phantomstealer | 72df054cc19ea7327ca090fa5419fa0006168fa7808d247ebbd3509e0fdae5c0

Resubmissions

29/10/2025, 12:39

251029-pvt8hsgs7c8

29/10/2025, 11:11

251029-m98ncaxrdt10

Analysis

max time kernel
149s
max time network
148s
platform
windows11-21h2_x64
resource
win11-20250502-en
resource tags

arch:x64arch:x86image:win11-20250502-enlocale:en-usos:windows11-21h2-x64system
submitted
29/10/2025, 11:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Camper Xing Tailai T102 Tooling PO 4510208597_Right Nik.exe
Size 1.2MB
Sample251029-m98ncaxrdt
SHA256 26a229f9c3d82111d8a235e29cf7f594fc0f7e22b892d73a429afefa090c23ce
MD5 65477fcce7768974b86c665fbb010c64
SHA1 f1ad7d076e31f67960a8dd7649c196b95ed1d659
SHA512 4428e248c4bc3dd95f147178d7397a67cbe37083d7d44afe086452693414a13ac59f1c09b4fcf8b454d3e9dc299468c2cc4795d592c999a0d451ac0bc1b20bb3
SSDEEP 24576:jfmN3t/U1aLOEasdBMvfmIazWgOmkwuhv7NU6MFip87eYfSdsO4BjeX6g:Slt/UkLO5sdBMX8agOh7+7Fip7YfSds4
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

collection discovery execution phantomstealer persistence spyware stealer

Malware Config

Extracted

Family

phantomstealer

Version

v3.5.0

Credentials

Protocol
smtp
Host
mail.honesty-shippings.com
Port
25
Username
[email protected]
Password
Honesty@2025
Email to
[email protected]

Mutex

QBWCBIKTN0XTMJI48U0Q

Attributes

anti_analysis
0
cb_enables_ssl
0
debug
0
keylogger
1
start_delay
0
startup
0

Signatures

Phantomstealer family
phantomstealer

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
6560	powershell.exe
6660	powershell.exe
4856	powershell.exe
5664	powershell.exe

Executes dropped EXE 3 IoCs

pid	Process
3492	QgotrKYsNEIZqu.exe
2980	QgotrKYsNEIZqu.exe
936	QgotrKYsNEIZqu.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-330179853-1108322181-418488014-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Camper Xing Tailai T102 Tooling PO 4510208597_Right Nik.exe
Key opened	\REGISTRY\USER\S-1-5-21-330179853-1108322181-418488014-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Camper Xing Tailai T102 Tooling PO 4510208597_Right Nik.exe
Key opened	\REGISTRY\USER\S-1-5-21-330179853-1108322181-418488014-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Camper Xing Tailai T102 Tooling PO 4510208597_Right Nik.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	icanhazip.com

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 5424 set thread context of 2344	5424	Camper Xing Tailai T102 Tooling PO 4510208597_Right Nik.exe	85
PID 3492 set thread context of 936	3492	QgotrKYsNEIZqu.exe	238

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\3512_13406209919019013_3512.pma	setup.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\132ac87e-f5a7-4c0c-baa7-4e02ea4cbe97.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\5796_13406209918939429_5796.pma	setup.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\600cc000-9226-4e12-9aa5-7371d2933fd4.tmp	setup.exe

Drops file in Windows directory 29 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File opened for modification	C:\Windows\SystemTemp	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\chrome_installer.log	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\msedge_installer.log	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\settings.dat	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\settings.dat	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\metadata	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\metadata	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\metadata	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\chrome_installer.log	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\metadata	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File opened for modification	C:\Windows\SystemTemp\msedge_installer.log	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\metadata	setup.exe
File opened for modification	C:\Windows\SystemTemp\chrome_installer.log	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat	setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Camper Xing Tailai T102 Tooling PO 4510208597_Right Nik.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	QgotrKYsNEIZqu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	QgotrKYsNEIZqu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Camper Xing Tailai T102 Tooling PO 4510208597_Right Nik.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Checks processor information in registry 2 TTPs 38 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	Camper Xing Tailai T102 Tooling PO 4510208597_Right Nik.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	Camper Xing Tailai T102 Tooling PO 4510208597_Right Nik.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Enumerates system info in registry 2 TTPs 12 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134062099008484022"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-330179853-1108322181-418488014-1000\{DAD454FB-A713-490B-B033-1A65D3F6C82D}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	chrmstp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
6724	schtasks.exe
3444	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5664	powershell.exe
4856	powershell.exe
5424	Camper Xing Tailai T102 Tooling PO 4510208597_Right Nik.exe
5424	Camper Xing Tailai T102 Tooling PO 4510208597_Right Nik.exe
5664	powershell.exe
4856	powershell.exe
2344	Camper Xing Tailai T102 Tooling PO 4510208597_Right Nik.exe
2344	Camper Xing Tailai T102 Tooling PO 4510208597_Right Nik.exe
3484	chrome.exe
3484	chrome.exe
2344	Camper Xing Tailai T102 Tooling PO 4510208597_Right Nik.exe
2344	Camper Xing Tailai T102 Tooling PO 4510208597_Right Nik.exe
2344	Camper Xing Tailai T102 Tooling PO 4510208597_Right Nik.exe
2344	Camper Xing Tailai T102 Tooling PO 4510208597_Right Nik.exe
2344	Camper Xing Tailai T102 Tooling PO 4510208597_Right Nik.exe
2344	Camper Xing Tailai T102 Tooling PO 4510208597_Right Nik.exe
2344	Camper Xing Tailai T102 Tooling PO 4510208597_Right Nik.exe
2344	Camper Xing Tailai T102 Tooling PO 4510208597_Right Nik.exe
2344	Camper Xing Tailai T102 Tooling PO 4510208597_Right Nik.exe
6136	firefox.exe
6136	firefox.exe
6136	firefox.exe
6136	firefox.exe
6136	firefox.exe
6136	firefox.exe
6136	firefox.exe
6136	firefox.exe
6136	firefox.exe
6136	firefox.exe
6136	firefox.exe
6136	firefox.exe
6136	firefox.exe
6136	firefox.exe
6136	firefox.exe
6136	firefox.exe
6136	firefox.exe
6136	firefox.exe
6136	firefox.exe
6136	firefox.exe
2344	Camper Xing Tailai T102 Tooling PO 4510208597_Right Nik.exe
2344	Camper Xing Tailai T102 Tooling PO 4510208597_Right Nik.exe
2344	Camper Xing Tailai T102 Tooling PO 4510208597_Right Nik.exe
2344	Camper Xing Tailai T102 Tooling PO 4510208597_Right Nik.exe
2344	Camper Xing Tailai T102 Tooling PO 4510208597_Right Nik.exe
2344	Camper Xing Tailai T102 Tooling PO 4510208597_Right Nik.exe
2344	Camper Xing Tailai T102 Tooling PO 4510208597_Right Nik.exe
2344	Camper Xing Tailai T102 Tooling PO 4510208597_Right Nik.exe
2344	Camper Xing Tailai T102 Tooling PO 4510208597_Right Nik.exe
2344	Camper Xing Tailai T102 Tooling PO 4510208597_Right Nik.exe
2344	Camper Xing Tailai T102 Tooling PO 4510208597_Right Nik.exe
2344	Camper Xing Tailai T102 Tooling PO 4510208597_Right Nik.exe
2344	Camper Xing Tailai T102 Tooling PO 4510208597_Right Nik.exe
6560	powershell.exe
6560	powershell.exe
6660	powershell.exe
6660	powershell.exe
3492	QgotrKYsNEIZqu.exe
3492	QgotrKYsNEIZqu.exe
2344	Camper Xing Tailai T102 Tooling PO 4510208597_Right Nik.exe
2344	Camper Xing Tailai T102 Tooling PO 4510208597_Right Nik.exe
6560	powershell.exe
6660	powershell.exe
2344	Camper Xing Tailai T102 Tooling PO 4510208597_Right Nik.exe
2344	Camper Xing Tailai T102 Tooling PO 4510208597_Right Nik.exe

Suspicious use of AdjustPrivilegeToken 26 IoCs

description	pid	Process
Token: SeDebugPrivilege	4856	powershell.exe
Token: SeDebugPrivilege	5664	powershell.exe
Token: SeDebugPrivilege	5424	Camper Xing Tailai T102 Tooling PO 4510208597_Right Nik.exe
Token: SeDebugPrivilege	2344	Camper Xing Tailai T102 Tooling PO 4510208597_Right Nik.exe
Token: SeShutdownPrivilege	3484	chrome.exe
Token: SeCreatePagefilePrivilege	3484	chrome.exe
Token: SeShutdownPrivilege	3484	chrome.exe
Token: SeCreatePagefilePrivilege	3484	chrome.exe
Token: SeShutdownPrivilege	3484	chrome.exe
Token: SeCreatePagefilePrivilege	3484	chrome.exe
Token: SeShutdownPrivilege	3484	chrome.exe
Token: SeCreatePagefilePrivilege	3484	chrome.exe
Token: SeShutdownPrivilege	3484	chrome.exe
Token: SeCreatePagefilePrivilege	3484	chrome.exe
Token: SeShutdownPrivilege	3484	chrome.exe
Token: SeCreatePagefilePrivilege	3484	chrome.exe
Token: SeDebugPrivilege	6560	powershell.exe
Token: SeDebugPrivilege	6660	powershell.exe
Token: SeDebugPrivilege	3492	QgotrKYsNEIZqu.exe
Token: SeDebugPrivilege	936	QgotrKYsNEIZqu.exe
Token: SeShutdownPrivilege	936	chrome.exe
Token: SeCreatePagefilePrivilege	936	chrome.exe
Token: SeShutdownPrivilege	936	chrome.exe
Token: SeCreatePagefilePrivilege	936	chrome.exe
Token: SeShutdownPrivilege	936	chrome.exe
Token: SeCreatePagefilePrivilege	936	chrome.exe

Suspicious use of FindShellTrayWindow 47 IoCs

pid	Process
3484	chrome.exe
3484	chrome.exe
2172	chrmstp.exe
6136	firefox.exe
6136	firefox.exe
6136	firefox.exe
6136	firefox.exe
6136	firefox.exe
6136	firefox.exe
6136	firefox.exe
6136	firefox.exe
6136	firefox.exe
6136	firefox.exe
6136	firefox.exe
6136	firefox.exe
6136	firefox.exe
6136	firefox.exe
6136	firefox.exe
6136	firefox.exe
6136	firefox.exe
6136	firefox.exe
6136	firefox.exe
6136	firefox.exe
4592	msedge.exe
3892	msedge.exe
3020	firefox.exe
3020	firefox.exe
3020	firefox.exe
3020	firefox.exe
3020	firefox.exe
3020	firefox.exe
3020	firefox.exe
3020	firefox.exe
3020	firefox.exe
3020	firefox.exe
3020	firefox.exe
3020	firefox.exe
3020	firefox.exe
3020	firefox.exe
3020	firefox.exe
3020	firefox.exe
3020	firefox.exe
3020	firefox.exe
3020	firefox.exe
3020	firefox.exe
936	chrome.exe
936	chrome.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
6136	firefox.exe
3020	firefox.exe
2344	Camper Xing Tailai T102 Tooling PO 4510208597_Right Nik.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5424 wrote to memory of 4856	5424	Camper Xing Tailai T102 Tooling PO 4510208597_Right Nik.exe	78
PID 5424 wrote to memory of 4856	5424	Camper Xing Tailai T102 Tooling PO 4510208597_Right Nik.exe	78
PID 5424 wrote to memory of 4856	5424	Camper Xing Tailai T102 Tooling PO 4510208597_Right Nik.exe	78
PID 5424 wrote to memory of 5664	5424	Camper Xing Tailai T102 Tooling PO 4510208597_Right Nik.exe	80
PID 5424 wrote to memory of 5664	5424	Camper Xing Tailai T102 Tooling PO 4510208597_Right Nik.exe	80
PID 5424 wrote to memory of 5664	5424	Camper Xing Tailai T102 Tooling PO 4510208597_Right Nik.exe	80
PID 5424 wrote to memory of 3444	5424	Camper Xing Tailai T102 Tooling PO 4510208597_Right Nik.exe	81
PID 5424 wrote to memory of 3444	5424	Camper Xing Tailai T102 Tooling PO 4510208597_Right Nik.exe	81
PID 5424 wrote to memory of 3444	5424	Camper Xing Tailai T102 Tooling PO 4510208597_Right Nik.exe	81
PID 5424 wrote to memory of 4384	5424	Camper Xing Tailai T102 Tooling PO 4510208597_Right Nik.exe	84
PID 5424 wrote to memory of 4384	5424	Camper Xing Tailai T102 Tooling PO 4510208597_Right Nik.exe	84
PID 5424 wrote to memory of 4384	5424	Camper Xing Tailai T102 Tooling PO 4510208597_Right Nik.exe	84
PID 5424 wrote to memory of 2344	5424	Camper Xing Tailai T102 Tooling PO 4510208597_Right Nik.exe	85
PID 5424 wrote to memory of 2344	5424	Camper Xing Tailai T102 Tooling PO 4510208597_Right Nik.exe	85
PID 5424 wrote to memory of 2344	5424	Camper Xing Tailai T102 Tooling PO 4510208597_Right Nik.exe	85
PID 5424 wrote to memory of 2344	5424	Camper Xing Tailai T102 Tooling PO 4510208597_Right Nik.exe	85
PID 5424 wrote to memory of 2344	5424	Camper Xing Tailai T102 Tooling PO 4510208597_Right Nik.exe	85
PID 5424 wrote to memory of 2344	5424	Camper Xing Tailai T102 Tooling PO 4510208597_Right Nik.exe	85
PID 5424 wrote to memory of 2344	5424	Camper Xing Tailai T102 Tooling PO 4510208597_Right Nik.exe	85
PID 5424 wrote to memory of 2344	5424	Camper Xing Tailai T102 Tooling PO 4510208597_Right Nik.exe	85
PID 2344 wrote to memory of 3484	2344	Camper Xing Tailai T102 Tooling PO 4510208597_Right Nik.exe	89
PID 2344 wrote to memory of 3484	2344	Camper Xing Tailai T102 Tooling PO 4510208597_Right Nik.exe	89
PID 3484 wrote to memory of 2872	3484	chrome.exe	90
PID 3484 wrote to memory of 2872	3484	chrome.exe	90
PID 2344 wrote to memory of 3484	2344	Camper Xing Tailai T102 Tooling PO 4510208597_Right Nik.exe	89
PID 2344 wrote to memory of 3484	2344	Camper Xing Tailai T102 Tooling PO 4510208597_Right Nik.exe	89
PID 3484 wrote to memory of 6040	3484	chrome.exe	91
PID 3484 wrote to memory of 6040	3484	chrome.exe	91
PID 3484 wrote to memory of 2280	3484	chrome.exe	92
PID 3484 wrote to memory of 2280	3484	chrome.exe	92
PID 2344 wrote to memory of 2872	2344	Camper Xing Tailai T102 Tooling PO 4510208597_Right Nik.exe	90
PID 2344 wrote to memory of 2872	2344	Camper Xing Tailai T102 Tooling PO 4510208597_Right Nik.exe	90
PID 3484 wrote to memory of 5112	3484	chrome.exe	93
PID 3484 wrote to memory of 5112	3484	chrome.exe	93
PID 3484 wrote to memory of 5860	3484	chrome.exe	94
PID 3484 wrote to memory of 5860	3484	chrome.exe	94
PID 3484 wrote to memory of 4764	3484	chrome.exe	95
PID 3484 wrote to memory of 4764	3484	chrome.exe	95
PID 3484 wrote to memory of 1712	3484	chrome.exe	96
PID 3484 wrote to memory of 1712	3484	chrome.exe	96
PID 3484 wrote to memory of 4228	3484	chrome.exe	97
PID 3484 wrote to memory of 4228	3484	chrome.exe	97
PID 3484 wrote to memory of 4268	3484	chrome.exe	98
PID 3484 wrote to memory of 4268	3484	chrome.exe	98
PID 3484 wrote to memory of 5580	3484	chrome.exe	99
PID 3484 wrote to memory of 5580	3484	chrome.exe	99
PID 3484 wrote to memory of 2740	3484	chrome.exe	100
PID 3484 wrote to memory of 2740	3484	chrome.exe	100
PID 2344 wrote to memory of 4268	2344	Camper Xing Tailai T102 Tooling PO 4510208597_Right Nik.exe	98
PID 2344 wrote to memory of 4268	2344	Camper Xing Tailai T102 Tooling PO 4510208597_Right Nik.exe	98
PID 2344 wrote to memory of 3484	2344	Camper Xing Tailai T102 Tooling PO 4510208597_Right Nik.exe	89
PID 2344 wrote to memory of 3484	2344	Camper Xing Tailai T102 Tooling PO 4510208597_Right Nik.exe	89
PID 2344 wrote to memory of 2872	2344	Camper Xing Tailai T102 Tooling PO 4510208597_Right Nik.exe	90
PID 2344 wrote to memory of 2872	2344	Camper Xing Tailai T102 Tooling PO 4510208597_Right Nik.exe	90
PID 3484 wrote to memory of 1752	3484	chrome.exe	101
PID 3484 wrote to memory of 1752	3484	chrome.exe	101
PID 2344 wrote to memory of 2280	2344	Camper Xing Tailai T102 Tooling PO 4510208597_Right Nik.exe	92
PID 2344 wrote to memory of 2280	2344	Camper Xing Tailai T102 Tooling PO 4510208597_Right Nik.exe	92
PID 2344 wrote to memory of 6040	2344	Camper Xing Tailai T102 Tooling PO 4510208597_Right Nik.exe	91
PID 2344 wrote to memory of 6040	2344	Camper Xing Tailai T102 Tooling PO 4510208597_Right Nik.exe	91
PID 2344 wrote to memory of 5580	2344	Camper Xing Tailai T102 Tooling PO 4510208597_Right Nik.exe	99
PID 2344 wrote to memory of 5580	2344	Camper Xing Tailai T102 Tooling PO 4510208597_Right Nik.exe	99
PID 2344 wrote to memory of 5112	2344	Camper Xing Tailai T102 Tooling PO 4510208597_Right Nik.exe	93
PID 2344 wrote to memory of 5112	2344	Camper Xing Tailai T102 Tooling PO 4510208597_Right Nik.exe	93

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-330179853-1108322181-418488014-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Camper Xing Tailai T102 Tooling PO 4510208597_Right Nik.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-330179853-1108322181-418488014-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Camper Xing Tailai T102 Tooling PO 4510208597_Right Nik.exe

C:\Users\Admin\AppData\Local\Temp\Camper Xing Tailai T102 Tooling PO 4510208597_Right Nik.exe
"C:\Users\Admin\AppData\Local\Temp\Camper Xing Tailai T102 Tooling PO 4510208597_Right Nik.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5424
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Camper Xing Tailai T102 Tooling PO 4510208597_Right Nik.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4856
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\QgotrKYsNEIZqu.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5664
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\QgotrKYsNEIZqu" /XML "C:\Users\Admin\AppData\Local\Temp\tmpE36B.tmp"
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:3444
- C:\Users\Admin\AppData\Local\Temp\Camper Xing Tailai T102 Tooling PO 4510208597_Right Nik.exe
  "C:\Users\Admin\AppData\Local\Temp\Camper Xing Tailai T102 Tooling PO 4510208597_Right Nik.exe"
  2⤵
  PID:4384
- C:\Users\Admin\AppData\Local\Temp\Camper Xing Tailai T102 Tooling PO 4510208597_Right Nik.exe
  "C:\Users\Admin\AppData\Local\Temp\Camper Xing Tailai T102 Tooling PO 4510208597_Right Nik.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - outlook_office_path
  - outlook_win_path
  PID:2344
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\bxejnikr.ahw"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3484
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\bxejnikr.ahw /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\bxejnikr.ahw\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\bxejnikr.ahw --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ffcc9fcdcf8,0x7ffcc9fcdd04,0x7ffcc9fcdd10
      4⤵
      PID:2872
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\bxejnikr.ahw" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=2116,i,8804041950505387914,12536992953335588208,262144 --variations-seed-version --mojo-platform-channel-handle=2112 /prefetch:2
      4⤵
      PID:6040
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\bxejnikr.ahw" --field-trial-handle=2196,i,8804041950505387914,12536992953335588208,262144 --variations-seed-version --mojo-platform-channel-handle=2220 /prefetch:11
      4⤵
      PID:2280
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\bxejnikr.ahw" --field-trial-handle=2340,i,8804041950505387914,12536992953335588208,262144 --variations-seed-version --mojo-platform-channel-handle=2352 /prefetch:13
      4⤵
      PID:5112
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\bxejnikr.ahw" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3088,i,8804041950505387914,12536992953335588208,262144 --variations-seed-version --mojo-platform-channel-handle=3100 /prefetch:1
      4⤵
      PID:5860
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\bxejnikr.ahw" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3104,i,8804041950505387914,12536992953335588208,262144 --variations-seed-version --mojo-platform-channel-handle=3140 /prefetch:1
      4⤵
      PID:4764
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\bxejnikr.ahw" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3332,i,8804041950505387914,12536992953335588208,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
      4⤵
      PID:1712
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\bxejnikr.ahw" --extension-process --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=3312,i,8804041950505387914,12536992953335588208,262144 --variations-seed-version --mojo-platform-channel-handle=3452 /prefetch:9
      4⤵
      PID:4228
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\bxejnikr.ahw" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=3344,i,8804041950505387914,12536992953335588208,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
      4⤵
      PID:4268
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\bxejnikr.ahw" --extension-process --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=3556,i,8804041950505387914,12536992953335588208,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:9
      4⤵
      PID:5580
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\bxejnikr.ahw" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=4060,i,8804041950505387914,12536992953335588208,262144 --variations-seed-version --mojo-platform-channel-handle=3872 /prefetch:1
      4⤵
      PID:2740
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\bxejnikr.ahw" --field-trial-handle=4388,i,8804041950505387914,12536992953335588208,262144 --variations-seed-version --mojo-platform-channel-handle=4392 /prefetch:14
      4⤵
      PID:1752
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\bxejnikr.ahw" --field-trial-handle=4908,i,8804041950505387914,12536992953335588208,262144 --variations-seed-version --mojo-platform-channel-handle=4916 /prefetch:14
      4⤵
      PID:3172
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\bxejnikr.ahw" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=4964,i,8804041950505387914,12536992953335588208,262144 --variations-seed-version --mojo-platform-channel-handle=5072 /prefetch:1
      4⤵
      PID:5044
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\bxejnikr.ahw" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=4996,i,8804041950505387914,12536992953335588208,262144 --variations-seed-version --mojo-platform-channel-handle=4980 /prefetch:1
      4⤵
      PID:3316
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\bxejnikr.ahw" --field-trial-handle=5144,i,8804041950505387914,12536992953335588208,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:14
      4⤵
      PID:924
  - - C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
      4⤵
      Drops file in Windows directory
      PID:4304
    - - C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x244,0x248,0x24c,0x220,0x250,0x7ff620bd1f58,0x7ff620bd1f64,0x7ff620bd1f70
        5⤵
        Drops file in Windows directory
        
        PID:6024
    - - C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\initial_preferences" --create-shortcuts=1 --install-level=0
        5⤵
        Drops file in Windows directory
        Modifies registry class
        Suspicious use of FindShellTrayWindow
        
        PID:2172
      - C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x244,0x248,0x24c,0x220,0x250,0x7ff620bd1f58,0x7ff620bd1f64,0x7ff620bd1f70
        6⤵
        Drops file in Windows directory
        
        PID:2736
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\bxejnikr.ahw" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=5004,i,8804041950505387914,12536992953335588208,262144 --variations-seed-version --mojo-platform-channel-handle=4972 /prefetch:1
      4⤵
      PID:3764
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\bxejnikr.ahw" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=5288,i,8804041950505387914,12536992953335588208,262144 --variations-seed-version --mojo-platform-channel-handle=5108 /prefetch:1
      4⤵
      PID:5012
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\bxejnikr.ahw" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --field-trial-handle=5116,i,8804041950505387914,12536992953335588208,262144 --variations-seed-version --mojo-platform-channel-handle=4972 /prefetch:1
      4⤵
      PID:1664
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\bxejnikr.ahw" --field-trial-handle=5208,i,8804041950505387914,12536992953335588208,262144 --variations-seed-version --mojo-platform-channel-handle=5080 /prefetch:14
      4⤵
      PID:3384
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\bxejnikr.ahw" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --field-trial-handle=4960,i,8804041950505387914,12536992953335588208,262144 --variations-seed-version --mojo-platform-channel-handle=4872 /prefetch:1
      4⤵
      PID:4276
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\bxejnikr.ahw" --field-trial-handle=5064,i,8804041950505387914,12536992953335588208,262144 --variations-seed-version --mojo-platform-channel-handle=5060 /prefetch:14
      4⤵
      PID:1596
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\bxejnikr.ahw" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --field-trial-handle=4928,i,8804041950505387914,12536992953335588208,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:1
      4⤵
      PID:1916
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\bxejnikr.ahw" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --field-trial-handle=5368,i,8804041950505387914,12536992953335588208,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:1
      4⤵
      PID:5312
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\bxejnikr.ahw" --field-trial-handle=4932,i,8804041950505387914,12536992953335588208,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:14
      4⤵
      PID:4900
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\bxejnikr.ahw" --extension-process --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --field-trial-handle=5156,i,8804041950505387914,12536992953335588208,262144 --variations-seed-version --mojo-platform-channel-handle=3316 /prefetch:9
      4⤵
      PID:2120
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ildwbnnc.l1b"
    3⤵
    PID:6004
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir=C:\Users\Admin\AppData\Local\Temp\ildwbnnc.l1b
      4⤵
      Checks processor information in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:6136
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1956 -prefsLen 27097 -prefMapHandle 1960 -prefMapSize 270279 -ipcHandle 2036 -initialChannelId {1e74fffe-abcc-4352-b684-4ab815626eff} -parentPid 6136 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6136" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
        5⤵
        
        PID:696
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2144 -prefsLen 27133 -prefMapHandle 2040 -prefMapSize 270279 -ipcHandle 2296 -initialChannelId {e288adeb-1f84-449d-a795-491e6690296b} -parentPid 6136 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6136" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
        5⤵
        
        PID:5184
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\c8750cfc-753b-4845-8041-1103621e3e24.dmp"
        5⤵
        
        PID:3752
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2228 -prefsLen 27133 -prefMapHandle 2824 -prefMapSize 270279 -ipcHandle 2820 -initialChannelId {3cef3b5d-7675-486c-921e-afccf0ca1cb1} -parentPid 6136 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6136" -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 gpu
        5⤵
        
        PID:5664
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\6d93eec2-66a0-41bf-9b37-0f14b9d1d47c.dmp"
        5⤵
        
        PID:3900
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2820 -prefsLen 27133 -prefMapHandle 3020 -prefMapSize 270279 -ipcHandle 2640 -initialChannelId {81677bae-7af2-4845-a22d-406821ce722e} -parentPid 6136 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6136" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 gpu
        5⤵
        
        PID:3104
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\34b1f59f-29ef-4bf8-80f3-6afb66d3f77a.dmp"
        5⤵
        
        PID:4912
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2640 -prefsLen 27198 -prefMapHandle 2936 -prefMapSize 270279 -ipcHandle 2948 -initialChannelId {11c0d0c2-a8cb-4985-b8e3-bd8326c349ae} -parentPid 6136 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6136" -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 gpu
        5⤵
        
        PID:3932
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3700 -prefsLen 27323 -prefMapHandle 3704 -prefMapSize 270279 -jsInitHandle 3708 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3832 -initialChannelId {61eeffb7-b4c2-450a-83b7-45b3850e42c7} -parentPid 6136 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6136" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 tab
        5⤵
        Checks processor information in registry
        
        PID:3232
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\341b8be3-4373-4c9c-8400-38e4c598c048.dmp"
        5⤵
        
        PID:4516
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2948 -prefsLen 27323 -prefMapHandle 3992 -prefMapSize 270279 -ipcHandle 4036 -initialChannelId {a87c26bf-5bbe-4904-a2ba-1beb95938586} -parentPid 6136 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6136" -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 gpu
        5⤵
        
        PID:3212
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\40ae1b64-84bc-44be-9c82-b550b646ee7d.dmp"
        5⤵
        
        PID:5548
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4268 -prefsLen 27323 -prefMapHandle 4272 -prefMapSize 270279 -ipcHandle 4180 -initialChannelId {3c90f173-1abb-435e-86b3-39478a8fbd8d} -parentPid 6136 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6136" -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 rdd
        5⤵
        
        PID:6076
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4504 -prefsLen 34876 -prefMapHandle 3200 -prefMapSize 270279 -jsInitHandle 4508 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3036 -initialChannelId {a72be8fd-bd01-4ca2-8592-b5015f030e99} -parentPid 6136 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6136" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
        5⤵
        Checks processor information in registry
        
        PID:4640
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4948 -prefsLen 35010 -prefMapHandle 3868 -prefMapSize 270279 -ipcHandle 4692 -initialChannelId {e2f65a2b-8f04-4f2f-a61b-f3608ada45ba} -parentPid 6136 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6136" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 utility
        5⤵
        Checks processor information in registry
        
        PID:764
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5008 -prefsLen 32900 -prefMapHandle 4512 -prefMapSize 270279 -jsInitHandle 2876 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4796 -initialChannelId {e01a1e94-0440-4513-9e04-545d90775741} -parentPid 6136 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6136" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
        5⤵
        Checks processor information in registry
        
        PID:2604
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4704 -prefsLen 32900 -prefMapHandle 3036 -prefMapSize 270279 -jsInitHandle 5104 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5204 -initialChannelId {d16090be-0895-494f-83b3-75e4406e9fc1} -parentPid 6136 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6136" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
        5⤵
        Checks processor information in registry
        
        PID:5692
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5544 -prefsLen 32900 -prefMapHandle 5548 -prefMapSize 270279 -jsInitHandle 5552 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5560 -initialChannelId {8031ced7-623d-4133-9ab7-b91545a39773} -parentPid 6136 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6136" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab
        5⤵
        Checks processor information in registry
        
        PID:5380
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\1bzlcnch.0fd"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious use of FindShellTrayWindow
    PID:4592
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\1bzlcnch.0fd /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\1bzlcnch.0fd\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x23c,0x240,0x244,0x238,0x250,0x7ffcc9baf208,0x7ffcc9baf214,0x7ffcc9baf220
      4⤵
      PID:1760
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\1bzlcnch.0fd" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --field-trial-handle=2092,i,6810254140920882721,14693117745580048219,262144 --variations-seed-version --mojo-platform-channel-handle=2016 /prefetch:2
      4⤵
      PID:4676
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\1bzlcnch.0fd" --always-read-main-dll --field-trial-handle=1860,i,6810254140920882721,14693117745580048219,262144 --variations-seed-version --mojo-platform-channel-handle=2096 /prefetch:11
      4⤵
      PID:3144
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\1bzlcnch.0fd" --always-read-main-dll --field-trial-handle=2252,i,6810254140920882721,14693117745580048219,262144 --variations-seed-version --mojo-platform-channel-handle=2436 /prefetch:13
      4⤵
      PID:5772
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\1bzlcnch.0fd" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=2828,i,6810254140920882721,14693117745580048219,262144 --variations-seed-version --mojo-platform-channel-handle=3024 /prefetch:1
      4⤵
      PID:1972
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\1bzlcnch.0fd" --instant-process --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=2960,i,6810254140920882721,14693117745580048219,262144 --variations-seed-version --mojo-platform-channel-handle=3032 /prefetch:1
      4⤵
      PID:5588
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\1bzlcnch.0fd" --always-read-main-dll --field-trial-handle=3416,i,6810254140920882721,14693117745580048219,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:14
      4⤵
      PID:3496
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\1bzlcnch.0fd" --always-read-main-dll --field-trial-handle=1864,i,6810254140920882721,14693117745580048219,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:14
      4⤵
      PID:1924
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\1bzlcnch.0fd" --always-read-main-dll --field-trial-handle=3428,i,6810254140920882721,14693117745580048219,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:14
      4⤵
      PID:4436
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\1bzlcnch.0fd" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --field-trial-handle=3544,i,6810254140920882721,14693117745580048219,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:1
      4⤵
      PID:3504
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\1bzlcnch.0fd" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --field-trial-handle=3556,i,6810254140920882721,14693117745580048219,262144 --variations-seed-version --mojo-platform-channel-handle=3680 /prefetch:9
      4⤵
      PID:4992
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\1bzlcnch.0fd" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --field-trial-handle=3612,i,6810254140920882721,14693117745580048219,262144 --variations-seed-version --mojo-platform-channel-handle=3704 /prefetch:1
      4⤵
      PID:404
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\1bzlcnch.0fd" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --field-trial-handle=3636,i,6810254140920882721,14693117745580048219,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:9
      4⤵
      PID:5084
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\1bzlcnch.0fd" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --field-trial-handle=3540,i,6810254140920882721,14693117745580048219,262144 --variations-seed-version --mojo-platform-channel-handle=3776 /prefetch:1
      4⤵
      PID:5776
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\1bzlcnch.0fd" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --field-trial-handle=3724,i,6810254140920882721,14693117745580048219,262144 --variations-seed-version --mojo-platform-channel-handle=3840 /prefetch:9
      4⤵
      PID:4968
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\1bzlcnch.0fd" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --field-trial-handle=3748,i,6810254140920882721,14693117745580048219,262144 --variations-seed-version --mojo-platform-channel-handle=3872 /prefetch:1
      4⤵
      PID:4940
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\1bzlcnch.0fd" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --field-trial-handle=3768,i,6810254140920882721,14693117745580048219,262144 --variations-seed-version --mojo-platform-channel-handle=3740 /prefetch:9
      4⤵
      PID:1804
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\1bzlcnch.0fd" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --field-trial-handle=3856,i,6810254140920882721,14693117745580048219,262144 --variations-seed-version --mojo-platform-channel-handle=3900 /prefetch:1
      4⤵
      PID:5136
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\1bzlcnch.0fd" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --field-trial-handle=3884,i,6810254140920882721,14693117745580048219,262144 --variations-seed-version --mojo-platform-channel-handle=3952 /prefetch:9
      4⤵
      PID:696
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\1bzlcnch.0fd" --always-read-main-dll --field-trial-handle=4460,i,6810254140920882721,14693117745580048219,262144 --variations-seed-version --mojo-platform-channel-handle=4472 /prefetch:14
      4⤵
      PID:3156
    - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=1140
        5⤵
        
        PID:5312
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\1bzlcnch.0fd" --always-read-main-dll --field-trial-handle=4952,i,6810254140920882721,14693117745580048219,262144 --variations-seed-version --mojo-platform-channel-handle=4908 /prefetch:14
      4⤵
      PID:5900
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\1bzlcnch.0fd" --always-read-main-dll --field-trial-handle=4980,i,6810254140920882721,14693117745580048219,262144 --variations-seed-version --mojo-platform-channel-handle=4996 /prefetch:14
      4⤵
      PID:2596
    - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=592
        5⤵
        
        PID:4296
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\1bzlcnch.0fd" --always-read-main-dll --field-trial-handle=5068,i,6810254140920882721,14693117745580048219,262144 --variations-seed-version --mojo-platform-channel-handle=5072 /prefetch:14
      4⤵
      PID:2192
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\1bzlcnch.0fd" --always-read-main-dll --field-trial-handle=5192,i,6810254140920882721,14693117745580048219,262144 --variations-seed-version --mojo-platform-channel-handle=5764 /prefetch:14
      4⤵
      PID:3576
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --no-sandbox --mute-audio --onnx-enabled-for-ee --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\1bzlcnch.0fd" --always-read-main-dll --field-trial-handle=5332,i,6810254140920882721,14693117745580048219,262144 --variations-seed-version --mojo-platform-channel-handle=5808 /prefetch:14
      4⤵
      PID:2096
  - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\1bzlcnch.0fd" --always-read-main-dll --field-trial-handle=5952,i,6810254140920882721,14693117745580048219,262144 --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:14
      4⤵
      PID:4856
  - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\1bzlcnch.0fd" --always-read-main-dll --field-trial-handle=5952,i,6810254140920882721,14693117745580048219,262144 --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:14
      4⤵
      PID:4436
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\1bzlcnch.0fd" --always-read-main-dll --field-trial-handle=6264,i,6810254140920882721,14693117745580048219,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:14
      4⤵
      PID:4800
  - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\Installer\setup.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
      4⤵
      Drops file in Program Files directory
      Drops file in Windows directory
      PID:3512
    - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\Installer\setup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x234,0x238,0x23c,0x210,0x240,0x7ff701e16a68,0x7ff701e16a74,0x7ff701e16a80
        5⤵
        Drops file in Windows directory
        
        PID:4552
    - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\Installer\setup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\Installer\setup.exe" --msedge --system-level --verbose-logging --installerdata="C:\Program Files (x86)\Microsoft\Edge\Application\master_preferences" --create-shortcuts=1 --install-level=0
        5⤵
        Drops file in Program Files directory
        Drops file in Windows directory
        
        PID:5796
      - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\Installer\setup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x234,0x238,0x23c,0x210,0x240,0x7ff701e16a68,0x7ff701e16a74,0x7ff701e16a80
        6⤵
        Drops file in Windows directory
        
        PID:1572
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\1bzlcnch.0fd" --always-read-main-dll --field-trial-handle=6316,i,6810254140920882721,14693117745580048219,262144 --variations-seed-version --mojo-platform-channel-handle=6720 /prefetch:14
      4⤵
      PID:3652
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\1bzlcnch.0fd" --always-read-main-dll --field-trial-handle=6760,i,6810254140920882721,14693117745580048219,262144 --variations-seed-version --mojo-platform-channel-handle=7308 /prefetch:14
      4⤵
      PID:3320
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\1bzlcnch.0fd" --always-read-main-dll --field-trial-handle=7300,i,6810254140920882721,14693117745580048219,262144 --variations-seed-version --mojo-platform-channel-handle=6868 /prefetch:14
      4⤵
      PID:4620
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\1bzlcnch.0fd" --always-read-main-dll --field-trial-handle=7236,i,6810254140920882721,14693117745580048219,262144 --variations-seed-version --mojo-platform-channel-handle=7268 /prefetch:14
      4⤵
      PID:5156
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\1bzlcnch.0fd" --always-read-main-dll --field-trial-handle=7204,i,6810254140920882721,14693117745580048219,262144 --variations-seed-version --mojo-platform-channel-handle=7244 /prefetch:14
      4⤵
      PID:4088
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\1bzlcnch.0fd" --always-read-main-dll --field-trial-handle=7120,i,6810254140920882721,14693117745580048219,262144 --variations-seed-version --mojo-platform-channel-handle=7128 /prefetch:14
      4⤵
      PID:2596
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\1bzlcnch.0fd" --always-read-main-dll --field-trial-handle=7304,i,6810254140920882721,14693117745580048219,262144 --variations-seed-version --mojo-platform-channel-handle=7284 /prefetch:14
      4⤵
      PID:5332
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\1b5jbvp4.v1s"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious use of FindShellTrayWindow
    PID:3892
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\1b5jbvp4.v1s /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\1b5jbvp4.v1s\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x240,0x244,0x248,0x23c,0x210,0x7ffcc9baf208,0x7ffcc9baf214,0x7ffcc9baf220
      4⤵
      PID:2452
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\1b5jbvp4.v1s" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --field-trial-handle=2160,i,10152646314957554109,12839192454182143849,262144 --variations-seed-version --mojo-platform-channel-handle=2156 /prefetch:2
      4⤵
      PID:2824
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\1b5jbvp4.v1s" --always-read-main-dll --field-trial-handle=1748,i,10152646314957554109,12839192454182143849,262144 --variations-seed-version --mojo-platform-channel-handle=2164 /prefetch:11
      4⤵
      PID:1228
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\1b5jbvp4.v1s" --always-read-main-dll --field-trial-handle=2236,i,10152646314957554109,12839192454182143849,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:13
      4⤵
      PID:3372
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\1b5jbvp4.v1s" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3328,i,10152646314957554109,12839192454182143849,262144 --variations-seed-version --mojo-platform-channel-handle=2944 /prefetch:1
      4⤵
      PID:5272
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\1b5jbvp4.v1s" --instant-process --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3336,i,10152646314957554109,12839192454182143849,262144 --variations-seed-version --mojo-platform-channel-handle=3364 /prefetch:1
      4⤵
      PID:2004
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\1b5jbvp4.v1s" --always-read-main-dll --field-trial-handle=3736,i,10152646314957554109,12839192454182143849,262144 --variations-seed-version --mojo-platform-channel-handle=3856 /prefetch:14
      4⤵
      PID:4612
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\1b5jbvp4.v1s" --always-read-main-dll --field-trial-handle=3740,i,10152646314957554109,12839192454182143849,262144 --variations-seed-version --mojo-platform-channel-handle=3296 /prefetch:14
      4⤵
      PID:1628
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\1b5jbvp4.v1s" --always-read-main-dll --field-trial-handle=3748,i,10152646314957554109,12839192454182143849,262144 --variations-seed-version --mojo-platform-channel-handle=3900 /prefetch:14
      4⤵
      PID:5884
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\1b5jbvp4.v1s" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --field-trial-handle=3768,i,10152646314957554109,12839192454182143849,262144 --variations-seed-version --mojo-platform-channel-handle=4000 /prefetch:1
      4⤵
      PID:4520
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\1b5jbvp4.v1s" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --field-trial-handle=3864,i,10152646314957554109,12839192454182143849,262144 --variations-seed-version --mojo-platform-channel-handle=4040 /prefetch:9
      4⤵
      PID:3152
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\1b5jbvp4.v1s" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --field-trial-handle=3892,i,10152646314957554109,12839192454182143849,262144 --variations-seed-version --mojo-platform-channel-handle=4116 /prefetch:1
      4⤵
      PID:808
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\1b5jbvp4.v1s" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --field-trial-handle=3948,i,10152646314957554109,12839192454182143849,262144 --variations-seed-version --mojo-platform-channel-handle=4120 /prefetch:9
      4⤵
      PID:1860
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\1b5jbvp4.v1s" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --field-trial-handle=3968,i,10152646314957554109,12839192454182143849,262144 --variations-seed-version --mojo-platform-channel-handle=4140 /prefetch:1
      4⤵
      PID:5516
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\1b5jbvp4.v1s" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --field-trial-handle=3988,i,10152646314957554109,12839192454182143849,262144 --variations-seed-version --mojo-platform-channel-handle=4168 /prefetch:9
      4⤵
      PID:2040
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\1b5jbvp4.v1s" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --field-trial-handle=4024,i,10152646314957554109,12839192454182143849,262144 --variations-seed-version --mojo-platform-channel-handle=4176 /prefetch:1
      4⤵
      PID:5152
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\1b5jbvp4.v1s" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --field-trial-handle=4032,i,10152646314957554109,12839192454182143849,262144 --variations-seed-version --mojo-platform-channel-handle=4188 /prefetch:9
      4⤵
      PID:536
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\1b5jbvp4.v1s" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --field-trial-handle=4128,i,10152646314957554109,12839192454182143849,262144 --variations-seed-version --mojo-platform-channel-handle=4200 /prefetch:1
      4⤵
      PID:3888
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\1b5jbvp4.v1s" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --field-trial-handle=4160,i,10152646314957554109,12839192454182143849,262144 --variations-seed-version --mojo-platform-channel-handle=4212 /prefetch:9
      4⤵
      PID:6064
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\1b5jbvp4.v1s" --always-read-main-dll --field-trial-handle=4264,i,10152646314957554109,12839192454182143849,262144 --variations-seed-version --mojo-platform-channel-handle=4364 /prefetch:14
      4⤵
      PID:1260
    - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=1128
        5⤵
        
        PID:6752
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\1b5jbvp4.v1s" --always-read-main-dll --field-trial-handle=5324,i,10152646314957554109,12839192454182143849,262144 --variations-seed-version --mojo-platform-channel-handle=5276 /prefetch:14
      4⤵
      PID:6516
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\1b5jbvp4.v1s" --always-read-main-dll --field-trial-handle=5332,i,10152646314957554109,12839192454182143849,262144 --variations-seed-version --mojo-platform-channel-handle=5264 /prefetch:14
      4⤵
      PID:6812
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\1b5jbvp4.v1s" --always-read-main-dll --field-trial-handle=5348,i,10152646314957554109,12839192454182143849,262144 --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:14
      4⤵
      PID:7064
    - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=596
        5⤵
        
        PID:1056
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\1b5jbvp4.v1s" --always-read-main-dll --field-trial-handle=5440,i,10152646314957554109,12839192454182143849,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:14
      4⤵
      PID:7000
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --no-sandbox --mute-audio --onnx-enabled-for-ee --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\1b5jbvp4.v1s" --always-read-main-dll --field-trial-handle=5500,i,10152646314957554109,12839192454182143849,262144 --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:14
      4⤵
      PID:6884
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\napymxhy.v3a"
    3⤵
    PID:6652
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir=C:\Users\Admin\AppData\Local\Temp\napymxhy.v3a
      4⤵
      Checks processor information in registry
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:3020
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1960 -prefsLen 27097 -prefMapHandle 1964 -prefMapSize 270331 -ipcHandle 2052 -initialChannelId {98e8ac73-d467-4f30-9dd3-7db727d66f39} -parentPid 3020 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3020" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
        5⤵
        
        PID:1544
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2152 -prefsLen 27133 -prefMapHandle 2156 -prefMapSize 270331 -ipcHandle 2196 -initialChannelId {34b8a7b5-193f-479a-9aa0-c2764c5b2932} -parentPid 3020 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3020" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
        5⤵
        
        PID:5436
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\63b81684-bba8-4ec5-be13-101a938c7304.dmp"
        5⤵
        
        PID:2272
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2656 -prefsLen 27133 -prefMapHandle 2652 -prefMapSize 270331 -ipcHandle 1408 -initialChannelId {11c30409-9f98-417a-bba5-cd8df2e05086} -parentPid 3020 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3020" -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 gpu
        5⤵
        
        PID:5212
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\940028d6-d450-482f-ab78-8c5ba8781e04.dmp"
        5⤵
        
        PID:2808
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2732 -prefsLen 27198 -prefMapHandle 3156 -prefMapSize 270331 -ipcHandle 3340 -initialChannelId {6451ea1a-0826-4423-bd7b-83d3746551db} -parentPid 3020 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3020" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 gpu
        5⤵
        
        PID:2856
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3804 -prefsLen 27323 -prefMapHandle 3808 -prefMapSize 270331 -jsInitHandle 3812 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3820 -initialChannelId {760726b1-f31f-4a5a-b75f-62207dd86f73} -parentPid 3020 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3020" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
        5⤵
        Checks processor information in registry
        
        PID:3664
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\cc6d0dc6-4047-4473-92e3-53b233741446.dmp"
        5⤵
        
        PID:2876
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3340 -prefsLen 27323 -prefMapHandle 3848 -prefMapSize 270331 -ipcHandle 2776 -initialChannelId {3c47bd01-debd-438b-81a7-ce5ac8fa2f23} -parentPid 3020 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3020" -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 gpu
        5⤵
        
        PID:2284
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\2a703382-a930-4c90-bbca-056b636181c7.dmp"
        5⤵
        
        PID:4620
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4208 -prefsLen 27323 -prefMapHandle 4204 -prefMapSize 270331 -ipcHandle 3800 -initialChannelId {69301f06-eacd-4044-8cb9-0c85b2e27ac8} -parentPid 3020 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3020" -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 rdd
        5⤵
        
        PID:5680
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4600 -prefsLen 34876 -prefMapHandle 4604 -prefMapSize 270331 -jsInitHandle 4608 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4616 -initialChannelId {8a0950f2-bf6f-4b88-9a0b-ac1d92d52d3f} -parentPid 3020 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3020" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
        5⤵
        Checks processor information in registry
        
        PID:6548
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 2652 -prefsLen 34876 -prefMapHandle 2020 -prefMapSize 270331 -ipcHandle 3812 -initialChannelId {23a40e46-56dc-4730-80cb-7f8df06371e4} -parentPid 3020 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3020" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 utility
        5⤵
        Checks processor information in registry
        
        PID:5644
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5108 -prefsLen 32766 -prefMapHandle 5112 -prefMapSize 270331 -jsInitHandle 5116 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5128 -initialChannelId {67c225ad-bfe7-4fa4-a117-137c6e34da7a} -parentPid 3020 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3020" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
        5⤵
        Checks processor information in registry
        
        PID:6420
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5144 -prefsLen 32766 -prefMapHandle 5148 -prefMapSize 270331 -jsInitHandle 5152 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5160 -initialChannelId {ab2546cd-81ff-4458-b025-ede3c5f69832} -parentPid 3020 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3020" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
        5⤵
        Checks processor information in registry
        
        PID:6776
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5116 -prefsLen 32818 -prefMapHandle 5128 -prefMapSize 270331 -jsInitHandle 5144 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5580 -initialChannelId {769c78a9-c768-4f58-ab3a-9b93709b9e2d} -parentPid 3020 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3020" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
        5⤵
        Checks processor information in registry
        
        PID:6692
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lproyise.gvh"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    PID:936
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\lproyise.gvh /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\lproyise.gvh\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\lproyise.gvh --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ffcc9fcdcf8,0x7ffcc9fcdd04,0x7ffcc9fcdd10
      4⤵
      PID:6576
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lproyise.gvh" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=2276,i,14956690949117877034,4143945364346360686,262144 --variations-seed-version --mojo-platform-channel-handle=2272 /prefetch:2
      4⤵
      PID:4520
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lproyise.gvh" --field-trial-handle=2028,i,14956690949117877034,4143945364346360686,262144 --variations-seed-version --mojo-platform-channel-handle=2776 /prefetch:11
      4⤵
      PID:236
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lproyise.gvh" --field-trial-handle=2352,i,14956690949117877034,4143945364346360686,262144 --variations-seed-version --mojo-platform-channel-handle=3116 /prefetch:13
      4⤵
      PID:6172
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lproyise.gvh" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3060,i,14956690949117877034,4143945364346360686,262144 --variations-seed-version --mojo-platform-channel-handle=3136 /prefetch:1
      4⤵
      PID:6180
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lproyise.gvh" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3080,i,14956690949117877034,4143945364346360686,262144 --variations-seed-version --mojo-platform-channel-handle=3788 /prefetch:1
      4⤵
      PID:808
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lproyise.gvh" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3328,i,14956690949117877034,4143945364346360686,262144 --variations-seed-version --mojo-platform-channel-handle=3820 /prefetch:1
      4⤵
      PID:1992
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lproyise.gvh" --extension-process --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=3324,i,14956690949117877034,4143945364346360686,262144 --variations-seed-version --mojo-platform-channel-handle=3836 /prefetch:9
      4⤵
      PID:2420
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lproyise.gvh" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=3348,i,14956690949117877034,4143945364346360686,262144 --variations-seed-version --mojo-platform-channel-handle=3872 /prefetch:1
      4⤵
      PID:4632
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lproyise.gvh" --extension-process --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=3364,i,14956690949117877034,4143945364346360686,262144 --variations-seed-version --mojo-platform-channel-handle=4140 /prefetch:9
      4⤵
      PID:6336
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lproyise.gvh" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=4320,i,14956690949117877034,4143945364346360686,262144 --variations-seed-version --mojo-platform-channel-handle=3752 /prefetch:1
      4⤵
      PID:6520
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lproyise.gvh" --field-trial-handle=4224,i,14956690949117877034,4143945364346360686,262144 --variations-seed-version --mojo-platform-channel-handle=4384 /prefetch:14
      4⤵
      PID:2844
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lproyise.gvh" --field-trial-handle=4908,i,14956690949117877034,4143945364346360686,262144 --variations-seed-version --mojo-platform-channel-handle=4896 /prefetch:14
      4⤵
      PID:5556
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lproyise.gvh" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=4936,i,14956690949117877034,4143945364346360686,262144 --variations-seed-version --mojo-platform-channel-handle=4984 /prefetch:1
      4⤵
      PID:6648
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lproyise.gvh" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=4960,i,14956690949117877034,4143945364346360686,262144 --variations-seed-version --mojo-platform-channel-handle=4988 /prefetch:1
      4⤵
      PID:7020
  - - C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
      4⤵
      Drops file in Windows directory
      PID:1196
    - - C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x244,0x248,0x24c,0x220,0x250,0x7ff620bd1f58,0x7ff620bd1f64,0x7ff620bd1f70
        5⤵
        Drops file in Windows directory
        
        PID:3624

C:\Users\Admin\AppData\Roaming\QgotrKYsNEIZqu.exe
C:\Users\Admin\AppData\Roaming\QgotrKYsNEIZqu.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3492
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\QgotrKYsNEIZqu.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:6560
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\QgotrKYsNEIZqu.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:6660
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\QgotrKYsNEIZqu" /XML "C:\Users\Admin\AppData\Local\Temp\tmp560A.tmp"
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:6724
- C:\Users\Admin\AppData\Roaming\QgotrKYsNEIZqu.exe
  "C:\Users\Admin\AppData\Roaming\QgotrKYsNEIZqu.exe"
  2⤵
  - Executes dropped EXE
  PID:2980
- C:\Users\Admin\AppData\Roaming\QgotrKYsNEIZqu.exe
  "C:\Users\Admin\AppData\Roaming\QgotrKYsNEIZqu.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:936

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2892

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Camper Xing Tailai T102 Tooling PO 4510208597_Right Nik.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Camper Xing Tailai T102 Tooling PO 4510208597_Right Nik.exe.log
Size 1KB
SHA256 4c17576f64dea465c45a50573ee41771f7be9962ab2d07f961af4df5589bdcce
MD5 7e1ed0055c3eaa0bbc4a29ec1ef15a6a
SHA1 765b954c1adbb6a6ecc4fe912fdaa6d0fba0ae7d
SHA512 de7c784c37d18c43820908add88f08ab4864c0ef3f9d158cc2c9d1bab120613cb093dd4bfc5d7ed0c289414956cfe0b213c386f8e6b5753847dec915566297c8
MD5 SHA1 SHA512

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 9600b3fdf0565ccb49e21656aa4b24d7c18f776bfd04d9ee984b134707550f02
MD5 d0c46cad6c0778401e21910bd6b56b70
SHA1 7be418951ea96326aca445b8dfe449b2bfa0dca6
SHA512 057531b468f7fbbb2175a696a8aab274dec0d17d9f71df309edcff35e064f3378050066a3df47ccd03048fac461594ec75e3d4fe64f9dd79949d129f51e02949
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 83581f83a480b9f6a47e2156dae881b9d9cd71db1045a60a84d3becb816806f7
MD5 7b7c262231975c916d4d695e6e96359f
SHA1 36607dff8adc0351ce07b5290ff85707ac579782
SHA512 552fc851d467e79d9532cd6fb2627652447d67ba696464d0938caec3ef92e31785ff03c2c00587981b45e42ece25ce57aba67c2cc6cc051ab89cfd12d2350ffb
SSDEEP 384:sL3HhRSS1UPS1TL0ME4H+cNHjs2xtgF5NTq059h9Egu0iF1X:SrSSC6t/EEnHj7xtgFTTq2h9Egu0o
MD5 SHA1 SHA512 SSDEEP

Submit Download

activity-stream.contile.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1tjvljcf.default-release\activity-stream.contile.json
Size 4KB
SHA256 112836ef8963ce8fc78466089363dd08dc8cc22a1badd408e3a04d980bcae6cb
MD5 2dcd613536bda154e8b93d1c6b9f08f8
SHA1 e4e24b60ec6a9ef8e5643170db5d8d9211e16667
SHA512 842a1f8287320b9a3b26d26f16d0edae9974b0628930b9e08e00d63e00e871194a7985387554b1df915baf0244a5ba1d9a6560d6f4f7f30fce77791677d7ba16
SSDEEP 96:K72Arz2tAcuPNdkb+T8DlkQvdhzPc/828DMZvPHl:KqtAcqdkyAlkcdhE/qMR/l
MD5 SHA1 SHA512 SSDEEP

Submit Download

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1tjvljcf.default-release\activity-stream.discovery_stream.json
Size 20KB
SHA256 5c58fce3998c6ecb733dca6cf60c78c1e21a5319728870c86f6bb8f8d107bec6
MD5 915ab1e72d86fc45cb12746ec5c4067b
SHA1 b8924e6abc5bc2585748c5453c7ce0cd649b855b
SHA512 01be33f7c1bef578cddd909cb490df892aa935c687e55a21b86680005cd38c067c5f348831fa56c12fff18e5ddb419dcf4a2d1b885bdcc9296a6a6f609d211ea
SSDEEP 384:aByaT5NmpXHQK65UOBwKfonUeWg+DQbrdW+q42ZmpcKMQIJ4IKjf4nKOjJ:aByK5NmpHQt5UmwKfzev+DQb0+qJZmen
MD5 SHA1 SHA512 SSDEEP

Submit Download

577120C5183923526312DC856F6825FC1C7D072F

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1tjvljcf.default-release\cache2\entries\577120C5183923526312DC856F6825FC1C7D072F
Size 13KB
SHA256 6141be2ef16960e395e343890a6f3c56d1fca13726e1decf55f0b1f089a7145d
MD5 ce4dfec7c6d90b4154462e98b610e5bf
SHA1 863ffa6791797bcfe5f709641a3e75a3557c63e0
SHA512 d2db8eb957296ed9da9013a0a3acd8577c74221c384b4a101432dce7bc3ead052dabba00a58dfb01762f37f1d9e86068bf4b418e98f8c0ed41676ad618dddbab
SSDEEP 384:HV9BpiO024Y907hSznZOML+CbcxDEclrIVy8ewKT:1EZYC7hSz8MLPbcxDEcVIVy8m
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\1b5jbvp4.v1s\Crashpad\settings.dat
Size 280B
SHA256 bcbfeceea7ab45b67887596389cd667dad3f98e0220fd57178b9574ccd3be471
MD5 eb958cfdeae53dfe1767cdf20f743161
SHA1 588f01c600a131f64c9e983c34db23f63e72b45b
SHA512 d36c0d2c36de6f0835aac5a3269fe493059d228811623c51350d22b9d5ba68e8b3e349c19c2b24fc8e8a1007fe41dbe129a8b3d78c52d8b950dc0c4a2b9861dd
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\1b5jbvp4.v1s\Crashpad\settings.dat
Size 280B
SHA256 d14db21acf960c995ac2fe64a22d5811ca53ea22d7ade885b8a41382e6153d36
MD5 3bc9d6bdc1c102364263ca1f068b3a4c
SHA1 0f3945c68cc45cff48c4f6eebb4bd902dacbae25
SHA512 82745b9264fc1ca188bcc59a6049c83c744f4e459112e60e272a2b9064efd3a0e3f12b4617706e2323070f6ae8691bb44abc729bad31c9448ca65626d45d2de9
MD5 SHA1 SHA512

Submit Download

f_000001

Path C:\Users\Admin\AppData\Local\Temp\1b5jbvp4.v1s\Default\Cache\Cache_Data\f_000001
Size 34KB
SHA256 811a18fec242e7041315ccb1e4ad494e1137a6622d796fc9cb985334b6a70ad7
MD5 46995ff28fd9802bf787f607bb4c91e2
SHA1 f4b18249c16377e00ff24669f23f0bfc3f7e6f9e
SHA512 7bc1f83b1d464e32177c2112e325dbb4819d4b5b1bf100364c9fd741a7148840b68cdccf96a45282f9a90e13ca5f0f20288edc8bd462181f4f09da14d568fefb
SSDEEP 768:eoBenkWV/R5n/uXqNi8gjbaWK0cyWGXfmzjp/JDR8dDRXPc86e:eoBekWV/zyqTgfaVkXfU/tgz6e
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000002

Path C:\Users\Admin\AppData\Local\Temp\1b5jbvp4.v1s\Default\Cache\Cache_Data\f_000002
Size 61KB
SHA256 9f2d4451492b9e373bdaf643dd45678bf2420bac5bb1addc798dca76c2910e8d
MD5 71be81bcc43e5381fd4871313d6ab422
SHA1 3f917d9c1a71eec28966eb39beb1af87a070a16d
SHA512 d2ef88823ec7eca66da76ee6865d78670a792c36d27e8180b76aba7bacf1e9762cc4f5ade33b970d6cc83ecf88ee39e33b0a7cf2c3de064aa381d7d4d5c38b70
SSDEEP 1536:IJO3C1jeZicKClcUN3SEnLfjpiwuy9OaaSI89m:IJK9GkSkfIwuy9z59m
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000003

Path C:\Users\Admin\AppData\Local\Temp\1b5jbvp4.v1s\Default\Cache\Cache_Data\f_000003
Size 100KB
SHA256 9e142b7136818f1b2472e077625dae0ee143cbd5999c8a1a0934d432c5d8dfd6
MD5 cbb4b8a233deffd59d05acf4b4d98dc5
SHA1 bad7e6c29b56562f4a092faacdcb48b30f730780
SHA512 df7de841aaac98b4ade9b98f4fb8502c9e8e91b8ab3e119bd864b441ba8e3f5479dfbc989be1a11f607f79fca54eeb01554a775a5c2b9ac22b5bf1d782d298d1
SSDEEP 1536:bUiYFU5toheabQc3JrD2lVbLyn4hJdR4sFNsUJzXvkBelF52qFKl25L9pV/6C0Q:OOoLtWVbLyn4AsFNsUJt52Q025ZpVyK
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000005

Path C:\Users\Admin\AppData\Local\Temp\1b5jbvp4.v1s\Default\Cache\Cache_Data\f_000005
Size 385KB
SHA256 8993cee600274b9949aad2ea196c6f9701499a58475ab8f77dcb4a259e3d67f9
MD5 cbe47b9ed46120cb3747dbca8cced6d8
SHA1 6999c67d7d0b6a58e23e35a521cba161abdf7f25
SHA512 67fdab51431aea27b1ac05784f081624b40d7aec5cb67707b466a9e5aca9f9981d59330c6fab5d23276aff786ee52e84cdc1d91e2f6f9cce5f67fc3099c45126
SSDEEP 12288:LaGMzX/5CFmWt9OTqeoX+u4Ad6cgJgCg2AwJY:Labv5eaq9+updC9AV
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00000a

Path C:\Users\Admin\AppData\Local\Temp\1b5jbvp4.v1s\Default\Cache\Cache_Data\f_00000a
Size 73KB
SHA256 e22faceff6271ed0f844d511153b098b9974849145b61a1df06a6b152bd12d73
MD5 b6459f9dfc6724f6ea1b974a05437d6e
SHA1 563ae2c3954ec085cd29005aff4f91d5c6be0026
SHA512 25ac6c666d967211fcce763d8c6feb8f64aa23ceb627616f60d3aa0800d656b12b904399ad968af06591cde888c8fe6a2b0c21c7f50d2310390ed5c8d581527e
SSDEEP 1536:AOuUq5g5z5ITuQyXhK/Vlz/c3gmEOYDYQUXxOXs+vAALNfg:AOzNIT1ysV9/mFRYtnwB
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00000b

Path C:\Users\Admin\AppData\Local\Temp\1b5jbvp4.v1s\Default\Cache\Cache_Data\f_00000b
Size 16KB
SHA256 acffb9eb5f0c32fe7ff7f4deded4e95d8719884ade577a68731012a746af78ac
MD5 e905bfc2309966e981e75615ef9d4db6
SHA1 4922e4114a97bb079de051a91b4452cb2addd955
SHA512 879d3c7a5d2fbda6ead03e5a24260680bd1a096881f47bf83470cbd4380ae4aed793f8dff15aa68394288ef6c10540b30d9df8c781bba56bb8c430e794186c78
SSDEEP 384:5EVLNCCvyZI+FPB+xfynJDyOFjuuSWo4fpuRwWj/n:+VLNr2PB+xfcrLqwWT
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00000c

Path C:\Users\Admin\AppData\Local\Temp\1b5jbvp4.v1s\Default\Cache\Cache_Data\f_00000c
Size 26KB
SHA256 e0c2009a1934b1a6c0bfcd67d2d55ca9661f008a8de92c819375ce543073e1c4
MD5 0deb78c510fc185f4d1f6d04198e3720
SHA1 b7edc6e4a6e98953fe2accd74ae73da46a1b9f90
SHA512 23693340b8252e601f0c9ebf7e8248688db1c5633f867ae84b24cb5af681af367c8b65d185a7427c85987918b9ab70a92f8335a6b549688c0cff0fbf694d70f1
SSDEEP 768:+QyI2ODfyV68zrN/LnkeW/L6gWcN0dzl7Xo:nPLyV6crRnkzthytlzo
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000011

Path C:\Users\Admin\AppData\Local\Temp\1b5jbvp4.v1s\Default\Cache\Cache_Data\f_000011
Size 17KB
SHA256 4672a98e8d677f63359dff993e6dd97e41d02c6e7f089ba3171591989ab468d1
MD5 6464050074ce447800d4641cb4af3948
SHA1 593cb680fe45accef5e578b47b851ba7e01c54da
SHA512 95691ab6cec47740c474898e14c3b20cd12edcdd03d0a538c3a4987e9e1614517c4973bfce806e054da9ed5591a25461ed5da70fb89efcae862f4ba782f36a18
SSDEEP 384:vguPixuNeXaFXhxyJ60ZmT7+kR4HIG7Lqu1ySVpAT:Io/NeqyJ1ZmT7+I1G7Lt8Up6
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000016

Path C:\Users\Admin\AppData\Local\Temp\1b5jbvp4.v1s\Default\Cache\Cache_Data\f_000016
Size 71KB
SHA256 edda796bcd1ec0cc732b89c47ae037ad32754c2c4a645f25f62de12ecc175acf
MD5 b7ffe3fba2a6eca6bf86c53b3e589413
SHA1 105203083d24f12d249391215419375c8c1e793c
SHA512 ce67f620d69e546e3f2ad4da2c7104c8140b3292ab305750ff29af7ad0dd9c5b69ba473f5f4fadd029664fd3624bd8a51931e8d051c569d89d81382699ed488d
SSDEEP 1536:6a3IT/dixUO3D0n5dDoyI3PUu24RDRcFoQ4qYOO1UnoK3+DkGFhazbKogP0QDOoK:6a3IMxUO3D+Msr4R2Fr44YUnoK3+DkGM
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000017

Path C:\Users\Admin\AppData\Local\Temp\1b5jbvp4.v1s\Default\Cache\Cache_Data\f_000017
Size 67KB
SHA256 500a81ce25d488d39536763686a4e3d6691164b067e69aca042232a5af3c1c13
MD5 b47b6c9304c4aa32259dfe0813eb2fe5
SHA1 b7e43cca3b38a52414a99c2490a1689832acd889
SHA512 101988be57b5edf19f80744dbad2a69eed05ec1684e623232605b26da1f73f4cd2960e7f65931783a2b970f2ec70d1c46a0840a6b4009aafa725c673f2cb691c
SSDEEP 1536:lyvbmQ7TmMm7qdklE2Sh6CL2jvHi63htMgutDqVZLTYRShc2:e6Q31m7qdkcsCLovHd3vMLtDqnYRSy2
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00001b

Path C:\Users\Admin\AppData\Local\Temp\1b5jbvp4.v1s\Default\Cache\Cache_Data\f_00001b
Size 18KB
SHA256 3b8808733ca9338ce537ee5a3e2d544624b52f76726d8d06b18518f5e0a2d370
MD5 6d4a8beeb49b1e93b4bd502a6e644758
SHA1 7b47c1fda78ec69bbcd361290396596bcca846ac
SHA512 fbd703ab84c86b0abeaaba1fa74553d2e240c9198d39b8b459f04535b0963db8e9bfbbd8b14e052dd5bcdc85114bca4bb95cb1574330637e3ac25f8079c65bbc
SSDEEP 384:k7Agkaj3QL5kz8Y39wXVCoMa/r75P1/ul0afXoyCJirgarHwnFK/MusbGb40ulyT:k7AKjzYYxFsnjKYLcrgu/Musb50u2
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00001d

Path C:\Users\Admin\AppData\Local\Temp\1b5jbvp4.v1s\Default\Cache\Cache_Data\f_00001d
Size 16KB
SHA256 9bdbad8cf1a6522f87435dc1d3cd4f32175382f18ba9350ff92d34799019d455
MD5 3e00ea8a3c999254ab6eb7979aacea62
SHA1 a51cc9a18484af58965cf25817ba7ccbae13f8e0
SHA512 facd2385607b957bb80b73ba0e5faf1c939aa30512378844c3e97dd3beb664eb6260f4b479f0839d58724a54315063370fa0be8821c1390c881a20e0289b8255
SSDEEP 384:qhNWb6VfaotTpsBR06HRxMlbX+oExREwJ6iVrYspCyaZZJzEJ3XfQpkh:qh4beCJBRxxMJAxREwJhBFpCPZfo/qkh
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000029

Path C:\Users\Admin\AppData\Local\Temp\1b5jbvp4.v1s\Default\Cache\Cache_Data\f_000029
Size 16KB
SHA256 b5c0954100318794dc982e3e9c40bbcd1043b40eb6f8815c2e143ffd267b12af
MD5 15f6a86c9e04a470003723b319e4c574
SHA1 57f4ba5be88f437ba59fa3aef54e3b817b82d800
SHA512 aeb652a0a190b616d1a9512072b5356cc1d3f8b1a32d91ef1a4a5fcfbd28b4481e715d1f7ee39db80fe60987d4207df41f32c426d77514793dccb24135886d7e
SSDEEP 384:mBnbtMrhv9T5PwLobLczIFV3AHI1c+WSS/fU:mNSrd9f3GOZArdSys
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00002b

Path C:\Users\Admin\AppData\Local\Temp\1b5jbvp4.v1s\Default\Cache\Cache_Data\f_00002b
Size 33KB
SHA256 e2a383825436fa84d442162cfa13a70d1727faa6f53febe6c1831d2289763312
MD5 e22eded8a7bbeece6660a8198f021625
SHA1 4a33ec9aef20eec3637e411f122609e066040d0b
SHA512 bed6e9d89e2976ddb5c2773b3c3c05144b3b1f769957f2cbe7155f64f36b761059b0ec0fd76324db8a5cbc45449bfe7368aaa22bd5cda989b0735a3ebfa0cf1a
SSDEEP 768:XldE1e6Qmy9YfoaUa7u5DaWBwFb5eBcWvK+23vERZqIj5TXa9Hc:VdE1eb9YfbUa7wDzwFb4WWvKH3vt45TN
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000033

Path C:\Users\Admin\AppData\Local\Temp\1b5jbvp4.v1s\Default\Cache\Cache_Data\f_000033
Size 37KB
SHA256 86c4d4d9d527fed5acacd7ac7cd60e2886dc73115919675c51a40306876a4f0b
MD5 975cd2ec13395403a717439615d18720
SHA1 817766e08655d13f77f01008474d036c5cb927ac
SHA512 2029ddd93bac08192b3dcbf699360b1a5db533d56ed8bca67e021d1203876755e280af104257a266d1feb0ea913df7b28fb47afaf1a839e8f34f8afc98ad4a14
SSDEEP 768:xfEBH9nh0owxbreEdXlQAtZnw4TDNE61+cxsI2X54pBEFziDaDdmMRanpBHGY:xMBdnhwxbTLZnwm5E6dxFg6mFzMWanzb
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000035

Path C:\Users\Admin\AppData\Local\Temp\1b5jbvp4.v1s\Default\Cache\Cache_Data\f_000035
Size 17KB
SHA256 285e439f0d5b3b23e648ee3ad01dc77cbd4275d0cd8eb59e939a92317fbc5b06
MD5 c6aab2a39a245dd4a34508a1f7f5ab88
SHA1 9f6f5ac535d832ce0b732c9335766e009216b6e4
SHA512 0778bbe7ccf92d42907e5ce2dad53e8e0e7f60f364d971fa708f5833a9c9073b3d557ce0364b01ee04109936a1ae690be01ff2937c0a16b5f3db739796733051
SSDEEP 384:Z0UJTbkCaBrUn6jNCGTx9swqJeEjPLBKCJ8i:Z0AbCCn6jQGrfIeEhz
MD5 SHA1 SHA512 SSDEEP

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Temp\1b5jbvp4.v1s\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 192B
SHA256 a8f4cef71043f72346ce9eda95718746f1957bbe94f62f5f7cd2ba9a742070f1
MD5 e2b3267eb89cc0475c79e8c1e8797b36
SHA1 be15da968dd3c40cbc8fc9e6b87d44c33a0306b0
SHA512 70b1cd8999c3e7576082901a62fdc63114fc097990df207f96803fe8bfce57c28aedf20586defc4341dc21b075bac2ce80639a3d70fec00a7774d6a83ab5bce2
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Temp\1b5jbvp4.v1s\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 257B
SHA256 11c190d00ff200a883f14ad9af2db1f6362159316d716887e97659539d503eea
MD5 df4e3c6cdb8964803c589765b3588c5e
SHA1 6cce0bc98e9bb4c226dd6935224e615a82c39a4f
SHA512 93d48aeaa25e287d32a7927b8b7d4ef744311b657ca2e28524095c4b1039e208d7ebb667694c17a9cda2613df1a9ac242b28d1c3df3d8308fc01d6e9f0b252c8
MD5 SHA1 SHA512

Submit Download

index.txt~RFe585f13.TMP

Path C:\Users\Admin\AppData\Local\Temp\1b5jbvp4.v1s\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt~RFe585f13.TMP
Size 119B
SHA256 2c8ed2f24ca807f37024256fb75148ea0f827baf8bb7afd31c09ed70c148dd0a
MD5 bdffc5f6fee369593bdbee71f65437ea
SHA1 71133de499703a0bbc1c64f6c2900abb48fe431c
SHA512 bf53c263087e3357409fdfbbe9b7cdd28f821c44dae699c7dabdeedd642185b74589723a94cc32038ed4eb52bf8195b135ec5d9aa258573865acaa7c68e67bda
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\1b5jbvp4.v1s\Local State
Size 3KB
SHA256 4cb8911023aaef5c2729358c9d3108a3fc9b0eeba0e6329a7228a0ac9a28d821
MD5 981a5f5fb6b9c02f07a238824390679a
SHA1 74e2f6e6e4e9cbc9e78dc83b7915506aaed796ab
SHA512 8484eab9097018dd2c3f310c2dee0b738f04ef2c353094ab06fbe9768f5879123f1d41e446853482cfbeb1a76a36ecd0b461edf25088fd8c3575b211efff21ad
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\1b5jbvp4.v1s\Local State
Size 4KB
SHA256 2178ca8b3a75bae47c19c3d83c087ab1f1f3a6b17f247a8fb270c5aef71ff8fd
MD5 5cd630368ea177cb3c5a4f9828e5430b
SHA1 9d19c3ec03970ab65ebda0c6f12d4123c8f64c34
SHA512 ce004344b7efd094a44ec896daca6707e11851871ed5270b27199591a0169be2a14550c8a3d7b09d258fab2f13933119ad3035fcdfd75e0727557ea0d0a46ecf
SSDEEP 96:VqGNkCufjy2vyx58Frh/cInURoDotov0oDrBkEvoO1lvfpJ3GJSDS4SYSuSDSDSv:sGNb0y2vTooDUwZVpdfvU
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State~RFe585242.TMP

Path C:\Users\Admin\AppData\Local\Temp\1b5jbvp4.v1s\Local State~RFe585242.TMP
Size 1KB
SHA256 991632fe9aaebf22fecc2348596536deee5a3d37056b3da207cda8465e007545
MD5 8c47241dab72510e5e422f4adafa8596
SHA1 2d12a45448c0beaad266091bc98428f4131fde74
SHA512 9c357fe62127efe24a799b5e4ff341f47db0b9616a84ca273681285713cdcce7fcc1dd58f12df3eeedbdff0eaf37addbaad515785b1c7a4d7184edb2093faf39
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\1bzlcnch.0fd\Crashpad\settings.dat
Size 280B
SHA256 765e6b0eb4693e56b88fbbf7836370309360e2d7cef7449272837872af2618ba
MD5 8670325b02d26f0cc796f3173c4c959e
SHA1 7d91de6cac1bc38b57af67e5e700db9bffc928c8
SHA512 32037381355242ceaaeb3789177b64c997599886bb45640a22c6a42ff241fa90ba493fa39b66f8373b3978fd3dc815979f67b1ce0489c88974349822a808e018
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Temp\1bzlcnch.0fd\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 257B
SHA256 e13513e181230bc115934a76ffa7016d5f228adb1cf5c88cd08df48bcc542cbc
MD5 b2e748fb75dac4a47e67957d3fdb395f
SHA1 b1f76254b7ad1a0c4d2a1c90090567c8ddc0dec6
SHA512 e117a6ed0bd89cead30a52ca0ad5bd835adadeb13fdd18ccb46aadef97bef4cddb62d5f71fd0d95f9382cdb1b565083741eadd07765b35877c4d152de018eb30
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Temp\1bzlcnch.0fd\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 192B
SHA256 03ff9712339522858df97c18dfe6bc07f2b59c433350a63ea6ffd89518493af2
MD5 2c6cf64fad8df1d4ee6d3a9c7e5e91b5
SHA1 75b972d57d83c9182119d75d274ba3d3909b343a
SHA512 17638223c9e472b1b3048636e2e2690438d6ece88f797b16582b4e2388c5b8ee390e3c720c771abaeccaff690a286aa8aa28e2d6965fed4c71fe78cf59202740
MD5 SHA1 SHA512

Submit Download

index.txt~RFe583dee.TMP

Path C:\Users\Admin\AppData\Local\Temp\1bzlcnch.0fd\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt~RFe583dee.TMP
Size 119B
SHA256 1292203d929f9b9a34452783a3491713a0af1e76125c1a457857ca769a22c4cd
MD5 2a058e072f9ed6e555b6e22cac229c23
SHA1 38598341cdf1777e0c579cb110001b66d7a511c3
SHA512 e60799e0bd4250eacf3a1603bb57164c6793c12c4ca38f0e70dddc8102320864246ce3aa7461da2db6c238aa8cec6a24ebd2a1361e477738ab98d332e8e1f766
MD5 SHA1 SHA512

Submit Download

dffe84b8-aa3c-4bd0-b580-c0e11d7e60c3.tmp

Path C:\Users\Admin\AppData\Local\Temp\1bzlcnch.0fd\Default\dffe84b8-aa3c-4bd0-b580-c0e11d7e60c3.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\1bzlcnch.0fd\Local State
Size 3KB
SHA256 4d7cf19316e3746cbc629328e1cdbeab4cc4cf58d44dcf6029618918f74fb0a9
MD5 851896c95ea2836099f66f8d5fe26770
SHA1 934af1de626d9d3e0d3e84aea074a0eaf14e14c3
SHA512 6b594b2a1ffe3312287e592ae5fda6f2509c2b531eb2568150d113b1883da297b610c1ca44edf92871652738ed4a569e395f34f14431200aeb52b7906f6e0578
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\1bzlcnch.0fd\Local State
Size 4KB
SHA256 8352df03687703d39d2c6185e3acb73adab640b0dee6365b6dd1b350acf30893
MD5 567409b33cbf8f3c723a34251921f53a
SHA1 1e43dfc5dc9a66655b29fafb7dd428c0a6cb9afd
SHA512 e60600021bcfa35d762d33bb2dc580e869bc2e991b89f071a0d77277b8d3a5c09e1ece1bdede5344454f85357725905830070bd030eee90ac2359e8095e2478b
SSDEEP 96:vqGNkCufjGRJf58Frh/cInURoDotovWQD8BwPKmvQtLLYJ37JSDS4SYSuSDSDSqT:yGNb0GRUooDUwFQiKNLL42T
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State~RFe583227.TMP

Path C:\Users\Admin\AppData\Local\Temp\1bzlcnch.0fd\Local State~RFe583227.TMP
Size 1KB
SHA256 83147bed3ccd35c74bdc27e81f415083d3af85bba42bd9a3f8ff94978c6be411
MD5 3f19a9dc2531486cf3dd090f374be33f
SHA1 43be4a93aefd608fd7432c202eac010c3f33fb50
SHA512 e62e6f57cccaaeed8421f875e9c6b74ab25d97e414c299e9a08a9cc5a66be8f3b5e3831faa34af21063559f80b188699e390372630b7d982ac4eca741c7081dc
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_ypokt104.p55.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ypokt104.p55.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\bxejnikr.ahw\Crashpad\settings.dat
Size 40B
SHA256 b9b960d5025ad849463b5276b38ce9bdaaf97b763a877f7907fdb40d6a680c65
MD5 dc885db5b7323650c6b9ffa97277a752
SHA1 0ceb4488d34bd1fde63c25e6bc252066acbdfbcb
SHA512 8a8fec72911687ac67120765da7226860c5309dfb34067b88e9fd3c537a523969e9a45364a391fa0a7679d6b8e7f7ff7de7a08d727ff2bc101010a82e1050668
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Temp\bxejnikr.ahw\Default\BrowsingTopicsState
Size 414B
SHA256 80db08faa07b67e50b12db3ab04edf4c1241d468bb1ed46b958eed83c9b3d1e8
MD5 b0bdb74d0a7e1d0b65be95c7e3a60a7e
SHA1 9044a3b5c470e48035a9a8d4757acbff46975d1a
SHA512 3f53ecd92cb8f16b31b31eaa03e33fffbe15e412c75d4bca38e314d86a0653f054bd0232b508d9e8ccb7e8bb4b140a24caa3635b8a0923d3b80bcc47fbd8afb5
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\bxejnikr.ahw\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 1099ec4404d857a36ef9e5d84ef46c77f98eb9e82734434a625e9ac8aab40690
MD5 7d7b4a899f8eb4c9c7a3d33c503d4728
SHA1 1aa161ce149b0b37485104a010d38aa412666d6f
SHA512 d501d21e5309d537f654a82e30a80e6d55750d6152a65a0d0c9113b249903e5c5470b183338125a83eb75c44da57645395654d0a21714ff59bc41c65e4d238e6
SSDEEP 6:/FoEXEc6u62NaaxQys3YGkm7+t5MjtS2MDEK1FM6LfVRZp/:d7X/731zRt5oRsjbLfVRZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\bxejnikr.ahw\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 3f72749f88ba84a19ab3df96fd752b0d1c547bd9e737cf6bf295cc2de7e7f9dc
MD5 db227c75853f141a34eac23bc0a80be7
SHA1 d073cb09e6f113dd6063697ab66cb24275d7f493
SHA512 ebe7d5ba55ce83419821cb4291622a1e54413c7c2ca94e67034bcee00eeb552bc4d76e9b0b08fbdff579ab75e3635fa341afd98842ceccc84c22f304b2587945
SSDEEP 48:MYgMCXg0BMiXGRGxoyCqS8aBCy18aT3jW0PU:Zg/gcD6PDqSCyCaT3C0PU
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\bxejnikr.ahw\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 9809ca6fcec6a6699a6ce82913198870e36798e30cb5d3504bf66b4dfb1fa5f7
MD5 661767d436e120b0551d71bd721247b5
SHA1 d1706e9b5123e6d72c1c4e8f13003d3b8390706d
SHA512 2a3a4bc034fda8335e1431245732e791e18db8988e32087b797c4aa7cd669002918f124d3fd60e8d3ad1d8c1d2b8bbee7e30a1dbef5098c9e776c345cca2aaa2
SSDEEP 24:WTqkGCDOj2NIRqBXQ8XloJc0C/PuhPgg1eA3uRxbagzu3XOJmlOji2:NkGaGZRqRdoJVCehPgBADHHEmlYV
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\bxejnikr.ahw\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 7bdba733b967060b89ec2b60a543f128073a57321b1df43304ffe74246b6d9f5
MD5 c270b6b3c56efacd6891912e72f753bb
SHA1 c824c8c4c4256a33f02decedc597f29a18086882
SHA512 424326faeb9a652b4bfedca2eb2bbb8101e47f78e028d644007aade4100000e69d81c8ae4e3b29d4bbd86c4bb35ff2f284b23dfbd16a5b17c17b02748fe73409
SSDEEP 768:SUfDPLSgcRUv+nv4efDPLSgcRUv+wv4/UfDPLSgcRUv+Rv4zhR4L4S4+4:AD6aDanD
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000001

Path C:\Users\Admin\AppData\Local\Temp\bxejnikr.ahw\Default\Cache\Cache_Data\f_000001
Size 35KB
SHA256 280d9d493d563d9c67deaa312ac2110b2934ab57b4aec075eeb8358ae3582410
MD5 694f9fbcdf610fd22390209697761c7b
SHA1 50ccce76e3f940491597152a70f2bbe2623656a9
SHA512 f85add9738fc2713c93d7bbcc4d6afbe31292bdd2ad6ecaf3c5fd79a0ba12154ec21cf79fa349be21017d1f2d5d4e171a7c459d04bf1b54ddaf22788f9d8dfb1
SSDEEP 768:VaxMz0f5TC/uWUabgCk7efG+4DTTXRiNtxNONm9p9wOKn:0UoraMCkKfUPTRqtvOGpSO2
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000002

Path C:\Users\Admin\AppData\Local\Temp\bxejnikr.ahw\Default\Cache\Cache_Data\f_000002
Size 68KB
SHA256 b0f592feb5003c94afb3480a2bdd50bd75b94138cb8ef900e263814391dd13a6
MD5 a532bb44c3f6bbd0ac7683e6865987f2
SHA1 7a30af4811ace68d5c3a8a96ba7194e7d9198fda
SHA512 17d2d19c9f748ce63b234442cbb26714cc42df64a9bbf1077cd10606df4373deba77a61ea2cc9adecb7d10f61dca524d21b656d6366382501ff1fb902cb77b73
SSDEEP 1536:IigmpgVcOkQZyClVrA2HkjRgD3YCORtiPjCiIV7gzQAGFglpfyiHrOv:Ii6FzyClh5kaxOriPAKNGFSy2A
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000003

Path C:\Users\Admin\AppData\Local\Temp\bxejnikr.ahw\Default\Cache\Cache_Data\f_000003
Size 38KB
SHA256 f99a6b6717561db657211f562e189cf471a9426f0875f5035f63afb1c6531adc
MD5 26c62557592d44aa716f9fee42cede1c
SHA1 c65c197971b8e77a234a8157bab57b05880ba0ab
SHA512 62d5dc34194815dcbb91db2cc58f35dcc17e472e249b123bff6a38d5228d1f6f3ae055d4a1f288830f40063206b48f0f1ddcdb2554ed94e077a6b3097e2d6e63
SSDEEP 768:2kbRpyla+GtuF8ZgN0vFNosQoKiwpo84pqaOI8idbk/KEEz+C5U4z:5bRaa+GtuFh6FNdKiso84ROeTRaC+4z
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\bxejnikr.ahw\Default\Cache\Cache_Data\index
Size 256KB
SHA256 6e60eec18da130039f5dd80b4b892e10c0f77249238045661bbd88c2e4696ae5
MD5 9bb0e96005101f89df0a0abe1ff6650a
SHA1 b3c85a3f7d8d5fe50d296b02893f68e5ddc6af27
SHA512 f0c580adad52c2cc00e1100d30422a0b00cfb102aa77f4147170438f66a9b5a0b0291544665993c5a38c36dbd3846b4a04d685d9ebd9c4a4ae3050d383763266
SSDEEP 3:LsLllNlNllklkXljuhnlltSllx/nWE/t/AlDlL/dlXlmNtl:LsRt3lPyhlGKElm0N
MD5 SHA1 SHA512 SSDEEP

Submit Download

7018b8cf1c3b00c7_0

Path C:\Users\Admin\AppData\Local\Temp\bxejnikr.ahw\Default\Code Cache\js\7018b8cf1c3b00c7_0
Size 306B
SHA256 df79159b33f6e3896da894c147e8d5db75716ec9de89584f5e8ce1e5d53a0a00
MD5 3e77ba44b3676320fb565f93ff475ed9
SHA1 6832b0a9ee2005ae50f52232434c2bd5f3e57f5b
SHA512 737849c0c3834d9ea5089bb58d39c49c0b04c3a21c9d7ace132061b48ff9e2984c2736e664f858b2ff870944b0da242bce0466b8636e232732482ba5ea2ca536
MD5 SHA1 SHA512

Submit Download

ba678a2fbd8c358c_0

Path C:\Users\Admin\AppData\Local\Temp\bxejnikr.ahw\Default\Code Cache\js\ba678a2fbd8c358c_0
Size 298B
SHA256 dcb475968edbc654dbb101893a401c2fe818191db388313c25511337b4fa7ef4
MD5 9ee6efbcbf2a65054a9196301c487a4a
SHA1 4e5ff5c56791c80cb8b4fe11aca6705f6e6f66ec
SHA512 b23c50b868463a54de9bcd6b1db8ed5ad3c412677ea7d6caa83b7fe41da01d6e1cc4642b102682ae819dbda930eb69ca6d8530ec1b3f71c9d6f56817d3df4e4c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\bxejnikr.ahw\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 6fbe95ba640bb22b230fe1490c75ef966dce1279b440b23e9ef4f1b5b4dfbff3
MD5 0fe76cfc4a221740b466ea42aa14499e
SHA1 3451429d1894e973bb9f60ba70e91adc57132d64
SHA512 db4c19b0e4ef3a2ed09c22b126d75d919bd11ff408a718bc414c5699b882699204c7caba73e178cb85df9e44b623791b1b8f9db27a4d27463b9da39a13e2ad71
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\bxejnikr.ahw\Default\Code Cache\wasm\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\bxejnikr.ahw\Default\Code Cache\wasm\index-dir\the-real-index
Size 48B
SHA256 7421f70a21557a3e969219f937ff5c0015b7ec4fff35d55ba797f4709f0203e0
MD5 3da2673411ba12a031e80276389e24ca
SHA1 801189327987411e5ef31ad029cff8a61c1b6737
SHA512 57e97041410f56be356e6508f0c76b464fb197a44d47eb83e2cb2fecf212e84e260529bcbe5e2b7cd3b39250b72bba0cfe9c4d683a42456710f839a69db51db7
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\bxejnikr.ahw\Default\DawnGraphiteCache\index
Size 256KB
SHA256 10bbc4a084e507b4304ba986ff322161e3e1a4e9d90a0cedbbcab9b2ebd963ea
MD5 f4260ded5b6686f02624fa7abc14fefe
SHA1 8dfa3ef4baed2c2b94d73821679176f69e505fcb
SHA512 d3073b6ddcb0e4fc84bc7d153567e1bfbee3d19b87871231e6e415253595505b7c72d6f0e41b1356e8c57d001d012106143cc0b18d3e3adf64c4a027fe60f997
SSDEEP 3:LstlNllklkXlSm:LsX3lPS
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\bxejnikr.ahw\Default\DawnWebGPUCache\index
Size 256KB
SHA256 6783eeaee85cd507b7eea7d61dd835edd99c046398afd91643d5542b46e273b7
MD5 a102f689950705df5f13dfe148b04f80
SHA1 0c1d927f125f09695eafe6ffac763782b1bf8c33
SHA512 a195c2d467922ca4f2b051e0e8e39445d6daed685ec1662cc61f8ceb3f92e5b9c0a25a3d259048cc12bdfeb491c490adbab68cf3b30451aae6aa00d8b96f66b7
SSDEEP 3:LstlNllklkXlc:LsX3lP
MD5 SHA1 SHA512 SSDEEP

Submit Download

128.png

Path C:\Users\Admin\AppData\Local\Temp\bxejnikr.ahw\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.97.1_0\128.png
Size 4KB
SHA256 75da533888189d13fc340d40637b9fc07a3f732e3fcf33ec300f4c7268790a62
MD5 35696aba596d5b8619a558dd05b4ad40
SHA1 7ecc1dad332847b08c889cb35dda9d4bae85dea8
SHA512 c32f20865f736b772844aaa44572369e7ae85b9f2f17f87d61694acc54487309a32bc4830ed8d9cee8b593babecf728c1ea33c2b9588649be0e4f1e6ed7ee753
SSDEEP 96:BCspUuBfy1PI2JIwOKpGzJhvw3ymK198EfeCW74mWQz3Z+1nl03Vjkq:BCsfly5TeFKpGFy3ymK1+oK4zQ1+Q6q
MD5 SHA1 SHA512 SSDEEP

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Temp\bxejnikr.ahw\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.97.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Temp\bxejnikr.ahw\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.97.1_0\manifest.json
Size 2KB
SHA256 ef67877af40d32f48d45e0fc44245f191e795b64ead8f4b87664ab80d0ca36a7
MD5 580173b7de156e29884d4f57a66ec07b
SHA1 9f08b09fb87b9db088c0de9c1af37fcee1dc94d8
SHA512 fc1d083171f4b25de0d4daa432ddde852bc160aa9fcdd7668438faabf14dfc75f2854a4936aea9990b3e487017f2f2d41a188e915a1063055b67456c859a9e1b
MD5 SHA1 SHA512

Submit Download

offscreendocument.html

Path C:\Users\Admin\AppData\Local\Temp\bxejnikr.ahw\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.97.1_0\offscreendocument.html
Size 97B
SHA256 b9fa2d52a4ffabb438b56184131b893b04655b01f336066415d4fe839efe64e7
MD5 b747b5922a0bc74bbf0a9bc59df7685f
SHA1 7bf124b0be8ee2cfcd2506c1c6ffc74d1650108c
SHA512 7567761be4054fcb31885e16d119cd4e419a423ffb83c3b3ed80bfbf64e78a73c2e97aae4e24ab25486cd1e43877842db0836db58fbfbcef495bc53f9b2a20ec
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\bxejnikr.ahw\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\bxejnikr.ahw\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\bxejnikr.ahw\Default\Sync Data\LevelDB\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

32.png

Path C:\Users\Admin\AppData\Local\Temp\bxejnikr.ahw\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\32.png
Size 1KB
SHA256 708b95af160bcdc6a17ca93f9b91158944cea75b743b4049a6e6ea299f8c7abf
MD5 a06bc120408cb7209f3ff0ba4b39d01a
SHA1 7b1df3b761840e87b484603da69837ec705cc082
SHA512 a3869426f4c5af3c225076454b2de0bb0f923eceba687ef7a82ae27b5384c90d03f1e6c1d50efdf8a1e51c1c7ab28ec4742fabe1cf75ef346a31f8037714c1f7
MD5 SHA1 SHA512

Submit Download

48.png

Path C:\Users\Admin\AppData\Local\Temp\bxejnikr.ahw\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\48.png
Size 2KB
SHA256 9962fe7bd4e81a0dc05e150a0a602db40bdd7dbff114f16adb712b8b749e1898
MD5 eae9011cbfb45db3e8a6a5f5d4f45554
SHA1 6a45d862f6d6658e14a4c925f5a3e25baab6c875
SHA512 cee11d79da34f767e1aff3771847b8008c0424825102decde2d0d51ea33f9a03262bdabd3938c5948bea95a4fdd46217cb81c1669ff5629e348265a40e30f9c4
MD5 SHA1 SHA512

Submit Download

64.png

Path C:\Users\Admin\AppData\Local\Temp\bxejnikr.ahw\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\64.png
Size 3KB
SHA256 4e0c7afe519c86da175dae1f069379a40694ae49391fdc3c7ccdf5c396e78ade
MD5 3c4bbde0c0ec7a7694b78ca833e41ba8
SHA1 e4afa932cecf06e03f59c9b6041ee723e10fcb2d
SHA512 523777c57a8c4d49faed221cbfea7dd589f9c576d2bb9386c6d84e47f5b30762a3012bbd702ea3c51b3f71c48e403b40b297928b94ce36e1a873047d27313006
MD5 SHA1 SHA512

Submit Download

32.png

Path C:\Users\Admin\AppData\Local\Temp\bxejnikr.ahw\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\32.png
Size 1KB
SHA256 3197a2ac164c5bacb65f02fd9a6eb9c0a533fdf3b24f43043bbe9af65ed6608a
MD5 60953b3aca67505c2c7ea1a902e84d51
SHA1 5e6a8e04a96e36306c66409edd4775a606f13f54
SHA512 2e65ec84471c3f703617171aa32f1a0d6c57d73e1d5c074b92d20d580df78e7ac4eef5ce54ab7defd0027bb38e33c44a6602d3e123a2fd310e514af0f5b38086
MD5 SHA1 SHA512

Submit Download

48.png

Path C:\Users\Admin\AppData\Local\Temp\bxejnikr.ahw\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\48.png
Size 2KB
SHA256 9bdfc3aa03d4e41b0d83862ce02f9fe7fdb55a492280d86d551b91a24efd47ca
MD5 1625c1dd7bab831d8ab5308a1a71d525
SHA1 f1c145985a7c8c18891caaba0f46729bcbd1f63b
SHA512 75079bcb02482abd10b121d81fe39607dcac17bb3107ca274c549b570bb473260dfdbdd13df769b1745425ac5433a22fd392a2a1d815897e0c2091b787bada8e
MD5 SHA1 SHA512

Submit Download

64.png

Path C:\Users\Admin\AppData\Local\Temp\bxejnikr.ahw\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\64.png
Size 2KB
SHA256 57d5cd9fa59f944ffc78ec2a12633a79e2f923124fc50676ffbecaef5021b4a9
MD5 e6671b804d6013a6706ea598e2d854c5
SHA1 40e4f401fe4afbf7bda49a02fe94f5308868460e
SHA512 7b11a47497ae5810ec4c7038ebf8358f03d79126886feb6daffd92d116fd606f530ecced9c3d635c0f57b9f9eb80ed9e8fa4eb98b029f9fd798d9b89ccd279a8
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\bxejnikr.ahw\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\bxejnikr.ahw\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\bxejnikr.ahw\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\bxejnikr.ahw\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

ef7c1c14-3f6d-4438-bd94-d3dc3008d16d.tmp

Path C:\Users\Admin\AppData\Local\Temp\ef7c1c14-3f6d-4438-bd94-d3dc3008d16d.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Action Predictor

Path C:\Users\Admin\AppData\Local\Temp\lproyise.gvh\Default\Network Action Predictor
Size 4KB
SHA256 8c471cab38a1696289186d01b06ff6af2a888852dc18d6fb8d2a0e54898104ed
MD5 d25d5e1dc1d93430e64ee17e48ce442e
SHA1 d5c7ca9a57e6cc68927a249fe8e601d52680ac7a
SHA512 f4cff7510b4ad81090e0b1842652f8eb7995f7aefd0ce651151bc24ca3a4305d34ecae41cf193d9b846e8f6359ccf545e5d05e63e6e766fa9761ccebce620f6c
MD5 SHA1 SHA512

Submit Download

Trust Tokens

Path C:\Users\Admin\AppData\Local\Temp\lproyise.gvh\Default\Network\Trust Tokens
Size 36KB
SHA256 19e1e0d60dc0a70455014fec98b5e4b73e93a80651600368745ab0d4a49c9529
MD5 4203aba60fd9de5b4232fc624db3f817
SHA1 1f07dfc552d6b509c83c36cb05986007ce29e250
SHA512 6240f8ef505e093f0ea99306adfa90969b3de094cde08b61076bd2c737763c0815108f532ec17e766fe15f9b1bcb9d82096f799ef04d50c3ce2305d8247bfeb1
SSDEEP 24:TL33lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:TL31DtX5nDOvyKDhU1cSB
MD5 SHA1 SHA512 SSDEEP

Submit Download

128.png

Path C:\Users\Admin\AppData\Local\Temp\lproyise.gvh\Default\Web Applications\Temp\scoped_dir936_1150676918\Icons\128.png
Size 5KB
SHA256 99b19cf47ea4e47b933229e92b87a474fbd5af7936bdf885c2240d0e6f4bdaaa
MD5 6a371e7bbf132a71f031772845249b9c
SHA1 36f499f3a2e2bf885019d914a0cc6e8b3e035a79
SHA512 b1fdcd5af84fa476808b8e89794d9df9f8e48b3e7c1a2239deae10832834d01bf311803ac95b3774d781be791b47389310ca866e1a6b497925ca6e2f004555a6
SSDEEP 96:n0NgAMSinf795k4ITgiEAyaD39SOOcqS+e60qq/zsB:n0Ngpf795k4CwG9ST3S0wzsB
MD5 SHA1 SHA512 SSDEEP

Submit Download

192.png

Path C:\Users\Admin\AppData\Local\Temp\lproyise.gvh\Default\Web Applications\Temp\scoped_dir936_1150676918\Icons\192.png
Size 2KB
SHA256 9cfd1ad226821af533499bd832a5674df52a720b19e054580a2b999e19dd7b1a
MD5 22ba8844019e231a435903176a618bf5
SHA1 0ce576800f66bc2145c8df72b9efbe0c7431aff8
SHA512 2e754fce3268dac2f8f9261f4d4337a7990a990121327c9d491f27fba5c4680968c7589bfa0d04082410f975cda97c46912ba8e1c39f8a6da15cb32c02929cfa
MD5 SHA1 SHA512

Submit Download

256.png

Path C:\Users\Admin\AppData\Local\Temp\lproyise.gvh\Default\Web Applications\Temp\scoped_dir936_1150676918\Icons\256.png
Size 11KB
SHA256 f64a3d1e393f9a114632d22bc8a01b328895127ff1796e2c3d18b206622fab1c
MD5 024859c892ef6882e8a3e1be4675d23c
SHA1 30ba3b6255e2514b9782ee29f6b8b55ed350a29e
SHA512 58caafadba7cda1db596f5a3c2f94fd3a167cbc21ad98387820ebd808a52eff0e23a5a8292b34a8e284aec4bf2573998ca62f0effb5b647af1bee96ded8bb384
SSDEEP 192:F4aCtq9F5vnIb8/0yNBlV28QNP716enZiP3dGu5yIs9gGDyIMWQo2BkL6O1sSO:Veq9vvPdBrQNL8PNoIsPGYwBO1sP
MD5 SHA1 SHA512 SSDEEP

Submit Download

96.png

Path C:\Users\Admin\AppData\Local\Temp\lproyise.gvh\Default\Web Applications\Temp\scoped_dir936_1150676918\Icons\96.png
Size 3KB
SHA256 6c5f0e1efa0cf592b01bc20be9c3f348a4285e4604e555216c064b64a05961c0
MD5 7b0532144ec2ce1915a3707ec9084aab
SHA1 81cab7df8538d1f757a3e58318716a9a1ed08d5a
SHA512 aefca0ca127e2b91a5c7206b8103b2afd977258643c12e972a292522152964da1beceaaba0b8f4f40e85e705bb9c9e5826ba49eb2d9b925dc07964096863dcaf
MD5 SHA1 SHA512

Submit Download

94eac8fc-37e0-452d-b649-6f05e5c41f86.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3484_600534855\94eac8fc-37e0-452d-b649-6f05e5c41f86.tmp
Size 154KB
SHA256 a468f5875b4e55ea732e3df283b4f4ea941be738b238122979ca5d8006a3a8fe
MD5 4ad81f6ccc657d1da582c75c5db037cb
SHA1 ab0370e7d32ebed71fe9787d3a4a2fc0c652a28e
SHA512 66461474f8b36d6d470797df9d4a3cc4698bceb7054c97166eed98b74def84f58486fdb909928aaeafee793799a436210b5d7091acce6232b23eb6ba926ad227
SSDEEP 3072:OqeD5sKZ7XcbMSqnDhcfXE0IfnpWpyKIrFn2wNkR7aUPuWm6u:yD5sIXcYSqDGc0kkpIZ2weeX6u
MD5 SHA1 SHA512 SSDEEP

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4592_2053177727\CRX_INSTALL\_locales\en_CA\messages.json
Size 711B
SHA256 2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
MD5 558659936250e03cc14b60ebf648aa09
SHA1 32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825
SHA512 1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4592_2053177727\CRX_INSTALL\manifest.json
Size 1KB
SHA256 f04b41a409ec4bf2f539b6f5334c36b0b14b8bf99746e0386980e4e12202dee8
MD5 3e85528d9e5a25bed8020634a653d296
SHA1 e63ee52c7e4c37559d1ece52216382af67894c01
SHA512 9916c110bb90ed25de689b7981472375b00574ff46b17f9c628501434e4bcf298f6eb5f8c01cf2ce0e12ca068b2f1796eefe676c2a76fbfb42283a41a54bb51d
MD5 SHA1 SHA512

Submit Download

tmpE36B.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmpE36B.tmp
Size 1KB
SHA256 40a4b0a5fdea14c66a2b242012cf6f17d605ab6ed66fc851ccaafdcb42254f4f
MD5 cf921b54572fe07035a16bd3cad09872
SHA1 9ff57fec6b3391597fd57f36d98f170d3d94ed0b
SHA512 3b5eec665d68379e61d8b3ca810792f077df53f0a2ec4dae563b96b5168158efcb9ce389e06b0f83d60eb409979882aebd8e22f3e3efddafae398f9a31d0705a
MD5 SHA1 SHA512

Submit Download

ccba5a5986c77e43.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Size 4KB
SHA256 9cd58d97376ae880d459e4165c0959f9d775fccbfcc6afdd90bc74afc29fc8ef
MD5 c6bd25abbffba03e86b44c3a2cb3c157
SHA1 cf38ce083daea7f231815ffa1e1939b5e6d27312
SHA512 701377f260ad94f956fda02cec3ffa6b4073f1480ff5372883b1d9427d7f497a116caf2fdc1ecb1c89799453a293cc30ca0b49ca421b6826c525665a87cfa275
SSDEEP 48:FlYzdOhGO5FpJ9zUoYadLXuHZpxlYzdOhGO5FpJ9zvYPgdLXuHw2g:LFrJUoru51FrJvwIuY
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1tjvljcf.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 c320d1d60f847544f9f12a26de36be7245e0756cfb05f72b27bf14e8570d4d25
MD5 d95d96b4443a4724313e418f4527ed59
SHA1 4d1288ac6d8bbea1de8eef8d2bbbc904e4742649
SHA512 1ae2c23d6634f8294fd11e72d66d5a3851d4bd1a1ce79cb052c680522eb5081fa09375a3fc08ae4317c0f4268061b1fef49fcb5217385bc904d5c0e3e34fe8b3
SSDEEP 192:y1/66Joz0dzgCl6mSSdtOv5zboobDAyjwc:8/66JozQzgC1bwboobDAyj
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1tjvljcf.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 55b22c4a56d70b4b25e20006d805181aafc436c950279f5e229632324ff16a5e
MD5 44b873883a328364250f1a84f4f6b3bb
SHA1 ec2b6828e03b56f8c86d469224cfdb5d1c0a20df
SHA512 4f04a8c15660a01e4bdc856fff8e06b2ec42dce74ee054e73a92ec91544434e5b5ef4f2746d92c64e57c416c82bb1e1f529d4108fdb28f79bb7ad14f2978bb60
SSDEEP 192:DOv5zboH0ZDAyjwcSX1/66Joz0dzgCl6mSSd:MboUZDAyjUl/66JozQzgC1b
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1tjvljcf.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 db2a5ec5f52e289ae50ba6059a1258609094db33d285ed92fa82da2573d621ad
MD5 0e3075fde41e22a70a808018fb87003e
SHA1 c97047b134665f1698854f5db5c25e811d5e4aa2
SHA512 51ae05d51cbb878e11e3e8f65c760fe90e71f032d386a6918203dd0308af13b345d0b99c9c2bb060963b0a809a37903784bc1f56412d52da7ebbb15663e5f083
SSDEEP 192:KOv5zboHXZDAyjwcde1/66Joz0dzgCl6mSSdz:pbo3ZDAyj74/66JozQzgC1bd
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1tjvljcf.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 987c94958031ee63693def08c0ba7bc88a51d6d3b1ebeec37f2b7e96c04df12c
MD5 d4e6088dd5fa7885b3f9a354828e33fb
SHA1 fb8b5a7618fda98ce4cfa6805ab5075c33fb265c
SHA512 0d8c742efa874c1c61abe5ff64e9b2eb3c2d4e3d7969c6696942c0bd1b08d7114875f39120ecd5ad214583e29cb05657a6714331446bff71ce7b066f329f31f2
SSDEEP 192:JOv5zboebDAyjwcd31/66Joz0dzgCl6mSSd:GboebDAyj7F/66JozQzgC1b
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1tjvljcf.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 25c3c481b06c17efedd49aadba80e09b584589d27cf25ea337e07e45775a92db
MD5 20a37d8e3cb276e36da389357aa05d99
SHA1 590926fca8233082947a85882b7c6498ebf1369d
SHA512 98de62114659f1d2beda691f2476b676f3fcb43a9b1a106f859549050e7025ba5624db3b4b30b1fd1bbc1c2f4da078472b85a7830de71fe35970f4c145fbf99e
SSDEEP 192:/81/66Joz0dzgCl6mSSdVOv5zboHXZDAyjwcU:/m/66JozQzgC1bkbo3ZDAyje
MD5 SHA1 SHA512 SSDEEP

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1tjvljcf.default-release\datareporting\glean\events\events
Size 1KB
SHA256 b9c23e4b93ee43d01cc239ddbf019489026d07b432145df3189fb2cb41a5629e
MD5 2756c219747928c3a136eab88b950404
SHA1 46042c8a5930bf5026d96ab92669bb0010df148c
SHA512 28abd035e887dbce85ec5f45b5900c7ecfcd9e476d13476c8beba7b8b7bdc3d4a544b9ff296042b5f7d450473b4d5dfcb56d75f920d2335a41e3cd3e70cdf87d
MD5 SHA1 SHA512

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1tjvljcf.default-release\datareporting\glean\events\events
Size 1KB
SHA256 bdf43c78279b53d7e1f454096b8e18cc4c773ecfa4dc207296713f93dd3a8bdb
MD5 89239e9350354fc07487dcfbf16f9b82
SHA1 0a49999297f622c02652e6febf4582c386ae7ed0
SHA512 561bb502e1c76b3583ab01d1c9005d8c202c1dc6226686731fa36829d0c3d656ea4bb185785211fbec8f6c391af7163ac00174f0681d17bf730c6876ba8d8bef
MD5 SHA1 SHA512

Submit Download

1617175a-20c8-45a0-85de-03d5f92b90d8

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1tjvljcf.default-release\datareporting\glean\pending_pings\1617175a-20c8-45a0-85de-03d5f92b90d8
Size 235B
SHA256 a65cd0c2489b6cece52ce40f5246516e4d27cc0f841cb66b1eea4d8692b84d98
MD5 8626f58fbcafdf78f3d40ff4f5b7e643
SHA1 5132bd4528e52a8d1e99bf34873588194c8c0f50
SHA512 f8a6fb571bda5229bbf5e125969d88b715ba0bd7722504c107b30c82342385d6cb39d3981c61d80234cd8d117a00d80c3eadb84edbc7350acd0fa22ae696955e
MD5 SHA1 SHA512

Submit Download

199134bf-1364-43f5-8eac-9d0f242a16dc

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1tjvljcf.default-release\datareporting\glean\pending_pings\199134bf-1364-43f5-8eac-9d0f242a16dc
Size 3KB
SHA256 87fe4a91500229eac3f1084fbd121cfc333241e3d7c2afe47e375416d641a230
MD5 6ce9525d1ad89261cab36b7ba6a14247
SHA1 e10e0c2e30921db95cd888a9b2723a268313ed5e
SHA512 6a01d8b7dfd840961e87352ad8909a060e8a38e3af5e6dc1e844fce8cb1e3d8e10bac16f88b07de6b3cad63c5114ed6f01915492dc165fa69c652c173409e39c
MD5 SHA1 SHA512

Submit Download

21d3d793-9dd4-4e98-9fd0-76fa373b0277

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1tjvljcf.default-release\datareporting\glean\pending_pings\21d3d793-9dd4-4e98-9fd0-76fa373b0277
Size 3KB
SHA256 5e0b881ba72bb3dd0a47e19878bea2e6099f1134e909280f9fa29893bbc48bf0
MD5 80df7e8e2cdd5cd26065934d7f65390e
SHA1 130cb46598e31af1f7af43f1694b3b0b714aaa58
SHA512 e3b4cfdfac756d915459a44c8719d0050347ce415240d6f70ed0474eaadcc082547883d59f7e5582f8554013aaee2a555ddc3606eda9ec0015fc4edb8a95cb51
MD5 SHA1 SHA512

Submit Download

22c8048e-7c35-4d78-9dea-a4eabefec23d

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1tjvljcf.default-release\datareporting\glean\pending_pings\22c8048e-7c35-4d78-9dea-a4eabefec23d
Size 883B
SHA256 ef1482e7b8c7634025dde36776ed3f76385e979a7000812a6425df339a9ff64e
MD5 e1007269249a43a91cfb6302708777d3
SHA1 46a78b708d53f269328416ca52c3738b9aca26a2
SHA512 bc1466da2e4a0a31ecc49295a78850e0d35543bc0835c7052e85b6eff3dbe7fffe617399f99ba9c5d4cf6570d507a7a5d9829c599a327703e549fb7bbaac25b9
MD5 SHA1 SHA512

Submit Download

29e4b642-da17-4a6d-ae5f-1e42d9d491d8

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1tjvljcf.default-release\datareporting\glean\pending_pings\29e4b642-da17-4a6d-ae5f-1e42d9d491d8
Size 235B
SHA256 29df2e954dc506c344ad0402fe8109cd9e53577d30dfc5c249f4d8b60a00c08a
MD5 bb3cf7339bb370360a78c27acc402eba
SHA1 b165aabcdb73ef23aa247d01178b28ec1791f81d
SHA512 7d61fd4de8a5f2bc9701b85ef407a4f60e44edc0c780f79ff4df09d31018935b616e7f0dca8132394e62f5bc9ae3157fa5e3d305096f0cc451f6f1f10d6303fb
MD5 SHA1 SHA512

Submit Download

349a0c4e-bb63-4d2c-9328-aae4e7a4d5a7

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1tjvljcf.default-release\datareporting\glean\pending_pings\349a0c4e-bb63-4d2c-9328-aae4e7a4d5a7
Size 235B
SHA256 30de5e16d0b66f0fc1494dcdfba57472cf79ff9f24be988a65d060cf568c772d
MD5 983c4358b1c8095aec01da08233b7c53
SHA1 944a358e4b34c6e7e191599da0a5a3a03fa897ea
SHA512 536b0f3befc0099308cb7252cb0250c4f2d5b7028b4bef302a105b663d690223e53db8659432ddc132231afcb4eca1c705d8ee820b5410f92681031c8f5c75b8
MD5 SHA1 SHA512

Submit Download

40fa960a-be9d-4959-b767-3c5aea4cfe10

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1tjvljcf.default-release\datareporting\glean\pending_pings\40fa960a-be9d-4959-b767-3c5aea4cfe10
Size 3KB
SHA256 3fd955f8155df0d3284901ddd2f0b7327ab935fdd65ec5f75c04032574f6b984
MD5 f2182944f56b8aab0d86d57129fb1740
SHA1 4f012a9fbe8b02114252b99433cef7df97f24008
SHA512 ec57b917ef12dda7a89b4b80261790c4cfa38d6525617106a69bc14910f52d32d26f79865996dacd4aef7290c03047367453497dde5b23509ab328c265b3eb6d
MD5 SHA1 SHA512

Submit Download

572a2979-fd7b-4a35-adba-6e0968ac5f66

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1tjvljcf.default-release\datareporting\glean\pending_pings\572a2979-fd7b-4a35-adba-6e0968ac5f66
Size 2KB
SHA256 6cd88481e14b72954a663185e9be6e9716049a71ee04ee8a2fe4483308960afe
MD5 9bffb2b32ddaede482a13cd255daf0f6
SHA1 71492eef11992921658b0d0421802ab1b7605250
SHA512 aa67394fd38643cc8e3ecd6a68d071d282fb27d5bba3ddc2c64b7f993682b7be21509b09beaa9f471946f27f109c0a37bff6750f262a900018b54ef8d3decd6b
MD5 SHA1 SHA512

Submit Download

5c05fc5c-b7ad-4c4f-87db-43cab612000e

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1tjvljcf.default-release\datareporting\glean\pending_pings\5c05fc5c-b7ad-4c4f-87db-43cab612000e
Size 871B
SHA256 d5edc698ad355d39fd7b76b18f64b03f9453c105f3d48c6e2121faeed8198ba2
MD5 e35a9d0904c8151c5b29bf4956473eab
SHA1 4f35204542f12f1462a4e383e09ebf037821e877
SHA512 7a4bc5efdd97277aea496bdf93ee7808740dff89ed5d4e36c0b01d0e22256b663788fdecff27f08a954aba3d154c869cce5b486e632f2f8ab3a143c317f9a6d7
MD5 SHA1 SHA512

Submit Download

5fe0a5f9-de6f-4042-afaf-2a33cfda67d1

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1tjvljcf.default-release\datareporting\glean\pending_pings\5fe0a5f9-de6f-4042-afaf-2a33cfda67d1
Size 3KB
SHA256 141075abc21eff7709f6c0dd8736eb7e91b81f29a5e5b24d473694fce304f9a3
MD5 334717521b1c33f34ab125396f5b1071
SHA1 439969ec1d76dcaf170f643a668310e5a2449897
SHA512 e3ab97cf00c1ff9df170dbcb56d1f3f9cd4093848f57ee08522ebacf4761c65039ae5f6782970e7215dba16b8ed52e0cb4e266eef8758ac6c846506f2ec3127f
MD5 SHA1 SHA512

Submit Download

743b33e9-1792-4b7b-81dc-6b9defa90aae

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1tjvljcf.default-release\datareporting\glean\pending_pings\743b33e9-1792-4b7b-81dc-6b9defa90aae
Size 886B
SHA256 de32fa99c290694c5c3e72c97b6d1ccf423ef237991a25c90ddce2be830227ca
MD5 30d737b380650e0b6ab3988b67d071bc
SHA1 8612067d96621dcd65d485c38b21f7d2def2a72d
SHA512 92ee685a666bfa24188d75b78d40b1f0b8c85c04d04093ebcd4dec5b7b202b3d0d15272d0172ab2a611412b4397739961bf4949517612308d4008d27277f601e
MD5 SHA1 SHA512

Submit Download

770413ed-c5f4-4ffb-bfbb-659834ca6d14

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1tjvljcf.default-release\datareporting\glean\pending_pings\770413ed-c5f4-4ffb-bfbb-659834ca6d14
Size 17KB
SHA256 70c3acdc7804428083bf2764bca6d9638aac6d3147a92e35754a52516ac103cc
MD5 776ee8e2d0e345d2c86ef7d29896f06e
SHA1 9d476782d0589d60e5ee8453c8b52e36468c6fdf
SHA512 91229df6f379506ee68e59d7fa83144d8f0aa1cb0b62b61ce4f62a08f65ea39c1a6278bbe5803740a0dddb37e0b06fe474e0ebf817049f7d09b4eb82231b0726
SSDEEP 192:n9RTV41ZxC+LAnrAfvzfteyNvuVzDN0tupadP7HQc8wa8aeoc9zH35mMF919wBOh:9mZx9sAft7xMw3hFxwgBpr86RlRgiSQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

91ad1565-8707-44fe-91c5-4afe8a41fa53

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1tjvljcf.default-release\datareporting\glean\pending_pings\91ad1565-8707-44fe-91c5-4afe8a41fa53
Size 2KB
SHA256 70c9ed65e70d175688f58a1db3747ccb555082049eee8cad8be81ac7429f30c2
MD5 c0d5695c9cebe50359e04196428536e0
SHA1 50dcf7356c524911aecf3c6734bfd8b7e7a32b3a
SHA512 5517f65cf4c1b55812e94cc590ad30c863c436d1e5cd375ba66be72d29ea6150dd8ad8aaea889dd0c789b601da8389f2934ae5baa72d34c58318166a21d8bf8d
MD5 SHA1 SHA512

Submit Download

95af23f2-600b-4936-bab8-b9cdba7ec581

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1tjvljcf.default-release\datareporting\glean\pending_pings\95af23f2-600b-4936-bab8-b9cdba7ec581
Size 3KB
SHA256 34f50572b01555852c8d3a7316017a2d34a2b583af2cb3b6b8b69410a4cb216f
MD5 63695cc4c593aac00716e15f196ff6ba
SHA1 a334c089216564056846ddb88c733c676fae5b3c
SHA512 2b4e050d250708519115bb8d6e16dc2383420191c6dcda3083e5ef01526c96d52f8175b3e2fb33cb737633551f6b8feb4f49111f0a1c3d4274e09eca8af9fdb6
MD5 SHA1 SHA512

Submit Download

a3f3bff4-7c3f-4ee2-af05-c61bfa6feda9

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1tjvljcf.default-release\datareporting\glean\pending_pings\a3f3bff4-7c3f-4ee2-af05-c61bfa6feda9
Size 3KB
SHA256 9bf8b0799b2f1ce9a4f560c56d35d4862af49d6646578e00dda1c4ee1d049153
MD5 abebc8421929aa245a0e3c818ca11ade
SHA1 4e1b189c2df944751f25a1bac678e00b00454c40
SHA512 cd2076ba902eba57b0bcc9a7b39b6144e0a266790fb7a715a6441bfcd81341ce44b2146dc651e3bfa1ebd4b8c4588fb404f354de1326c6d076e317c6ed28274a
MD5 SHA1 SHA512

Submit Download

adb883db-a897-4be0-8eaa-d1766269bc54

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1tjvljcf.default-release\datareporting\glean\pending_pings\adb883db-a897-4be0-8eaa-d1766269bc54
Size 3KB
SHA256 79d7b4c9a9af7b56b26b3044a8c04bb7e037ca90e72d267d18dbce5b6aa96eb2
MD5 307718416e261be374aa93994f6b66b6
SHA1 43cc65e734ea00c1f2e2a100f0b5c4238c6b6972
SHA512 641ff47b666af1141871e2c4fac74d532402adbc0fc04425486fc3acaab0451a8a97a37e59632b9cb3ef5355aea44ee5ea9c9a6dbf7a621784110842591f69d8
MD5 SHA1 SHA512

Submit Download

b6a69ae9-8296-4de5-8aa2-bfcb7c57b236

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1tjvljcf.default-release\datareporting\glean\pending_pings\b6a69ae9-8296-4de5-8aa2-bfcb7c57b236
Size 896B
SHA256 6825c37ad8767f96bea3a740f2ad0bd33d89d80a34d0e759951acb6cbf8350cd
MD5 365d257d588f1d4c6c1d14571176847b
SHA1 8883ab1361f8f4aeec751f4b9b2cca160814fcfa
SHA512 3b6706b3b5ba36d3aa6e32c8248c7892aa0da367ff19a7f340fe73c798f4ba2d24cdffcaf019ea0d8d4adbad19d03b8b466a688bfbef5943a6c3a30285150ceb
MD5 SHA1 SHA512

Submit Download

be5ff0ef-7482-4aa2-8ba6-754ab16ed383

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1tjvljcf.default-release\datareporting\glean\pending_pings\be5ff0ef-7482-4aa2-8ba6-754ab16ed383
Size 3KB
SHA256 ab04bf3fa7cb67cf038243c9241d8cdbbe72ccf9317752593ec29dc58ce88fe5
MD5 d315b4d49ba046c9e2604a550c8f3092
SHA1 3a0530ec307006b5b58c28f4cf98ad821a0e0e50
SHA512 380ba0af5df05d9d62a27885bd154f54b37f1fb15e56512ce866365b9d732c622dd43cbdd5334df84557b85d1bdf7df5de300e6f8c3c8fd5bf37466d24ec2380
MD5 SHA1 SHA512

Submit Download

c402fb11-9683-41ab-8d23-2014856e1971

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1tjvljcf.default-release\datareporting\glean\pending_pings\c402fb11-9683-41ab-8d23-2014856e1971
Size 235B
SHA256 5ab54b3a7934de1f89b48802f5b6773b3a8cbc49d6fccaf2304d0a43ae15d1e3
MD5 9fffa092875c1b2d896d95e19d19076a
SHA1 bfe38f1a8f0d304197a69901c71dc0ba929199a0
SHA512 a278cf56ba3b8b59c46ca6ca480091e37595ebdf9afac857d5c67cdb942ddccfad4648e47b238acd68fb9c0cb974672f8c7805de2fb5a887fd6543df45319745
MD5 SHA1 SHA512

Submit Download

c89b4297-f1cc-4c96-8164-c7c28b76fde5

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1tjvljcf.default-release\datareporting\glean\pending_pings\c89b4297-f1cc-4c96-8164-c7c28b76fde5
Size 3KB
SHA256 9987a937a5cc79e32b27c1d26ddd2b659e63078ff9b06dd28889c4ecf0d9302d
MD5 4dfd02391fe0623882fb1c7a9b822e9b
SHA1 8f7e93ebdfeff2fe9b0711f4349019b8a8ec853f
SHA512 4470febbacad99e670c54ea92f7549de69255e04a124b9150fb13306802ad6e58d506e5c8f70f87055fa557aeb7b7c641033d74b29486d369ee330c844d0c6e8
MD5 SHA1 SHA512

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1tjvljcf.default-release\prefs-1.js
Size 6KB
SHA256 ab18f66b5840eae0c7ec6b779c28589d04c75ee79506d105b720075765df3dc0
MD5 aabec05e6c505a10d78cabb236c373be
SHA1 3ed8a6cef70d4a2271793631d7f5c52ddda3dfd5
SHA512 b967a74e851d16b7497e5688bcc08c5ecc571ba3d697f2c8cf6e37a32e7efc2363c5c9637970fd7cc71922049efaa405490561c53c60d1da3fb5874c9d9024e0
SSDEEP 96:xHmUTUhqGqm1ftKnny1zSfSSl5dv9j6nSRH/CgBw88H8L4cnUV9xI:ssRm1ft8y+SSx91Bw88l2
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1tjvljcf.default-release\prefs-1.js
Size 6KB
SHA256 00aaf65f11363aa9b3b62e50235ec23fc02b7fc869f202cb0fc0a20a2724d996
MD5 d866556b4b48d0bed0024db9d5cbf090
SHA1 8cd2b68b13f8d7c022a7c388b566048a7ca01852
SHA512 136324f0b9b17e2e60a177153842b4e261ba55c31fd3c2a37ca4fe5237daec20821f673f88bd0288e9d4e9a443dd257c6d32d757f88eaa602bfadf72e9ac7367
SSDEEP 96:xHmUTUhqGqm1ftKnny1zSBSSl5dv9j6nSRH/CgBw88H8L4cnUV9xI:ssRm1ft8yESSx91Bw88l2
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1tjvljcf.default-release\prefs.js
Size 6KB
SHA256 fb95d4316f001926a986478882a1de84ce830ccd71de3f8a4db3ff63af75b7f7
MD5 917f65e83316343dcdbc8a7ebfd83435
SHA1 03e9f322c663d3e1e506957a50f79ff9b239df02
SHA512 023f8db32fb367a2c3ec68a70d8f94a071687aff80575a54e59aa819c9f6ab1012bfd6efc0193c70f766b492a74c8a02967efa1861e47a2cde340bd2c07b9873
SSDEEP 96:xHmUTUhqGqm1ftoY1zSSvSSl5dv9jMnSRH/CgBw88H8L4cnUVaI:ssRm1ftoYrvSSX91Bw88lx
MD5 SHA1 SHA512 SSDEEP

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1tjvljcf.default-release\sessionCheckpoints.json
Size 90B
SHA256 00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2
MD5 c4ab2ee59ca41b6d6a6ea911f35bdc00
SHA1 5942cd6505fc8a9daba403b082067e1cdefdfbc4
SHA512 71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2
MD5 SHA1 SHA512

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1tjvljcf.default-release\sessionCheckpoints.json
Size 53B
SHA256 792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da
MD5 ea8b62857dfdbd3d0be7d7e4a954ec9a
SHA1 b43bc4b3ea206a02ef8f63d5bfad0c96bf2a3b2a
SHA512 076ee83534f42563046d25086166f82e1a3ec61840c113aec67abe2d8195daa247d827d0c54e7e8f8a1bbf2d082a3763577587e84342ec160ff97905243e6d19
MD5 SHA1 SHA512

Submit Download

QgotrKYsNEIZqu.exe

Path C:\Users\Admin\AppData\Roaming\QgotrKYsNEIZqu.exe
Size 1.2MB
SHA256 26a229f9c3d82111d8a235e29cf7f594fc0f7e22b892d73a429afefa090c23ce
MD5 65477fcce7768974b86c665fbb010c64
SHA1 f1ad7d076e31f67960a8dd7649c196b95ed1d659
SHA512 4428e248c4bc3dd95f147178d7397a67cbe37083d7d44afe086452693414a13ac59f1c09b4fcf8b454d3e9dc299468c2cc4795d592c999a0d451ac0bc1b20bb3
SSDEEP 24576:jfmN3t/U1aLOEasdBMvfmIazWgOmkwuhv7NU6MFip87eYfSdsO4BjeX6g:Slt/UkLO5sdBMX8agOh7+7Fip7YfSds4
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Windows\SystemTemp\Crashpad\settings.dat
Size 40B
SHA256 900bf772b891eaa2dffd77d4ee4d13daddb035d19436c61cd0b96a0718073ff5
MD5 e42cb01ca416aa5b300542630b0ae4d2
SHA1 59f112a3233fab65040d3a3b203a7e251100fdce
SHA512 826de70d11410dc5f5323d1c7a3f3a67270615a46c5f57ce13dc1ae1b420bbc3ee48ef38bc964140398221f8b4f720f3bcfa40b626eaf5c897b7d9792d24c310
MD5 SHA1 SHA512

Submit Download

chrome_installer.log

Path C:\Windows\SystemTemp\chrome_installer.log
Size 7KB
SHA256 7a12007bb15e7ba5ede72b2ba9e2b3c5dbfd27fafd817258c8d4d0beae6277dd
MD5 01d8438485770c6d1860765335829e91
SHA1 03fccdc44efbece774b3bad13945de1dc0993f3a
SHA512 b52402dddfb17c8a1cdd46fccb10aabd1c59b27018f08ece1352630838466f0da28116b55166ffc50495bd33d9d00f38df147146387e6d788fed891ed41289eb
SSDEEP 192:cosyihAQPp7FV09p5V7O7O9o/+z/JwWyNtEavTrNRdkZfI5:QyCdG83TrNRdqI5
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2344-76-0x0000000006530000-0x00000000066F2000-memory.dmp

Download

memory/2344-38-0x0000000000400000-0x00000000004BE000-memory.dmp

Download

memory/2344-78-0x0000000006470000-0x00000000064C0000-memory.dmp

Download

memory/2344-75-0x00000000062A0000-0x0000000006352000-memory.dmp

Download

memory/2344-77-0x00000000063F0000-0x0000000006466000-memory.dmp

Download

memory/2344-4105-0x0000000007160000-0x00000000074B7000-memory.dmp

Download

memory/2344-80-0x0000000005F60000-0x0000000005F7E000-memory.dmp

Download

memory/2344-79-0x0000000006C30000-0x000000000715C000-memory.dmp

Download

memory/3484-87-0x00000200C0290000-0x00000200C03CE000-memory.dmp

Download

memory/3492-60-0x0000000005CD0000-0x0000000005CE2000-memory.dmp

Download

memory/3512-2276-0x00000000005A0000-0x00000000005A1000-memory.dmp

Download

memory/3892-2524-0x000002617D200000-0x000002617D33E000-memory.dmp

Download

memory/4436-2321-0x0000000000410000-0x0000000000411000-memory.dmp

Download

memory/4436-2229-0x0000000000400000-0x0000000000401000-memory.dmp

Download

memory/4436-2464-0x000001B94C380000-0x000001B94D380000-memory.dmp

Download

memory/4552-2327-0x0000000000190000-0x0000000000191000-memory.dmp

Download

memory/4856-44-0x00000000714F0000-0x000000007153C000-memory.dmp

Download

memory/4856-18-0x0000000005720000-0x0000000005742000-memory.dmp

Download

memory/4856-69-0x0000000007D60000-0x0000000007D68000-memory.dmp

Download

memory/4856-67-0x0000000007C70000-0x0000000007C85000-memory.dmp

Download

memory/4856-59-0x00000000076C0000-0x0000000007764000-memory.dmp

Download

memory/4856-40-0x0000000006C30000-0x0000000006C7C000-memory.dmp

Download

memory/4856-21-0x0000000006060000-0x00000000060C6000-memory.dmp

Download

memory/4856-65-0x0000000007C30000-0x0000000007C41000-memory.dmp

Download

memory/4856-15-0x0000000005930000-0x0000000005F5A000-memory.dmp

Download

memory/4856-12-0x0000000002EC0000-0x0000000002ED0000-memory.dmp

Download

memory/4856-14-0x0000000002EC0000-0x0000000002ED0000-memory.dmp

Download

memory/4856-43-0x0000000007680000-0x00000000076B4000-memory.dmp

Download

memory/4856-13-0x0000000002F10000-0x0000000002F46000-memory.dmp

Download

memory/4856-63-0x0000000007AA0000-0x0000000007AAA000-memory.dmp

Download

memory/5424-3-0x00000000050E0000-0x00000000050F0000-memory.dmp

Download

memory/5424-2-0x0000000004F20000-0x0000000004FB2000-memory.dmp

Download

memory/5424-1-0x0000000005410000-0x00000000059B6000-memory.dmp

Download

memory/5424-4-0x00000000050C0000-0x00000000050CA000-memory.dmp

Download

memory/5424-7-0x0000000006940000-0x0000000006A42000-memory.dmp

Download

memory/5424-0-0x0000000000360000-0x000000000049E000-memory.dmp

Download

memory/5424-5-0x0000000005260000-0x00000000052FC000-memory.dmp

Download

memory/5424-6-0x0000000005210000-0x0000000005222000-memory.dmp

Download

memory/5664-58-0x0000000006E50000-0x0000000006E6E000-memory.dmp

Download

memory/5664-45-0x00000000714F0000-0x000000007153C000-memory.dmp

Download

memory/5664-16-0x0000000004AB0000-0x0000000004AC0000-memory.dmp

Download

memory/5664-17-0x0000000004AB0000-0x0000000004AC0000-memory.dmp

Download

memory/5664-33-0x00000000058C0000-0x0000000005C17000-memory.dmp

Download

memory/5664-68-0x0000000007500000-0x000000000751A000-memory.dmp

Download

memory/5664-66-0x00000000073F0000-0x00000000073FE000-memory.dmp

Download

memory/5664-64-0x0000000007440000-0x00000000074D6000-memory.dmp

Download

memory/5664-62-0x00000000071B0000-0x00000000071CA000-memory.dmp

Download

memory/5664-19-0x0000000005DC0000-0x0000000005E26000-memory.dmp

Download

memory/5664-61-0x00000000077F0000-0x0000000007E6A000-memory.dmp

Download

memory/5664-39-0x0000000005E70000-0x0000000005E8E000-memory.dmp

Download

memory/6560-3032-0x00000000714B0000-0x00000000714FC000-memory.dmp

Download

memory/6560-2790-0x0000000006290000-0x00000000065E7000-memory.dmp

Download

memory/6560-2972-0x0000000006D30000-0x0000000006D7C000-memory.dmp

Download

memory/6560-3093-0x0000000007BF0000-0x0000000007C01000-memory.dmp

Download

memory/6560-3182-0x0000000007D90000-0x0000000007DA5000-memory.dmp

Download

memory/6660-3036-0x00000000714B0000-0x00000000714FC000-memory.dmp

Download

memory/6660-3062-0x0000000007680000-0x0000000007724000-memory.dmp

Download