dekont.pdf.exe
4732	e-dekont.pdf.exe
4732	e-dekont.pdf.exe
4732	e-dekont.pdf.exe
4732	e-dekont.pdf.exe
4732	e-dekont.pdf.exe
3612	firefox.exe
3612	firefox.exe
3612	firefox.exe
3612	firefox.exe
3612	firefox.exe
3612	firefox.exe
3612	firefox.exe
3612	firefox.exe
3612	firefox.exe
3612	firefox.exe
3612	firefox.exe
3612	firefox.exe
3612	firefox.exe
3612	firefox.exe
3612	firefox.exe
3612	firefox.exe
3612	firefox.exe
3612	firefox.exe
3612	firefox.exe
3612	firefox.exe
4732	e-dekont.pdf.exe
4732	e-dekont.pdf.exe
4732	e-dekont.pdf.exe
1212	powershell.exe
1212	powershell.exe
5168	powershell.exe
5168	powershell.exe
4732	e-dekont.pdf.exe
4732	e-dekont.pdf.exe
1212	powershell.exe
5168	powershell.exe
4732	e-dekont.pdf.exe
4732	e-dekont.pdf.exe
4732	e-dekont.pdf.exe
4732	e-dekont.pdf.exe
4732	e-dekont.pdf.exe
4732	e-dekont.pdf.exe
4732	e-dekont.pdf.exe
4732	e-dekont.pdf.exe
4732	e-dekont.pdf.exe
4732	e-dekont.pdf.exe
4732	e-dekont.pdf.exe
4732	e-dekont.pdf.exe
4732	e-dekont.pdf.exe
4732	e-dekont.pdf.exe

Suspicious use of AdjustPrivilegeToken 25 IoCs

description	pid	Process
Token: SeDebugPrivilege	3476	powershell.exe
Token: SeDebugPrivilege	1044	powershell.exe
Token: SeDebugPrivilege	4816	e-dekont.pdf.exe
Token: SeDebugPrivilege	4732	e-dekont.pdf.exe
Token: SeShutdownPrivilege	4468	chrome.exe
Token: SeCreatePagefilePrivilege	4468	chrome.exe
Token: SeShutdownPrivilege	4468	chrome.exe
Token: SeCreatePagefilePrivilege	4468	chrome.exe
Token: SeShutdownPrivilege	4468	chrome.exe
Token: SeCreatePagefilePrivilege	4468	chrome.exe
Token: SeShutdownPrivilege	4468	chrome.exe
Token: SeCreatePagefilePrivilege	4468	chrome.exe
Token: SeShutdownPrivilege	4468	chrome.exe
Token: SeCreatePagefilePrivilege	4468	chrome.exe
Token: SeShutdownPrivilege	4468	chrome.exe
Token: SeCreatePagefilePrivilege	4468	chrome.exe
Token: SeShutdownPrivilege	4468	chrome.exe
Token: SeCreatePagefilePrivilege	4468	chrome.exe
Token: SeDebugPrivilege	1212	powershell.exe
Token: SeDebugPrivilege	5168	powershell.exe
Token: SeDebugPrivilege	4168	iutrxhkAlxJQ.exe
Token: SeShutdownPrivilege	2328	chrome.exe
Token: SeCreatePagefilePrivilege	2328	chrome.exe
Token: SeShutdownPrivilege	2328	chrome.exe
Token: SeCreatePagefilePrivilege	2328	chrome.exe

Suspicious use of FindShellTrayWindow 47 IoCs

pid	Process
4468	chrome.exe
4468	chrome.exe
5668	chrmstp.exe
3612	firefox.exe
3612	firefox.exe
3612	firefox.exe
3612	firefox.exe
3612	firefox.exe
3612	firefox.exe
3612	firefox.exe
3612	firefox.exe
3612	firefox.exe
3612	firefox.exe
3612	firefox.exe
3612	firefox.exe
3612	firefox.exe
3612	firefox.exe
3612	firefox.exe
3612	firefox.exe
3612	firefox.exe
3612	firefox.exe
3612	firefox.exe
3612	firefox.exe
4384	msedge.exe
5900	msedge.exe
6008	firefox.exe
6008	firefox.exe
6008	firefox.exe
6008	firefox.exe
6008	firefox.exe
6008	firefox.exe
6008	firefox.exe
6008	firefox.exe
6008	firefox.exe
6008	firefox.exe
6008	firefox.exe
6008	firefox.exe
6008	firefox.exe
6008	firefox.exe
6008	firefox.exe
6008	firefox.exe
6008	firefox.exe
6008	firefox.exe
6008	firefox.exe
6008	firefox.exe
2328	chrome.exe
2328	chrome.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3612	firefox.exe
6008	firefox.exe
4732	e-dekont.pdf.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4816 wrote to memory of 3476	4816	e-dekont.pdf.exe	82
PID 4816 wrote to memory of 3476	4816	e-dekont.pdf.exe	82
PID 4816 wrote to memory of 3476	4816	e-dekont.pdf.exe	82
PID 4816 wrote to memory of 1044	4816	e-dekont.pdf.exe	84
PID 4816 wrote to memory of 1044	4816	e-dekont.pdf.exe	84
PID 4816 wrote to memory of 1044	4816	e-dekont.pdf.exe	84
PID 4816 wrote to memory of 4452	4816	e-dekont.pdf.exe	85
PID 4816 wrote to memory of 4452	4816	e-dekont.pdf.exe	85
PID 4816 wrote to memory of 4452	4816	e-dekont.pdf.exe	85
PID 4816 wrote to memory of 4212	4816	e-dekont.pdf.exe	88
PID 4816 wrote to memory of 4212	4816	e-dekont.pdf.exe	88
PID 4816 wrote to memory of 4212	4816	e-dekont.pdf.exe	88
PID 4816 wrote to memory of 4732	4816	e-dekont.pdf.exe	89
PID 4816 wrote to memory of 4732	4816	e-dekont.pdf.exe	89
PID 4816 wrote to memory of 4732	4816	e-dekont.pdf.exe	89
PID 4816 wrote to memory of 4732	4816	e-dekont.pdf.exe	89
PID 4816 wrote to memory of 4732	4816	e-dekont.pdf.exe	89
PID 4816 wrote to memory of 4732	4816	e-dekont.pdf.exe	89
PID 4816 wrote to memory of 4732	4816	e-dekont.pdf.exe	89
PID 4816 wrote to memory of 4732	4816	e-dekont.pdf.exe	89
PID 4732 wrote to memory of 4468	4732	e-dekont.pdf.exe	93
PID 4732 wrote to memory of 4468	4732	e-dekont.pdf.exe	93
PID 4468 wrote to memory of 5964	4468	chrome.exe	94
PID 4468 wrote to memory of 5964	4468	chrome.exe	94
PID 4732 wrote to memory of 5964	4732	e-dekont.pdf.exe	94
PID 4732 wrote to memory of 5964	4732	e-dekont.pdf.exe	94
PID 4468 wrote to memory of 2560	4468	chrome.exe	95
PID 4468 wrote to memory of 2560	4468	chrome.exe	95
PID 4468 wrote to memory of 5336	4468	chrome.exe	96
PID 4468 wrote to memory of 5336	4468	chrome.exe	96
PID 4468 wrote to memory of 732	4468	chrome.exe	97
PID 4468 wrote to memory of 732	4468	chrome.exe	97
PID 4468 wrote to memory of 3920	4468	chrome.exe	98
PID 4468 wrote to memory of 3920	4468	chrome.exe	98
PID 4468 wrote to memory of 2460	4468	chrome.exe	99
PID 4468 wrote to memory of 2460	4468	chrome.exe	99
PID 4732 wrote to memory of 4468	4732	e-dekont.pdf.exe	93
PID 4732 wrote to memory of 4468	4732	e-dekont.pdf.exe	93
PID 4468 wrote to memory of 4240	4468	chrome.exe	100
PID 4468 wrote to memory of 4240	4468	chrome.exe	100
PID 4468 wrote to memory of 1652	4468	chrome.exe	101
PID 4468 wrote to memory of 1652	4468	chrome.exe	101
PID 4468 wrote to memory of 2336	4468	chrome.exe	102
PID 4468 wrote to memory of 2336	4468	chrome.exe	102
PID 4468 wrote to memory of 572	4468	chrome.exe	103
PID 4468 wrote to memory of 572	4468	chrome.exe	103
PID 4468 wrote to memory of 3164	4468	chrome.exe	104
PID 4468 wrote to memory of 3164	4468	chrome.exe	104
PID 4732 wrote to memory of 2560	4732	e-dekont.pdf.exe	95
PID 4732 wrote to memory of 2560	4732	e-dekont.pdf.exe	95
PID 4732 wrote to memory of 2336	4732	e-dekont.pdf.exe	102
PID 4732 wrote to memory of 2336	4732	e-dekont.pdf.exe	102
PID 4732 wrote to memory of 732	4732	e-dekont.pdf.exe	97
PID 4732 wrote to memory of 732	4732	e-dekont.pdf.exe	97
PID 4732 wrote to memory of 572	4732	e-dekont.pdf.exe	103
PID 4732 wrote to memory of 572	4732	e-dekont.pdf.exe	103
PID 4732 wrote to memory of 2460	4732	e-dekont.pdf.exe	99
PID 4732 wrote to memory of 2460	4732	e-dekont.pdf.exe	99
PID 4732 wrote to memory of 1652	4732	e-dekont.pdf.exe	101
PID 4732 wrote to memory of 1652	4732	e-dekont.pdf.exe	101
PID 4468 wrote to memory of 4420	4468	chrome.exe	105
PID 4468 wrote to memory of 4420	4468	chrome.exe	105
PID 4732 wrote to memory of 5964	4732	e-dekont.pdf.exe	94
PID 4732 wrote to memory of 5964	4732	e-dekont.pdf.exe	94

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1811515719-224358676-1950738906-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	e-dekont.pdf.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1811515719-224358676-1950738906-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	e-dekont.pdf.exe

C:\Users\Admin\AppData\Local\Temp\e-dekont.pdf.exe
"C:\Users\Admin\AppData\Local\Temp\e-dekont.pdf.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4816
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\e-dekont.pdf.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3476
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\iutrxhkAlxJQ.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1044
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\iutrxhkAlxJQ" /XML "C:\Users\Admin\AppData\Local\Temp\tmpC738.tmp"
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:4452
- C:\Users\Admin\AppData\Local\Temp\e-dekont.pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\e-dekont.pdf.exe"
  2⤵
  PID:4212
- C:\Users\Admin\AppData\Local\Temp\e-dekont.pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\e-dekont.pdf.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - outlook_office_path
  - outlook_win_path
  PID:4732
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5nrf3crs.21y"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4468
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\5nrf3crs.21y /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\5nrf3crs.21y\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\5nrf3crs.21y --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x104,0x108,0x10c,0x50,0x110,0x7ffd4406dcf8,0x7ffd4406dd04,0x7ffd4406dd10
      4⤵
      PID:5964
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5nrf3crs.21y" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=1880,i,9434029482113023226,313183037431429718,262144 --variations-seed-version --mojo-platform-channel-handle=1876 /prefetch:2
      4⤵
      PID:2560
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5nrf3crs.21y" --field-trial-handle=1980,i,9434029482113023226,313183037431429718,262144 --variations-seed-version --mojo-platform-channel-handle=1912 /prefetch:11
      4⤵
      PID:5336
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5nrf3crs.21y" --field-trial-handle=2132,i,9434029482113023226,313183037431429718,262144 --variations-seed-version --mojo-platform-channel-handle=2240 /prefetch:13
      4⤵
      PID:732
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5nrf3crs.21y" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=2876,i,9434029482113023226,313183037431429718,262144 --variations-seed-version --mojo-platform-channel-handle=2888 /prefetch:1
      4⤵
      PID:3920
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5nrf3crs.21y" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=2892,i,9434029482113023226,313183037431429718,262144 --variations-seed-version --mojo-platform-channel-handle=2916 /prefetch:1
      4⤵
      PID:2460
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5nrf3crs.21y" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3328,i,9434029482113023226,313183037431429718,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
      4⤵
      PID:4240
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5nrf3crs.21y" --extension-process --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=3344,i,9434029482113023226,313183037431429718,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:9
      4⤵
      PID:1652
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5nrf3crs.21y" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=3364,i,9434029482113023226,313183037431429718,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
      4⤵
      PID:2336
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5nrf3crs.21y" --extension-process --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=3376,i,9434029482113023226,313183037431429718,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:9
      4⤵
      PID:572
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5nrf3crs.21y" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=3348,i,9434029482113023226,313183037431429718,262144 --variations-seed-version --mojo-platform-channel-handle=3960 /prefetch:1
      4⤵
      PID:3164
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5nrf3crs.21y" --field-trial-handle=4404,i,9434029482113023226,313183037431429718,262144 --variations-seed-version --mojo-platform-channel-handle=4412 /prefetch:14
      4⤵
      PID:4420
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5nrf3crs.21y" --field-trial-handle=4916,i,9434029482113023226,313183037431429718,262144 --variations-seed-version --mojo-platform-channel-handle=4900 /prefetch:14
      4⤵
      PID:5240
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5nrf3crs.21y" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=5004,i,9434029482113023226,313183037431429718,262144 --variations-seed-version --mojo-platform-channel-handle=5068 /prefetch:1
      4⤵
      PID:5112
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5nrf3crs.21y" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=5032,i,9434029482113023226,313183037431429718,262144 --variations-seed-version --mojo-platform-channel-handle=5016 /prefetch:1
      4⤵
      PID:3636
  - - C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
      4⤵
      Drops file in Windows directory
      PID:2000
    - - C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x244,0x248,0x24c,0x220,0x250,0x7ff6d43a1f58,0x7ff6d43a1f64,0x7ff6d43a1f70
        5⤵
        Drops file in Windows directory
        
        PID:4912
    - - C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\initial_preferences" --create-shortcuts=1 --install-level=0
        5⤵
        Drops file in Windows directory
        Modifies registry class
        Suspicious use of FindShellTrayWindow
        
        PID:5668
      - C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x244,0x248,0x24c,0x220,0x250,0x7ff6d43a1f58,0x7ff6d43a1f64,0x7ff6d43a1f70
        6⤵
        Drops file in Windows directory
        
        PID:3884
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5nrf3crs.21y" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=5072,i,9434029482113023226,313183037431429718,262144 --variations-seed-version --mojo-platform-channel-handle=5068 /prefetch:1
      4⤵
      PID:1436
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5nrf3crs.21y" --field-trial-handle=5144,i,9434029482113023226,313183037431429718,262144 --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:14
      4⤵
      PID:1600
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5nrf3crs.21y" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=4912,i,9434029482113023226,313183037431429718,262144 --variations-seed-version --mojo-platform-channel-handle=5232 /prefetch:1
      4⤵
      PID:5512
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5nrf3crs.21y" --field-trial-handle=5000,i,9434029482113023226,313183037431429718,262144 --variations-seed-version --mojo-platform-channel-handle=5040 /prefetch:14
      4⤵
      PID:2092
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5nrf3crs.21y" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --field-trial-handle=5276,i,9434029482113023226,313183037431429718,262144 --variations-seed-version --mojo-platform-channel-handle=5320 /prefetch:1
      4⤵
      PID:4056
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5nrf3crs.21y" --field-trial-handle=5388,i,9434029482113023226,313183037431429718,262144 --variations-seed-version --mojo-platform-channel-handle=5232 /prefetch:14
      4⤵
      PID:4596
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5nrf3crs.21y" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --field-trial-handle=5364,i,9434029482113023226,313183037431429718,262144 --variations-seed-version --mojo-platform-channel-handle=5080 /prefetch:1
      4⤵
      PID:3592
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5nrf3crs.21y" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --field-trial-handle=5272,i,9434029482113023226,313183037431429718,262144 --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:1
      4⤵
      PID:2392
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5nrf3crs.21y" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --field-trial-handle=5152,i,9434029482113023226,313183037431429718,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:1
      4⤵
      PID:5092
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5nrf3crs.21y" --field-trial-handle=5324,i,9434029482113023226,313183037431429718,262144 --variations-seed-version --mojo-platform-channel-handle=3928 /prefetch:14
      4⤵
      PID:5976
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5nrf3crs.21y" --extension-process --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --field-trial-handle=5300,i,9434029482113023226,313183037431429718,262144 --variations-seed-version --mojo-platform-channel-handle=5368 /prefetch:9
      4⤵
      PID:5416
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\x0b22zgg.ujp"
    3⤵
    PID:4108
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir=C:\Users\Admin\AppData\Local\Temp\x0b22zgg.ujp
      4⤵
      Checks processor information in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:3612
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1988 -prefsLen 27097 -prefMapHandle 1992 -prefMapSize 270279 -ipcHandle 2056 -initialChannelId {ea1d4cdf-95f2-4aa5-9af5-b0a316e62f2a} -parentPid 3612 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3612" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
        5⤵
        
        PID:5992
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2208 -prefsLen 27133 -prefMapHandle 2196 -prefMapSize 270279 -ipcHandle 2312 -initialChannelId {d5983e18-27b1-4db9-bc84-c697c711cfcc} -parentPid 3612 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3612" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
        5⤵
        
        PID:656
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\4916e12a-b17d-49cd-9a89-c4f58bf070cf.dmp"
        5⤵
        
        PID:5192
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2280 -prefsLen 27133 -prefMapHandle 2832 -prefMapSize 270279 -ipcHandle 2856 -initialChannelId {d28168fb-94d4-4340-9301-5c38b99f27c4} -parentPid 3612 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3612" -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 gpu
        5⤵
        
        PID:2504
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\36188405-f2cf-4544-8bf7-714895b6558f.dmp"
        5⤵
        
        PID:2640
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2856 -prefsLen 27133 -prefMapHandle 2996 -prefMapSize 270279 -ipcHandle 3028 -initialChannelId {3a88df99-0d7b-422e-994d-481adddfbfe5} -parentPid 3612 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3612" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 gpu
        5⤵
        
        PID:3540
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\d89b8a7e-d5f0-4ed9-8609-887892aaab80.dmp"
        5⤵
        
        PID:664
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3028 -prefsLen 27198 -prefMapHandle 3820 -prefMapSize 270279 -ipcHandle 3536 -initialChannelId {46718fa3-e9a4-47d0-9525-a9dfb5a75add} -parentPid 3612 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3612" -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 gpu
        5⤵
        
        PID:4572
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3972 -prefsLen 27274 -prefMapHandle 3976 -prefMapSize 270279 -jsInitHandle 3980 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3988 -initialChannelId {aa897d3d-6dd2-4545-9010-f99cac056932} -parentPid 3612 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3612" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 tab
        5⤵
        Checks processor information in registry
        
        PID:232
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\f5bb7d29-875e-41ff-a38c-2178cfbb867b.dmp"
        5⤵
        
        PID:4560
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3536 -prefsLen 27274 -prefMapHandle 3836 -prefMapSize 270279 -ipcHandle 3816 -initialChannelId {215543fe-a973-4318-b27c-ac07e484bfc0} -parentPid 3612 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3612" -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 gpu
        5⤵
        
        PID:4720
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\389c1b91-f479-46e0-9f8c-46f642678dc6.dmp"
        5⤵
        
        PID:5680
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3536 -prefsLen 27274 -prefMapHandle 4224 -prefMapSize 270279 -ipcHandle 4248 -initialChannelId {f2d6a698-4620-44d0-80fd-6bd3f3a09c5a} -parentPid 3612 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3612" -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 rdd
        5⤵
        
        PID:3352
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3416 -prefsLen 34773 -prefMapHandle 3420 -prefMapSize 270279 -jsInitHandle 3380 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4648 -initialChannelId {c18bba2c-3957-4df6-90f2-251183126dcc} -parentPid 3612 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3612" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
        5⤵
        Checks processor information in registry
        
        PID:5004
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 2832 -prefsLen 35010 -prefMapHandle 3004 -prefMapSize 270279 -ipcHandle 1692 -initialChannelId {776d5cb8-a388-451e-86cf-d009516fca89} -parentPid 3612 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3612" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 utility
        5⤵
        Checks processor information in registry
        
        PID:1244
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2552 -prefsLen 32900 -prefMapHandle 2684 -prefMapSize 270279 -jsInitHandle 4140 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4908 -initialChannelId {5b783c35-1149-4327-bd24-e7550cc51b4b} -parentPid 3612 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3612" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
        5⤵
        Checks processor information in registry
        
        PID:4456
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3328 -prefsLen 32900 -prefMapHandle 2988 -prefMapSize 270279 -jsInitHandle 3304 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4884 -initialChannelId {5f3186f7-d3c6-4f25-9bea-9c7e285762cf} -parentPid 3612 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3612" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
        5⤵
        Checks processor information in registry
        
        PID:4844
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2196 -prefsLen 32900 -prefMapHandle 5484 -prefMapSize 270279 -jsInitHandle 5488 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5496 -initialChannelId {dbd1786b-1caa-4864-b62e-c7778b136f51} -parentPid 3612 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3612" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab
        5⤵
        Checks processor information in registry
        
        PID:1884
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\251rnlgp.fim"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious use of FindShellTrayWindow
    PID:4384
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\251rnlgp.fim /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\251rnlgp.fim\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x23c,0x240,0x244,0x238,0x250,0x7ffd32f9f208,0x7ffd32f9f214,0x7ffd32f9f220
      4⤵
      PID:5860
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\251rnlgp.fim" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --field-trial-handle=2124,i,5245616640842208396,7511308589114466130,262144 --variations-seed-version --mojo-platform-channel-handle=2120 /prefetch:2
      4⤵
      PID:4648
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\251rnlgp.fim" --always-read-main-dll --field-trial-handle=1724,i,5245616640842208396,7511308589114466130,262144 --variations-seed-version --mojo-platform-channel-handle=2128 /prefetch:11
      4⤵
      PID:5072
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\251rnlgp.fim" --always-read-main-dll --field-trial-handle=2304,i,5245616640842208396,7511308589114466130,262144 --variations-seed-version --mojo-platform-channel-handle=2456 /prefetch:13
      4⤵
      PID:4804
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\251rnlgp.fim" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3032,i,5245616640842208396,7511308589114466130,262144 --variations-seed-version --mojo-platform-channel-handle=3068 /prefetch:1
      4⤵
      PID:3576
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\251rnlgp.fim" --instant-process --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3040,i,5245616640842208396,7511308589114466130,262144 --variations-seed-version --mojo-platform-channel-handle=2928 /prefetch:1
      4⤵
      PID:1688
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\251rnlgp.fim" --always-read-main-dll --field-trial-handle=3264,i,5245616640842208396,7511308589114466130,262144 --variations-seed-version --mojo-platform-channel-handle=3308 /prefetch:14
      4⤵
      PID:920
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\251rnlgp.fim" --always-read-main-dll --field-trial-handle=3272,i,5245616640842208396,7511308589114466130,262144 --variations-seed-version --mojo-platform-channel-handle=3292 /prefetch:14
      4⤵
      PID:2172
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\251rnlgp.fim" --always-read-main-dll --field-trial-handle=3280,i,5245616640842208396,7511308589114466130,262144 --variations-seed-version --mojo-platform-channel-handle=3404 /prefetch:14
      4⤵
      PID:1936
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\251rnlgp.fim" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --field-trial-handle=3380,i,5245616640842208396,7511308589114466130,262144 --variations-seed-version --mojo-platform-channel-handle=3428 /prefetch:1
      4⤵
      PID:2184
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\251rnlgp.fim" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --field-trial-handle=3424,i,5245616640842208396,7511308589114466130,262144 --variations-seed-version --mojo-platform-channel-handle=3000 /prefetch:9
      4⤵
      PID:4764
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\251rnlgp.fim" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --field-trial-handle=3476,i,5245616640842208396,7511308589114466130,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
      4⤵
      PID:5936
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\251rnlgp.fim" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --field-trial-handle=3548,i,5245616640842208396,7511308589114466130,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:9
      4⤵
      PID:4004
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\251rnlgp.fim" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --field-trial-handle=3576,i,5245616640842208396,7511308589114466130,262144 --variations-seed-version --mojo-platform-channel-handle=3396 /prefetch:1
      4⤵
      PID:6040
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\251rnlgp.fim" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --field-trial-handle=3584,i,5245616640842208396,7511308589114466130,262144 --variations-seed-version --mojo-platform-channel-handle=3452 /prefetch:9
      4⤵
      PID:5508
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\251rnlgp.fim" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --field-trial-handle=3624,i,5245616640842208396,7511308589114466130,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:1
      4⤵
      PID:3592
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\251rnlgp.fim" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --field-trial-handle=3612,i,5245616640842208396,7511308589114466130,262144 --variations-seed-version --mojo-platform-channel-handle=3692 /prefetch:9
      4⤵
      PID:5700
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\251rnlgp.fim" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --field-trial-handle=3720,i,5245616640842208396,7511308589114466130,262144 --variations-seed-version --mojo-platform-channel-handle=3740 /prefetch:1
      4⤵
      PID:1804
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\251rnlgp.fim" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --field-trial-handle=3768,i,5245616640842208396,7511308589114466130,262144 --variations-seed-version --mojo-platform-channel-handle=3744 /prefetch:9
      4⤵
      PID:3644
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\251rnlgp.fim" --always-read-main-dll --field-trial-handle=3848,i,5245616640842208396,7511308589114466130,262144 --variations-seed-version --mojo-platform-channel-handle=4200 /prefetch:14
      4⤵
      PID:2984
    - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=1128
        5⤵
        
        PID:5552
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\251rnlgp.fim" --always-read-main-dll --field-trial-handle=5008,i,5245616640842208396,7511308589114466130,262144 --variations-seed-version --mojo-platform-channel-handle=4984 /prefetch:14
      4⤵
      PID:5716
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\251rnlgp.fim" --always-read-main-dll --field-trial-handle=5024,i,5245616640842208396,7511308589114466130,262144 --variations-seed-version --mojo-platform-channel-handle=5036 /prefetch:14
      4⤵
      PID:72
    - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=596
        5⤵
        
        PID:5460
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\251rnlgp.fim" --always-read-main-dll --field-trial-handle=5100,i,5245616640842208396,7511308589114466130,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:14
      4⤵
      PID:2868
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\251rnlgp.fim" --always-read-main-dll --field-trial-handle=5448,i,5245616640842208396,7511308589114466130,262144 --variations-seed-version --mojo-platform-channel-handle=5532 /prefetch:14
      4⤵
      PID:5408
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --no-sandbox --mute-audio --onnx-enabled-for-ee --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\251rnlgp.fim" --always-read-main-dll --field-trial-handle=5444,i,5245616640842208396,7511308589114466130,262144 --variations-seed-version --mojo-platform-channel-handle=5580 /prefetch:14
      4⤵
      PID:4800
  - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\251rnlgp.fim" --always-read-main-dll --field-trial-handle=3296,i,5245616640842208396,7511308589114466130,262144 --variations-seed-version --mojo-platform-channel-handle=3292 /prefetch:14
      4⤵
      PID:660
  - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\251rnlgp.fim" --always-read-main-dll --field-trial-handle=3296,i,5245616640842208396,7511308589114466130,262144 --variations-seed-version --mojo-platform-channel-handle=3292 /prefetch:14
      4⤵
      PID:3408
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\251rnlgp.fim" --always-read-main-dll --field-trial-handle=6444,i,5245616640842208396,7511308589114466130,262144 --variations-seed-version --mojo-platform-channel-handle=6492 /prefetch:14
      4⤵
      PID:5012
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\251rnlgp.fim" --always-read-main-dll --field-trial-handle=4016,i,5245616640842208396,7511308589114466130,262144 --variations-seed-version --mojo-platform-channel-handle=5396 /prefetch:14
      4⤵
      PID:5580
  - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\Installer\setup.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
      4⤵
      PID:6008
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\dmgdpxxe.rj4"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious use of FindShellTrayWindow
    PID:5900
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\dmgdpxxe.rj4 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\dmgdpxxe.rj4\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x23c,0x240,0x244,0x238,0x24c,0x7ffd32f9f208,0x7ffd32f9f214,0x7ffd32f9f220
      4⤵
      PID:3352
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\dmgdpxxe.rj4" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --field-trial-handle=2148,i,17012861537975222990,1350154508547596805,262144 --variations-seed-version --mojo-platform-channel-handle=2144 /prefetch:2
      4⤵
      PID:4736
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\dmgdpxxe.rj4" --always-read-main-dll --field-trial-handle=1796,i,17012861537975222990,1350154508547596805,262144 --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:11
      4⤵
      PID:2812
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\dmgdpxxe.rj4" --always-read-main-dll --field-trial-handle=2328,i,17012861537975222990,1350154508547596805,262144 --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:13
      4⤵
      PID:4972
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\dmgdpxxe.rj4" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3032,i,17012861537975222990,1350154508547596805,262144 --variations-seed-version --mojo-platform-channel-handle=3092 /prefetch:1
      4⤵
      PID:3768
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\dmgdpxxe.rj4" --instant-process --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3040,i,17012861537975222990,1350154508547596805,262144 --variations-seed-version --mojo-platform-channel-handle=3120 /prefetch:1
      4⤵
      PID:1000
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\dmgdpxxe.rj4" --always-read-main-dll --field-trial-handle=3684,i,17012861537975222990,1350154508547596805,262144 --variations-seed-version --mojo-platform-channel-handle=3860 /prefetch:14
      4⤵
      PID:6408
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\dmgdpxxe.rj4" --always-read-main-dll --field-trial-handle=3680,i,17012861537975222990,1350154508547596805,262144 --variations-seed-version --mojo-platform-channel-handle=3888 /prefetch:14
      4⤵
      PID:6416
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\dmgdpxxe.rj4" --always-read-main-dll --field-trial-handle=3688,i,17012861537975222990,1350154508547596805,262144 --variations-seed-version --mojo-platform-channel-handle=3972 /prefetch:14
      4⤵
      PID:6424
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\dmgdpxxe.rj4" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --field-trial-handle=3776,i,17012861537975222990,1350154508547596805,262144 --variations-seed-version --mojo-platform-channel-handle=4080 /prefetch:1
      4⤵
      PID:6432
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\dmgdpxxe.rj4" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --field-trial-handle=3780,i,17012861537975222990,1350154508547596805,262144 --variations-seed-version --mojo-platform-channel-handle=4536 /prefetch:9
      4⤵
      PID:6444
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\dmgdpxxe.rj4" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --field-trial-handle=3816,i,17012861537975222990,1350154508547596805,262144 --variations-seed-version --mojo-platform-channel-handle=4540 /prefetch:1
      4⤵
      PID:6460
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\dmgdpxxe.rj4" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --field-trial-handle=3852,i,17012861537975222990,1350154508547596805,262144 --variations-seed-version --mojo-platform-channel-handle=4580 /prefetch:9
      4⤵
      PID:6468
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\dmgdpxxe.rj4" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --field-trial-handle=3868,i,17012861537975222990,1350154508547596805,262144 --variations-seed-version --mojo-platform-channel-handle=4588 /prefetch:1
      4⤵
      PID:6476
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\dmgdpxxe.rj4" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --field-trial-handle=3952,i,17012861537975222990,1350154508547596805,262144 --variations-seed-version --mojo-platform-channel-handle=4612 /prefetch:9
      4⤵
      PID:6484
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\dmgdpxxe.rj4" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --field-trial-handle=3984,i,17012861537975222990,1350154508547596805,262144 --variations-seed-version --mojo-platform-channel-handle=4640 /prefetch:1
      4⤵
      PID:6492
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\dmgdpxxe.rj4" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --field-trial-handle=3988,i,17012861537975222990,1350154508547596805,262144 --variations-seed-version --mojo-platform-channel-handle=4556 /prefetch:9
      4⤵
      PID:6500
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\dmgdpxxe.rj4" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --field-trial-handle=4020,i,17012861537975222990,1350154508547596805,262144 --variations-seed-version --mojo-platform-channel-handle=4668 /prefetch:1
      4⤵
      PID:6508
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\dmgdpxxe.rj4" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --field-trial-handle=4076,i,17012861537975222990,1350154508547596805,262144 --variations-seed-version --mojo-platform-channel-handle=4748 /prefetch:9
      4⤵
      PID:6560
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\dmgdpxxe.rj4" --always-read-main-dll --field-trial-handle=5024,i,17012861537975222990,1350154508547596805,262144 --variations-seed-version --mojo-platform-channel-handle=4616 /prefetch:14
      4⤵
      PID:7876
    - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=1128
        5⤵
        
        PID:8088
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\dmgdpxxe.rj4" --always-read-main-dll --field-trial-handle=5316,i,17012861537975222990,1350154508547596805,262144 --variations-seed-version --mojo-platform-channel-handle=4624 /prefetch:14
      4⤵
      PID:7884
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\dmgdpxxe.rj4" --always-read-main-dll --field-trial-handle=3920,i,17012861537975222990,1350154508547596805,262144 --variations-seed-version --mojo-platform-channel-handle=4132 /prefetch:14
      4⤵
      PID:7892
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\dmgdpxxe.rj4" --always-read-main-dll --field-trial-handle=5404,i,17012861537975222990,1350154508547596805,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:14
      4⤵
      PID:8116
    - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=592
        5⤵
        
        PID:8164
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\dmgdpxxe.rj4" --always-read-main-dll --field-trial-handle=4496,i,17012861537975222990,1350154508547596805,262144 --variations-seed-version --mojo-platform-channel-handle=5028 /prefetch:14
      4⤵
      PID:6968
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --no-sandbox --mute-audio --onnx-enabled-for-ee --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\dmgdpxxe.rj4" --always-read-main-dll --field-trial-handle=4528,i,17012861537975222990,1350154508547596805,262144 --variations-seed-version --mojo-platform-channel-handle=5356 /prefetch:14
      4⤵
      PID:7384
  - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\dmgdpxxe.rj4" --always-read-main-dll --field-trial-handle=6084,i,17012861537975222990,1350154508547596805,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:14
      4⤵
      PID:4788
  - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\dmgdpxxe.rj4" --always-read-main-dll --field-trial-handle=6084,i,17012861537975222990,1350154508547596805,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:14
      4⤵
      PID:7220
  - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\Installer\setup.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
      4⤵
      PID:7332
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\dmgdpxxe.rj4" --always-read-main-dll --field-trial-handle=6292,i,17012861537975222990,1350154508547596805,262144 --variations-seed-version --mojo-platform-channel-handle=6300 /prefetch:14
      4⤵
      PID:3320
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5vp1qarg.3mx"
    3⤵
    PID:4440
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir=C:\Users\Admin\AppData\Local\Temp\5vp1qarg.3mx
      4⤵
      Checks processor information in registry
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:6008
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1964 -prefsLen 27097 -prefMapHandle 1968 -prefMapSize 270331 -ipcHandle 2052 -initialChannelId {52d31092-1f14-4526-9b04-66418c2d6c7d} -parentPid 6008 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6008" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
        5⤵
        
        PID:6024
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2432 -prefsLen 27133 -prefMapHandle 2436 -prefMapSize 270331 -ipcHandle 1968 -initialChannelId {9be5a5de-efa1-4940-9f50-b3357c2c1af9} -parentPid 6008 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6008" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
        5⤵
        
        PID:5928
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\9b542ebb-5bc0-41cf-b65b-14ccd613b19f.dmp"
        5⤵
        
        PID:2104
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2456 -prefsLen 27133 -prefMapHandle 2320 -prefMapSize 270331 -ipcHandle 2324 -initialChannelId {9145badb-ef23-4533-97a8-af411f6c0770} -parentPid 6008 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6008" -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 gpu
        5⤵
        
        PID:1916
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\f96d534e-81f5-4b9f-9e06-98b1de77e9f8.dmp"
        5⤵
        
        PID:2456
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2324 -prefsLen 27198 -prefMapHandle 3284 -prefMapSize 270331 -ipcHandle 3556 -initialChannelId {bf5e502e-8fb0-4f1e-9e63-5d70cbd4a754} -parentPid 6008 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6008" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 gpu
        5⤵
        
        PID:2328
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3804 -prefsLen 27274 -prefMapHandle 3808 -prefMapSize 270331 -jsInitHandle 3812 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3820 -initialChannelId {2f6f1411-4286-4af7-9630-aa731ac325ba} -parentPid 6008 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6008" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
        5⤵
        Checks processor information in registry
        
        PID:7492
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\3fac3489-c8b2-4c9b-b730-010c5240f76b.dmp"
        5⤵
        
        PID:1172
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3396 -prefsLen 27274 -prefMapHandle 3856 -prefMapSize 270331 -ipcHandle 4060 -initialChannelId {7495fc46-e3aa-4263-9e9e-b41e427b09c0} -parentPid 6008 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6008" -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 gpu
        5⤵
        
        PID:7564
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\4483379d-4622-42cf-8ea5-64c8ae5f2ce2.dmp"
        5⤵
        
        PID:7672
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3800 -prefsLen 27274 -prefMapHandle 2028 -prefMapSize 270331 -ipcHandle 4240 -initialChannelId {56c31f23-0c72-4462-ac14-1a6b03be92d9} -parentPid 6008 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6008" -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 rdd
        5⤵
        
        PID:6304
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4524 -prefsLen 34827 -prefMapHandle 4528 -prefMapSize 270331 -jsInitHandle 4532 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4540 -initialChannelId {b75267a1-3336-4370-a48d-6fc29b9d3092} -parentPid 6008 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6008" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
        5⤵
        Checks processor information in registry
        
        PID:7788
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4672 -prefsLen 34876 -prefMapHandle 4548 -prefMapSize 270331 -ipcHandle 5156 -initialChannelId {2553f995-5a5c-43f3-b782-fc233ff365d4} -parentPid 6008 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6008" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 utility
        5⤵
        Checks processor information in registry
        
        PID:7576
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2832 -prefsLen 32766 -prefMapHandle 4880 -prefMapSize 270331 -jsInitHandle 4884 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5164 -initialChannelId {89ba1e2e-e461-40fc-afad-d43e0e811c2f} -parentPid 6008 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6008" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
        5⤵
        Checks processor information in registry
        
        PID:5036
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5116 -prefsLen 32766 -prefMapHandle 5124 -prefMapSize 270331 -jsInitHandle 5128 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5172 -initialChannelId {7fb1b42e-aa63-4916-a42c-d149f0a0f721} -parentPid 6008 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6008" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
        5⤵
        Checks processor information in registry
        
        PID:7100
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5624 -prefsLen 32818 -prefMapHandle 5628 -prefMapSize 270331 -jsInitHandle 5632 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5640 -initialChannelId {1a922937-8f5b-4502-9506-412db725e268} -parentPid 6008 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6008" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
        5⤵
        Checks processor information in registry
        
        PID:3308
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\jdqgumkv.ogk"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    PID:2328
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\jdqgumkv.ogk /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\jdqgumkv.ogk\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\jdqgumkv.ogk --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ffd32fbdcf8,0x7ffd32fbdd04,0x7ffd32fbdd10
      4⤵
      PID:7536
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\jdqgumkv.ogk" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=2284,i,13538020333496222846,15956871807709876244,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:2
      4⤵
      PID:236
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\jdqgumkv.ogk" --field-trial-handle=1804,i,13538020333496222846,15956871807709876244,262144 --variations-seed-version --mojo-platform-channel-handle=2336 /prefetch:11
      4⤵
      PID:5412
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\jdqgumkv.ogk" --field-trial-handle=2016,i,13538020333496222846,15956871807709876244,262144 --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:13
      4⤵
      PID:7160
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\jdqgumkv.ogk" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=2896,i,13538020333496222846,15956871807709876244,262144 --variations-seed-version --mojo-platform-channel-handle=2912 /prefetch:1
      4⤵
      PID:8028
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\jdqgumkv.ogk" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=2916,i,13538020333496222846,15956871807709876244,262144 --variations-seed-version --mojo-platform-channel-handle=2960 /prefetch:1
      4⤵
      PID:8040
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\jdqgumkv.ogk" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3496,i,13538020333496222846,15956871807709876244,262144 --variations-seed-version --mojo-platform-channel-handle=3712 /prefetch:1
      4⤵
      PID:2964
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\jdqgumkv.ogk" --extension-process --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=3512,i,13538020333496222846,15956871807709876244,262144 --variations-seed-version --mojo-platform-channel-handle=3716 /prefetch:9
      4⤵
      PID:4788
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\jdqgumkv.ogk" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=3532,i,13538020333496222846,15956871807709876244,262144 --variations-seed-version --mojo-platform-channel-handle=3724 /prefetch:1
      4⤵
      PID:7944
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\jdqgumkv.ogk" --extension-process --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=3548,i,13538020333496222846,15956871807709876244,262144 --variations-seed-version --mojo-platform-channel-handle=3736 /prefetch:9
      4⤵
      PID:8092
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\jdqgumkv.ogk" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=4340,i,13538020333496222846,15956871807709876244,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:1
      4⤵
      PID:5176
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\jdqgumkv.ogk" --field-trial-handle=4292,i,13538020333496222846,15956871807709876244,262144 --variations-seed-version --mojo-platform-channel-handle=4044 /prefetch:14
      4⤵
      PID:5104
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\jdqgumkv.ogk" --field-trial-handle=4892,i,13538020333496222846,15956871807709876244,262144 --variations-seed-version --mojo-platform-channel-handle=4756 /prefetch:14
      4⤵
      PID:7424
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\jdqgumkv.ogk" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=4992,i,13538020333496222846,15956871807709876244,262144 --variations-seed-version --mojo-platform-channel-handle=5052 /prefetch:1
      4⤵
      PID:6052
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\jdqgumkv.ogk" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=5020,i,13538020333496222846,15956871807709876244,262144 --variations-seed-version --mojo-platform-channel-handle=5004 /prefetch:1
      4⤵
      PID:7396

C:\Users\Admin\AppData\Roaming\iutrxhkAlxJQ.exe
C:\Users\Admin\AppData\Roaming\iutrxhkAlxJQ.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1948
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\iutrxhkAlxJQ.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1212
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\iutrxhkAlxJQ.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5168
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\iutrxhkAlxJQ" /XML "C:\Users\Admin\AppData\Local\Temp\tmp14DB.tmp"
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:1600
- C:\Users\Admin\AppData\Roaming\iutrxhkAlxJQ.exe
  "C:\Users\Admin\AppData\Roaming\iutrxhkAlxJQ.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:4168

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4832

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 9600b3fdf0565ccb49e21656aa4b24d7c18f776bfd04d9ee984b134707550f02
MD5 d0c46cad6c0778401e21910bd6b56b70
SHA1 7be418951ea96326aca445b8dfe449b2bfa0dca6
SHA512 057531b468f7fbbb2175a696a8aab274dec0d17d9f71df309edcff35e064f3378050066a3df47ccd03048fac461594ec75e3d4fe64f9dd79949d129f51e02949
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 7cf533809de39ba70f36e2cb144ea861eacaed50e02db85ae24c0876375dd5d9
MD5 b4af215b45ef0947b8eda8850baa9676
SHA1 940834bb6ee50ff3e3d75ebcc342db7a4b59ea11
SHA512 03692a523d523d55e974fe81eacf92a79dca1a5f16dc2df997b835212b61e799eb2ebc7923d9b1b9156ed7e4ca3e31a4a492233ab291a9f3164455d52b015900
SSDEEP 384:iL3HhY1SS1wS9ZRhMagHnnNSjs2xtgDNS2L9F9Eou0iFZX:sWSS39ZRi3NSj7xtgRSeF9Eou0E
MD5 SHA1 SHA512 SSDEEP

Submit Download

activity-stream.contile.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\is3a9iyn.default-release\activity-stream.contile.json
Size 4KB
SHA256 4433d8d9052eae94cbd1ec11f998d6d10931294b9ed6e6242049c58dcfbb0a48
MD5 4e2f2510487bacce52234bc75e3e26ad
SHA1 709a22eb17b48683e950cc4c3d03fc18eff2ba69
SHA512 3942ab60e42563b8af34011dbfe4f374ed7416305a510de35f8ead66c82b120857cca1528f6caa99aa7bd9bf7de6a14b4fbb2116973c04dddd45476b9f44c1d6
SSDEEP 96:kKYpc++n4DHbD6DJ+v87l0VSQb4tvtVruhVesvldaKq8DlOHbvhl:Qx7DwkU7SVWtvt1uhzdxVlypl
MD5 SHA1 SHA512 SSDEEP

Submit Download

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\is3a9iyn.default-release\activity-stream.discovery_stream.json
Size 22KB
SHA256 38338f3076972e033e7dfcd50983ee946e7cc3d5b97288de88c89a5d2b7419ba
MD5 126648df5a97baa97289bd8d0bbfc855
SHA1 55f48ccd121075d898a34ae43046130980006fdf
SHA512 517a4cac6a8fb5143eb025c98f5c638e8b5247ff5b86e76d8e8a03e7b00673e30ff918a530119d0de18eec817b5035835e7128bcfb6bbec2e3f7b517386767c9
SSDEEP 192:y/y8ysK1cURPAeP0jHajtBk7rEUrHpTf3bD4ziJqp8B+vdZfelVbTZjnH2ZtB+Pb:yyaFgSnShcqdNq3xnWExNgOe3ep3hq2F
MD5 SHA1 SHA512 SSDEEP

Submit Download

577120C5183923526312DC856F6825FC1C7D072F

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\is3a9iyn.default-release\cache2\entries\577120C5183923526312DC856F6825FC1C7D072F
Size 14KB
SHA256 a02336f19bad80f9ef96af110cd7e70dbfba6dc4f1ca25308ffba880ac22bcbc
MD5 6ccb798ca4b2e6c4ede7d04f0db674ff
SHA1 5305b8c4085c10c33aca5c5708d00420013d5030
SHA512 e283743a477e93027711cf4cb5bf5251c916c2eee30b3b6f1b071b50c267f3c98f763d0c82113de92adbea76404dbc6a3e115e85655982e95474d8553e05ef04
SSDEEP 384:HV9BpiO024Yz7hSznZOML+CbcxDEclrIVy8eboCozn:1EZYz7hSz8MLPbcxDEcVIVy8T
MD5 SHA1 SHA512 SSDEEP

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\is3a9iyn.default-release\startupCache\webext.sc.lz4
Size 104KB
SHA256 bdc587ea915963d513e98065e04138c302d95e0cf482ea0bf3d8fb5cfba2e692
MD5 927dd8d3e43410a724cdb2e86d4056a3
SHA1 8dd4fb8cb1310358c67ce9d424b1080e33f9edf1
SHA512 84c1712ecc3eee55319ed4ef451781c6e56f8a7a339fe9dc2b09122361e82c0712190a6b346f2b86d2607d417e06f9dccb14e292a850d15a1d26c0ddd8679e88
SSDEEP 3072:j3ljgNvIGuuwou5scWTuCyd396x/IttGPsqdJ3:p0ISecuxExTPT3
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\251rnlgp.fim\Crashpad\settings.dat
Size 280B
SHA256 a1dd5a4150089819bd17e79c2192874d57f482750ce1d7bebd54dd4f17ba9cf0
MD5 a9a27838cb355f818eadc45084aacfce
SHA1 1608b52667df23cca85c69545e4ca8522aa75430
SHA512 d1f791bd5ee273060ec4f0000a1d9722c274aa3643b462195d261b643ba847678ed85dadd94d8f123a9ca0d025ed6858dc16fc2cfc127da847747ee6d079ee9e
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Temp\251rnlgp.fim\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 192B
SHA256 693338eb6cdfc9fab041d6f4ba9c6455efe14c06a0be87482a60c44185caba5a
MD5 2da9cc29a03549855ce3f3408375bcf6
SHA1 3b03318b2a170e7262b0d31c504ae30852c2b821
SHA512 ed4f48409a1e0fe728c58534d5083ddb49a5f90b5109931d4086e348d366822d5440c422ec938ca023c41949bb0d02cce0a71f8574630ad0cf0b4021077bad68
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Temp\251rnlgp.fim\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 257B
SHA256 e9b5c8f4fc58f2fcd8ab5b025d5a2f5f73fff779a90e0b8d3d2ba1dd8f80f377
MD5 dcbc9c6565fff5b25e0a97d263219b6e
SHA1 e33f6e50a43260992fffc6fe5bdbd9a3e8b04794
SHA512 48718a47ef8addb43941c9af312a7357ac5321632ca0dbafa297e61638992c7e8e5cdc674c2febc041d1e2b3ecfc916d78a2357ee39e2c8fa85bf71c453c7f13
MD5 SHA1 SHA512

Submit Download

index.txt~RFe5820a2.TMP

Path C:\Users\Admin\AppData\Local\Temp\251rnlgp.fim\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt~RFe5820a2.TMP
Size 119B
SHA256 a77c9e44b0cdf7dcbbc8407dbbea06d38fdf9ceddc614f49a69bef3257d91ddc
MD5 6b3529fbfd38c99b4663aa3daa506328
SHA1 5ea8b6e71e01541c765a0d31df8fd5448b2b4da6
SHA512 3a3fdc2df8751e780ba8da77429ee3e882db65e3d52c041001ec5576986e0b2ca38f796216eb157d95d2217cd1599c43e976413049c552f4cdc8e1e59acca7b8
MD5 SHA1 SHA512

Submit Download

ed9ee88c-5f51-46d8-9b41-aa32b0f8b78b.tmp

Path C:\Users\Admin\AppData\Local\Temp\251rnlgp.fim\Default\ed9ee88c-5f51-46d8-9b41-aa32b0f8b78b.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\251rnlgp.fim\Local State
Size 3KB
SHA256 f5591d34bc451d197782fd17d9b95efa2c8ddbf7d362ea32ea53d3e764b93267
MD5 3fcaa7e3daec1a6cd0da2b3866ed9689
SHA1 66ed1d9c2705370e0fda057cfeedc09786bd3a67
SHA512 6dcc5371d132422a9c51b40fa5aed74f4bd33b6dafbd3afc9f33865bfbde9911d5b76bf11c5da256285e84097e817800f25841af6b9958f5d36190f6b56e2264
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\251rnlgp.fim\Local State
Size 4KB
SHA256 34c8efc889a7239a07b3916779b926040a1620029233b2f527b25e99148b9d67
MD5 6c9370f387c7234d803d7b8d08ce9f84
SHA1 35f8483c439974446a089921345ea067257429c1
SHA512 12a6a77b2daa7c3adb427ecb25ba625c1c1a00b08c76727017cbdba29608c1370726c7210fdc7b3bc7ae4dc3c2608669fca31f05eac51d4de19524b31d8e0946
SSDEEP 96:4qGNkCufcEBDy58Frh/cInURoDotovWdD4BgTvWXz2vszJ8y6QBpa:jGNbnEB1ooDUwsM72vsF8B
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State~RFe5811ae.TMP

Path C:\Users\Admin\AppData\Local\Temp\251rnlgp.fim\Local State~RFe5811ae.TMP
Size 1KB
SHA256 6e671737c02f07b4a140197def6a1f768e8758b76633572f1945ecf3625d244b
MD5 1323b79246224be2cd419fbb22568fc4
SHA1 bc3fe0c1a0201b2b37a28d27a2d05cc60916eda3
SHA512 a6775fc390ae4d204505ba4fc07674ff48b83806de1d56cde52916ecbdfde5f404bba8950dcd6e428df210961e476c466faa91ef237ee1eea2330788a4575201
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\5nrf3crs.21y\Crashpad\settings.dat
Size 40B
SHA256 97faa1cf94f3e6a215d8abecd5b4ce62dc13e4d7397aa90d61a7855d5d01ee0f
MD5 7704e86d775353d93d2bbc9fb9fbdf84
SHA1 1926615e7015bb8e4c34987aa327e3e5183e1432
SHA512 448669519e466f835af839f604c1b1981592f50f70d90f5b8e30aa052bb887e5b5d178e7dc5b65b5016799bd81cfef39468747b3168825db08dbfa97b73dd162
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Temp\5nrf3crs.21y\Default\BrowsingTopicsState
Size 414B
SHA256 d50245f6e50514cf547b29700fb7f042463a91f80fe90510c640e1802965dc6c
MD5 c6e2e306b70b96e060227a1cf7300398
SHA1 ea5a5ac76e68cf78a97172711c43cd239591615d
SHA512 be17c52b551f07ba2251d74eee7d36682a08de634279471e08f21ffea4915d2c154648b157e3f5a10cbd99a6980e2648314e997572857ee1aad3318c2b23971c
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\5nrf3crs.21y\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 6d8d18326cf29519b987e6af32862959db281137c737cec637f53ec0d58fcb3c
MD5 956fa11e900a6173ef765c50998b8218
SHA1 106c6ab21b5d69ece8287cee305f6e906f88de40
SHA512 99bc598d5238e169bb6c3bc65ee95eefc7c9eacb14e4fddbb62304f108b074534d47bbb515e32e2dea2ba7a15496a18fc3843473a0cae277e7600199be42b78b
SSDEEP 6:/FoEXEJ+o4wbIkEVsWdLt+kS0Dwxq6tAZ:d7Xe+o4wbIbVLd53SkWZy
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\5nrf3crs.21y\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 7355030d35809a5618d8397d9f76cb4d02a23cbcaf787a30adccdd773cc7afc6
MD5 4d9401d02c69773da05fd5ac5741bb5f
SHA1 2b69abdb2bd77c698b8699ffeca91c63c9d85d0e
SHA512 84681c3f49f64a25712e0f68a5f7c7fb995d8c090a9faa9204a1b5756d95acb4e3dbe698659c2f83f61b4521ece3130c3b1c981f171c0150935a83ac969e9a94
SSDEEP 48:3Yjs7MMCXgNtkMiXGRGxoyCqS8aBCyYZaT3jW0PU:on/ggD6PDqSCyYaT3C0PU
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\5nrf3crs.21y\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 9809ca6fcec6a6699a6ce82913198870e36798e30cb5d3504bf66b4dfb1fa5f7
MD5 661767d436e120b0551d71bd721247b5
SHA1 d1706e9b5123e6d72c1c4e8f13003d3b8390706d
SHA512 2a3a4bc034fda8335e1431245732e791e18db8988e32087b797c4aa7cd669002918f124d3fd60e8d3ad1d8c1d2b8bbee7e30a1dbef5098c9e776c345cca2aaa2
SSDEEP 24:WTqkGCDOj2NIRqBXQ8XloJc0C/PuhPgg1eA3uRxbagzu3XOJmlOji2:NkGaGZRqRdoJVCehPgBADHHEmlYV
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\5nrf3crs.21y\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 25e067c281db07929e0bd413ac3a0ef38a14ec67d72fdaa5ad2e119760bdc78f
MD5 c1cb5298300d3ddbcd97335b631f0731
SHA1 6d4a819fc64f14438e39b1c50f08ffdeb7c597ae
SHA512 010911f953a8c43645a79d675adeaf8773ecaee85d9dc8c491b036ab68701065c94972b6d4b547cfaac9500228462025d17c6f53ad284e4dbc2bbf79b317be88
SSDEEP 768:HEkfDPLSgcRUv+84QEGUfDPLSgcRUv+14qUfDPLSgcRUv+N4IhTO4SO48O47Ty4:PLhdBO/OVOUTy
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000001

Path C:\Users\Admin\AppData\Local\Temp\5nrf3crs.21y\Default\Cache\Cache_Data\f_000001
Size 35KB
SHA256 e2d93bc835c7700d369287bd1850cee5446541a02d2eaffddce5709f0fb84160
MD5 a854d8ec0fb8b194c3dbd20f192ea299
SHA1 73c0d17962ce478252d49832cd1eb3b19cedc6a3
SHA512 bb9d1a6d729f6978cdc8dc8ec15267a51978947a85a4acc03073191b06382f9ff8bcf008abb69f6b8e3df150d4b9f2b9862ae02a979400633d484b18319543ea
SSDEEP 768:RbYeKPQYXhK1Fv3nJNPRxW9VI04n4JZxsjCTuJscFS9bxI:RbYLQ8w/JNZx8Vp4n4Xxs+6mo5
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000002

Path C:\Users\Admin\AppData\Local\Temp\5nrf3crs.21y\Default\Cache\Cache_Data\f_000002
Size 68KB
SHA256 2c6ecf00dc583c695446b0d6ca3ec5926baccc22b2139e0757fa4611cb27419a
MD5 65267683c8a97e45fba8840a3c7ade67
SHA1 3a236f274a406c7883cc84c3e978910921f7aaca
SHA512 b46dec98df1c35c618a79a34fed669385e7a65299cab53f8797c59cc3d2a1dbf2b6ef1f080cacd554cf7aaede2df778d9b4c3a2760ec929f3d7e6a8f9dce7d59
SSDEEP 1536:5avIv4Ps8dZxGZh/5/af17UIkhZZSJceY5C1qDT6/khcyVw9b50epUGVgJdbRzUj:gICXGl/u17t+ZSD6CoT6/uw9b50ep8bo
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000003

Path C:\Users\Admin\AppData\Local\Temp\5nrf3crs.21y\Default\Cache\Cache_Data\f_000003
Size 38KB
SHA256 f99a6b6717561db657211f562e189cf471a9426f0875f5035f63afb1c6531adc
MD5 26c62557592d44aa716f9fee42cede1c
SHA1 c65c197971b8e77a234a8157bab57b05880ba0ab
SHA512 62d5dc34194815dcbb91db2cc58f35dcc17e472e249b123bff6a38d5228d1f6f3ae055d4a1f288830f40063206b48f0f1ddcdb2554ed94e077a6b3097e2d6e63
SSDEEP 768:2kbRpyla+GtuF8ZgN0vFNosQoKiwpo84pqaOI8idbk/KEEz+C5U4z:5bRaa+GtuFh6FNdKiso84ROeTRaC+4z
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\5nrf3crs.21y\Default\Cache\Cache_Data\index
Size 256KB
SHA256 ee30d415a7d8744061a04cffef118cfe5e9bb4a853a915ce7ca036aacab3838c
MD5 2054a0b51f2c4bc8365b32b1118aad14
SHA1 3c61ae8afca38959fb23a810359356a1a921f927
SHA512 46bceb33836c5e1ed55e5eab5e6f37f09027406bb86303a20835e67df2a709dcd4f1086ca462e6fde8b31678fce9f72d88e54bf6b04df3cbe625d451fe4185f0
SSDEEP 3:LsLllNlNllklkXlrJFKlo1Sllx/mltL/dlXlDlL/8E/WNtlQl:LsRt3lPVw/eNnUEeN
MD5 SHA1 SHA512 SSDEEP

Submit Download

7018b8cf1c3b00c7_0

Path C:\Users\Admin\AppData\Local\Temp\5nrf3crs.21y\Default\Code Cache\js\7018b8cf1c3b00c7_0
Size 306B
SHA256 76922ea209ecca777eab05ab5548843eb39ac2268b8037c3b4c5455d03579a9f
MD5 f71e24994764d1a858c4be83ec071abc
SHA1 f1aac91c3474a3317414737834db0728a41fcd6e
SHA512 3f858db3789d2281aa0b4d463ffbb814bfd1a9ae3dc935c571c0085cb81357ad1507d56ad1ba4385a79b36351aea7e41ecac678dd8e9eaba8bca5acbe6077a95
MD5 SHA1 SHA512

Submit Download

ba678a2fbd8c358c_0

Path C:\Users\Admin\AppData\Local\Temp\5nrf3crs.21y\Default\Code Cache\js\ba678a2fbd8c358c_0
Size 298B
SHA256 90f89f433dd810721248e60219c18c849a98a6562a91e21ddaa1d7683145e111
MD5 ec46bcb902439627bea0b82719809c28
SHA1 ef8d4aa47c4ddb9d20c89540172ec1c44172ee19
SHA512 f17013ed9d735524a2963914a4a9bffaf36d496e8fa2c69fad2f907bee9a0b9bc5742b77194244c661f06b10ea2a39b729108ca77ca497ccdfa665a82ec48ae8
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\5nrf3crs.21y\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 33f0a8a92d71271ade94ffcbbc7b5a7a0152834c9305857aed02c6f2ef3e4b66
MD5 57522977d9d1321f2bf3616f5cd2b500
SHA1 e1d3f2a9204ecb7e08660f85c7ae18102282bcfa
SHA512 5471d4565f47525804f15e8eda38c1153d27e3e144e590a6b9dfd007c53eed042cfc516e3f507b99e88397401196cd4f146adb8b72376f67f48d0a7447fc3423
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\5nrf3crs.21y\Default\Code Cache\wasm\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\5nrf3crs.21y\Default\Code Cache\wasm\index-dir\the-real-index
Size 48B
SHA256 a4e7f6dc26080fb1ae2b06572aa7ccf3c93d13c5e39a2dd04b66ed15644680a8
MD5 83cbd76d56fc3b0961dd8d46421052f3
SHA1 8c4d8481ad99fe2fde911795a37df3e8b1998b30
SHA512 0059158fd1b407fa2726a94693cf5baeede3ba85e7b4d4fcffbf7d0773cd64730dace0cb6bb97f2c90b6ce705638a3c513b1405ec38eb30c9f31c25f37287ccc
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\5nrf3crs.21y\Default\DawnGraphiteCache\index
Size 256KB
SHA256 277c6e65f57ea7ae3651ef92d6659b942e79a1905cc937d92bcda80f20cc7ce5
MD5 ca8bf7972bc75ee5c321444304519574
SHA1 a9da5126096a5c22e58f6f4c0ad4bab76801bcc9
SHA512 db8b473385bdcc72912e11e17d1094ce6e86a7b68c3264de52c6c78533099b35f6def7ac945d7c1c6882dba1b4137c92878ad8a2af23f9c1154dd41ad1f4b947
SSDEEP 3:LstlNllklkXlfF+:LsX3lPf
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\5nrf3crs.21y\Default\DawnWebGPUCache\index
Size 256KB
SHA256 0e51fe355bfe6090c20d7a0fabc27744bac0f9400f5f78584d9678666e4b6218
MD5 cc6c6950d095cff158c992b3a25ac8fe
SHA1 a5219b7e652dfafa7b9514b35dbb42f4df39ee13
SHA512 22849c5979fe19c439c7e70e7d1e235bfc22bebd8d8b0b4bb05b53f9777e7a4130c580f69fad5aa3597c5c09bde8fb47b07cb5d7b60603908bbbd2c5ceb54074
SSDEEP 3:LstlNllklkXlubvF+:LsX3lPu
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\5nrf3crs.21y\Default\Extension Rules\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\5nrf3crs.21y\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

128.png

Path C:\Users\Admin\AppData\Local\Temp\5nrf3crs.21y\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.97.1_0\128.png
Size 4KB
SHA256 75da533888189d13fc340d40637b9fc07a3f732e3fcf33ec300f4c7268790a62
MD5 35696aba596d5b8619a558dd05b4ad40
SHA1 7ecc1dad332847b08c889cb35dda9d4bae85dea8
SHA512 c32f20865f736b772844aaa44572369e7ae85b9f2f17f87d61694acc54487309a32bc4830ed8d9cee8b593babecf728c1ea33c2b9588649be0e4f1e6ed7ee753
SSDEEP 96:BCspUuBfy1PI2JIwOKpGzJhvw3ymK198EfeCW74mWQz3Z+1nl03Vjkq:BCsfly5TeFKpGFy3ymK1+oK4zQ1+Q6q
MD5 SHA1 SHA512 SSDEEP

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Temp\5nrf3crs.21y\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.97.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Temp\5nrf3crs.21y\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.97.1_0\manifest.json
Size 2KB
SHA256 ef67877af40d32f48d45e0fc44245f191e795b64ead8f4b87664ab80d0ca36a7
MD5 580173b7de156e29884d4f57a66ec07b
SHA1 9f08b09fb87b9db088c0de9c1af37fcee1dc94d8
SHA512 fc1d083171f4b25de0d4daa432ddde852bc160aa9fcdd7668438faabf14dfc75f2854a4936aea9990b3e487017f2f2d41a188e915a1063055b67456c859a9e1b
MD5 SHA1 SHA512

Submit Download

offscreendocument.html

Path C:\Users\Admin\AppData\Local\Temp\5nrf3crs.21y\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.97.1_0\offscreendocument.html
Size 97B
SHA256 b9fa2d52a4ffabb438b56184131b893b04655b01f336066415d4fe839efe64e7
MD5 b747b5922a0bc74bbf0a9bc59df7685f
SHA1 7bf124b0be8ee2cfcd2506c1c6ffc74d1650108c
SHA512 7567761be4054fcb31885e16d119cd4e419a423ffb83c3b3ed80bfbf64e78a73c2e97aae4e24ab25486cd1e43877842db0836db58fbfbcef495bc53f9b2a20ec
MD5 SHA1 SHA512

Submit Download

offscreendocument_main.js

Path C:\Users\Admin\AppData\Local\Temp\5nrf3crs.21y\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.97.1_0\offscreendocument_main.js
Size 135KB
SHA256 7a64c384eaee7579f0c07dea3d49bc404cedf21fb060e736949f523e8af656db
MD5 ea3a1f7fb8dd2996fb5e066c10c7154f
SHA1 cf3c11aeba964e303f9005d65737dd0d6e2033bf
SHA512 eceb8cca0c4803a1144aec47b875cd8d4b723c22a1d1d323521826db37cb8536384b0905b25fc7337e0a94abec45c6c70d1d0a74c3a71e546a11fc402fcf1f5a
SSDEEP 1536:E3oQjxDHEhMS4L8MrOUZfSj3rZxOEzt2txtKjKtvLH33XnmSzfQhXPJ/s/I8eNhC:b44Mr+brZxOEgKjE7ZfQBNsI8e3yu6LL
MD5 SHA1 SHA512 SSDEEP

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\5nrf3crs.21y\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

32.png

Path C:\Users\Admin\AppData\Local\Temp\5nrf3crs.21y\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\32.png
Size 1KB
SHA256 c0b2a99e82bfa9b629fc903c77bd36fd3b148b25fb67ae196cbda262c593efcf
MD5 b422f26131f7d87105b2ef5bcc8996d1
SHA1 5bebedb12720c3b09dbafe9204bdc8eb0f7971d4
SHA512 1a4b3406afb311ad824a1adfcb33f336de09efab34c66e058936a57d4f73ac33431eacf1fdb11f516f56107a93741aab3b9fa5c85d805466ca58c3e24bcc9c28
MD5 SHA1 SHA512

Submit Download

48.png

Path C:\Users\Admin\AppData\Local\Temp\5nrf3crs.21y\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\48.png
Size 2KB
SHA256 a16b7fa466101581d443223247589ff21fdf73f1b09d43ac740fa128d0252931
MD5 33da9ad751e4a3b21bfccca9e6727e8f
SHA1 05d5ceb6a2b80de82a2f70442f68ae803dad22f4
SHA512 5af9ef87eb7c050158b7add761ca06273094a5a2d5dba87991c7ab20fa2dfb7e7f7ebf1fbae21286781144ec1fe3531457deaedfd2a668975dc7184020c6f0a9
MD5 SHA1 SHA512

Submit Download

64.png

Path C:\Users\Admin\AppData\Local\Temp\5nrf3crs.21y\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\64.png
Size 3KB
SHA256 4fea2d966296665a3ae1d35c0eae541b0ef7b9b1a9890e9e65314f80db5a3e21
MD5 1efcc119d02c61752598ca121cd0babd
SHA1 6d0736581b02aee66d51fe29e68babca6a59fdb5
SHA512 8d5554a167907f96720a126e901aa25f01e1f58f9469f8366e7f2352ce16da82fa3963845cdd586837c5aeafb3092a2aec6d3e755bec2031d12325b4799d44e1
MD5 SHA1 SHA512

Submit Download

32.png

Path C:\Users\Admin\AppData\Local\Temp\5nrf3crs.21y\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\32.png
Size 1KB
SHA256 708b95af160bcdc6a17ca93f9b91158944cea75b743b4049a6e6ea299f8c7abf
MD5 a06bc120408cb7209f3ff0ba4b39d01a
SHA1 7b1df3b761840e87b484603da69837ec705cc082
SHA512 a3869426f4c5af3c225076454b2de0bb0f923eceba687ef7a82ae27b5384c90d03f1e6c1d50efdf8a1e51c1c7ab28ec4742fabe1cf75ef346a31f8037714c1f7
MD5 SHA1 SHA512

Submit Download

48.png

Path C:\Users\Admin\AppData\Local\Temp\5nrf3crs.21y\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\48.png
Size 2KB
SHA256 9962fe7bd4e81a0dc05e150a0a602db40bdd7dbff114f16adb712b8b749e1898
MD5 eae9011cbfb45db3e8a6a5f5d4f45554
SHA1 6a45d862f6d6658e14a4c925f5a3e25baab6c875
SHA512 cee11d79da34f767e1aff3771847b8008c0424825102decde2d0d51ea33f9a03262bdabd3938c5948bea95a4fdd46217cb81c1669ff5629e348265a40e30f9c4
MD5 SHA1 SHA512

Submit Download

64.png

Path C:\Users\Admin\AppData\Local\Temp\5nrf3crs.21y\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\64.png
Size 3KB
SHA256 4e0c7afe519c86da175dae1f069379a40694ae49391fdc3c7ccdf5c396e78ade
MD5 3c4bbde0c0ec7a7694b78ca833e41ba8
SHA1 e4afa932cecf06e03f59c9b6041ee723e10fcb2d
SHA512 523777c57a8c4d49faed221cbfea7dd589f9c576d2bb9386c6d84e47f5b30762a3012bbd702ea3c51b3f71c48e403b40b297928b94ce36e1a873047d27313006
MD5 SHA1 SHA512

Submit Download

32.png

Path C:\Users\Admin\AppData\Local\Temp\5nrf3crs.21y\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\32.png
Size 903B
SHA256 217f48c637316cfba706de86339bbdb5f6d60c0fab701fc71ba2da01ea71bd99
MD5 166a9c3ecab6cfe73664f783d6d49a89
SHA1 0b9e5c909810c2d2b40df3fd4c8feacebad846c9
SHA512 d3da9c250dd728af13e8eb1ee75f420b1857357e7afca9f93090d253fb6cba43bb52b1199725ce3683d7e0411af764333ad2293ada77638847d2526b1b363d3c
MD5 SHA1 SHA512

Submit Download

48.png

Path C:\Users\Admin\AppData\Local\Temp\5nrf3crs.21y\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\48.png
Size 1KB
SHA256 2e201cd442e08720a6d4e38516ceea3e892dbc345db1835441e9eec005501c67
MD5 19f9c11e56103a25a50b9c33be84560b
SHA1 266f57c5a015281d4dd266a9b3dec9cb3a754653
SHA512 964e1e6d787450b837f130a4289906ac39277fcd4a98f6314e5aa0450fff81fae275f023c15eb58548ef3ada0b7363e4e6b3d61bb326246f3dc63336d68bb160
MD5 SHA1 SHA512

Submit Download

64.png

Path C:\Users\Admin\AppData\Local\Temp\5nrf3crs.21y\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\64.png
Size 1KB
SHA256 a693bf9d32c7ec663b864a2faa9b99d8bb6cb76e332263f5e9a6e3fc2ba60ac5
MD5 1f695a492ddf318b832bb48f5b9442fc
SHA1 81eb257fc22a30c4e75454ea0e4677043367a6f0
SHA512 0ad7e376288ec7a2d9314447f2649bb19bb703bedc9710a758e7a15e39083150aa34e2a2e6c22229b324cef4e41c09289c90b445a413336d6eed497f65d8bcb3
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\5nrf3crs.21y\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\5nrf3crs.21y\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\5nrf3crs.21y\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\5nrf3crs.21y\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_ap1lsu2s.bvr.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ap1lsu2s.bvr.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\dmgdpxxe.rj4\Crashpad\settings.dat
Size 280B
SHA256 254cf7f906984ae5296839ed38e41835212f6bfe083156ae80a362207181a146
MD5 5f8665a8b542a3d4d242d56369a44842
SHA1 9f8de968438e2556eb2bb7c67b523a5ab3d0c3e9
SHA512 62b168e4742ef8caa9405dc24fe8d4a50904bc3d043482bcaabb40a7c92e7aa3da04a5451f6a739c3ec5294dd9c80eff3f68ffbf48ec4bca7e4b2ba90795454b
MD5 SHA1 SHA512

Submit Download

f_000001

Path C:\Users\Admin\AppData\Local\Temp\dmgdpxxe.rj4\Default\Cache\Cache_Data\f_000001
Size 34KB
SHA256 7278f9812930cdad0c816a3f78c7fefa53a818687b4e7187aa95418369240556
MD5 375fd0d880d30fe16520b0de71cdc0ed
SHA1 b163bbd5326f302ce71f5cd8eff609cf5976e92a
SHA512 ccd80d854ea9176b7c528c8c04a661a8bc66df7f85ac4cd716d07d1e432a36d47af5f78a8b736578bd2360c0533dfd38e9926f7556194c6b45d55d7402346839
SSDEEP 768:1uGe0hN1C7kTxSiKo7eJ35MDr/NcWDp8jDAZa7NXHsJi9nK4z5gXdk7bSVIotd:1u90hzwoSiKCw3uSMp84Za7NXMWSdk7S
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000002

Path C:\Users\Admin\AppData\Local\Temp\dmgdpxxe.rj4\Default\Cache\Cache_Data\f_000002
Size 100KB
SHA256 5682c98effece00491be8227ae75e3cfae09fb3147db1a23827bcc45dd6fe392
MD5 b9458d8a9a334ad0342ee4d74f8187db
SHA1 d7333a8d13e1383b4537a99526bd0b46f1fc3b28
SHA512 bad64ece9db02369d73f81ed8a2ca6c8929b414a2f1ca9a878eedcfce12866050bfcd313026d730fb978388162d0feb516c316d07cf8a85bc59aa93c97cfbdee
SSDEEP 3072:sL2Z0/CW2loqicfuJxk7JMCUADxbZulTJa:w2Z0/CWEoq/fQxyJMfQxNulg
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000003

Path C:\Users\Admin\AppData\Local\Temp\dmgdpxxe.rj4\Default\Cache\Cache_Data\f_000003
Size 61KB
SHA256 6230a7574e8b41544be2583746994c7bdcc70082a630f170144efb45a090cc1d
MD5 a8c8b41570dee73af2cafe3ea8e38e2c
SHA1 718bc4bef60f984848ce50137aa419271a174841
SHA512 80a74b8a7e1db38b4c5287e411a90740a03dd45da97d000768158a20b8fc5eb72e7c5336ba301440dc8aa4242bcc1c77fc4e174a2a94630c9c60dc442185bdc5
SSDEEP 1536:OU6bNxry5KAIC+MtWRGC4/riQKF/avTwkFyh8:OU6zaKAxVAIGQzvyh8
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000004

Path C:\Users\Admin\AppData\Local\Temp\dmgdpxxe.rj4\Default\Cache\Cache_Data\f_000004
Size 382KB
SHA256 27515cc93e76996c4e7289d6aa9946c9e029585556888998a3870dfd9cbb0f3e
MD5 c6c6d0eec3b0959ae81f06e6c0b70e3b
SHA1 328d0be29cd518f38af45ea4b1e69578e883dc30
SHA512 d8c7301cf17f0f97f273d983d1cfe62afac91598b97a2cfcb236b08fe8b6e5c5001518767216a397734a0b9890da8421ef9279a5a6762c562ebcbdd0f364575e
SSDEEP 6144:mrUZ6xu/j7wAJNvJA4C4tvtdKpg6RmYRh6JDt4dmgrfmrFh/mZ5zoTLNKe2H932S:moZ6xuj/JNvsgtKg6Rmk6JDt4wgLKFJE
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00000a

Path C:\Users\Admin\AppData\Local\Temp\dmgdpxxe.rj4\Default\Cache\Cache_Data\f_00000a
Size 73KB
SHA256 641339624bb1f0a20a2ea001b020103a33fe0f7829643820e150c061c751992f
MD5 a83bb51eda77c8492eceed3d1fe3217e
SHA1 81823975317f94ed2a85f48245f8734648ce7a16
SHA512 38b74b7a9cb6501e546d82ad3e0a8748b5076d3dc31c30b0032f76c839da18a0ee6f85f66d4029f5332efd28d0d86b0e45d79ddab4be2f3037181f895f53256a
SSDEEP 1536:52WlA5K9FQuFr/MfLBipvTxwh+OYCJw45HKsRRtzVR+2YtfkvcI:NA+xFr/Mzspbxwh+fSjHKezv+sEI
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00000b

Path C:\Users\Admin\AppData\Local\Temp\dmgdpxxe.rj4\Default\Cache\Cache_Data\f_00000b
Size 26KB
SHA256 039ad570ac612dbed3a4501a84b872d7454814734b5fbbbf3df758f2f69b895f
MD5 e924cc41c587c8861a1c9915fc32c3d6
SHA1 e3def882c7aaac31f5f2e08d260a60281eb9bf0e
SHA512 1a6c602ed4fe828e7611ad45212025d8074982d749b917dba1e64d26bbc2a1d708fe35da3b3a75f907b25bbc8fbaef62eaf550d577fa1de5c343f58cc15e16be
SSDEEP 768:MJ8Ytwxv6eua8RgV4hfhEOhiLoAKaz3AyaE4zE:68Ytavc1RggEOhiLlvcy/EE
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00000c

Path C:\Users\Admin\AppData\Local\Temp\dmgdpxxe.rj4\Default\Cache\Cache_Data\f_00000c
Size 17KB
SHA256 173eb31d3baec51bcbcfdb45dc4345663792f7a4f18d28cb11dd7cf3c48a5c3e
MD5 44e3fa6b0ee4add808f77722dd9e663e
SHA1 368c6cdf54977c7398327617f6e6e5e46dbee7b4
SHA512 d5f6e228ab36e83ebba0ec93f89deee87a612ef6316666b3e3236cd05a7824374ca2dc413aae8d773c8867a09b63a419d28e33b6359330d62ff4f881761f6c14
SSDEEP 384:W3Kg/pSY0NmxeAoHdaYkNXdxqcYk6kQgg9gADBZlc5wZaJrzNkMn:W6g/pSY0UxeAoHdE4QzPShDC5RCMn
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00000e

Path C:\Users\Admin\AppData\Local\Temp\dmgdpxxe.rj4\Default\Cache\Cache_Data\f_00000e
Size 68KB
SHA256 4f9c2a46314ea3e96c61fc7bf810f04318b8ba8acab0c8fc9d92e90de1eca4d0
MD5 37b9e9921ea0d29fd873777c68146864
SHA1 a5bfb1332fb7d9e1f9fa9cb055da5ee4ff62907f
SHA512 27777608adb4810c34030e9bb5915952719acc6070aed36c75953f57aa7acada121048149e419056917dfaaf106d83efa951d1afdd65537c067fcd56ad63f08f
SSDEEP 1536:aSirfsne2f7m1ujIXZFZVu5HCvQO9T/ZoYdw6k8rHFQI+LZFxt2dewP:B7ne2f7DIXjeivlrPwgFQjHCZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000010

Path C:\Users\Admin\AppData\Local\Temp\dmgdpxxe.rj4\Default\Cache\Cache_Data\f_000010
Size 71KB
SHA256 a603adb990e91eaacb44393e03a3400c659ecc0b4e5080be99a47090907722f1
MD5 843bedd4e39caf21aef09d6e00bff9f1
SHA1 a83393545fd6c35d60447e749ecb12909b0dadf3
SHA512 8a2c7c3a1a0c1433ea07f240b87712c9b2b7edef77cee71d54854a47904a25098e3c236d8d505e51d90a8c27b0407eb6c6313eabce87eed8fd5ca2a91b55a81c
SSDEEP 1536:07hfl0tlHsc3YVKDAcvQ8o2QdZPIWpRDHuhB7QenyhUZTBKHPq4:NtBoK8cvQL5HDqB3yb
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000018

Path C:\Users\Admin\AppData\Local\Temp\dmgdpxxe.rj4\Default\Cache\Cache_Data\f_000018
Size 18KB
SHA256 2ab1f8126c01f9499011368282781b1ee84562071925921d8c066b7bd52f076c
MD5 ffc11d010cb2a8b705f066925f455c00
SHA1 727637777486888513dc5da716026b585a73272b
SHA512 c7c818658f8e60d920d7a4ee83f9b62909bbdff3e34e1118cedf1f8f19eed9e12b21dab934158bcac6c2b0465104f39bfee6b784f2a4507e701d3ef2b39d4b6b
SSDEEP 384:uO2hUTBp0sg7K5X/TWJr/8lKlb1YFAQeuLw6+91tHRx5sUqzmYfwlIP0y1S:N2iZtTWil4bGOOwvrHRxlqzmyy
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00001b

Path C:\Users\Admin\AppData\Local\Temp\dmgdpxxe.rj4\Default\Cache\Cache_Data\f_00001b
Size 16KB
SHA256 17e4391d4ae168ae55fb00db1d76f6e7249303ba102ff015111abef3a4472666
MD5 3400ba445bc611f59ffc2371f119fd46
SHA1 8148ae8480d8358354c74535ed0da2ad389ed23b
SHA512 2c2db51b00f0c4c42c8cdc111a01c9ac40310eb0a3bc928139d6c457230193c5daa8bb6daaca200871b1bfc82f874bc5ad6779a624f389b7a07eb1cd663256c9
SSDEEP 384:aiRAGAAr4ABli2DRrFq2dbkUaUSktY7Cl9m+FjUIo:ai3A0Ll9JkPqtDHFwb
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000023

Path C:\Users\Admin\AppData\Local\Temp\dmgdpxxe.rj4\Default\Cache\Cache_Data\f_000023
Size 16KB
SHA256 b5c0954100318794dc982e3e9c40bbcd1043b40eb6f8815c2e143ffd267b12af
MD5 15f6a86c9e04a470003723b319e4c574
SHA1 57f4ba5be88f437ba59fa3aef54e3b817b82d800
SHA512 aeb652a0a190b616d1a9512072b5356cc1d3f8b1a32d91ef1a4a5fcfbd28b4481e715d1f7ee39db80fe60987d4207df41f32c426d77514793dccb24135886d7e
SSDEEP 384:mBnbtMrhv9T5PwLobLczIFV3AHI1c+WSS/fU:mNSrd9f3GOZArdSys
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000025

Path C:\Users\Admin\AppData\Local\Temp\dmgdpxxe.rj4\Default\Cache\Cache_Data\f_000025
Size 33KB
SHA256 80cae6a3e20baf66aa17eea8978fc15f5c44fee0421c7ab2a280ff6c5219e12c
MD5 371968c16184b85339f192a116ae8ed3
SHA1 f85201b0b2df8b80c10791e9c7f14b7ac709d302
SHA512 27f74f6b46f7e9201df6fa051cc74ded9bf2b928547a39cae772dd07541a54cd4f75038f1fdf4c756ca9cf3a992a8f2b95c86d10bd53963b94fb19849a90ee9d
SSDEEP 768:hX9UTc3JwRhDnyV8/NnnRI3Evuld1/gpu:/83Do8VnRjKd1Ypu
MD5 SHA1 SHA512 SSDEEP

Submit Download

66954325-07bf-4b24-9405-10de6fadd615.tmp

Path C:\Users\Admin\AppData\Local\Temp\dmgdpxxe.rj4\Default\DualEngine\66954325-07bf-4b24-9405-10de6fadd615.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

ExtensionActivityComp

Path C:\Users\Admin\AppData\Local\Temp\dmgdpxxe.rj4\Default\ExtensionActivityComp
Size 4KB
SHA256 8c471cab38a1696289186d01b06ff6af2a888852dc18d6fb8d2a0e54898104ed
MD5 d25d5e1dc1d93430e64ee17e48ce442e
SHA1 d5c7ca9a57e6cc68927a249fe8e601d52680ac7a
SHA512 f4cff7510b4ad81090e0b1842652f8eb7995f7aefd0ce651151bc24ca3a4305d34ecae41cf193d9b846e8f6359ccf545e5d05e63e6e766fa9761ccebce620f6c
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Temp\dmgdpxxe.rj4\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 192B
SHA256 b2a5535bcf15d65d4ddbd98ca04e9f4d4c445d3379c95a82b5d8212038b775bb
MD5 92656599ebea2465f696b8fbc4729db4
SHA1 5f750a9b54de3532a6bb9af90ce8d62819e0344a
SHA512 f3fa3197bd7478c4effa0550a56c2da131df7d4aed1389c98690c3b0417ce1f14c50bf914698b8f49254f51ec75912d561b6ae31fc3fd407e07b213631c6bd4a
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Temp\dmgdpxxe.rj4\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 257B
SHA256 871c74b1ad5f191d9bc886ec978e39651002766afafe099de6929e8a862f87cb
MD5 56d14b882273e69fc85cd21725185878
SHA1 ade9ec4970a7327a9b16df92071ae2bfb4a0f550
SHA512 5ae391cabad5675547c544c785c608ea7677261f33e8c3f81017b8ab2b7de0fb58f577c04227d3644e7e97c2b737c9a10c64d6cde29bfa2144467b2c9116acaf
MD5 SHA1 SHA512

Submit Download

index.txt~RFe584273.TMP

Path C:\Users\Admin\AppData\Local\Temp\dmgdpxxe.rj4\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt~RFe584273.TMP
Size 119B
SHA256 82041d80ec3891aedbd887c582fe37257b0efd5addf32835d511c25e64e6c850
MD5 a4a2dfe4c964ae24aeaec1b18c733b99
SHA1 319395a04ec5efcce63f6499a67397e3703116a2
SHA512 533cd34485a3796dbad13d50ff266ee40d155ffdc70cf34a4e11e2543584130a39f8e73ca50e70a0ef73d7b66e9b047839ad1d2eb288f54232d15b0af7d17eba
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\dmgdpxxe.rj4\Local State
Size 3KB
SHA256 cf48ddae647f7ddec30616b78b365da348afaf844a7d8277b00073add62152d7
MD5 a910f971fa8d5a2ade0a7f268cbcf215
SHA1 580ddcb9643fc54e460185c3748bf175233a04b8
SHA512 efd90d3eb8829ac4ab16eea5246d45f9fe2c0cc26fc5e82809e23f5fde4c71feff92648ef1fcd288474bd29a7f2a99482bac0fde19e5d5f7f15508c710e38c91
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\dmgdpxxe.rj4\Local State
Size 4KB
SHA256 316a113eed142ba5536734af1462a76f3bfdf4ce8ec1f8690a608eab1b3147a7
MD5 ea4234f959773c144bbf5f955fad8f48
SHA1 efb48f2fcbc50e5e0fd06e540092868546098c07
SHA512 aa3e0a067a7f301c9a731239d9565942aa12df0e511539d0e07b229518fef0432be254e7f1b46f33db3cc51d1af88b7b7f49061cadc68a7cfb22c7a7b357b8c8
SSDEEP 96:fqGNkCufc538zRn58Frh/cInURoDotovJIDhBOPOvH8TIVuJ8xUB01a:CGNbn18zkooDUw0XIwwIVK85s
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State~RFe583582.TMP

Path C:\Users\Admin\AppData\Local\Temp\dmgdpxxe.rj4\Local State~RFe583582.TMP
Size 1KB
SHA256 9537005ad4d90c9b03d4dc34e1e10d7ec8807606e35848765952c2945f02e797
MD5 9075a1c81d7118d41f2ce57949b7bd0a
SHA1 abcbf96cd0610b1f92cec62f432949a845608f5d
SHA512 870ce5291855a6a0693ce7a0b0cf88d499c783f73d13af911daf110fe78beece6c217372c3b614f09d6881dcf217d807950a4e146ba16bec82c45717e37aa078
MD5 SHA1 SHA512

Submit Download

32.png

Path C:\Users\Admin\AppData\Local\Temp\jdqgumkv.ogk\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\32.png
Size 1KB
SHA256 3197a2ac164c5bacb65f02fd9a6eb9c0a533fdf3b24f43043bbe9af65ed6608a
MD5 60953b3aca67505c2c7ea1a902e84d51
SHA1 5e6a8e04a96e36306c66409edd4775a606f13f54
SHA512 2e65ec84471c3f703617171aa32f1a0d6c57d73e1d5c074b92d20d580df78e7ac4eef5ce54ab7defd0027bb38e33c44a6602d3e123a2fd310e514af0f5b38086
MD5 SHA1 SHA512

Submit Download

48.png

Path C:\Users\Admin\AppData\Local\Temp\jdqgumkv.ogk\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\48.png
Size 2KB
SHA256 9bdfc3aa03d4e41b0d83862ce02f9fe7fdb55a492280d86d551b91a24efd47ca
MD5 1625c1dd7bab831d8ab5308a1a71d525
SHA1 f1c145985a7c8c18891caaba0f46729bcbd1f63b
SHA512 75079bcb02482abd10b121d81fe39607dcac17bb3107ca274c549b570bb473260dfdbdd13df769b1745425ac5433a22fd392a2a1d815897e0c2091b787bada8e
MD5 SHA1 SHA512

Submit Download

64.png

Path C:\Users\Admin\AppData\Local\Temp\jdqgumkv.ogk\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\64.png
Size 2KB
SHA256 57d5cd9fa59f944ffc78ec2a12633a79e2f923124fc50676ffbecaef5021b4a9
MD5 e6671b804d6013a6706ea598e2d854c5
SHA1 40e4f401fe4afbf7bda49a02fe94f5308868460e
SHA512 7b11a47497ae5810ec4c7038ebf8358f03d79126886feb6daffd92d116fd606f530ecced9c3d635c0f57b9f9eb80ed9e8fa4eb98b029f9fd798d9b89ccd279a8
MD5 SHA1 SHA512

Submit Download

128.png

Path C:\Users\Admin\AppData\Local\Temp\jdqgumkv.ogk\Default\Web Applications\Temp\scoped_dir2328_344210753\Icons\128.png
Size 5KB
SHA256 99b19cf47ea4e47b933229e92b87a474fbd5af7936bdf885c2240d0e6f4bdaaa
MD5 6a371e7bbf132a71f031772845249b9c
SHA1 36f499f3a2e2bf885019d914a0cc6e8b3e035a79
SHA512 b1fdcd5af84fa476808b8e89794d9df9f8e48b3e7c1a2239deae10832834d01bf311803ac95b3774d781be791b47389310ca866e1a6b497925ca6e2f004555a6
SSDEEP 96:n0NgAMSinf795k4ITgiEAyaD39SOOcqS+e60qq/zsB:n0Ngpf795k4CwG9ST3S0wzsB
MD5 SHA1 SHA512 SSDEEP

Submit Download

192.png

Path C:\Users\Admin\AppData\Local\Temp\jdqgumkv.ogk\Default\Web Applications\Temp\scoped_dir2328_344210753\Icons\192.png
Size 2KB
SHA256 9cfd1ad226821af533499bd832a5674df52a720b19e054580a2b999e19dd7b1a
MD5 22ba8844019e231a435903176a618bf5
SHA1 0ce576800f66bc2145c8df72b9efbe0c7431aff8
SHA512 2e754fce3268dac2f8f9261f4d4337a7990a990121327c9d491f27fba5c4680968c7589bfa0d04082410f975cda97c46912ba8e1c39f8a6da15cb32c02929cfa
MD5 SHA1 SHA512

Submit Download

256.png

Path C:\Users\Admin\AppData\Local\Temp\jdqgumkv.ogk\Default\Web Applications\Temp\scoped_dir2328_344210753\Icons\256.png
Size 11KB
SHA256 f64a3d1e393f9a114632d22bc8a01b328895127ff1796e2c3d18b206622fab1c
MD5 024859c892ef6882e8a3e1be4675d23c
SHA1 30ba3b6255e2514b9782ee29f6b8b55ed350a29e
SHA512 58caafadba7cda1db596f5a3c2f94fd3a167cbc21ad98387820ebd808a52eff0e23a5a8292b34a8e284aec4bf2573998ca62f0effb5b647af1bee96ded8bb384
SSDEEP 192:F4aCtq9F5vnIb8/0yNBlV28QNP716enZiP3dGu5yIs9gGDyIMWQo2BkL6O1sSO:Veq9vvPdBrQNL8PNoIsPGYwBO1sP
MD5 SHA1 SHA512 SSDEEP

Submit Download

96.png

Path C:\Users\Admin\AppData\Local\Temp\jdqgumkv.ogk\Default\Web Applications\Temp\scoped_dir2328_344210753\Icons\96.png
Size 3KB
SHA256 6c5f0e1efa0cf592b01bc20be9c3f348a4285e4604e555216c064b64a05961c0
MD5 7b0532144ec2ce1915a3707ec9084aab
SHA1 81cab7df8538d1f757a3e58318716a9a1ed08d5a
SHA512 aefca0ca127e2b91a5c7206b8103b2afd977258643c12e972a292522152964da1beceaaba0b8f4f40e85e705bb9c9e5826ba49eb2d9b925dc07964096863dcaf
MD5 SHA1 SHA512

Submit Download

edd35208-b4f1-4dd2-9cd2-294b5d1beaa6.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4384_1478387564\edd35208-b4f1-4dd2-9cd2-294b5d1beaa6.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5 SHA1 SHA512 SSDEEP

Submit Download

2cfb475f-d4e8-4cb9-87c4-c4dc3941dd23.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4468_666996116\2cfb475f-d4e8-4cb9-87c4-c4dc3941dd23.tmp
Size 154KB
SHA256 a468f5875b4e55ea732e3df283b4f4ea941be738b238122979ca5d8006a3a8fe
MD5 4ad81f6ccc657d1da582c75c5db037cb
SHA1 ab0370e7d32ebed71fe9787d3a4a2fc0c652a28e
SHA512 66461474f8b36d6d470797df9d4a3cc4698bceb7054c97166eed98b74def84f58486fdb909928aaeafee793799a436210b5d7091acce6232b23eb6ba926ad227
SSDEEP 3072:OqeD5sKZ7XcbMSqnDhcfXE0IfnpWpyKIrFn2wNkR7aUPuWm6u:yD5sIXcYSqDGc0kkpIZ2weeX6u
MD5 SHA1 SHA512 SSDEEP

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5900_161670875\CRX_INSTALL\manifest.json
Size 1KB
SHA256 f04b41a409ec4bf2f539b6f5334c36b0b14b8bf99746e0386980e4e12202dee8
MD5 3e85528d9e5a25bed8020634a653d296
SHA1 e63ee52c7e4c37559d1ece52216382af67894c01
SHA512 9916c110bb90ed25de689b7981472375b00574ff46b17f9c628501434e4bcf298f6eb5f8c01cf2ce0e12ca068b2f1796eefe676c2a76fbfb42283a41a54bb51d
MD5 SHA1 SHA512

Submit Download

tmpC738.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmpC738.tmp
Size 1KB
SHA256 7ae725c91e3a1c0a22cd433075db09cd078204fe9ae87eb8987100e13d23e5c2
MD5 cc06bd083432b50a5f2cd2814b98928d
SHA1 e4fcef4addce21895ffb0d37d2155e543248d2de
SHA512 d78aa9f84264612726c9a12c8dd9c3c75bdb491923b4c5c56f72be81688a5ce362883087f71935575c653d918940b2adcd5af2618fcf764327b9977ed9bfa209
MD5 SHA1 SHA512

Submit Download

2AAS5CLE898H9W9YITUZ.temp

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\2AAS5CLE898H9W9YITUZ.temp
Size 4KB
SHA256 0b97fae269efac0dc7920e7d855883c6f455111c9b8ba03411a23b2d94f09a3d
MD5 a66419825376206a6352521b16614864
SHA1 8f5197a018159d057913250bf8bf96bfad26de66
SHA512 efdb812d657c0ca925f9a0bf1ad15e161b2039acdb8bbe1add2f946940c6b875753cd7fe186e5a58db6ff9c506c80b3cd8c0980b4f86d06dae53620f2f1e8d7a
SSDEEP 48:AV8dOvH9TgYLfbJ9zUoYYdLXuHEpuV8dOvH9TgYLfbJ9zvYNgdLXuHf2u:cJUodukcJviIun
MD5 SHA1 SHA512 SSDEEP

Submit Download

ccba5a5986c77e43.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Size 4KB
SHA256 ef49af7cb1df51de3eee622ca29f05bf831be0e7d31b326e06cba5a042568223
MD5 a6a2e4ac78917cfec834baa7bed2adf9
SHA1 78e1614865fe492fa6100b08f0dbb3e044d2fcce
SHA512 a614240f1e45330049ec1d0cae985659898f4134077131ecbb17367eb41c7fd2693f4dc7424269f99415572449208c80ab60bd360629baea11e483ff79b9b21b
SSDEEP 48:lV8dOvH9TgYLfbJ9zUoYn4dLXuHEpzV8dOvH9TgYLfbJ9zvYntgdLXuHf2u:xJUoduklJviIun
MD5 SHA1 SHA512 SSDEEP

Submit Download

store.json.mozlz4.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\is3a9iyn.default-release\crashes\store.json.mozlz4.tmp
Size 6KB
SHA256 61e634ce418958609b6afabf841ae0a3b85faadd7efa0ee52206255f2eabc99f
MD5 7a5c2c4406086a2bf009ff5259e079d5
SHA1 99eb233b5322f5cb0a5e46f3e1b5c5fa4658d713
SHA512 05f7d0e485e69de25e93f3e180ac68645f653e5cc1a08d14cd6036a2cc468b66e69886ed974e2dac01842bfc6815ce1f0b7500d1eddc66942720c715df589075
SSDEEP 192:+ijlMK6numtIV2K0W4rS1WA3XhYdmSPwStNtYqUyS6+UciKbu:Pa4AZnfrbAHhUtrJ3+Uc8
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\is3a9iyn.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 0ba000e9e64cb2b68064ea49aa3663db76bb6fdebbb5b607b7e68d6bbc0316e6
MD5 53e78fac7eed3076ae4761fbe4e2eb30
SHA1 88945d087f9376dd5ffefe88116d8850fc891ff1
SHA512 72ecf534cb6bb9a0fb5a70954226cb34f5626196d4171ead2adafa2eacde37d6d20a1d2ba9471abd58f9882186fd8133ad78f3517c769ad8dbf8e0aa9d2c2028
SSDEEP 192:b31/66Joz0dzgCl6mSSd9Ov5zboHtZAhyjSi3:bF/66JozQzgC1bMboNZAhyj9
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\is3a9iyn.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 23fdccb9146d20b80f990aec0f47475b36f8296ede0512d5d5d4b6ce4b305918
MD5 7af89eabcc1adf04837f80c463ffd48e
SHA1 8a829e1b0188cae8931da56814bf1b96bd1ac775
SHA512 bcde398a3be1bf677ee36094aa8396ae190f23d1f7e54b3a588752945b596987ddbfbe7fdeba37f515b19db86f57989c36c7e5987763665029c2d95c159d1059
SSDEEP 192:LOv5zboHtZAhyjSio31/66Joz0dzgCl6mSSd:UboNZAhyjiF/66JozQzgC1b
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\is3a9iyn.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 1af522219af765b4af392b74d7d2bae8350af379fde666c88fa3adf7631cc176
MD5 7c88307d1e889497d982afafae817df6
SHA1 6fd3a00d4637c812b141da84125d910a93d7c293
SHA512 ef3f833c08b0dd195ef84c9c84f0a390827bc7f550aa4fc64a042444bec696c8940715005fa140efd493beab6ea9bd8ef73a7a3f127951e164e8ae447bf2861a
SSDEEP 96:EmWs8mZbSdF95/7bkW6QXjrcEqmIZLyUR6Dm9/x2WZ7Tx2/omO/dFl66Joz0dzgI:jOv5zboobAhyjOxv1/66Joz0dzgCl6mh
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\is3a9iyn.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 3db85f055193aecd6135104afcc267f9e4567a32deeeab1b3de27e1cf9d78bc1
MD5 8bcf3bd699d15bf6dbd8fa1729eacc2f
SHA1 4c7a8c6068127b4db6252b008692ab1847ef0905
SHA512 bf100b0838d40000deee281712ae1def2d1f5c0973a6678d3cfe87c9664b04db0d73563c2416267cd78f673340124bdc0ede5061379aebcdf0bc3d5688d241e3
SSDEEP 192:Sf1/66Joz0dzgCl6mSSdyOv5zboHeZAhyjSi:St/66JozQzgC1b/bo+ZAhyj
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\is3a9iyn.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 c931601ba1ecd6b011b40d928b6e929226f9e6a14e237f3811d368714e870bb1
MD5 69c05e6441ebc97657f6037064719cd8
SHA1 ea0a3555269c9022a287b2b13523fed4f3082fdb
SHA512 13fa939874b9250e35de09b37dabe04c560ebaad785d4b052c3987619d04cabf14ec5310ad40f351aa718538863a337475d64cce6c5917ee237c1012a9cffb31
SSDEEP 192:b11/66Joz0dzgCl6mSSd4Ov5zbokZAhyjSi3:bz/66JozQzgC1bpbokZAhyj9
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\is3a9iyn.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 3d7c59c63ef58d0031a7a2eb0d17f0bd183a9adc57a034ec644315a20b76c618
MD5 abedae25038964fdd73a6cea25d69232
SHA1 5283363a9f957f42f7e62db12848301fdbfa948d
SHA512 5874002d18627b69021b2a5ec21e402243e6ba45ddd61f4f546b048e2b90c2a7d4e4a4c642050f1195212aadf2e99e0722baedac52d639c27290aefa5917f06e
SSDEEP 192:LOv5zboHtZAhyjSioh1/66Joz0dzgCl6mSSd:UboNZAhyjif/66JozQzgC1b
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\is3a9iyn.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 1140b596fa17f226f63603669b84b5f2ce75a86f0313a41c93d5e02c952bca3e
MD5 dad9295779e7a316a8a2fc4b7f1d9ad5
SHA1 31b459e362b380dfcce90d7e9f095777bacc5f6a
SHA512 47dc5c284ce109dc5df2a37dc00890532f2657532869409e2d4362200598cbf4c3af993241222bac37b7ab74d2482e52d2f79fc3a57d3ef44dd684a5fcca5039
SSDEEP 192:OOv5zboHtZAhyjSioY1/66Joz0dzgCl6mSSdz:FboNZAhyjiy/66JozQzgC1bd
MD5 SHA1 SHA512 SSDEEP

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\is3a9iyn.default-release\datareporting\glean\events\events
Size 1KB
SHA256 0a011ba84e2ddda076d46919ce91536043cbbed85cab0a2f224fd7c6b9722f70
MD5 1b7de00bb4b7ae692c047d766005e524
SHA1 f7cf64809124d8bd08da302eae1f86687afdad86
SHA512 d6f8db9595caacb4271ab5f55e023fad218b55c0782b2c07ee5953cbdc5407d21978104a3d52e10f32a878662db8af2c8951ecc7aaa492316a0a32dc4cbc5d1a
MD5 SHA1 SHA512

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\is3a9iyn.default-release\datareporting\glean\events\events
Size 1KB
SHA256 c30f05e665e94db02bc7c00d39e76790fe92a1ffad53ef29e67b54f5d02ed6dc
MD5 d85b7e364bff8dd27277da8e2603ed50
SHA1 a4df416809ee0dce847718a1acb897d4ea84d859
SHA512 6e61374507d83110ee7e0d5397802fbe921e9f06e0fde67e1cf4ad2fd729f7d4ff3c2bf0d081ee7b21940da816c19066cd93a0079b7b831b8bc36a7ee5e509ac
MD5 SHA1 SHA512

Submit Download

00f42283-a9b2-473c-bdae-067f4b2c30f9

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\is3a9iyn.default-release\datareporting\glean\pending_pings\00f42283-a9b2-473c-bdae-067f4b2c30f9
Size 235B
SHA256 5eb892e09860c5eebc9ad5233457327d76f8dc0fc00f2641b8e111bd03d9cc18
MD5 53ddfd0745530136c1d3fa4adffc32da
SHA1 03ba74e68e81356925985e37b6f7b3761e429e69
SHA512 c0f4832faf2e0587416712984ea2b0288d7bf14a31d463394642617e6d3b3dcea5aa73b6278512d869dfcff19dca25fe0f39ad9e1a9f0c5b4fdb4d0f300e8aea
MD5 SHA1 SHA512

Submit Download

02c1578e-a14a-4f61-9e69-3dabefb37238

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\is3a9iyn.default-release\datareporting\glean\pending_pings\02c1578e-a14a-4f61-9e69-3dabefb37238
Size 3KB
SHA256 e441caa5a8d816b40280f137dbe3c78472c4451b0942f3774deeee93f7df7fd9
MD5 080c0aaba61cab666a727ae4d71c104f
SHA1 92bc75d5fd27647aff7345ffb2955dcbf13a7bdd
SHA512 d03d8a8ab6c2c4b2fa449ff29af3ac9e878ba8d87c1e4f192ea20f0da7aa66dc4f34978e1b4830b24694f0e1dae2f07acbe8ee2b92cfe40e544184bfa4dadea9
MD5 SHA1 SHA512

Submit Download

1093551e-15c8-4434-90bc-d340c48df841

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\is3a9iyn.default-release\datareporting\glean\pending_pings\1093551e-15c8-4434-90bc-d340c48df841
Size 17KB
SHA256 9a6357dd80f7401098424c86efeb0337b7eed3a9879c8d04b0c0bea0b70dccd3
MD5 2a7e626f5b45376cd8c2a3b7afa54b09
SHA1 c6bdedd3176d46df74e625ba8dfab0f71833a84f
SHA512 6d795f8dbf47c1ce6ecdc8888e1c298edd223c1f670e7141ecf2f01bb86e052a77a4aa65e77a3cfc2cd586883f12eed56beca019be0adbcc38ee2558168b0559
SSDEEP 384:K0H2HLoP8OxAGaBrckpbSli7KaETYpLax:Ke2EZkB3VFax
MD5 SHA1 SHA512 SSDEEP

Submit Download

41d13f06-3127-4306-b70d-e8753c80e339

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\is3a9iyn.default-release\datareporting\glean\pending_pings\41d13f06-3127-4306-b70d-e8753c80e339
Size 3KB
SHA256 a9b8cc8cc07e0648477b8f4980f57ac88738d6af8233291722d3d209a98f1b1f
MD5 59cae47a8013d39049028303e979fc53
SHA1 766d15fb8857797d4f3c2544e5afec07b5163db8
SHA512 0ac3451cd4a6f1e1c089e31652a498f94908659364e1d6cda37ec8df2f064c3365c0ce6cadc6054dc8c6ee21150c5a46a2e365f0359436aff620a8c3be4367af
MD5 SHA1 SHA512

Submit Download

4432ffc2-ddb6-41f6-a720-235c479f5261

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\is3a9iyn.default-release\datareporting\glean\pending_pings\4432ffc2-ddb6-41f6-a720-235c479f5261
Size 235B
SHA256 bab618be4a62e2d8abfdfc30c68dd3190b860e6fd8149ee99a9722b8fd756014
MD5 46251df88832c21cd605deecc73de106
SHA1 b0ccc9a1e08e31c31450ffcfe29fbfd9c0d24361
SHA512 a57028ef42ffbd6dafbaa948bba4d0e56a4514fc56079ebf48f26996b921a946ff7e50c5832b718056324a24b6a27a73c7863fdb19b197cb44325d0cdbd08a0a
MD5 SHA1 SHA512

Submit Download

4db632a4-7b54-4dd9-a421-122b61ed9dd3

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\is3a9iyn.default-release\datareporting\glean\pending_pings\4db632a4-7b54-4dd9-a421-122b61ed9dd3
Size 3KB
SHA256 034288b2da7b89e0212625c0f8614dcf9d7edcdb6972803fa2288931f9cec749
MD5 fdfdd9acc75283b7014f4de582003e24
SHA1 4d071d9154fdd718d20fcbecff1482c741320d81
SHA512 7e1ab2fde55f7181756b449a3f92cf0189c7754317ca209af3eb43729da51e0768a55d8efd485d3b321c52b592a90cc367386f45d5a8fcfda2e81d773bce788f
MD5 SHA1 SHA512

Submit Download

67e2e050-f2f2-48b8-bfc4-2ba9dd2c56cd

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\is3a9iyn.default-release\datareporting\glean\pending_pings\67e2e050-f2f2-48b8-bfc4-2ba9dd2c56cd
Size 2KB
SHA256 96cb22620b93f1e68e852cf05a83e35ebee7be7c4cd8cacb0ffe1345082f93a9
MD5 3b1edf3298716ced42a0a27bb94d4296
SHA1 523440a6b9a3beec6b5ffa83a4e86755b830d27b
SHA512 b0a1f214b0727e96ba6af77c114a695760aea7b1f4cdc75945e0c3cbaf87849e6b47ff4ae67c5e43e1a397569c6a4f88e926de26dffdeeb53cb385a8a76cd6dd
MD5 SHA1 SHA512

Submit Download

6df38462-c912-4357-b20c-59da986528a1

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\is3a9iyn.default-release\datareporting\glean\pending_pings\6df38462-c912-4357-b20c-59da986528a1
Size 883B
SHA256 6205bd0ee1f6d38b5f28994e27ac609a80c918eee9df3455637852920c61a105
MD5 5378ae3e458abadaeda558f068f3e4b7
SHA1 77bf8d3f0e977c41c25a4621eaa2bf324d8c4521
SHA512 920d49c54f80f21564b08829314a938a47cc49f2c7c0015e5e79e09d2246dae5a466f21dc711fc670fdd8e0e1213fb63a54a3fdba99f3ccc62e099c8f314d8d8
MD5 SHA1 SHA512

Submit Download

a150c51f-4175-4b55-903e-def0df567873

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\is3a9iyn.default-release\datareporting\glean\pending_pings\a150c51f-4175-4b55-903e-def0df567873
Size 235B
SHA256 6ebce322c29f2efea75d5486666009d5597cf718c3d15acd0b838492e7ed2e4b
MD5 20a57c1e7f64cdb5d53bdbe94b9f8e48
SHA1 4857506f249557e52ea18dfae36773d6abba0ed0
SHA512 badcb729c6b0c52784af338fab29979c94cb21303d168c1e7b32027f4c83092330cfb236f2b6c4b20026472942ce5230c29830c351eda3c1c1e51f19031c9310
MD5 SHA1 SHA512

Submit Download

afde3409-de09-45cc-b965-8bfb4f42bb38

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\is3a9iyn.default-release\datareporting\glean\pending_pings\afde3409-de09-45cc-b965-8bfb4f42bb38
Size 3KB
SHA256 6d13a49b3da4c231308f510d5fe603cc5e26f95d0cd226a3fcd16b6042cc86be
MD5 07020a429293e6aa88566ab1a2bd78c5
SHA1 f6ac62a0f5fab57358dbb440151b896cb02c4b29
SHA512 81243424a65a385fc227121fade26074b51a29e09f3bd9748aabf8567ca5e7e6ad58f7012d5820b721273cea462c508f479dbc97366c1a4593afc2f4f1523b60
MD5 SHA1 SHA512

Submit Download

afde7934-f553-43fc-a35d-a74b13bb85d2

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\is3a9iyn.default-release\datareporting\glean\pending_pings\afde7934-f553-43fc-a35d-a74b13bb85d2
Size 886B
SHA256 f4d807707cddfdbfa300fbd8397a249749989d5807b494f0f22aec20b8505d6e
MD5 764fd05bd60a3bc26187e37214ec63f4
SHA1 20d3d2c0ed52d52c41171d64c11136539908ed98
SHA512 3cf03e4904d1b108a572481ea8778208a36f04648c221f34881ca8a3effb46e36acb22784d4f3d3bc30ea1a0d7b202d6a1139d6de397c29ef13af581ba72aa93
MD5 SHA1 SHA512

Submit Download

b644bc18-c16c-4447-b292-a58f4c39b918

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\is3a9iyn.default-release\datareporting\glean\pending_pings\b644bc18-c16c-4447-b292-a58f4c39b918
Size 886B
SHA256 fba2093c4ec288674c6868cedc42bc64a560b0aa3474f5f7a7951a669bf9e05d
MD5 01da4d5c7fb6f621fe4764e2e9e0610f
SHA1 7e329a9bdeebdb17be123615171fd334d5affeed
SHA512 5db372ccd2edad2c2879256eb5c111fceb0b09eaecea21f62e043f6bb3f817a1b4a84f87b214ffe05678b0a9d9972effe97a7b9c8b42fb3f7e06c4a0cc180a26
MD5 SHA1 SHA512

Submit Download

bdd9c29e-f4c8-45d6-bedb-23763462a989

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\is3a9iyn.default-release\datareporting\glean\pending_pings\bdd9c29e-f4c8-45d6-bedb-23763462a989
Size 2KB
SHA256 d0e0098e7a66ad3e49983dad0ab966a584ac9ec05100c6bfb903e0132c18151e
MD5 f0c801bc234a6e03e9fc4ba050e25095
SHA1 73da185da0d542913455895185f4f10e9de8dd27
SHA512 427bfce052ac7ad1dd2641c892fbb50101c28ce2fc2da290d84962629ef3ae9e3def949bb4fc9a2fdf58ad3ba3d05c5c08361ac246445cc38c7c0fb7b5f9fc78
MD5 SHA1 SHA512

Submit Download

c037ef6c-f541-4737-b404-767c1cc30c2a

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\is3a9iyn.default-release\datareporting\glean\pending_pings\c037ef6c-f541-4737-b404-767c1cc30c2a
Size 3KB
SHA256 7148c1f1e84cd2f0dfd71da50cec3556f326e60d113be3204049497e760508ac
MD5 ef534c3ea180de7fc93c46fab2a69a52
SHA1 45cdefd7f3b12a16e8114f7acb8ab055bb114586
SHA512 09bf6642cb2557d72a632d8d803b37c8c956a341c4f27877d3c102109ebe6ea7a949af2f41410dbdaac83d65e05d38c8dc36d66b3c1e266e7220fd5ec881ff86
MD5 SHA1 SHA512

Submit Download

c5963cbd-1b75-4c47-adc8-3faf51b64865

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\is3a9iyn.default-release\datareporting\glean\pending_pings\c5963cbd-1b75-4c47-adc8-3faf51b64865
Size 3KB
SHA256 a650a999354e487d3b6724b425556e7bde6ece92e64c507b726081868a36f45d
MD5 59d667a26d3eef8efd5eb31ad2a83fac
SHA1 b07efe381e61082868fcca968f329f60a5e08f06
SHA512 90422b487ec40fe66fa9d94dd68a90a11cc0bed5996351e0367aed9ab9f1ef479ba37eea0c90d519d46bd96b4c6fd46338559d2228bb7956d4ad9f3b45b69b26
MD5 SHA1 SHA512

Submit Download

c8a7570c-07c1-4a5d-918e-ae34ffbf7420

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\is3a9iyn.default-release\datareporting\glean\pending_pings\c8a7570c-07c1-4a5d-918e-ae34ffbf7420
Size 3KB
SHA256 231d48ad1d2e06d45705c44969d8a666f51e9ab5deeecc506890156894b271d5
MD5 e11fe3d038984e43dcf3b42787ce010c
SHA1 143ce98602d7b7016bfda767212997a0e1d3006e
SHA512 f2d104316a66ff85a620393c99cd53cce824446a50fe868864919f5a92d5cf687178fcfd64b322ff44fff79a6e0a4b5c8283cb745b689ab967373105ef55709d
MD5 SHA1 SHA512

Submit Download

d3a7871e-1417-4915-8a46-a4f79721c075

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\is3a9iyn.default-release\datareporting\glean\pending_pings\d3a7871e-1417-4915-8a46-a4f79721c075
Size 871B
SHA256 7e6fbb94d3ec200a72c2d2bb9d9158bb95301279f6e3dc5fe964a611c2900bbc
MD5 dd26e7a0c956615ef0f06baf086c449a
SHA1 2c9f86a47d1dcbf72bba5b3617e520d78aa8b24d
SHA512 d30adf510ca938068d6b1aff318f483b907a085eef677020b0d5b6178709d96e41d9eaf15d616f6c6bcc3b16649b7fb5e23ca92833170a3f5abf7f9bc9902987
MD5 SHA1 SHA512

Submit Download

e180c1fc-bd25-43ed-90bc-916f711bd1ce

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\is3a9iyn.default-release\datareporting\glean\pending_pings\e180c1fc-bd25-43ed-90bc-916f711bd1ce
Size 3KB
SHA256 db62dd783e5db12fc9f22c24be698b30dfefeb9d3dcb382ce9580c1208231844
MD5 ff7888e1a5ef85ad95cb3dc89536a3de
SHA1 840dda2bc7220ab0592fcd7b61ad1783cbe6a707
SHA512 238c1c5b8b221bc5a96ce0470cffbaf0176fa146f8f9ef902bd7522f069e853827b0c231ee0d7c909b37aaa8603f25b80f4466fe5f562aea4f9809e59f7c41cd
MD5 SHA1 SHA512

Submit Download

e46e2fba-8493-481f-a944-e6de1d15de9e

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\is3a9iyn.default-release\datareporting\glean\pending_pings\e46e2fba-8493-481f-a944-e6de1d15de9e
Size 235B
SHA256 aeaff92ff318cf9190ef11f40578dee4a2512d0eacf84002849e7129af297c80
MD5 be3315a90e3aaed036141ca07fcc86de
SHA1 1b6f541af97b30532da4150bcd960361a8523938
SHA512 af8ed178750b5334eefc93485895ba84eda7b9e081d53b9fe0715b1c055400008ebb38807b3ca3c8a51e328b47c4f569b8bc665c66e4f0966e8717b0c7643c94
MD5 SHA1 SHA512

Submit Download

fb5b3c4b-3134-4989-9d2a-0bad373a1ded

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\is3a9iyn.default-release\datareporting\glean\pending_pings\fb5b3c4b-3134-4989-9d2a-0bad373a1ded
Size 3KB
SHA256 9cd38b6d07008f908b4f48674bf3bbff8bfa519ba65ae0e6338c1a6f547b5c92
MD5 a7e96add50c8fc9436ef9eccd10270b8
SHA1 a641e409ecc8987f7eacb8cad8b19c4b412e506c
SHA512 0d6da13b958dda5b2186501191ea15fa6cf4e023a494a0edab824a555915f3d750b5d8413cf787b03cb9130104160a0246d446a7e3c5c8cdff787c1345141756
MD5 SHA1 SHA512

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\is3a9iyn.default-release\prefs-1.js
Size 6KB
SHA256 c94086274dcb5f52115f0d3077d8a7541eed2f33b5d0b85855fd524af253a85c
MD5 b3cfe1ab0d1d61914775974cbd12591b
SHA1 c84572a724b2059aab9fc8e340b80b0881f381db
SHA512 f52bd089c67072691e3183188776e51f2f9655a6d8e44c31ff24681b7287c78a29d8ae31b5eeaa080d3e82bfcb1327bbba098938d8c8c88bd63b5c952c135dab
SSDEEP 96:xHMUTUykqGqJffKInW1zSdSSlhdv9jSntSHattLKBw88H8L4cnpVmComgcY:iCXRJffvWASS7sLKBw88WgP
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\is3a9iyn.default-release\prefs.js
Size 6KB
SHA256 08099f32db41cb617cb01a9dae057486ebdab207f4bae03d0f61eb7f55dd36c3
MD5 97f037d7f2f41c9f8ed59150a7c739fd
SHA1 b057f75ad5a2468333051b82d789bfbe6eaf0391
SHA512 6620024f0d6f9cbb960ebddc0da372fc69be078f4bffec1fbf8e454c8069e6b6179b2e4d6d5b7f273f850a9e913b256180f265c2d6da9f5c1dbfb6371eb6da51
SSDEEP 96:xHMUTUykqGqJffKInW1zS4SSlhdv9jzntSHattLKBw88H8L4cnpVmComgcY:iCXRJffvWFSSisLKBw88WgP
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\is3a9iyn.default-release\prefs.js
Size 6KB
SHA256 a4ed26447b14d40e4bb79874f0572c346fb3967d1d1bef23b0341bb172ce2f5f
MD5 97b78a291139093b919fcd465d077f9b
SHA1 b5ea0f73e643c42d68986eb374459de017f78c94
SHA512 a32e2b58bee6ebf3cc3fa401f27ee7962f9cb8da2d2b14d753ac95c6712593b88653ba4041828f86f80567805f2843256857a4c43aa034dbf4e0441a7809609f
SSDEEP 96:xHMUTUykqGqJffKtnI1zSWSSlhdv9jintSHattLKBw88H8L4cnpVmomgcY:iCXRJffmIPSSzsLKBw88Wgq
MD5 SHA1 SHA512 SSDEEP

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\is3a9iyn.default-release\sessionCheckpoints.json
Size 90B
SHA256 00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2
MD5 c4ab2ee59ca41b6d6a6ea911f35bdc00
SHA1 5942cd6505fc8a9daba403b082067e1cdefdfbc4
SHA512 71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2
MD5 SHA1 SHA512

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\is3a9iyn.default-release\sessionCheckpoints.json
Size 53B
SHA256 792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da
MD5 ea8b62857dfdbd3d0be7d7e4a954ec9a
SHA1 b43bc4b3ea206a02ef8f63d5bfad0c96bf2a3b2a
SHA512 076ee83534f42563046d25086166f82e1a3ec61840c113aec67abe2d8195daa247d827d0c54e7e8f8a1bbf2d082a3763577587e84342ec160ff97905243e6d19
MD5 SHA1 SHA512

Submit Download

iutrxhkAlxJQ.exe

Path C:\Users\Admin\AppData\Roaming\iutrxhkAlxJQ.exe
Size 1.2MB
SHA256 6945230e786da1f48c3f4d9ea9fa52a73a501d343c24cc3616ad4e092b32fb5c
MD5 4c7ac9b03eeb8e4ca1070b386aeaf43e
SHA1 0cc8c73ea802690126b66dc42f5fcf18458ce380
SHA512 1601af238b753d3883a501962085205415672f9a70f257dab9db5de9b2fabfdac6ab0dcb01accd4ed12a4b46c5c6762c381c3097898f26d8c30ace4eaba1d8d2
SSDEEP 24576:+DAFLQAAxHn0Ui+KH6nWyuyapu8SJLUeqlMVNpxVrmkD7XV2vB:+GpAJnC+XapuzJL7eKpx4WkvB
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Windows\SystemTemp\Crashpad\settings.dat
Size 40B
SHA256 6d7f6bed629dd8d88b442f3a75216f26fd050b840597138116c863aba8ec32f5
MD5 60a97f6dc9a5f0aee5ee019cf9dc909f
SHA1 201582047a1f90158b8b009271a2712af7fbe165
SHA512 19704c52a628c91b45c325e210d83988597223435de00cad3043d7bc06b395c5803e3196cb9ec05fdc6bfd5047944337f43192f0cf7e5193ac69a872857910ad
MD5 SHA1 SHA512

Submit Download

chrome_installer.log

Path C:\Windows\SystemTemp\chrome_installer.log
Size 7KB
SHA256 e4db2f632ffdfee5aa3a6154acc65c97ea96fb41380fb32aa42934f1e0fe5ea3
MD5 2dd61b2c6d962c7366fe04874949338f
SHA1 805d5cc59c0d866d1c709d43204c79225b4b6f2b
SHA512 b762fcc1ec1ebffb452b178b3175e04a4526fde6cf06e06c89d31fc90baaec4c299474c2fdce97e1b00e199c3a59291f1d3de98fdb4bbe9789e8bfa4335e4c15
SSDEEP 96:nTAhlCwGveu9cwK3kK3epXOpwwK2yK2UH08grQp07gKk8k8U0wK3c9K3aG3:nTAaj9rbhepPc4grQpygKk8k8UD599G3
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1044-63-0x0000000007850000-0x0000000007861000-memory.dmp

Download

memory/1044-42-0x00000000072D0000-0x0000000007304000-memory.dmp

Download

memory/1044-43-0x0000000071170000-0x00000000711BC000-memory.dmp

Download

memory/1044-17-0x00000000050C0000-0x00000000050D0000-memory.dmp

Download

memory/1044-60-0x0000000007640000-0x000000000765A000-memory.dmp

Download

memory/1044-61-0x00000000076C0000-0x00000000076CA000-memory.dmp

Download

memory/1044-62-0x00000000078D0000-0x0000000007966000-memory.dmp

Download

memory/1212-1938-0x0000000007000000-0x0000000007015000-memory.dmp

Download

memory/1212-1525-0x0000000005610000-0x0000000005967000-memory.dmp

Download

memory/1212-1601-0x0000000005AA0000-0x0000000005AEC000-memory.dmp

Download

memory/1212-1808-0x0000000071130000-0x000000007117C000-memory.dmp

Download

memory/1212-1817-0x0000000006CC0000-0x0000000006D64000-memory.dmp

Download

memory/1212-1876-0x0000000006FC0000-0x0000000006FD1000-memory.dmp

Download

memory/3408-2254-0x00000000002C0000-0x00000000002C1000-memory.dmp

Download

memory/3476-21-0x0000000005C40000-0x0000000005CA6000-memory.dmp

Download

memory/3476-13-0x0000000002AB0000-0x0000000002AE6000-memory.dmp

Download

memory/3476-57-0x0000000006870000-0x000000000688E000-memory.dmp

Download

memory/3476-44-0x0000000071170000-0x00000000711BC000-memory.dmp

Download

memory/3476-59-0x0000000007C40000-0x00000000082BA000-memory.dmp

Download

memory/3476-64-0x0000000007840000-0x000000000784E000-memory.dmp

Download

memory/3476-58-0x00000000074D0000-0x0000000007574000-memory.dmp

Download

memory/3476-39-0x0000000006630000-0x000000000667C000-memory.dmp

Download

memory/3476-65-0x0000000007850000-0x0000000007865000-memory.dmp

Download

memory/3476-66-0x0000000007950000-0x000000000796A000-memory.dmp

Download

memory/3476-67-0x0000000007940000-0x0000000007948000-memory.dmp

Download

memory/3476-38-0x00000000062B0000-0x00000000062CE000-memory.dmp

Download

memory/3476-14-0x0000000002B70000-0x0000000002B80000-memory.dmp

Download

memory/3476-22-0x0000000005D70000-0x00000000060C7000-memory.dmp

Download

memory/3476-20-0x0000000005BD0000-0x0000000005C36000-memory.dmp

Download

memory/3476-15-0x0000000002B70000-0x0000000002B80000-memory.dmp

Download

memory/3476-16-0x0000000005500000-0x0000000005B2A000-memory.dmp

Download

memory/3476-19-0x0000000005B30000-0x0000000005B52000-memory.dmp

Download

memory/4732-36-0x0000000000400000-0x00000000004BE000-memory.dmp

Download

memory/4732-3895-0x0000000006CC0000-0x0000000007017000-memory.dmp

Download

memory/4732-76-0x0000000005F60000-0x0000000005FB0000-memory.dmp

Download

memory/4732-77-0x0000000006730000-0x0000000006C5C000-memory.dmp

Download

memory/4732-78-0x0000000006360000-0x000000000637E000-memory.dmp

Download

memory/4732-74-0x0000000006030000-0x00000000061F2000-memory.dmp

Download

memory/4732-75-0x0000000005EE0000-0x0000000005F56000-memory.dmp

Download

memory/4732-73-0x0000000005DB0000-0x0000000005E62000-memory.dmp

Download

memory/4816-6-0x0000000004E20000-0x0000000004E30000-memory.dmp

Download

memory/4816-3-0x0000000004E20000-0x0000000004E30000-memory.dmp

Download

memory/4816-1-0x0000000005400000-0x00000000059A6000-memory.dmp

Download

memory/4816-0-0x0000000000220000-0x0000000000354000-memory.dmp

Download

memory/4816-8-0x0000000006600000-0x000000000669C000-memory.dmp

Download

memory/4816-2-0x0000000004E50000-0x0000000004EE2000-memory.dmp

Download

memory/4816-7-0x0000000006000000-0x0000000006102000-memory.dmp

Download

memory/4816-4-0x0000000004E00000-0x0000000004E0A000-memory.dmp

Download

memory/4816-5-0x00000000050C0000-0x00000000050D6000-memory.dmp

Download

memory/5168-1820-0x0000000071130000-0x000000007117C000-memory.dmp

Download

memory/5900-2360-0x000002C5F36C0000-0x000002C5F37F4000-memory.dmp

Download

memory/5964-93-0x000002236C270000-0x000002236C3A4000-memory.dmp

Download

memory/7220-3113-0x0000000000F00000-0x0000000000F01000-memory.dmp

Download

memory/7944-3760-0x000002A0F0B60000-0x000002A0F0C94000-memory.dmp

Download