phantom_stealer | b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c

Analysis

max time kernel
149s
max time network
130s
platform
windows11-21h2_x64
resource
win11-20251015-en
resource tags

arch:x64arch:x86image:win11-20251015-enlocale:en-usos:windows11-21h2-x64system
submitted
06/11/2025, 10:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe
Size 1.2MB
Sample251106-mda27svmfm
SHA256 b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c
MD5 c714eda54303d9235a46ce4537efc074
SHA1 17b5a790e2250b4e7a12ae2c0b35cc56103f0910
SHA512 4d7191bddb61ac099b7e19e65287c51952e52aee4b34d1420d6ddda0d44bcbb5caf63191736512c9e97074b603704bfb2a1d054cbadc679f6a4afe42bc791a7b
SSDEEP 24576:XL21q+uS0KBjzt2a1IzFVgZB31PLNqw2Tak+RECk59vIzy2kNRcL:ahuTMv31KXgnFP5eTak+mNjv8y2
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

collection discovery execution phantom_stealer persistence spyware stealer

Malware Config

Extracted

Family

phantom_stealer

Version

v3.5.0

https://api.telegram.org/bot8258835706:AAHepHwFFBo9S8JL3o2JWYOp0qIoZLribwE/sendMessage?chat_id=7435764630

Mutex

N0V00IIVPCZ29U2820SD

Attributes

anti_analysis
0
cb_enables_ssl
0
debug
0
keylogger
1
start_delay
0
startup
0

Signatures

Detects PhantomStealer payload 1 IoCs

resource	yara_rule
behavioral2/memory/4904-37-0x0000000000400000-0x00000000004BE000-memory.dmp	family_phantomstealer

PhantomStealer
Phantom Stealer is a stealer written in C#, forked from the Stealerium family.
stealer phantom_stealer
Phantom_stealer family
phantom_stealer

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
5668	powershell.exe
1068	powershell.exe
8	powershell.exe
1016	powershell.exe

Executes dropped EXE 4 IoCs

pid	Process
4584	aKjaHHPf.exe
2948	aKjaHHPf.exe
3892	aKjaHHPf.exe
5104	aKjaHHPf.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1912098173-3310702793-1420386224-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe
Key opened	\REGISTRY\USER\S-1-5-21-1912098173-3310702793-1420386224-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe
Key opened	\REGISTRY\USER\S-1-5-21-1912098173-3310702793-1420386224-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
19	icanhazip.com

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3760 set thread context of 4904	3760	b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe	85
PID 4584 set thread context of 3892	4584	aKjaHHPf.exe	170

Drops file in Program Files directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\2320_13406898079328684_2320.pma	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\5824_13406898079392878_5824.pma	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\5796_13406898087492365_5796.pma	setup.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\f9130a21-0877-4f8c-83b1-8a390ace04d1.tmp	setup.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\80c7b106-ffc8-4472-8d60-4916a8316b00.tmp	setup.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\5560bb39-7b4f-45ea-b381-ddf14f546ddb.tmp	setup.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\8bd634d7-ac75-4017-af60-0b7c4d8a8d6c.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\6568_13406898087550874_6568.pma	setup.exe

Drops file in Windows directory 48 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\metadata	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\metadata	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\chrome_installer.log	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\metadata	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp\chrome_installer.log	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\msedge_installer.log	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\metadata	setup.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\settings.dat	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp	setup.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File opened for modification	C:\Windows\SystemTemp	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\settings.dat	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\msedge_installer.log	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\metadata	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp	setup.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\metadata	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\chrome_installer.log	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp	setup.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp\chrome_installer.log	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\settings.dat	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\settings.dat	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\metadata	setup.exe
File opened for modification	C:\Windows\SystemTemp	setup.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\metadata	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\msedge_installer.log	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\msedge_installer.log	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat	setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aKjaHHPf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aKjaHHPf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Checks processor information in registry 2 TTPs 38 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Enumerates system info in registry 2 TTPs 12 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134068980591556038"	chrome.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	chrmstp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1912098173-3310702793-1420386224-1000\{2AEEBCDC-39F7-4883-A655-9E8B2D7BDF81}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1912098173-3310702793-1420386224-1000\{0C9AD0B2-E146-4E51-A7CC-DCF099CF08C3}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	chrmstp.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3036	schtasks.exe
2028	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1068	powershell.exe
8	powershell.exe
8	powershell.exe
1068	powershell.exe
4904	b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe
4904	b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe
4448	chrome.exe
4448	chrome.exe
4904	b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe
4904	b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe
4904	b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe
4904	b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe
4904	b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe
4904	b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe
4904	b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe
4904	b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe
700	firefox.exe
700	firefox.exe
700	firefox.exe
700	firefox.exe
700	firefox.exe
700	firefox.exe
700	firefox.exe
700	firefox.exe
700	firefox.exe
700	firefox.exe
700	firefox.exe
700	firefox.exe
700	firefox.exe
700	firefox.exe
700	firefox.exe
700	firefox.exe
700	firefox.exe
700	firefox.exe
700	firefox.exe
700	firefox.exe
4904	b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe
4904	b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe
1016	powershell.exe
4904	b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe
5668	powershell.exe
5668	powershell.exe
5668	powershell.exe
4584	aKjaHHPf.exe
4584	aKjaHHPf.exe
4584	aKjaHHPf.exe
4584	aKjaHHPf.exe
4904	b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe
4904	b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe
1016	powershell.exe
1016	powershell.exe
4904	b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe
4904	b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe
4904	b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe
4904	b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe
4904	b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe
4904	b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe
4904	b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe
4904	b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe
4904	b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe
4904	b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe
4904	b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe
4904	b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe
4904	b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe

Suspicious use of AdjustPrivilegeToken 33 IoCs

description	pid	Process
Token: SeDebugPrivilege	1068	powershell.exe
Token: SeDebugPrivilege	8	powershell.exe
Token: SeDebugPrivilege	4904	b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe
Token: SeShutdownPrivilege	4448	chrome.exe
Token: SeCreatePagefilePrivilege	4448	chrome.exe
Token: SeShutdownPrivilege	4448	chrome.exe
Token: SeCreatePagefilePrivilege	4448	chrome.exe
Token: SeShutdownPrivilege	4448	chrome.exe
Token: SeCreatePagefilePrivilege	4448	chrome.exe
Token: SeShutdownPrivilege	4448	chrome.exe
Token: SeCreatePagefilePrivilege	4448	chrome.exe
Token: SeShutdownPrivilege	4448	chrome.exe
Token: SeCreatePagefilePrivilege	4448	chrome.exe
Token: SeShutdownPrivilege	4448	chrome.exe
Token: SeCreatePagefilePrivilege	4448	chrome.exe
Token: SeShutdownPrivilege	4448	chrome.exe
Token: SeCreatePagefilePrivilege	4448	chrome.exe
Token: SeDebugPrivilege	1016	powershell.exe
Token: SeDebugPrivilege	5668	powershell.exe
Token: SeDebugPrivilege	4584	aKjaHHPf.exe
Token: SeDebugPrivilege	3892	aKjaHHPf.exe
Token: SeShutdownPrivilege	6596	chrome.exe
Token: SeCreatePagefilePrivilege	6596	chrome.exe
Token: SeShutdownPrivilege	6596	chrome.exe
Token: SeCreatePagefilePrivilege	6596	chrome.exe
Token: SeShutdownPrivilege	6596	chrome.exe
Token: SeCreatePagefilePrivilege	6596	chrome.exe
Token: SeShutdownPrivilege	6596	chrome.exe
Token: SeCreatePagefilePrivilege	6596	chrome.exe
Token: SeShutdownPrivilege	6596	chrome.exe
Token: SeCreatePagefilePrivilege	6596	chrome.exe
Token: SeShutdownPrivilege	6596	chrome.exe
Token: SeCreatePagefilePrivilege	6596	chrome.exe

Suspicious use of FindShellTrayWindow 48 IoCs

pid	Process
4448	chrome.exe
4448	chrome.exe
5048	chrmstp.exe
700	firefox.exe
700	firefox.exe
700	firefox.exe
700	firefox.exe
700	firefox.exe
700	firefox.exe
700	firefox.exe
700	firefox.exe
700	firefox.exe
700	firefox.exe
700	firefox.exe
700	firefox.exe
700	firefox.exe
700	firefox.exe
700	firefox.exe
700	firefox.exe
700	firefox.exe
700	firefox.exe
700	firefox.exe
700	firefox.exe
5296	msedge.exe
4832	msedge.exe
2472	firefox.exe
2472	firefox.exe
2472	firefox.exe
2472	firefox.exe
2472	firefox.exe
2472	firefox.exe
2472	firefox.exe
2472	firefox.exe
2472	firefox.exe
2472	firefox.exe
2472	firefox.exe
2472	firefox.exe
2472	firefox.exe
2472	firefox.exe
2472	firefox.exe
2472	firefox.exe
2472	firefox.exe
2472	firefox.exe
2472	firefox.exe
2472	firefox.exe
6596	chrome.exe
6596	chrome.exe
4392	chrmstp.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
700	firefox.exe
2472	firefox.exe
4904	b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3760 wrote to memory of 1068	3760	b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe	78
PID 3760 wrote to memory of 1068	3760	b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe	78
PID 3760 wrote to memory of 1068	3760	b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe	78
PID 3760 wrote to memory of 8	3760	b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe	80
PID 3760 wrote to memory of 8	3760	b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe	80
PID 3760 wrote to memory of 8	3760	b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe	80
PID 3760 wrote to memory of 3036	3760	b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe	82
PID 3760 wrote to memory of 3036	3760	b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe	82
PID 3760 wrote to memory of 3036	3760	b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe	82
PID 3760 wrote to memory of 4904	3760	b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe	85
PID 3760 wrote to memory of 4904	3760	b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe	85
PID 3760 wrote to memory of 4904	3760	b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe	85
PID 3760 wrote to memory of 4904	3760	b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe	85
PID 3760 wrote to memory of 4904	3760	b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe	85
PID 3760 wrote to memory of 4904	3760	b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe	85
PID 3760 wrote to memory of 4904	3760	b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe	85
PID 3760 wrote to memory of 4904	3760	b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe	85
PID 4904 wrote to memory of 4448	4904	b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe	88
PID 4904 wrote to memory of 4448	4904	b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe	88
PID 4448 wrote to memory of 4528	4448	chrome.exe	89
PID 4448 wrote to memory of 4528	4448	chrome.exe	89
PID 4448 wrote to memory of 1980	4448	chrome.exe	90
PID 4448 wrote to memory of 1980	4448	chrome.exe	90
PID 4448 wrote to memory of 2612	4448	chrome.exe	91
PID 4448 wrote to memory of 2612	4448	chrome.exe	91
PID 4448 wrote to memory of 1904	4448	chrome.exe	92
PID 4448 wrote to memory of 1904	4448	chrome.exe	92
PID 4904 wrote to memory of 1904	4904	b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe	92
PID 4448 wrote to memory of 4420	4448	chrome.exe	93
PID 4448 wrote to memory of 4420	4448	chrome.exe	93
PID 4904 wrote to memory of 1904	4904	b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe	92
PID 4448 wrote to memory of 4224	4448	chrome.exe	94
PID 4448 wrote to memory of 4224	4448	chrome.exe	94
PID 4448 wrote to memory of 5288	4448	chrome.exe	95
PID 4448 wrote to memory of 5288	4448	chrome.exe	95
PID 4448 wrote to memory of 992	4448	chrome.exe	96
PID 4448 wrote to memory of 992	4448	chrome.exe	96
PID 4448 wrote to memory of 3536	4448	chrome.exe	97
PID 4448 wrote to memory of 3536	4448	chrome.exe	97
PID 4448 wrote to memory of 5376	4448	chrome.exe	98
PID 4448 wrote to memory of 5376	4448	chrome.exe	98
PID 4904 wrote to memory of 4448	4904	b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe	88
PID 4904 wrote to memory of 4448	4904	b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe	88
PID 4904 wrote to memory of 4528	4904	b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe	89
PID 4448 wrote to memory of 3508	4448	chrome.exe	99
PID 4448 wrote to memory of 3508	4448	chrome.exe	99
PID 4904 wrote to memory of 4528	4904	b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe	89
PID 4904 wrote to memory of 2612	4904	b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe	91
PID 4904 wrote to memory of 2612	4904	b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe	91
PID 4904 wrote to memory of 1980	4904	b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe	90
PID 4904 wrote to memory of 1980	4904	b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe	90
PID 4448 wrote to memory of 632	4448	chrome.exe	100
PID 4448 wrote to memory of 632	4448	chrome.exe	100
PID 4904 wrote to memory of 1904	4904	b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe	92
PID 4904 wrote to memory of 1904	4904	b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe	92
PID 4904 wrote to memory of 4448	4904	b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe	88
PID 4904 wrote to memory of 4448	4904	b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe	88
PID 4904 wrote to memory of 4224	4904	b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe	94
PID 4904 wrote to memory of 4224	4904	b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe	94
PID 4904 wrote to memory of 4528	4904	b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe	89
PID 4904 wrote to memory of 4528	4904	b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe	89
PID 4904 wrote to memory of 2612	4904	b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe	91
PID 4904 wrote to memory of 2612	4904	b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe	91
PID 4904 wrote to memory of 3536	4904	b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe	97

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1912098173-3310702793-1420386224-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1912098173-3310702793-1420386224-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe

C:\Users\Admin\AppData\Local\Temp\b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe
"C:\Users\Admin\AppData\Local\Temp\b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3760
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1068
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\aKjaHHPf.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:8
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\aKjaHHPf" /XML "C:\Users\Admin\AppData\Local\Temp\tmpAF4B.tmp"
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:3036
- C:\Users\Admin\AppData\Local\Temp\b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe
  "C:\Users\Admin\AppData\Local\Temp\b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - outlook_office_path
  - outlook_win_path
  PID:4904
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cedl4lis.mum"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4448
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\cedl4lis.mum /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\cedl4lis.mum\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\cedl4lis.mum --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ffc943edcf8,0x7ffc943edd04,0x7ffc943edd10
      4⤵
      PID:4528
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cedl4lis.mum" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=1856,i,17624704526454173437,3315853313934071953,262144 --variations-seed-version --mojo-platform-channel-handle=1852 /prefetch:2
      4⤵
      PID:1980
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cedl4lis.mum" --field-trial-handle=1960,i,17624704526454173437,3315853313934071953,262144 --variations-seed-version --mojo-platform-channel-handle=1964 /prefetch:11
      4⤵
      PID:2612
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cedl4lis.mum" --field-trial-handle=2128,i,17624704526454173437,3315853313934071953,262144 --variations-seed-version --mojo-platform-channel-handle=2184 /prefetch:13
      4⤵
      PID:1904
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cedl4lis.mum" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=2748,i,17624704526454173437,3315853313934071953,262144 --variations-seed-version --mojo-platform-channel-handle=2912 /prefetch:1
      4⤵
      PID:4420
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cedl4lis.mum" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=2896,i,17624704526454173437,3315853313934071953,262144 --variations-seed-version --mojo-platform-channel-handle=2968 /prefetch:1
      4⤵
      PID:4224
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cedl4lis.mum" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3152,i,17624704526454173437,3315853313934071953,262144 --variations-seed-version --mojo-platform-channel-handle=3308 /prefetch:1
      4⤵
      PID:5288
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cedl4lis.mum" --extension-process --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=3168,i,17624704526454173437,3315853313934071953,262144 --variations-seed-version --mojo-platform-channel-handle=3804 /prefetch:9
      4⤵
      PID:992
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cedl4lis.mum" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=3184,i,17624704526454173437,3315853313934071953,262144 --variations-seed-version --mojo-platform-channel-handle=3788 /prefetch:1
      4⤵
      PID:3536
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cedl4lis.mum" --extension-process --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=3212,i,17624704526454173437,3315853313934071953,262144 --variations-seed-version --mojo-platform-channel-handle=3844 /prefetch:9
      4⤵
      PID:5376
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cedl4lis.mum" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=3900,i,17624704526454173437,3315853313934071953,262144 --variations-seed-version --mojo-platform-channel-handle=3848 /prefetch:1
      4⤵
      PID:3508
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cedl4lis.mum" --field-trial-handle=3376,i,17624704526454173437,3315853313934071953,262144 --variations-seed-version --mojo-platform-channel-handle=3908 /prefetch:14
      4⤵
      PID:632
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cedl4lis.mum" --field-trial-handle=4880,i,17624704526454173437,3315853313934071953,262144 --variations-seed-version --mojo-platform-channel-handle=4892 /prefetch:14
      4⤵
      PID:4768
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cedl4lis.mum" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=4948,i,17624704526454173437,3315853313934071953,262144 --variations-seed-version --mojo-platform-channel-handle=5044 /prefetch:1
      4⤵
      PID:4812
  - - C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
      4⤵
      Drops file in Windows directory
      PID:4844
    - - C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x244,0x248,0x24c,0x220,0x250,0x7ff7dfe71f58,0x7ff7dfe71f64,0x7ff7dfe71f70
        5⤵
        Drops file in Windows directory
        
        PID:1880
    - - C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\initial_preferences" --create-shortcuts=1 --install-level=0
        5⤵
        Drops file in Windows directory
        Modifies registry class
        Suspicious use of FindShellTrayWindow
        
        PID:5048
      - C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x244,0x248,0x24c,0x80,0x250,0x7ff7dfe71f58,0x7ff7dfe71f64,0x7ff7dfe71f70
        6⤵
        Drops file in Windows directory
        
        PID:5072
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cedl4lis.mum" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=4936,i,17624704526454173437,3315853313934071953,262144 --variations-seed-version --mojo-platform-channel-handle=4960 /prefetch:1
      4⤵
      PID:6108
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cedl4lis.mum" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=5072,i,17624704526454173437,3315853313934071953,262144 --variations-seed-version --mojo-platform-channel-handle=4952 /prefetch:1
      4⤵
      PID:440
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cedl4lis.mum" --field-trial-handle=5172,i,17624704526454173437,3315853313934071953,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:14
      4⤵
      PID:760
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cedl4lis.mum" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=5284,i,17624704526454173437,3315853313934071953,262144 --variations-seed-version --mojo-platform-channel-handle=5264 /prefetch:1
      4⤵
      PID:3784
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cedl4lis.mum" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --field-trial-handle=5380,i,17624704526454173437,3315853313934071953,262144 --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:1
      4⤵
      PID:3524
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cedl4lis.mum" --field-trial-handle=5184,i,17624704526454173437,3315853313934071953,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:14
      4⤵
      PID:2068
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cedl4lis.mum" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --field-trial-handle=5372,i,17624704526454173437,3315853313934071953,262144 --variations-seed-version --mojo-platform-channel-handle=5264 /prefetch:1
      4⤵
      PID:1152
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cedl4lis.mum" --field-trial-handle=5312,i,17624704526454173437,3315853313934071953,262144 --variations-seed-version --mojo-platform-channel-handle=5068 /prefetch:14
      4⤵
      PID:1772
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cedl4lis.mum" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --field-trial-handle=5388,i,17624704526454173437,3315853313934071953,262144 --variations-seed-version --mojo-platform-channel-handle=4944 /prefetch:1
      4⤵
      PID:980
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cedl4lis.mum" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --field-trial-handle=5300,i,17624704526454173437,3315853313934071953,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:1
      4⤵
      PID:1556
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cedl4lis.mum" --field-trial-handle=4940,i,17624704526454173437,3315853313934071953,262144 --variations-seed-version --mojo-platform-channel-handle=5332 /prefetch:14
      4⤵
      PID:4276
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cedl4lis.mum" --extension-process --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --field-trial-handle=4256,i,17624704526454173437,3315853313934071953,262144 --variations-seed-version --mojo-platform-channel-handle=3904 /prefetch:9
      4⤵
      PID:5752
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\wewrkie0.tvh"
    3⤵
    PID:2864
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir=C:\Users\Admin\AppData\Local\Temp\wewrkie0.tvh
      4⤵
      Checks processor information in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:700
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1976 -prefsLen 27097 -prefMapHandle 1980 -prefMapSize 270279 -ipcHandle 2056 -initialChannelId {147d1d0c-4938-4bc3-adce-18ad83ca61bb} -parentPid 700 -crashReporter "\\.\pipe\gecko-crash-server-pipe.700" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
        5⤵
        
        PID:2212
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2184 -prefsLen 27133 -prefMapHandle 2172 -prefMapSize 270279 -ipcHandle 2148 -initialChannelId {aa897c80-ad10-4eac-9c3a-078266fc485b} -parentPid 700 -crashReporter "\\.\pipe\gecko-crash-server-pipe.700" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
        5⤵
        
        PID:5840
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\a3402b9f-32b3-4ff4-8c3f-418f1186393b.dmp"
        5⤵
        
        PID:5224
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2628 -prefsLen 27133 -prefMapHandle 2056 -prefMapSize 270279 -ipcHandle 2872 -initialChannelId {19ae88d7-6818-4da0-a7bb-d28d771f65f8} -parentPid 700 -crashReporter "\\.\pipe\gecko-crash-server-pipe.700" -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 gpu
        5⤵
        
        PID:4984
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\c237ec89-fa8d-4fa3-bcb9-d51e638cb9fb.dmp"
        5⤵
        
        PID:5204
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2920 -prefsLen 27133 -prefMapHandle 3004 -prefMapSize 270279 -ipcHandle 2988 -initialChannelId {9c978f6b-39d4-4384-8afc-e4c376db7446} -parentPid 700 -crashReporter "\\.\pipe\gecko-crash-server-pipe.700" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 gpu
        5⤵
        
        PID:4664
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\772c1b8b-acce-435c-a36d-caeae8118168.dmp"
        5⤵
        
        PID:748
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3336 -prefsLen 27198 -prefMapHandle 3332 -prefMapSize 270279 -ipcHandle 3436 -initialChannelId {b7aa795e-6c60-42e9-b92d-72dd86e90fb5} -parentPid 700 -crashReporter "\\.\pipe\gecko-crash-server-pipe.700" -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 gpu
        5⤵
        
        PID:3472
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3248 -prefsLen 27323 -prefMapHandle 3236 -prefMapSize 270279 -jsInitHandle 3224 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3876 -initialChannelId {d8497a40-c962-448f-a3ab-6770fb9de1e0} -parentPid 700 -crashReporter "\\.\pipe\gecko-crash-server-pipe.700" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 tab
        5⤵
        Checks processor information in registry
        
        PID:2684
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\0451614b-b431-4cd3-82ca-2cba793f3e7a.dmp"
        5⤵
        
        PID:3396
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3436 -prefsLen 27323 -prefMapHandle 3840 -prefMapSize 270279 -ipcHandle 3464 -initialChannelId {e6bf63c4-9a63-4d3b-b7d7-4e3298ae8e5c} -parentPid 700 -crashReporter "\\.\pipe\gecko-crash-server-pipe.700" -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 gpu
        5⤵
        
        PID:4308
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\b3a2c3d7-e360-4975-9c47-f99e5a1e9a37.dmp"
        5⤵
        
        PID:2788
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4280 -prefsLen 27323 -prefMapHandle 4276 -prefMapSize 270279 -ipcHandle 4268 -initialChannelId {6b08cfb6-fe69-4c35-96af-571ba3ebeaba} -parentPid 700 -crashReporter "\\.\pipe\gecko-crash-server-pipe.700" -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 rdd
        5⤵
        
        PID:6076
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2720 -prefsLen 34822 -prefMapHandle 2724 -prefMapSize 270279 -jsInitHandle 4592 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2996 -initialChannelId {ff744d1b-6ae4-412f-b3fd-4edab513ef60} -parentPid 700 -crashReporter "\\.\pipe\gecko-crash-server-pipe.700" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
        5⤵
        Checks processor information in registry
        
        PID:428
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 2860 -prefsLen 35010 -prefMapHandle 2928 -prefMapSize 270279 -ipcHandle 5044 -initialChannelId {15fa17a5-46d3-49da-ad1d-9f7fcd880025} -parentPid 700 -crashReporter "\\.\pipe\gecko-crash-server-pipe.700" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 utility
        5⤵
        Checks processor information in registry
        
        PID:2724
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3940 -prefsLen 32900 -prefMapHandle 5116 -prefMapSize 270279 -jsInitHandle 5124 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5132 -initialChannelId {0a26e72b-f118-438f-a62a-7ada0618ed6b} -parentPid 700 -crashReporter "\\.\pipe\gecko-crash-server-pipe.700" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
        5⤵
        Checks processor information in registry
        
        PID:1564
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5148 -prefsLen 32900 -prefMapHandle 5152 -prefMapSize 270279 -jsInitHandle 5156 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5164 -initialChannelId {146b1624-4bd7-43fd-8618-f4261152a4d1} -parentPid 700 -crashReporter "\\.\pipe\gecko-crash-server-pipe.700" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
        5⤵
        Checks processor information in registry
        
        PID:2264
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2772 -prefsLen 32900 -prefMapHandle 5644 -prefMapSize 270279 -jsInitHandle 5648 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5564 -initialChannelId {72b7e76f-5992-4215-bfbc-5f85e8590225} -parentPid 700 -crashReporter "\\.\pipe\gecko-crash-server-pipe.700" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab
        5⤵
        Checks processor information in registry
        
        PID:232
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cirjwcad.w04"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious use of FindShellTrayWindow
    PID:5296
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\cirjwcad.w04 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\cirjwcad.w04\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x23c,0x240,0x244,0x238,0x268,0x7ffc93f4f208,0x7ffc93f4f214,0x7ffc93f4f220
      4⤵
      PID:4004
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cirjwcad.w04" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --field-trial-handle=2376,i,8032011530362945054,5981293182195417103,262144 --variations-seed-version --mojo-platform-channel-handle=2372 /prefetch:2
      4⤵
      PID:3408
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cirjwcad.w04" --always-read-main-dll --field-trial-handle=1772,i,8032011530362945054,5981293182195417103,262144 --variations-seed-version --mojo-platform-channel-handle=2392 /prefetch:11
      4⤵
      PID:4168
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cirjwcad.w04" --always-read-main-dll --field-trial-handle=2156,i,8032011530362945054,5981293182195417103,262144 --variations-seed-version --mojo-platform-channel-handle=2412 /prefetch:13
      4⤵
      PID:5712
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cirjwcad.w04" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3124,i,8032011530362945054,5981293182195417103,262144 --variations-seed-version --mojo-platform-channel-handle=3196 /prefetch:1
      4⤵
      PID:5624
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cirjwcad.w04" --instant-process --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3132,i,8032011530362945054,5981293182195417103,262144 --variations-seed-version --mojo-platform-channel-handle=3228 /prefetch:1
      4⤵
      PID:5708
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cirjwcad.w04" --always-read-main-dll --field-trial-handle=3480,i,8032011530362945054,5981293182195417103,262144 --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:14
      4⤵
      PID:1808
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cirjwcad.w04" --always-read-main-dll --field-trial-handle=3472,i,8032011530362945054,5981293182195417103,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:14
      4⤵
      PID:968
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cirjwcad.w04" --always-read-main-dll --field-trial-handle=3520,i,8032011530362945054,5981293182195417103,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:14
      4⤵
      PID:5076
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cirjwcad.w04" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --field-trial-handle=3584,i,8032011530362945054,5981293182195417103,262144 --variations-seed-version --mojo-platform-channel-handle=4408 /prefetch:1
      4⤵
      PID:3388
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cirjwcad.w04" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --field-trial-handle=3600,i,8032011530362945054,5981293182195417103,262144 --variations-seed-version --mojo-platform-channel-handle=4420 /prefetch:9
      4⤵
      PID:2052
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cirjwcad.w04" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --field-trial-handle=3608,i,8032011530362945054,5981293182195417103,262144 --variations-seed-version --mojo-platform-channel-handle=4452 /prefetch:1
      4⤵
      PID:1784
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cirjwcad.w04" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --field-trial-handle=3636,i,8032011530362945054,5981293182195417103,262144 --variations-seed-version --mojo-platform-channel-handle=4440 /prefetch:9
      4⤵
      PID:5184
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cirjwcad.w04" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --field-trial-handle=3660,i,8032011530362945054,5981293182195417103,262144 --variations-seed-version --mojo-platform-channel-handle=4464 /prefetch:1
      4⤵
      PID:3764
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cirjwcad.w04" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --field-trial-handle=3740,i,8032011530362945054,5981293182195417103,262144 --variations-seed-version --mojo-platform-channel-handle=4492 /prefetch:9
      4⤵
      PID:3760
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cirjwcad.w04" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --field-trial-handle=3752,i,8032011530362945054,5981293182195417103,262144 --variations-seed-version --mojo-platform-channel-handle=4884 /prefetch:1
      4⤵
      PID:3252
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cirjwcad.w04" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --field-trial-handle=3768,i,8032011530362945054,5981293182195417103,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:9
      4⤵
      PID:5840
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cirjwcad.w04" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --field-trial-handle=3788,i,8032011530362945054,5981293182195417103,262144 --variations-seed-version --mojo-platform-channel-handle=5004 /prefetch:1
      4⤵
      PID:1692
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cirjwcad.w04" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --field-trial-handle=3804,i,8032011530362945054,5981293182195417103,262144 --variations-seed-version --mojo-platform-channel-handle=4996 /prefetch:9
      4⤵
      PID:4496
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cirjwcad.w04" --always-read-main-dll --field-trial-handle=3916,i,8032011530362945054,5981293182195417103,262144 --variations-seed-version --mojo-platform-channel-handle=5068 /prefetch:14
      4⤵
      PID:1040
    - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=1128
        5⤵
        
        PID:1736
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cirjwcad.w04" --always-read-main-dll --field-trial-handle=4956,i,8032011530362945054,5981293182195417103,262144 --variations-seed-version --mojo-platform-channel-handle=3748 /prefetch:14
      4⤵
      PID:4988
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cirjwcad.w04" --always-read-main-dll --field-trial-handle=5428,i,8032011530362945054,5981293182195417103,262144 --variations-seed-version --mojo-platform-channel-handle=4352 /prefetch:14
      4⤵
      PID:5576
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cirjwcad.w04" --always-read-main-dll --field-trial-handle=5468,i,8032011530362945054,5981293182195417103,262144 --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:14
      4⤵
      PID:2112
    - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=592
        5⤵
        
        PID:4536
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cirjwcad.w04" --always-read-main-dll --field-trial-handle=5476,i,8032011530362945054,5981293182195417103,262144 --variations-seed-version --mojo-platform-channel-handle=6208 /prefetch:14
      4⤵
      PID:3228
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --no-sandbox --mute-audio --onnx-enabled-for-ee --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cirjwcad.w04" --always-read-main-dll --field-trial-handle=5492,i,8032011530362945054,5981293182195417103,262144 --variations-seed-version --mojo-platform-channel-handle=6252 /prefetch:14
      4⤵
      PID:556
  - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cirjwcad.w04" --always-read-main-dll --field-trial-handle=5068,i,8032011530362945054,5981293182195417103,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:14
      4⤵
      PID:3784
  - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cirjwcad.w04" --always-read-main-dll --field-trial-handle=5068,i,8032011530362945054,5981293182195417103,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:14
      4⤵
      PID:4344
  - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\Installer\setup.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
      4⤵
      Drops file in Program Files directory
      Drops file in Windows directory
      PID:5824
    - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\Installer\setup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x234,0x238,0x23c,0x210,0x240,0x7ff7c6b66a68,0x7ff7c6b66a74,0x7ff7c6b66a80
        5⤵
        Drops file in Windows directory
        
        PID:2020
    - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\Installer\setup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\Installer\setup.exe" --msedge --system-level --verbose-logging --installerdata="C:\Program Files (x86)\Microsoft\Edge\Application\master_preferences" --create-shortcuts=1 --install-level=0
        5⤵
        Drops file in Program Files directory
        Drops file in Windows directory
        
        PID:2320
      - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\Installer\setup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x234,0x238,0x23c,0x210,0x240,0x7ff7c6b66a68,0x7ff7c6b66a74,0x7ff7c6b66a80
        6⤵
        Drops file in Windows directory
        
        PID:4444
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cirjwcad.w04" --always-read-main-dll --field-trial-handle=6448,i,8032011530362945054,5981293182195417103,262144 --variations-seed-version --mojo-platform-channel-handle=6456 /prefetch:14
      4⤵
      PID:2724
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cirjwcad.w04" --always-read-main-dll --field-trial-handle=4336,i,8032011530362945054,5981293182195417103,262144 --variations-seed-version --mojo-platform-channel-handle=6512 /prefetch:14
      4⤵
      PID:5588
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\mmotvssi.03b"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious use of FindShellTrayWindow
    PID:4832
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\mmotvssi.03b /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\mmotvssi.03b\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x23c,0x240,0x244,0x238,0x2f0,0x7ffc93f4f208,0x7ffc93f4f214,0x7ffc93f4f220
      4⤵
      PID:5192
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\mmotvssi.03b" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --field-trial-handle=2124,i,13149813917428359401,4283016728643942287,262144 --variations-seed-version --mojo-platform-channel-handle=2120 /prefetch:2
      4⤵
      PID:396
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\mmotvssi.03b" --always-read-main-dll --field-trial-handle=1784,i,13149813917428359401,4283016728643942287,262144 --variations-seed-version --mojo-platform-channel-handle=1632 /prefetch:11
      4⤵
      PID:4728
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\mmotvssi.03b" --always-read-main-dll --field-trial-handle=1780,i,13149813917428359401,4283016728643942287,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:13
      4⤵
      PID:4152
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\mmotvssi.03b" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=2984,i,13149813917428359401,4283016728643942287,262144 --variations-seed-version --mojo-platform-channel-handle=3024 /prefetch:1
      4⤵
      PID:3108
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\mmotvssi.03b" --instant-process --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=2992,i,13149813917428359401,4283016728643942287,262144 --variations-seed-version --mojo-platform-channel-handle=3048 /prefetch:1
      4⤵
      PID:1556
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\mmotvssi.03b" --always-read-main-dll --field-trial-handle=3192,i,13149813917428359401,4283016728643942287,262144 --variations-seed-version --mojo-platform-channel-handle=3224 /prefetch:14
      4⤵
      PID:5324
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\mmotvssi.03b" --always-read-main-dll --field-trial-handle=3212,i,13149813917428359401,4283016728643942287,262144 --variations-seed-version --mojo-platform-channel-handle=3304 /prefetch:14
      4⤵
      PID:5276
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\mmotvssi.03b" --always-read-main-dll --field-trial-handle=3228,i,13149813917428359401,4283016728643942287,262144 --variations-seed-version --mojo-platform-channel-handle=4140 /prefetch:14
      4⤵
      PID:2764
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\mmotvssi.03b" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --field-trial-handle=3296,i,13149813917428359401,4283016728643942287,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:1
      4⤵
      PID:572
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\mmotvssi.03b" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --field-trial-handle=3332,i,13149813917428359401,4283016728643942287,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:9
      4⤵
      PID:5628
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\mmotvssi.03b" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --field-trial-handle=3360,i,13149813917428359401,4283016728643942287,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:1
      4⤵
      PID:6072
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\mmotvssi.03b" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --field-trial-handle=3388,i,13149813917428359401,4283016728643942287,262144 --variations-seed-version --mojo-platform-channel-handle=4392 /prefetch:9
      4⤵
      PID:2548
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\mmotvssi.03b" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --field-trial-handle=3408,i,13149813917428359401,4283016728643942287,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:1
      4⤵
      PID:6268
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\mmotvssi.03b" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --field-trial-handle=3424,i,13149813917428359401,4283016728643942287,262144 --variations-seed-version --mojo-platform-channel-handle=3216 /prefetch:9
      4⤵
      PID:6348
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\mmotvssi.03b" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --field-trial-handle=3444,i,13149813917428359401,4283016728643942287,262144 --variations-seed-version --mojo-platform-channel-handle=4576 /prefetch:1
      4⤵
      PID:6400
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\mmotvssi.03b" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --field-trial-handle=3460,i,13149813917428359401,4283016728643942287,262144 --variations-seed-version --mojo-platform-channel-handle=4564 /prefetch:9
      4⤵
      PID:6408
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\mmotvssi.03b" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --field-trial-handle=3480,i,13149813917428359401,4283016728643942287,262144 --variations-seed-version --mojo-platform-channel-handle=4596 /prefetch:1
      4⤵
      PID:6416
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\mmotvssi.03b" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --field-trial-handle=3508,i,13149813917428359401,4283016728643942287,262144 --variations-seed-version --mojo-platform-channel-handle=4588 /prefetch:9
      4⤵
      PID:6504
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\mmotvssi.03b" --always-read-main-dll --field-trial-handle=4476,i,13149813917428359401,4283016728643942287,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:14
      4⤵
      PID:7040
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\mmotvssi.03b" --always-read-main-dll --field-trial-handle=4916,i,13149813917428359401,4283016728643942287,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:14
      4⤵
      PID:1316
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\mmotvssi.03b" --always-read-main-dll --field-trial-handle=5224,i,13149813917428359401,4283016728643942287,262144 --variations-seed-version --mojo-platform-channel-handle=4468 /prefetch:14
      4⤵
      PID:3808
    - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=1100
        5⤵
        
        PID:4884
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\mmotvssi.03b" --always-read-main-dll --field-trial-handle=5424,i,13149813917428359401,4283016728643942287,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:14
      4⤵
      PID:5056
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --no-sandbox --mute-audio --onnx-enabled-for-ee --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\mmotvssi.03b" --always-read-main-dll --field-trial-handle=5432,i,13149813917428359401,4283016728643942287,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:14
      4⤵
      PID:3116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\mmotvssi.03b" --always-read-main-dll --field-trial-handle=6256,i,13149813917428359401,4283016728643942287,262144 --variations-seed-version --mojo-platform-channel-handle=6212 /prefetch:14
      4⤵
      PID:3444
    - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=592
        5⤵
        
        PID:3984
  - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\mmotvssi.03b" --always-read-main-dll --field-trial-handle=4100,i,13149813917428359401,4283016728643942287,262144 --variations-seed-version --mojo-platform-channel-handle=6260 /prefetch:14
      4⤵
      PID:7032
  - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\mmotvssi.03b" --always-read-main-dll --field-trial-handle=4100,i,13149813917428359401,4283016728643942287,262144 --variations-seed-version --mojo-platform-channel-handle=6260 /prefetch:14
      4⤵
      PID:7088
  - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\Installer\setup.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
      4⤵
      Drops file in Program Files directory
      Drops file in Windows directory
      PID:6568
    - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\Installer\setup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x234,0x238,0x23c,0x210,0x240,0x7ff7c6b66a68,0x7ff7c6b66a74,0x7ff7c6b66a80
        5⤵
        Drops file in Windows directory
        
        PID:7116
    - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\Installer\setup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\Installer\setup.exe" --msedge --system-level --verbose-logging --installerdata="C:\Program Files (x86)\Microsoft\Edge\Application\master_preferences" --create-shortcuts=1 --install-level=0
        5⤵
        Drops file in Program Files directory
        Drops file in Windows directory
        
        PID:5796
      - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\Installer\setup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x234,0x238,0x23c,0x1e4,0x240,0x7ff7c6b66a68,0x7ff7c6b66a74,0x7ff7c6b66a80
        6⤵
        Drops file in Windows directory
        
        PID:5832
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vixfubli.jsu"
    3⤵
    PID:6016
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir=C:\Users\Admin\AppData\Local\Temp\vixfubli.jsu
      4⤵
      Checks processor information in registry
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:2472
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1908 -prefsLen 27097 -prefMapHandle 1912 -prefMapSize 270331 -ipcHandle 1976 -initialChannelId {ea5f5865-2c56-405a-b0c3-9bc18d5dc00c} -parentPid 2472 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2472" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
        5⤵
        
        PID:2684
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2244 -prefsLen 27133 -prefMapHandle 2240 -prefMapSize 270331 -ipcHandle 2364 -initialChannelId {2e4622ca-cb25-4276-a79b-e589e443b7da} -parentPid 2472 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2472" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
        5⤵
        
        PID:2300
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\d60d92d3-e72c-4447-9ae3-16dfe276de9f.dmp"
        5⤵
        
        PID:1968
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1976 -prefsLen 27133 -prefMapHandle 2680 -prefMapSize 270331 -ipcHandle 2684 -initialChannelId {4794a9d7-9ce7-45ae-8d7a-aab57c08ad55} -parentPid 2472 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2472" -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 gpu
        5⤵
        
        PID:3104
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\0fd36a56-36ff-4490-bdd9-96c4ed0a12e3.dmp"
        5⤵
        
        PID:5472
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2728 -prefsLen 27133 -prefMapHandle 3180 -prefMapSize 270331 -ipcHandle 2508 -initialChannelId {971b6b49-71b2-418a-93b6-a59df2224ef4} -parentPid 2472 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2472" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 gpu
        5⤵
        
        PID:4836
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3728 -prefsLen 27323 -prefMapHandle 3704 -prefMapSize 270331 -jsInitHandle 3712 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3772 -initialChannelId {7d16c57c-a420-41c5-8413-631552a7103f} -parentPid 2472 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2472" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
        5⤵
        Checks processor information in registry
        
        PID:2200
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\317015f6-3cb5-4368-a0ee-09eb0504dbe9.dmp"
        5⤵
        
        PID:408
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3328 -prefsLen 27323 -prefMapHandle 3428 -prefMapSize 270331 -ipcHandle 2808 -initialChannelId {62f16437-3263-48a0-8584-331424f364ba} -parentPid 2472 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2472" -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 gpu
        5⤵
        
        PID:5564
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\4e24e643-d3d0-43a7-b2dc-471a77ca9022.dmp"
        5⤵
        
        PID:6168
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4112 -prefsLen 27323 -prefMapHandle 4116 -prefMapSize 270331 -ipcHandle 4124 -initialChannelId {44ddea93-98ac-4b73-b237-b90701b8c865} -parentPid 2472 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2472" -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 rdd
        5⤵
        
        PID:6960
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4448 -prefsLen 34876 -prefMapHandle 4452 -prefMapSize 270331 -jsInitHandle 4456 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4464 -initialChannelId {2d770ea1-f611-40f4-95ca-400453d68929} -parentPid 2472 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2472" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
        5⤵
        Checks processor information in registry
        
        PID:6608
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5052 -prefsLen 34876 -prefMapHandle 5056 -prefMapSize 270331 -ipcHandle 5008 -initialChannelId {6bc754c8-841c-4724-8e1b-1787bcce59bc} -parentPid 2472 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2472" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 utility
        5⤵
        Checks processor information in registry
        
        PID:5844
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5076 -prefsLen 32766 -prefMapHandle 5080 -prefMapSize 270331 -jsInitHandle 5084 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5004 -initialChannelId {2477aa21-d1e4-401d-858a-de7ff1b22e04} -parentPid 2472 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2472" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
        5⤵
        Checks processor information in registry
        
        PID:2296
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3252 -prefsLen 32766 -prefMapHandle 2792 -prefMapSize 270331 -jsInitHandle 3436 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5108 -initialChannelId {94928320-674f-4885-b692-33a44f535cbd} -parentPid 2472 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2472" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
        5⤵
        Checks processor information in registry
        
        PID:996
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5560 -prefsLen 32818 -prefMapHandle 5564 -prefMapSize 270331 -jsInitHandle 5568 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5576 -initialChannelId {3483a817-4711-4dc4-9e66-4872b597de04} -parentPid 2472 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2472" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
        5⤵
        Checks processor information in registry
        
        PID:5064
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ykkjfujr.b5d"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    PID:6596
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\ykkjfujr.b5d /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\ykkjfujr.b5d\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\ykkjfujr.b5d --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x108,0x10c,0x110,0xe4,0x114,0x7ffc943edcf8,0x7ffc943edd04,0x7ffc943edd10
      4⤵
      PID:6644
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ykkjfujr.b5d" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=2032,i,13282722663322522970,5727190222108156890,262144 --variations-seed-version --mojo-platform-channel-handle=2028 /prefetch:2
      4⤵
      PID:3080
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ykkjfujr.b5d" --field-trial-handle=1788,i,13282722663322522970,5727190222108156890,262144 --variations-seed-version --mojo-platform-channel-handle=2124 /prefetch:11
      4⤵
      PID:416
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ykkjfujr.b5d" --field-trial-handle=1880,i,13282722663322522970,5727190222108156890,262144 --variations-seed-version --mojo-platform-channel-handle=2828 /prefetch:13
      4⤵
      PID:7036
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ykkjfujr.b5d" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=2756,i,13282722663322522970,5727190222108156890,262144 --variations-seed-version --mojo-platform-channel-handle=2856 /prefetch:1
      4⤵
      PID:7008
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ykkjfujr.b5d" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=2764,i,13282722663322522970,5727190222108156890,262144 --variations-seed-version --mojo-platform-channel-handle=2864 /prefetch:1
      4⤵
      PID:4656
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ykkjfujr.b5d" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3092,i,13282722663322522970,5727190222108156890,262144 --variations-seed-version --mojo-platform-channel-handle=3128 /prefetch:1
      4⤵
      PID:892
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ykkjfujr.b5d" --extension-process --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=3100,i,13282722663322522970,5727190222108156890,262144 --variations-seed-version --mojo-platform-channel-handle=3432 /prefetch:9
      4⤵
      PID:6720
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ykkjfujr.b5d" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=3140,i,13282722663322522970,5727190222108156890,262144 --variations-seed-version --mojo-platform-channel-handle=3704 /prefetch:1
      4⤵
      PID:6736
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ykkjfujr.b5d" --extension-process --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=3172,i,13282722663322522970,5727190222108156890,262144 --variations-seed-version --mojo-platform-channel-handle=3364 /prefetch:9
      4⤵
      PID:2124
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ykkjfujr.b5d" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=3880,i,13282722663322522970,5727190222108156890,262144 --variations-seed-version --mojo-platform-channel-handle=3260 /prefetch:1
      4⤵
      PID:6480
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ykkjfujr.b5d" --field-trial-handle=3360,i,13282722663322522970,5727190222108156890,262144 --variations-seed-version --mojo-platform-channel-handle=3872 /prefetch:14
      4⤵
      PID:1808
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ykkjfujr.b5d" --field-trial-handle=4872,i,13282722663322522970,5727190222108156890,262144 --variations-seed-version --mojo-platform-channel-handle=4928 /prefetch:14
      4⤵
      PID:808
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ykkjfujr.b5d" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=4972,i,13282722663322522970,5727190222108156890,262144 --variations-seed-version --mojo-platform-channel-handle=4992 /prefetch:1
      4⤵
      PID:3764
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ykkjfujr.b5d" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=5012,i,13282722663322522970,5727190222108156890,262144 --variations-seed-version --mojo-platform-channel-handle=4996 /prefetch:1
      4⤵
      PID:1988
  - - C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
      4⤵
      Drops file in Windows directory
      PID:1520
    - - C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x244,0x248,0x24c,0x220,0x250,0x7ff7dfe71f58,0x7ff7dfe71f64,0x7ff7dfe71f70
        5⤵
        Drops file in Windows directory
        
        PID:3204
    - - C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\initial_preferences" --create-shortcuts=1 --install-level=0
        5⤵
        Drops file in Windows directory
        Modifies registry class
        Suspicious use of FindShellTrayWindow
        
        PID:4392
      - C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x244,0x248,0x24c,0x220,0x250,0x7ff7dfe71f58,0x7ff7dfe71f64,0x7ff7dfe71f70
        6⤵
        Drops file in Windows directory
        
        PID:2264
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ykkjfujr.b5d" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=5100,i,13282722663322522970,5727190222108156890,262144 --variations-seed-version --mojo-platform-channel-handle=4988 /prefetch:1
      4⤵
      PID:6632
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ykkjfujr.b5d" --field-trial-handle=5092,i,13282722663322522970,5727190222108156890,262144 --variations-seed-version --mojo-platform-channel-handle=5088 /prefetch:14
      4⤵
      PID:6208
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ykkjfujr.b5d" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=5116,i,13282722663322522970,5727190222108156890,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:1
      4⤵
      PID:6656
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ykkjfujr.b5d" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --field-trial-handle=4940,i,13282722663322522970,5727190222108156890,262144 --variations-seed-version --mojo-platform-channel-handle=5104 /prefetch:1
      4⤵
      PID:4400
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ykkjfujr.b5d" --field-trial-handle=4980,i,13282722663322522970,5727190222108156890,262144 --variations-seed-version --mojo-platform-channel-handle=5032 /prefetch:14
      4⤵
      PID:7140
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ykkjfujr.b5d" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --field-trial-handle=4956,i,13282722663322522970,5727190222108156890,262144 --variations-seed-version --mojo-platform-channel-handle=5044 /prefetch:1
      4⤵
      PID:5004
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ykkjfujr.b5d" --field-trial-handle=5308,i,13282722663322522970,5727190222108156890,262144 --variations-seed-version --mojo-platform-channel-handle=5300 /prefetch:14
      4⤵
      PID:5440
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ykkjfujr.b5d" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --field-trial-handle=5024,i,13282722663322522970,5727190222108156890,262144 --variations-seed-version --mojo-platform-channel-handle=5272 /prefetch:1
      4⤵
      PID:3488
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ykkjfujr.b5d" --field-trial-handle=4976,i,13282722663322522970,5727190222108156890,262144 --variations-seed-version --mojo-platform-channel-handle=4988 /prefetch:14
      4⤵
      PID:6604
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ykkjfujr.b5d" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --field-trial-handle=5300,i,13282722663322522970,5727190222108156890,262144 --variations-seed-version --mojo-platform-channel-handle=4968 /prefetch:1
      4⤵
      PID:1548
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ykkjfujr.b5d" --extension-process --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --field-trial-handle=5284,i,13282722663322522970,5727190222108156890,262144 --variations-seed-version --mojo-platform-channel-handle=3844 /prefetch:9
      4⤵
      PID:2968

C:\Users\Admin\AppData\Roaming\aKjaHHPf.exe
C:\Users\Admin\AppData\Roaming\aKjaHHPf.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4584
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\aKjaHHPf.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1016
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\aKjaHHPf.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5668
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\aKjaHHPf" /XML "C:\Users\Admin\AppData\Local\Temp\tmpFA0F.tmp"
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:2028
- C:\Users\Admin\AppData\Roaming\aKjaHHPf.exe
  "C:\Users\Admin\AppData\Roaming\aKjaHHPf.exe"
  2⤵
  - Executes dropped EXE
  PID:2948
- C:\Users\Admin\AppData\Roaming\aKjaHHPf.exe
  "C:\Users\Admin\AppData\Roaming\aKjaHHPf.exe"
  2⤵
  - Executes dropped EXE
  PID:5104
- C:\Users\Admin\AppData\Roaming\aKjaHHPf.exe
  "C:\Users\Admin\AppData\Roaming\aKjaHHPf.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:3892

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4752

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4844_13406898059531297.pma

Path C:\Program Files\Google\Chrome\Application\SetupMetrics\4844_13406898059531297.pma
Size 344B
SHA256 fd668d6edcf6b6cc176edd9bf7b0d7f1881fe2f0d94ebae656127c27a359550e
MD5 1b7cdddfb06152ae01f12d9f253237d6
SHA1 1ef358781a086a0727f4fa95cd53510eb328bc52
SHA512 4705c93b233be92dd2d04649d404b538bc76607bbe655d5e35a739653ac1af776ecdd12ec1cbf81476070ec5bae633f891817155014730a06939efb21bd132ea
MD5 SHA1 SHA512

Submit Download

5048_13406898059489741.pma

Path C:\Program Files\Google\Chrome\Application\SetupMetrics\5048_13406898059489741.pma
Size 696B
SHA256 da9a8ae0c04da6ceae900796a026f4777895bf149eed2c495fbdae098362f596
MD5 3f5af086a83b749aa34a3aac1b986a0a
SHA1 0e67e17122beec914722d98cef0e669541560ff3
SHA512 0a12749b3971d0023cc1dd4f87113c94cc2c961ef824009c89a32ba24fe51de83357bb0757af7612ffb3a638302f5a298a2fc823dec8d117cf27255d2996191b
MD5 SHA1 SHA512

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 9600b3fdf0565ccb49e21656aa4b24d7c18f776bfd04d9ee984b134707550f02
MD5 d0c46cad6c0778401e21910bd6b56b70
SHA1 7be418951ea96326aca445b8dfe449b2bfa0dca6
SHA512 057531b468f7fbbb2175a696a8aab274dec0d17d9f71df309edcff35e064f3378050066a3df47ccd03048fac461594ec75e3d4fe64f9dd79949d129f51e02949
MD5 SHA1 SHA512

Submit Download

activity-stream.contile.json.tmp

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5rm9ff4w.default-release\activity-stream.contile.json.tmp
Size 4KB
SHA256 4a799e26c41a639d12208f0389d4fb0a43e8dcde174e0772089c931f1cba0ab9
MD5 67a223a6b372fc33cc1be7197ef0e13b
SHA1 3605accd08cc7a24808eb6838a7942849028933c
SHA512 152fcd0b7ac888a939c367dc4f1a2a75e58f9b475d2e47b1a6b445840cb5c3d1e63a49d92c6e887f59ba0c311ec4e31d80eaac68a2f7a6343b9a0afdd1836e70
SSDEEP 96:KsytDQtRINZdqPUuvI3SgsF06PTz8dVtl:KsytDQtRIPdAHkSgsF0Y8dVtl
MD5 SHA1 SHA512 SSDEEP

Submit Download

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5rm9ff4w.default-release\activity-stream.discovery_stream.json
Size 23KB
SHA256 e1e7b2135f8be08e7281f83209c7550f3bdf250754397c6f0b8b1d16c68de0ec
MD5 dee654a2591b0265210692e9dae27c24
SHA1 c4f92c872ad889722fd4d45d39c8d4312ea2e3d6
SHA512 14a8bb095ca75ce5aa6691d3746407dd1992cac2c6274a788143dfaa6373bea0dad4410146392de1185207dc3c5f97f62054235904b69b5481235d858bc3d796
SSDEEP 384:lyalBW/DTpwVrAg7i06lHt2LgJF+8eP0yP:ly5bTorAMi06lSgi8eJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5rm9ff4w.default-release\startupCache\webext.sc.lz4
Size 104KB
SHA256 bff47c76bffe21dc96967f0e471aca6c970139e01aea63e60bf47d01d27b7f72
MD5 8114417a961f9d8f7b9d1e33b2a7a1e0
SHA1 e6e926690ea0f21ed184a758ab33d891ae0eef93
SHA512 2787ee341ffa350ba022bb5b2e227e773ba37aa0432bd83819d5926a4e8afbbc93746c5f340507a0da5c7285e03d15be3eb594f2807c0044c8875172c67680c3
SSDEEP 3072:j3l9qrcQ+V49VTETiayc1pdrVjdngh6bHvq:pgmVWQTiNGFdn06bPq
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_uhdvrz5v.gor.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_uhdvrz5v.gor.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\cedl4lis.mum\Crashpad\settings.dat
Size 40B
SHA256 58df33bcbc900208f9355a8a90cb9a279853ea87b44ea167945d7c141e9e78ba
MD5 c917fc64f0a53fc536524d1ce3f54366
SHA1 4915dc4749e41d015e3f59b5b49d8cdc0dd294a7
SHA512 39387786e97764938edebfe438a3df6b1fd652f1e48dba5ed24092135498102a87ea7cebb586df6cb4a75752fada077cf53e123790c16c71950a9414a898b27a
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Temp\cedl4lis.mum\Default\BrowsingTopicsState
Size 414B
SHA256 dc66d7060e33e16e131a76078d03f064106884264b92faaab967035b53557da6
MD5 9016462356204414c60881c164386ab4
SHA1 b7b9fccb4871f0470fda06d07df550c776ff13fa
SHA512 c1c1d4e1b9d1a3c6d82b01fe196e3e2b056122fa5fff5ee282c0152c5f6c69a4514b462c770cd95ba820ff04737d9b3dfbefb5a6fa79d00a63a2df86fd328232
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\cedl4lis.mum\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 64981a65560246592ff0fa67075c9c19f2976f38db3d494ee226dc699f204577
MD5 b2d79af80d80cd3e8e52df337c528b58
SHA1 6349b615722e7455acc84de0990960806e7b1423
SHA512 de88a2c1d54ce3692eb062a86c10e6cfa1ba33758eac3606e8ffa3aa4b39a49fc513b3d13515516f1644f785f0b47e9e8b0e3852270926aafda503319f070648
SSDEEP 6:/FoEXEm9KUClnUX+EGu9r8Ee/1Ft0lgTtIGLTHVDldQ:d7XPkUCh1sQEO130gL35ld
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\cedl4lis.mum\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 9744ff67dfac0492db76c3eb6098922a47b5e24d4886aa3345daa19747e19651
MD5 71b4dacd2010e730e4d44cd09821d55b
SHA1 73461f6705a27c88eae19132714b506c21e4c1c3
SHA512 27dc8f9ab7294f2de8e8f8864a0339ac275a194801e2ecc3d3660c828743b6bd9ac538bbc33ca2903f468fa5bba56c86ad2e392d2eaf0500c24e25e14ff7c21a
SSDEEP 48:9tY232ufLyMCXgkMiXGRGxoyCqS8aBCy8aI9W0:9q0g/gkD6PDqSCy8aV0
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\cedl4lis.mum\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 9809ca6fcec6a6699a6ce82913198870e36798e30cb5d3504bf66b4dfb1fa5f7
MD5 661767d436e120b0551d71bd721247b5
SHA1 d1706e9b5123e6d72c1c4e8f13003d3b8390706d
SHA512 2a3a4bc034fda8335e1431245732e791e18db8988e32087b797c4aa7cd669002918f124d3fd60e8d3ad1d8c1d2b8bbee7e30a1dbef5098c9e776c345cca2aaa2
SSDEEP 24:WTqkGCDOj2NIRqBXQ8XloJc0C/PuhPgg1eA3uRxbagzu3XOJmlOji2:NkGaGZRqRdoJVCehPgBADHHEmlYV
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\cedl4lis.mum\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 45fca43995cb6c5afce2b592bb668c41762692cc9356122a052cabf97d026dda
MD5 c30daa7678bdd8643760f4b5cd4ba85d
SHA1 75a125a85f7342e46a6e79a44501467fbeee0b2a
SHA512 e6d683fc69e5ecd196d05f8009389c3e2cc89ea79488611da163d6c74435573a0a6c9f3c43528fe5bfbbf7f4fdf6b600965672ccf45cbf313ba3860fd4c744cb
SSDEEP 768:jfDPLSgcRUv+O4TUfDPLSgcRUv+H4GUfDPLSgcRUv+A4744Nha44Q441E4:HMGk4E0434gE
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000001

Path C:\Users\Admin\AppData\Local\Temp\cedl4lis.mum\Default\Cache\Cache_Data\f_000001
Size 35KB
SHA256 1dc76cfb65267052554a9c945cfc14f6e6e46cd332980f9659cb12314c919e03
MD5 fb6405136bf92d149c571db55106f482
SHA1 2503211a5a703f019ba54626c375d96d84a7d233
SHA512 f0f845c29430c22f82c8c5a9343b8386e6d1bf8ddfdf7637309ddb20b7f240c22bcabd56694d420b25113c257992e9a5e5490bda8421f272873dcaa5a6e70f6c
SSDEEP 768:G/wEvbdJPwltoB8JRcZqsMAKNdORaoAg0LaJGC+i:GoEvP2WKJSUhh54Wi
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000002

Path C:\Users\Admin\AppData\Local\Temp\cedl4lis.mum\Default\Cache\Cache_Data\f_000002
Size 68KB
SHA256 60285351809cdc81f9a541ac176ee41a98966083b696554a24f7d40f84a7d147
MD5 5ad9e126b3f5ab697fb695128fb4cce6
SHA1 097df99986db1c7fa1c25562544f17515cd7fc42
SHA512 32e7432260742798fcfefd6c6afa92482ad6ef24f7c60f58ac6079de0e8a0baa80ebf172f45499e0de0efd1f51a3e3a9fa654b41ada4ca706abb80b82a23803b
SSDEEP 1536:4Hxw1mszr0jRYLO0hfTjWlO6E/8xH0PllThTxdCvbA:4o0j+dlTqg6om0ZreA
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000003

Path C:\Users\Admin\AppData\Local\Temp\cedl4lis.mum\Default\Cache\Cache_Data\f_000003
Size 38KB
SHA256 f9ad4fa1adfc18c4dd4b6e8b0aec3991749370ace523aa00e094d9eadaba6dcf
MD5 1fd363e44327c5e74ba59a663f190419
SHA1 5766c2a04931b7834cef2efb92fb501f58ae0e42
SHA512 e23cce63fc528598da30f17f330755d2b837c6aff46130f335ac0eb00547aad0039d76f9a5bf74aa1d6877c3b067a6abac44b50fa8496959a4d2f81535e1ffaa
SSDEEP 768:WKlVzaWjdNYbC92iImwXG7o2QHaKWiF8B5ccJ25h9Z6g8ysY3kEhTn9Jl:WQz7SC92IPo2s8B5c7Z6g89Kp9Jl
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\cedl4lis.mum\Default\Cache\Cache_Data\index
Size 256KB
SHA256 fa0af4a09669074e75d5e2ffba92d1d2e4f88651e723c8889fa1569264c7a765
MD5 c6aa37cfcc4724a5dc13bda307049232
SHA1 12588254300b076441aea27a9c051c697f4b1184
SHA512 f59690591584959dce9ab3ab7d31cb8b917d011d40492d853aff34248f383c54a57c56c663a795768306b9020618a087b2a6826d3022b6a6cdd5a7722cdcfb75
SSDEEP 3:LsLllNlNllklkXltDC/Sllx/mltb/sE/9lXlDlL/WNtlQl:LsRt3lPlTe9EEHeN
MD5 SHA1 SHA512 SSDEEP

Submit Download

7018b8cf1c3b00c7_0

Path C:\Users\Admin\AppData\Local\Temp\cedl4lis.mum\Default\Code Cache\js\7018b8cf1c3b00c7_0
Size 306B
SHA256 d3e01bf5a56666131505fd5b7bc095d02de3a0167793b34ffec4b15b5554c1a1
MD5 e6e4243141f54a7acb3d7e5ad18ac2bb
SHA1 4d6660e02adb8dafc5fce45b26b83a0eace13cc1
SHA512 544938ec1ce26411089e51cd224b75cbbb3ae516a5a6b077beaae16ce19cc89c78eafc8e986e34d9fc76f243cd9d48caa37079963266ffd77f112d016c76954e
MD5 SHA1 SHA512

Submit Download

ba678a2fbd8c358c_0

Path C:\Users\Admin\AppData\Local\Temp\cedl4lis.mum\Default\Code Cache\js\ba678a2fbd8c358c_0
Size 298B
SHA256 598569916a3fa1bc7f381c174cee1232d1b31d3f3afd85a3759d8c5dfcb04a8b
MD5 5d0584e82e590b250a5f8a84dfe12268
SHA1 1ca3cfac74eaa17fe8feb9e543bc7711169f4b45
SHA512 69fc851fcc9dd06f615c04ff6af2f4db9ae34cb03e091b2cb4a49b580caf09a0988aba8106837f4ce199a1634b181dd95388524dcda9cb5715490b10312d4484
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\cedl4lis.mum\Default\Code Cache\wasm\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\cedl4lis.mum\Default\Code Cache\wasm\index-dir\the-real-index
Size 48B
SHA256 380587155c05af64066e2f8bd0f517e617e9674d61c90b8a6569c868637873f0
MD5 c83594742b7785c64e944543d678a899
SHA1 180403a5387b486ca45c5bca74bedfce2790ea9a
SHA512 98af8f33fd6c308bb05386f98160567cbe2d9e802a597ff4c409b2e150a932c3ded38b34a981bc1ccce2c6645e36eca6b10d07ef21ab4fc92dceca698a2ceb94
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\cedl4lis.mum\Default\DawnGraphiteCache\index
Size 256KB
SHA256 d4cf91b00d48cf55ad7764e1875d86b370bd87c9330fbd0595ed2f5eb075bfee
MD5 d6075d16ae4489886eaa2d3c2b380863
SHA1 c9973a6fcade77cda40de47be80f714bed9437e2
SHA512 03de13c3f8423b660f5396cb27f41cc67da3f29da88b21d0a4193c12c1c2c380c70e85e32e4eceb70738d297672cf05aa57674897d86ae19d7778db58e288f30
SSDEEP 3:LstlNllklkXlUEK:LsX3lPUEK
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\cedl4lis.mum\Default\DawnWebGPUCache\index
Size 256KB
SHA256 985326ed0ea230e7bdb44a1562520d0c575d1912582a2bdcc7347126884721db
MD5 d2649a4bf7e1d876baf2cf9b70566f50
SHA1 ddcdc9b62029b31c9c84c98f57f8003260a7c2f5
SHA512 bfa7c8df541bb5aacf6e0a445efb201f1ef0ed3d843de45bce37706558649298c6c843c186c19d4ac7b88abf57970c37740eac8fdce2da4a83a71718b408b53d
SSDEEP 3:LstlNllklkXl0RVl:LsX3lPE
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\cedl4lis.mum\Default\Extension Rules\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\cedl4lis.mum\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

128.png

Path C:\Users\Admin\AppData\Local\Temp\cedl4lis.mum\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.97.1_0\128.png
Size 4KB
SHA256 75da533888189d13fc340d40637b9fc07a3f732e3fcf33ec300f4c7268790a62
MD5 35696aba596d5b8619a558dd05b4ad40
SHA1 7ecc1dad332847b08c889cb35dda9d4bae85dea8
SHA512 c32f20865f736b772844aaa44572369e7ae85b9f2f17f87d61694acc54487309a32bc4830ed8d9cee8b593babecf728c1ea33c2b9588649be0e4f1e6ed7ee753
SSDEEP 96:BCspUuBfy1PI2JIwOKpGzJhvw3ymK198EfeCW74mWQz3Z+1nl03Vjkq:BCsfly5TeFKpGFy3ymK1+oK4zQ1+Q6q
MD5 SHA1 SHA512 SSDEEP

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Temp\cedl4lis.mum\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.97.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Temp\cedl4lis.mum\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.97.1_0\manifest.json
Size 2KB
SHA256 ef67877af40d32f48d45e0fc44245f191e795b64ead8f4b87664ab80d0ca36a7
MD5 580173b7de156e29884d4f57a66ec07b
SHA1 9f08b09fb87b9db088c0de9c1af37fcee1dc94d8
SHA512 fc1d083171f4b25de0d4daa432ddde852bc160aa9fcdd7668438faabf14dfc75f2854a4936aea9990b3e487017f2f2d41a188e915a1063055b67456c859a9e1b
MD5 SHA1 SHA512

Submit Download

offscreendocument.html

Path C:\Users\Admin\AppData\Local\Temp\cedl4lis.mum\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.97.1_0\offscreendocument.html
Size 97B
SHA256 b9fa2d52a4ffabb438b56184131b893b04655b01f336066415d4fe839efe64e7
MD5 b747b5922a0bc74bbf0a9bc59df7685f
SHA1 7bf124b0be8ee2cfcd2506c1c6ffc74d1650108c
SHA512 7567761be4054fcb31885e16d119cd4e419a423ffb83c3b3ed80bfbf64e78a73c2e97aae4e24ab25486cd1e43877842db0836db58fbfbcef495bc53f9b2a20ec
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\cedl4lis.mum\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

32.png

Path C:\Users\Admin\AppData\Local\Temp\cedl4lis.mum\Default\Web Applications\Manifest Resources\mdpkiolbdkhdjpekfbkbmhigcaggjagi\Icons\32.png
Size 1KB
SHA256 a5670fe56dbae316511d6f8c7349477c69c53dc59fe5615984eed5c8cf55a717
MD5 a3a00ef924278ba60be0fffeec04995e
SHA1 69ab25402bb5ef6d99538ec8044c6edb128be0d3
SHA512 fd53f2c0e8f493817f5ff5c2f9b87ffb82a11bc2b56a9798072efdf22677d2760bc489a2c8d76fdee6f65a0f4509d4bc257851811b4f720120780e796c6bc4b9
MD5 SHA1 SHA512

Submit Download

48.png

Path C:\Users\Admin\AppData\Local\Temp\cedl4lis.mum\Default\Web Applications\Manifest Resources\mdpkiolbdkhdjpekfbkbmhigcaggjagi\Icons\48.png
Size 1KB
SHA256 6dc4e5c4c1722173cb9d40e7edd2947c12677b12fd2fdd6e2544bda6bb456ab1
MD5 5bfbb6b6a7e313f5d67a1219f7866c4a
SHA1 c49ec46ca5fb945b582c99b47a2b7c09da8f766e
SHA512 55928faf39965083855cf6e1a8bc477560b41f3d8d8f678de7271960c6b59b7f2a256ae4e03428f86c1fc0e431370512e9c69a5631cad9e103e8978faa10ac13
MD5 SHA1 SHA512

Submit Download

64.png

Path C:\Users\Admin\AppData\Local\Temp\cedl4lis.mum\Default\Web Applications\Manifest Resources\mdpkiolbdkhdjpekfbkbmhigcaggjagi\Icons\64.png
Size 1KB
SHA256 3695587d1d40ba3171aa991cb77e6c9080b550db7c3d3b52097c1723ab060f32
MD5 0aa5ac35c79f5cb38dd5fafbabf2983c
SHA1 36658f24dbb49f5ff2a19897b22071f72e523f12
SHA512 fcbc8a65c4b852c848a13fa12131fa7b17b1310ad3278e78545e8334ddf199b627110bde2fc0a5e7312fad3a5f12b0db54c665d00f1feb1cf3b7c4b18e7569e7
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\cedl4lis.mum\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\cedl4lis.mum\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\cedl4lis.mum\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\cedl4lis.mum\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\cirjwcad.w04\Crashpad\settings.dat
Size 280B
SHA256 71731f80e8530a878ed68ee30430ddc0d0d82efb8eae372adfe4657d6f5e25fe
MD5 c4657e70e9e02cd8aaf30779a76f770b
SHA1 0c98be239e8ee568447974e24ebddeab698ae7c0
SHA512 1c63ddd87d8f18aab7bb69c3295c34377c6cfc7b1d9b4b61d4a19d24a004cdd7d540e7e12fb84a57dca08499c1199b0fb1bd993bf279d7d3721f6b85c2bcc77d
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\cirjwcad.w04\Crashpad\settings.dat
Size 280B
SHA256 6d4d92faa76e1b2fe734b62337954378e34c63bbee1fb2ab08b3ba6602d6699d
MD5 233e8a623488ab0ee07d0cdc8e756bbc
SHA1 06768df82e23ef3bd0e406fef2bc929e28cec0f6
SHA512 c13feda59a59d8448b8f44d06379bfe5d57750c7f5aef693e546fdc2cebd648cc87c89a5b62404ad0637481610f2ac903c706aff8d7dd3e2c09892374702091b
MD5 SHA1 SHA512

Submit Download

17bc3a47-e2de-4c4b-819b-2d665d81c667.tmp

Path C:\Users\Admin\AppData\Local\Temp\cirjwcad.w04\Default\17bc3a47-e2de-4c4b-819b-2d665d81c667.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Temp\cirjwcad.w04\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 186B
SHA256 77119e8a5d1264c3ec10e6ca30425f3af326ea916d71a87ca79b44e12182b14d
MD5 a4463b69699a22f294003f960f42a13d
SHA1 27e7630027a779f5f9012137f84b47b664fdb9c6
SHA512 d685c6aeb03f6139cebc44390eb4f95d0c269372ac04b8d80d780e407526cd06724b981a15eb5f45318041626d33431cdbeb95f4d6b317bb1c1ee2e4de20f5d2
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Temp\cirjwcad.w04\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 259B
SHA256 0f963bf23065bf4cec4efb3e5879d3dbc0cf47893e9c2f7b5f223a39c753637f
MD5 0fad66b105c5583a5a0b5ed94bedc429
SHA1 6d318cb9c63474b85ac36e9d426a23503b1e6baf
SHA512 c2c9ce364cd148678cb44611671ab35522bab1787fe68e20e840fa63d23d825ff63f3adac79734eaeff226543eb282e38de80b356534487e071eaa5911e67273
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Temp\cirjwcad.w04\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 324B
SHA256 b8c6edecf01adfd137d84310f797af81aae3f116153b761ad48659c56bc7c9a9
MD5 ddfa0738feb1409eb5d3691a6c0a65a2
SHA1 b3464322d16bf0dda9a510b6d0e033852fd44266
SHA512 d8c9c3653d003485b74cdd326d1299dadaf79354630ec7248cbe40779c01365d4cbaff9508927c2cd9b8c5b80c172bf6a6a643917f0f33c5df0984b573aabb90
MD5 SHA1 SHA512

Submit Download

index.txt~RFe580904.TMP

Path C:\Users\Admin\AppData\Local\Temp\cirjwcad.w04\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt~RFe580904.TMP
Size 120B
SHA256 4ceed85cedebf4e63d9acd7b1dfe06176edb838cf10b554bc70460fee443f8ec
MD5 8adcf83310250df9509a6f8f9f0dc983
SHA1 8143ed65441795296132598483b4ec770bcdd650
SHA512 f11d9536019e4a76097b4e5e0f036a8bd103055bbb247f33a5f1954ab4edfe630d20f6d8e714b102bea54d9847f985447f79e8f95a6362bcd8d5b86d541377f6
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\cirjwcad.w04\Local State
Size 3KB
SHA256 54fac5d955e5beb1b8247339298f4dbde5cf74296dec571ad2921d9be8df9bdb
MD5 b76ae04d6e456e75b0d8fa9620ab2015
SHA1 953870a07832c6b349e63a7396532ba64c8fd5b0
SHA512 011de791f1f5180d44ebe9a491f6510179d729daea1bb48434dbe861a1f635fc16f6d81fe99280bd663a05e746de829c28b2ebc8ce07f3f66d23066d56c45db7
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\cirjwcad.w04\Local State
Size 4KB
SHA256 ede6dca686297655043c6817087b4957481f9fb021172d3b8e2bbdd7d5f5d5b2
MD5 72a019694f7fd66877cfbe72bff1b5d0
SHA1 6bff71ffff4807f1d4a5734ceaa53b5e2277d158
SHA512 3982175e197cee8e03532659e0fe0f634512218eafeea9521d25b00c0e7897408b63127304cd4db71486861c28000caa4d4dcf5c976d1f7cf705e1ff909a99d2
SSDEEP 96:1qGNkCufcVm3AE58Frh/cInURoDotovSFJDxBnkvvtDKKsJK6CUXInaB7a:MGNbLVTooDUwiH/KsK3UwB
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State~RFe57fafa.TMP

Path C:\Users\Admin\AppData\Local\Temp\cirjwcad.w04\Local State~RFe57fafa.TMP
Size 1KB
SHA256 c2baa7f6bf7dcc5958b8bc3f2043892eb027f66b5c8c2cb39f21bf7613477149
MD5 35e349d1465cf86004f4fa35b6f81606
SHA1 439727442f3fba33b8adfc4c0d4588c2ea287f9b
SHA512 74366f2c6c853bfcc59d6bae51b136a366cc6e44b14872c573dc1636449b9675202b45c95609efd9700d13e712c8a7c3562db91eccf9ec6d09e335ab1def4c67
MD5 SHA1 SHA512

Submit Download

d96d3bdc-6a41-4f86-9091-bceb404a49e7.tmp

Path C:\Users\Admin\AppData\Local\Temp\d96d3bdc-6a41-4f86-9091-bceb404a49e7.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\mmotvssi.03b\Crashpad\settings.dat
Size 280B
SHA256 b83ee1dea37da35b44da966c933ba3a093676348e38e3889f2fe94c8a67b1eb0
MD5 f84f49bf1e675f3e021d0796924d5a0b
SHA1 2a23b12a01dd83dea84fcec6bd37d4fa852e7b1f
SHA512 a76bf977f6fd68927dcde0eee232e2a3fd8ffa14b392b89e24d23ecd8086e6f6317ea61a897483dbf4f0ae7af4089e36741b9ada1109d23934e6f9cbe2329870
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\mmotvssi.03b\Crashpad\settings.dat
Size 280B
SHA256 08a79cf1e7ad93264a4f62f8073b2612588e0fa2815cf0ff66aa462785a84994
MD5 18d2c151742320c8dc090407e53b6b46
SHA1 248125d3ae9f6b5d8d18d130a7e158fec12c5c8b
SHA512 c315a93a414d0b446485af43d56127f30b0821641e577f267577576372455ba93325429d787b30ea877b501955733b55573c7c2086e06c61689f417d4b3d511d
MD5 SHA1 SHA512

Submit Download

f_000001

Path C:\Users\Admin\AppData\Local\Temp\mmotvssi.03b\Default\Cache\Cache_Data\f_000001
Size 34KB
SHA256 8c97e1a3437f857eb8a346a360274ea339a09eda1b965ee1445d870c09b066ca
MD5 4227139d34ecd3be139bf6c7d75fce5b
SHA1 0e984113aa96daf31d002392523ad0dfc9cc3870
SHA512 bdb38f430aa623a17b26044288841a07c82691ee858325b158423839fad99a75b192fe0df269898cd76e22a7e54250611f852ccb763ce82db2f7d1c4eb6fcb52
SSDEEP 768:iFPCuSWxAknP3gQlE3brX+48360GKKAC4FZ8ELh/SAE9gnmlV:iFPCuSonPJErr18ZGKK1oLQH95
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000002

Path C:\Users\Admin\AppData\Local\Temp\mmotvssi.03b\Default\Cache\Cache_Data\f_000002
Size 63KB
SHA256 9262f4b44d5369eaa84bf7c101825f7456aba7d383276afe02a339a9cfc828dc
MD5 8b1b8d2b199c6a450261969ffbe62d8e
SHA1 9cbbe016425cc59a003fa683d53b4193d8d09ee1
SHA512 792b793c7accbba2ae2acdfe0e82e1c6174c7c152196cf13c126a5b2f4b67f48e5dc07d0c812d5a54e30e36b2c5e11220ab24a142707459b3a229ec9e61eccbf
SSDEEP 1536:dxp1FtJCziewz3sR0Rro/pXgUijePOiYoVw:VbHxuwrUgbom
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000003

Path C:\Users\Admin\AppData\Local\Temp\mmotvssi.03b\Default\Cache\Cache_Data\f_000003
Size 99KB
SHA256 cad25cfcc108f11e81cf1a339916e956b5ccd3ab3da38a3bd7a3a7a01adcd3f4
MD5 86e9c0ad8befdb46f1ecda1d3f2c70ad
SHA1 cf9520c235db04ac02e98a7f7c9f3d5d631d4199
SHA512 30a1265891f03df0c46d4f310d97ffa312b84d485a214d895a1c5e260474260d6637592b20d9cf4efa507c131694f63253577fdb352e8e0c46505e02183e0ab4
SSDEEP 1536:GAqrSnLU5BxYE4bP9zel9rbvjJvNCLtY25wJ0qPKldrT6LTMyT2ItH3RHTZ:GAqrSLSvYEwsVbrTfUPdqL4S2iTZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000004

Path C:\Users\Admin\AppData\Local\Temp\mmotvssi.03b\Default\Cache\Cache_Data\f_000004
Size 384KB
SHA256 190d58fc9e64557a1660177f1861da2583d9346a46178580ec528d588bac84e6
MD5 741461a015e8fa7511020fbcea437fd4
SHA1 663e34385442a454602ec8e4a09ff2f40d16e556
SHA512 3ebad342e90bb4631b5d84ef2cd2969177e7cd7efe8c30b052b6c51305b61bd29953d6fe0ebc4facf55fbceee4581322bc4a3bb871c61c82f589e099038925af
SSDEEP 12288:Q9AaqN3ZL4BLECn1S3yDsQUnqov5d8HNMBliv:Q9VqN3ZGn16y4Qc4MG
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00000f

Path C:\Users\Admin\AppData\Local\Temp\mmotvssi.03b\Default\Cache\Cache_Data\f_00000f
Size 33KB
SHA256 65b7693af8bf475d6139343ce8a537e5fad39ec97d8b3d90ec1c52cfc212823f
MD5 7d5ebf87845d5ed9decbe32fe4ca0fb8
SHA1 b285def71de50504ebdee52db42be5dddadbd7cf
SHA512 16f0afdb1638764fed626a6e26d1fe83a622b9a3716cc79e9208f949e8877d966bc1bef33eaaee389eff21cf94d97c3438f29bf2666ae909162d76d782215dac
SSDEEP 768:8iLXI6vk9nZZdYfildXBLAnpxOXX36vvsz+ZeS+BXog:8iPvkXY4XB8nzY6vvsz+4S+x3
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000010

Path C:\Users\Admin\AppData\Local\Temp\mmotvssi.03b\Default\Cache\Cache_Data\f_000010
Size 18KB
SHA256 cb78510332b46564f4369bf31ff85c1ab0016bbcef3110b9b9388b88f1cf4795
MD5 9e32121253edde20161adf93523eb060
SHA1 4b9267459ba3c68bd08e6492a270ccaefe2c2dbf
SHA512 7b5c22ac424e32122637c434f4a087b87ba43ac341c008a4df3d0f57f443e38c68f75ae6087e16cf3d7c651a8a35b80faaa8a28b866b1c0def48e3b6c451fae8
SSDEEP 384:USS65/+IiYmwVYkgDdUlzU7SjcKalWW4sIkb6d2e/Oc+C2kZu:lS64ZimDWz/jcK3WRIkMnmo2Su
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000012

Path C:\Users\Admin\AppData\Local\Temp\mmotvssi.03b\Default\Cache\Cache_Data\f_000012
Size 16KB
SHA256 283e231a1dedf20c3f98eb1452ec52d042179d31a6ee482e54b51066074faf42
MD5 46b49aad1412c12943384f8afb51204f
SHA1 e6a38f254f0681007745ededdde176ec64670723
SHA512 8b521405691a78c9f03740f2484f6f07ae881cb1ea5d18336fa44771ec025d1dab438c1a849c30a3b7fbabd9dc391fe4aff499a09de1af6391611d1752ee8d45
SSDEEP 384:iEEbbexRg+TpS0d0qXYsoXB+SBuqkXL214/R7MI7fm:WexRbw0/XYf+SBQ/xMD
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000015

Path C:\Users\Admin\AppData\Local\Temp\mmotvssi.03b\Default\Cache\Cache_Data\f_000015
Size 68KB
SHA256 fe2fbf50c33ae9e12935df44eb094e541236f27fbbd97ec1bdaec2bf03e69054
MD5 7f3bae3ddb127530a3b1ec2c8501a056
SHA1 3d2a9ec8ebda8961af05bd4f2fbe0aea180fa762
SHA512 e8a5c7cbb1081d5e229b231b3e50a2d0211082981a44628cb6e01dee18087b73240633f649fc1a0103f24613178973997d7a74961bd4ea7dbea49296c48b0e10
SSDEEP 1536:NupBZ1xSO3cQmUY/lbFBw70hbBD9AfA1pwdpPq3Yf3AZ:NunZ18O3NOlJpd+kpwdpi1
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000016

Path C:\Users\Admin\AppData\Local\Temp\mmotvssi.03b\Default\Cache\Cache_Data\f_000016
Size 70KB
SHA256 30b4527ac16dda6093c174e8e842c7208d6c1cc26693f6f1a849d52b17b41d37
MD5 362644b225a27e4a658d69e9b17a8d19
SHA1 99e0fd685d570022b40800612b5dd13b801044a8
SHA512 cf1122d85319b28c69ccdf3f12b7362ffde1cafe952edb0e4a40370d1fb80dc6f8ab70e50ae8f07166c29e254d5a138ad8fb346d796752efbd14642afe5905dc
SSDEEP 1536:SPD6v1B+LiVECo6I6hUr2ZEwVjnZefbudrSb3fFQ9RMVFO:SPD6v1B+kvfYWnP5Sb3fFQT
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000019

Path C:\Users\Admin\AppData\Local\Temp\mmotvssi.03b\Default\Cache\Cache_Data\f_000019
Size 17KB
SHA256 252ca98cffdec1c6ec7604b72704d736d95d0a9643195d0a1bac3b1d9db01b7e
MD5 5942cee93487a49093faa631139784ea
SHA1 5723860b365df1ca84d69d7d6a06d4b224a97b51
SHA512 3c4a657db0abea8a7b64ab5ceeae4c26f26b4b11667b8118f141ae9985774ee2c6dd05f4659914005c4e1fc94de0683268037a71aabd82c885880235a7be86a2
SSDEEP 384:6pChsr03QM325DbpSWIC3N08ZNa8+CUFnlxAkt7Fmp4vrv7Y1EwL:6QWrSh325npHz90xCCrZxvrv7Y1Ea
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00001a

Path C:\Users\Admin\AppData\Local\Temp\mmotvssi.03b\Default\Cache\Cache_Data\f_00001a
Size 28KB
SHA256 b421c05a340e40d4d4bd1831521268b6f0afd0461ec3991cfa8d5314bf3207b4
MD5 57f9a7c7e2be49102533a2ceb7a05e51
SHA1 850ab0a80577b7f7effe196cba037899e71594c5
SHA512 66406d54a1d1a44f30e19a9bff1242b50fdcfbf66c33e4c23daaa756c06f50a2e39c991e7a8dfd9a81184cc37c2062d0406070be132e28a22307896e63b55447
SSDEEP 768:dT+CJ4QL+F8S4bApn9Ua0ndjCaixJ/fVW2/AGYnS:TJ45F8SgjXnNCa4fVWVnS
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00001f

Path C:\Users\Admin\AppData\Local\Temp\mmotvssi.03b\Default\Cache\Cache_Data\f_00001f
Size 73KB
SHA256 142ab0cf464de635b95896a97751cc33295580a46fdbb246bfb09978015db80a
MD5 7d8e07b3c19a7d627cd99acb6a78b0e6
SHA1 58809430a4ac9956b3fc21a9da30d8aa50111eb0
SHA512 c15b2d21341dfd4edb8bcad9dcee873307c0bc4331af184736e95a2d045b948cd1afe5669b610cdc56563e162101fcf7c5926b11841502166de202df1d528daa
SSDEEP 1536:DhsX00aVe4LP67yGpcWq9iIsHPiVEC+vBF/lySVlr6ac7D77Go0ukIV:lsE0afuprqTsHPiVEFRym6ac7rGo09IV
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000023

Path C:\Users\Admin\AppData\Local\Temp\mmotvssi.03b\Default\Cache\Cache_Data\f_000023
Size 16KB
SHA256 23cebdde3aa3c9b38e0647ae2bd6daedae2f62adee6521dbf726731d00bf14b5
MD5 fdbdb95b5ac5c4edecb625ceaccf87b5
SHA1 8da620668bc6b3ee6c2eac8c258d80afa06ead0c
SHA512 08c9c96ffa14e4be65c50bed0683a5d817ea190a493cca1119dbec30807a9e5846baa86c96dd97603620ee67c3acee2cda678cb246fdbd033aed1805aef1d2f1
SSDEEP 384:BhBYbM/UQhdWQz2xB4uINwHHKwq2Lx+J7Yj83GyEskVvyWpg5Fe:DqQUwWQz2xBrnnbNLUBYI2yEVVKWpn
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000033

Path C:\Users\Admin\AppData\Local\Temp\mmotvssi.03b\Default\Cache\Cache_Data\f_000033
Size 37KB
SHA256 7ce6f1a39d51cfbaeb9198ba239a20309c9dc45de3892cda503ef9ff1f4cc713
MD5 beb11bd7bd03305b82a81bc4baf383e9
SHA1 90d923da299ee412ddd744cb0874b2b23541fc07
SHA512 dd03f0fb732d38a42a0d24e4d0e8ea8b0b6ecd30c02a5429356e3fe034b2433ba33e027f00c9531a93faece825d8b2661d2f19b79e57ba7080494d83300806c3
SSDEEP 768:A7j5bYJ3yvjNvT/R8NICe2JhjoX66P7kTLy5v+hLSXJEsV51hj+F:Av5bw4jNv7aNIL2JdR6PITL0+61MF
MD5 SHA1 SHA512 SSDEEP

Submit Download

2ad4259b-8bf3-4f96-aa9e-e28ce0750008.tmp

Path C:\Users\Admin\AppData\Local\Temp\mmotvssi.03b\Default\DualEngine\2ad4259b-8bf3-4f96-aa9e-e28ce0750008.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

ExtensionActivityComp

Path C:\Users\Admin\AppData\Local\Temp\mmotvssi.03b\Default\ExtensionActivityComp
Size 4KB
SHA256 8c471cab38a1696289186d01b06ff6af2a888852dc18d6fb8d2a0e54898104ed
MD5 d25d5e1dc1d93430e64ee17e48ce442e
SHA1 d5c7ca9a57e6cc68927a249fe8e601d52680ac7a
SHA512 f4cff7510b4ad81090e0b1842652f8eb7995f7aefd0ce651151bc24ca3a4305d34ecae41cf193d9b846e8f6359ccf545e5d05e63e6e766fa9761ccebce620f6c
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Temp\mmotvssi.03b\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 192B
SHA256 b696f839f19eef0c0f18bcb71acd106528a7bdfbe3996e26a4c485a8484b901e
MD5 d3230e025bc7393c68b6e4c9be7b337c
SHA1 faa8e0daf6b2bc8be7b98fb9dea2c3fbdad4520d
SHA512 e4d29c4b159d453a330c1d21d92165e04857ab6644859536d1a932da559ce71739b081d8b2ee7f1405557e0f37b487e48947485502770e8915cae554f542abc9
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Temp\mmotvssi.03b\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 257B
SHA256 e86ab5b4d1888d527c3e0680aeffd1fbf33605f419c40c7e1684f9c6fd17ec85
MD5 8b67d70716fa8a7e8c16a8bf4782427c
SHA1 0a3f8c7aaa5c315965334292ba0992dcfa1f0b9e
SHA512 03c75691e0c6a500b9a267a5b9c19d76ffe4d298f7d3f8d4abefc3ed17bac276ce7e1986186a25a8d5e12b4beabf9f3bd955aa7b0e70e526274694830dd77a35
MD5 SHA1 SHA512

Submit Download

index.txt~RFe582f77.TMP

Path C:\Users\Admin\AppData\Local\Temp\mmotvssi.03b\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt~RFe582f77.TMP
Size 119B
SHA256 d4f2a4d1a5a9090ff33ef1b327df5f4c6a21cd90ba04ad05d8b3a29b380d0df2
MD5 9aeb97f0e8fc80f2d0b4aefa6084b161
SHA1 312cc5e5f288b4f23182dceaa1d2000b4606579f
SHA512 d475f7410deeb27349674df80060144b2995fa507794ab7e26f3985f16b35a6bcf394ea693e0673207480c918b9d7d8d906d0043b208a4774aae8109b2d00d6e
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\mmotvssi.03b\Local State
Size 4KB
SHA256 7bba21329f23cd1ea490238ba173c37a4b2eab0faec3e3748c1c0bd00744d815
MD5 2dfecc90578e63650f366168a20853e3
SHA1 521679aa52a2524152cfc5bd2ba85e5c19ecdae4
SHA512 b2ed1d6d7e86128eca865d721c16387da2ad4d50d90106281a877e3bc978ee4304004dd28db86c1b61380ae8885520bb80695738443c23780e37fcc452627038
SSDEEP 96:FqGNkCufcrbJlZ58Frh/cInURoDotov+guSDwBU0vYvZuJKHeCUnB+a:8GNbLrTAooDUw/uU0+ZKKbUH
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\mmotvssi.03b\Local State
Size 3KB
SHA256 1761ff61474f35a9ebe5cc0c83a60b85ca07e3ea3e0ef9c28ec6e21682b8dd3f
MD5 3b6b431cc6d2febbaeb4ef57a8682b55
SHA1 19662e2016744866969f6b16a50ef4292a7f3f7e
SHA512 c7778466b6e193ebbe1b95788f52499a8c8f2f11245043f3881f34fa960f82976b3dd2d462ebd22f15ffa920c4079a4f6aae79d7983614b6179346e1938da3fc
MD5 SHA1 SHA512

Submit Download

Local State~RFe58220a.TMP

Path C:\Users\Admin\AppData\Local\Temp\mmotvssi.03b\Local State~RFe58220a.TMP
Size 1KB
SHA256 59bce40d83b892f0721301d3ce53e148735b5583fcacf7f9d5703668f19410f4
MD5 f95de24ba771265a6e1a31409be58f5f
SHA1 cbb80ebb1efef6cf677fefa2cde6a4ffc9bcef14
SHA512 7d6d8c6d9504eda678542fc0c3d5be58ace373cc56271c5766f13b96dae75c81481d2dc0944e0f46ae2b75057f098b3e2cf61d2460f90e1cf76af80f2eebde5b
MD5 SHA1 SHA512

Submit Download

357c0a20-2845-424f-9575-035f040cb3c2.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4448_108187454\357c0a20-2845-424f-9575-035f040cb3c2.tmp
Size 154KB
SHA256 a468f5875b4e55ea732e3df283b4f4ea941be738b238122979ca5d8006a3a8fe
MD5 4ad81f6ccc657d1da582c75c5db037cb
SHA1 ab0370e7d32ebed71fe9787d3a4a2fc0c652a28e
SHA512 66461474f8b36d6d470797df9d4a3cc4698bceb7054c97166eed98b74def84f58486fdb909928aaeafee793799a436210b5d7091acce6232b23eb6ba926ad227
SSDEEP 3072:OqeD5sKZ7XcbMSqnDhcfXE0IfnpWpyKIrFn2wNkR7aUPuWm6u:yD5sIXcYSqDGc0kkpIZ2weeX6u
MD5 SHA1 SHA512 SSDEEP

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6596_622587267\CRX_INSTALL\_locales\en\messages.json
Size 851B
SHA256 6895648577286002f1dc9c3366f558484eb7020d52bbf64a296406e61d09599c
MD5 07ffbe5f24ca348723ff8c6c488abfb8
SHA1 6dc2851e39b2ee38f88cf5c35a90171dbea5b690
SHA512 7ed2c8db851a84f614d5daf1d5fe633bd70301fd7ff8a6723430f05f642ceb3b1ad0a40de65b224661c782ffcec69d996ebe3e5bb6b2f478181e9a07d8cd41f6
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6596_622587267\CRX_INSTALL\_locales\en_CA\messages.json
Size 711B
SHA256 2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
MD5 558659936250e03cc14b60ebf648aa09
SHA1 32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825
SHA512 1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6596_622587267\CRX_INSTALL\_locales\en_US\messages.json
Size 1KB
SHA256 4f70eca8e28541855a11ec7a4e6b3bc6dd16c672ff9b596ecfb7715bb3b5898c
MD5 64eaeb92cb15bf128429c2354ef22977
SHA1 45ec549acaa1fda7c664d3906835ced6295ee752
SHA512 f63ee02159812146eee84c4eb2034edfc2858a287119cc34a8b38c309c1b98953e14ca1ca6304d6b32b715754b15ba1b3aa4b46976631b5944d50581b2f49def
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6596_622587267\CRX_INSTALL\manifest.json
Size 1KB
SHA256 f04b41a409ec4bf2f539b6f5334c36b0b14b8bf99746e0386980e4e12202dee8
MD5 3e85528d9e5a25bed8020634a653d296
SHA1 e63ee52c7e4c37559d1ece52216382af67894c01
SHA512 9916c110bb90ed25de689b7981472375b00574ff46b17f9c628501434e4bcf298f6eb5f8c01cf2ce0e12ca068b2f1796eefe676c2a76fbfb42283a41a54bb51d
MD5 SHA1 SHA512

Submit Download

tmpAF4B.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmpAF4B.tmp
Size 1KB
SHA256 bbc7c4083383f720f2b499ec87c6d320f47131ddf78327bd0688fe2b511f866e
MD5 f0c981b4de3929175150ac5a32675e51
SHA1 84ffea709edacba3dbbc9298948b296ebf867be5
SHA512 d1af5f952306e45c93c134eab9720657d66097045026daab2ad6fa6ab928aac7a888520b72a09a4c50c860fd271a987e4b677f5b195f250f643858294b82dd20
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\ykkjfujr.b5d\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.97.1_0\_locales\en_US\messages.json
Size 1KB
SHA256 102b586b197ea7d6edfeb874b97f95b05d229ea6a92780ea8544c4ff1e6bc5b1
MD5 578215fbb8c12cb7e6cd73fbd16ec994
SHA1 9471d71fa6d82ce1863b74e24237ad4fd9477187
SHA512 e698b1a6a6ed6963182f7d25ac12c6de06c45d14499ddc91e81bdb35474e7ec9071cfebd869b7d129cb2cd127bc1442c75e408e21eb8e5e6906a607a3982b212
MD5 SHA1 SHA512

Submit Download

computed_hashes.json

Path C:\Users\Admin\AppData\Local\Temp\ykkjfujr.b5d\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.97.1_0\_metadata\computed_hashes.json
Size 5KB
SHA256 effefd279e2e0a161ce7b1c1579d4d363b1f3feb507d050a76d1fd0168bd5c28
MD5 2a06d41bb787711242f0e2c62764a896
SHA1 42caba321ca0842ed87c8db6c782c0e6d771d6f3
SHA512 25564741750a76078b87f25d90772edc29e97028509275a5176b6c03dc88506d2770d474e415a3b2d5fbd868b8e275c1b943c8193e35bc5c9f07ced0b32d403a
SSDEEP 96:CbLBlwtH4zrgQQRDmoMnjo5A3u8x0p2c7S8cz7PEHPHIAsSVHdr2:mLB7rgQ+CZjoKe8yIckz78gJSVHZ2
MD5 SHA1 SHA512 SSDEEP

Submit Download

verified_contents.json

Path C:\Users\Admin\AppData\Local\Temp\ykkjfujr.b5d\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.97.1_0\_metadata\verified_contents.json
Size 11KB
SHA256 01d1fd4a0636c1437eedd1d2fb7d722f9e79df2982a8d117a1623be45e52599b
MD5 48e8c6bd088ef0ce194afe729ac05ca2
SHA1 20dfabdd450e09f87bf43892148159abff2c3356
SHA512 2296969f340889ceaed18183bafefa86684bffd2897b378580542174c2774bdf540e6aebcdbe2edf977b2d3f6c286b1bee7c25dc3cddc144c46d90baafe00967
SSDEEP 192:RBG1G1UPkUj/86Op//Ier/2nsNLJtwg+K8HNnswuHEIIpuuqd7CK/v/ppkf:m8IEI4u8en
MD5 SHA1 SHA512 SSDEEP

Submit Download

service_worker_bin_prod.js

Path C:\Users\Admin\AppData\Local\Temp\ykkjfujr.b5d\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.97.1_0\service_worker_bin_prod.js
Size 141KB
SHA256 01101df3341dff41f5e9dc5d4191ae135a700c03d28233f9f2704f6c6d92d799
MD5 7b0d1dc77da0b32f7c273b9c57c5d944
SHA1 a2fb1ee3a525609c1d9b95ad3212d64a717ed432
SHA512 2b8b08bb3a0fa9a7c302ab38fdc0bbb63d834f04cc5171323a1a27da001e3c42185711978a8659d1b5e45cc5b7145c11cf4a7217815e8aa00c3711b2f3f27117
SSDEEP 1536:S6Vj/O/Wl38TfNwJDP5s/qu4nQsea4VQvtwKoXA8Gss2emSuiZPMTER9/M/KQiXn:2TGqsea0KoX3fiZ0IPMKQLGKwQtAig
MD5 SHA1 SHA512 SSDEEP

Submit Download

32.png

Path C:\Users\Admin\AppData\Local\Temp\ykkjfujr.b5d\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\32.png
Size 1KB
SHA256 c0b2a99e82bfa9b629fc903c77bd36fd3b148b25fb67ae196cbda262c593efcf
MD5 b422f26131f7d87105b2ef5bcc8996d1
SHA1 5bebedb12720c3b09dbafe9204bdc8eb0f7971d4
SHA512 1a4b3406afb311ad824a1adfcb33f336de09efab34c66e058936a57d4f73ac33431eacf1fdb11f516f56107a93741aab3b9fa5c85d805466ca58c3e24bcc9c28
MD5 SHA1 SHA512

Submit Download

48.png

Path C:\Users\Admin\AppData\Local\Temp\ykkjfujr.b5d\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\48.png
Size 2KB
SHA256 a16b7fa466101581d443223247589ff21fdf73f1b09d43ac740fa128d0252931
MD5 33da9ad751e4a3b21bfccca9e6727e8f
SHA1 05d5ceb6a2b80de82a2f70442f68ae803dad22f4
SHA512 5af9ef87eb7c050158b7add761ca06273094a5a2d5dba87991c7ab20fa2dfb7e7f7ebf1fbae21286781144ec1fe3531457deaedfd2a668975dc7184020c6f0a9
MD5 SHA1 SHA512

Submit Download

64.png

Path C:\Users\Admin\AppData\Local\Temp\ykkjfujr.b5d\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\64.png
Size 3KB
SHA256 4fea2d966296665a3ae1d35c0eae541b0ef7b9b1a9890e9e65314f80db5a3e21
MD5 1efcc119d02c61752598ca121cd0babd
SHA1 6d0736581b02aee66d51fe29e68babca6a59fdb5
SHA512 8d5554a167907f96720a126e901aa25f01e1f58f9469f8366e7f2352ce16da82fa3963845cdd586837c5aeafb3092a2aec6d3e755bec2031d12325b4799d44e1
MD5 SHA1 SHA512

Submit Download

32.png

Path C:\Users\Admin\AppData\Local\Temp\ykkjfujr.b5d\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\32.png
Size 903B
SHA256 217f48c637316cfba706de86339bbdb5f6d60c0fab701fc71ba2da01ea71bd99
MD5 166a9c3ecab6cfe73664f783d6d49a89
SHA1 0b9e5c909810c2d2b40df3fd4c8feacebad846c9
SHA512 d3da9c250dd728af13e8eb1ee75f420b1857357e7afca9f93090d253fb6cba43bb52b1199725ce3683d7e0411af764333ad2293ada77638847d2526b1b363d3c
MD5 SHA1 SHA512

Submit Download

48.png

Path C:\Users\Admin\AppData\Local\Temp\ykkjfujr.b5d\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\48.png
Size 1KB
SHA256 2e201cd442e08720a6d4e38516ceea3e892dbc345db1835441e9eec005501c67
MD5 19f9c11e56103a25a50b9c33be84560b
SHA1 266f57c5a015281d4dd266a9b3dec9cb3a754653
SHA512 964e1e6d787450b837f130a4289906ac39277fcd4a98f6314e5aa0450fff81fae275f023c15eb58548ef3ada0b7363e4e6b3d61bb326246f3dc63336d68bb160
MD5 SHA1 SHA512

Submit Download

64.png

Path C:\Users\Admin\AppData\Local\Temp\ykkjfujr.b5d\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\64.png
Size 1KB
SHA256 a693bf9d32c7ec663b864a2faa9b99d8bb6cb76e332263f5e9a6e3fc2ba60ac5
MD5 1f695a492ddf318b832bb48f5b9442fc
SHA1 81eb257fc22a30c4e75454ea0e4677043367a6f0
SHA512 0ad7e376288ec7a2d9314447f2649bb19bb703bedc9710a758e7a15e39083150aa34e2a2e6c22229b324cef4e41c09289c90b445a413336d6eed497f65d8bcb3
MD5 SHA1 SHA512

Submit Download

32.png

Path C:\Users\Admin\AppData\Local\Temp\ykkjfujr.b5d\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\32.png
Size 927B
SHA256 af50d64bd3cc7c3d201cb5abf0d76f44737e2a4040741ce178d9765fe440bcc5
MD5 26496798ba29a454042d60c9633c1e72
SHA1 65977f9cc15dd73026c91b479f1bc678050c8c45
SHA512 a4a61f66c712fcd27681073c2f30fda3a98fb6348ac4451d8a8e181e525f4ad8491a09d19c17dfb8f01a53eecbfc3ba25f370afd9df5b2ecb9b613236ecdd3cd
MD5 SHA1 SHA512

Submit Download

48.png

Path C:\Users\Admin\AppData\Local\Temp\ykkjfujr.b5d\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\48.png
Size 1KB
SHA256 3339af4538fdfa40bb438469e35f6b7668d5c5ac93db0ef4a9e2fbf9ae884446
MD5 815ddced6b03c8a62cb590ea4585fcba
SHA1 9f7e8cce2319b15ec63d89f837a173bd247e6998
SHA512 ec7069b51959572c40dfa02f380b081912053898b4d4f86166b90bd277f9e8271d0fb3f0627e82645052ebe021c2e24698785e5214e82190a2298f32dd879b3d
MD5 SHA1 SHA512

Submit Download

64.png

Path C:\Users\Admin\AppData\Local\Temp\ykkjfujr.b5d\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\64.png
Size 1KB
SHA256 e895cbcc424d6000a15b21d7cc9dec96deb2403a1469761ba3d9f11528c215b1
MD5 f2222b9d8dea52f5ce7d75378de76037
SHA1 e3b266fca2e5bf8bd82a62791902e879af7ff6fd
SHA512 74b947bc915c89f27954b5d0c8c790316ace581a20f7031aa91af3d95303ff0dd8cb4c87d3746ef2b13f76e0e8bba1b5b4a6916f3230c0514164fb1700640f66
MD5 SHA1 SHA512

Submit Download

128.png

Path C:\Users\Admin\AppData\Local\Temp\ykkjfujr.b5d\Default\Web Applications\Temp\scoped_dir6596_1511825389\Icons\128.png
Size 1KB
SHA256 311b922287618c19e33f3cde7a3150a094215b79f0811e5a862b1ccb4f8298b9
MD5 396369d945adf93fcba40c33de48d7b2
SHA1 104871c9e3f76f615b3da80e09c513787bf08b2a
SHA512 5ffe4ba38f16456b25aab3b859e589bb165d847f9e5ecaba80cfceb0d5b86dee8d4280187a5777c2a006a40905e4e5ddc80db9e9bfde365492ceb720ce3607c7
MD5 SHA1 SHA512

Submit Download

192.png

Path C:\Users\Admin\AppData\Local\Temp\ykkjfujr.b5d\Default\Web Applications\Temp\scoped_dir6596_1511825389\Icons\192.png
Size 1KB
SHA256 e1f2468d3bf8ea4d5b71b231c87919da27560c6bef59bb280eb923102100a9ee
MD5 ac9a008b8937842d4c1f21d0fa8db6fa
SHA1 3dca4c8f92f18bec0b5eac7a043ec167d3a8013d
SHA512 c6c4ba5bf82cf603994e152d42a5ecf05508bfbabcb5b55f15574ca68d133fa59ae8a195948fb1e203208166849271c3623a3cd5cb073ea37abdf1d8b7e36f35
MD5 SHA1 SHA512

Submit Download

256.png

Path C:\Users\Admin\AppData\Local\Temp\ykkjfujr.b5d\Default\Web Applications\Temp\scoped_dir6596_1511825389\Icons\256.png
Size 4KB
SHA256 1e129c136766ea81882c6b360d5ba2835f28282823675ddee5babe9b4d87c259
MD5 55c51c7bc3b9274c01d9c758a15b7369
SHA1 7b678294d06054d1ef615fba6d22756fde5df412
SHA512 354f48e94a93264d0b747cebb7d4e339ee0728bd2acf92ad53251e22f7aa1fe7ccd27fd2176d1bb5887a59d70177afad2b6f9d9ff48d1094a715ddcf752bfc20
SSDEEP 96:cJHYPfHbLi/KFpahfBBBBBQqa9xBKFzurBBwjDTBBBBBBBBBkdHuMRAi5yzGVl:cJLyWhBBBBBQqyxBq4BBwHTBBBBBBBB6
MD5 SHA1 SHA512 SSDEEP

Submit Download

96.png

Path C:\Users\Admin\AppData\Local\Temp\ykkjfujr.b5d\Default\Web Applications\Temp\scoped_dir6596_1511825389\Icons\96.png
Size 1KB
SHA256 c362681b842ba5fadd93fd442c07b6a0318d5d0bfec212df23a8f2fc885e3045
MD5 aedd1c7fb708deaa4f156ad6c395c7a3
SHA1 8ccfc9cb5585b45e6cd64c130666fb6a00a5f09b
SHA512 e6476ee4a9e902c65d2175fe56fac67d7cf8898ce50a77317e55645614f64c10b0089d0c804f999476bcaafd82e79397d1d0c81d0d5436150687d1a13f4f1473
MD5 SHA1 SHA512

Submit Download

128.png

Path C:\Users\Admin\AppData\Local\Temp\ykkjfujr.b5d\Default\Web Applications\Temp\scoped_dir6596_1514924421\Icons\128.png
Size 7KB
SHA256 dece52000cc113eccfeaab6a5aefdf1868fbfd3eb61b0ab2ab1d71530b6ad8a5
MD5 2483da6f42e84bf1d8c39b67b849a78e
SHA1 38a1f27fa44a777c27043ee0ede1048c052b1d54
SHA512 e43b074870ac2fab95d1aebd11154f0cd44664c1d2e2d36013896b8cba92346d8d08bf4f7cf933579d781315fb48b3b375e7964658052ee7e1288b105f6dfe47
SSDEEP 192:2O7p4JBy5Fo0g5luSqNacpC9JciUzxmXDiNij1:ReJ29PNpC9JciUtkRj1
MD5 SHA1 SHA512 SSDEEP

Submit Download

192.png

Path C:\Users\Admin\AppData\Local\Temp\ykkjfujr.b5d\Default\Web Applications\Temp\scoped_dir6596_1514924421\Icons\192.png
Size 5KB
SHA256 1ad0085b5820af862f2231bf9460048b37ef068c624cd920691f94252c2c5fd7
MD5 d18dee0302e5264d474f04018f2b3e90
SHA1 14af07666741fda9efc2b51c00aa53d7cb27e5a0
SHA512 9fec0ad33361a7acd86463c501e3f70cc317e3b605bfca1a2739f43080da7ab674bec7feb860662f4190e31bd8eeec557f0812ab1d44fe4814d71f598d66eb2b
SSDEEP 96:lL7vg2ThS+PZZ8RL8gduPe9ttGssuO0K+ab9uF9iaZVcLKjrenv/P+OPs:17vtTTPb8RL8suPattdO8apufiaZVbyY
MD5 SHA1 SHA512 SSDEEP

Submit Download

256.png

Path C:\Users\Admin\AppData\Local\Temp\ykkjfujr.b5d\Default\Web Applications\Temp\scoped_dir6596_1514924421\Icons\256.png
Size 19KB
SHA256 4477ecf5ee15b7c1e557976487a49a3c9031db8df4fdab15f0819208146d2b94
MD5 a3c33fa42dbc99db0a6b8a56ee33bf81
SHA1 857b35462ac7a919c6b618a95fbce9e91cdb0adb
SHA512 ccc1fd4837721f4b972d34981e294cdc7b4556ade953a0106fb410bbd6e51c371ace5b114e613229be4d2a4e4ab030567467b9fd2149329bee1eeec7d9b1fb30
SSDEEP 384:9SXGtW841VZccYCmLRUsBpRCFxM0G3NGt6VkO7RPB8cMO0yptjSC1+gl:9IGt/ZCDsB/CFoBOAMO/zSC+0
MD5 SHA1 SHA512 SSDEEP

Submit Download

96.png

Path C:\Users\Admin\AppData\Local\Temp\ykkjfujr.b5d\Default\Web Applications\Temp\scoped_dir6596_1514924421\Icons\96.png
Size 5KB
SHA256 8c3748c8c5b7d44116cba13eada8b4e501f4edd304e4593edacc2c7b21ec9ee8
MD5 d5e0b5fd1fa76c4d463db97ba4d445fe
SHA1 9d70eb36f2f450bbab7cc96279712581b77b4770
SHA512 5033b7209ef27e3fca4f79f855083ddf2406bfe4eecc0fa87e97537b6e6a71cafeaba990c17297c86d54fa96af36a13b65510e61755cfc22389c983a4987852d
SSDEEP 96:KgDYdm3U+IKJGiVLmaItVv4xsXr2PbbClGRlFn+LiTTSF3jZrQlCPN8ODza:KgDYdw8yRyaItVv4xs78vzn+Li6BZsCO
MD5 SHA1 SHA512 SSDEEP

Submit Download

128.png

Path C:\Users\Admin\AppData\Local\Temp\ykkjfujr.b5d\Default\Web Applications\Temp\scoped_dir6596_280148027\Icons\128.png
Size 1KB
SHA256 0a3f8a7b16e51ffeac42890e8fce377612089608f71894970a842efae305921f
MD5 11d3ec8701407614232495b6417f0774
SHA1 ee10a04124d8e8b894fe3c538346fd082ed55e2e
SHA512 4ae79d10b6b16470f4c70fcda381e0896591ddec7edc6ecf5691f0f8ca1fa9ea758fcebea4ab98ca428d974ba0cc01f85b8db67549fdeeeee44aa5cd59f40545
MD5 SHA1 SHA512

Submit Download

192.png

Path C:\Users\Admin\AppData\Local\Temp\ykkjfujr.b5d\Default\Web Applications\Temp\scoped_dir6596_280148027\Icons\192.png
Size 1KB
SHA256 c71bb2a41f2aaa8c22fc6bfd11ff1b91b4d27e20d9caa503167986ff868dd0bd
MD5 5650706fc87fbbb20afb23fcc06e17f7
SHA1 215a317ee97db099f6886b31512b7390ca394401
SHA512 0d3cf4e7b010a9cbd3fe0ac3afaa3f1bfb3ebcf8c22efdcb0c3011d58efac4296e89650bb30614012ed05313e251f8fe8e02554b16ec2912b8c8f9c4c5d4843f
MD5 SHA1 SHA512

Submit Download

256.png

Path C:\Users\Admin\AppData\Local\Temp\ykkjfujr.b5d\Default\Web Applications\Temp\scoped_dir6596_280148027\Icons\256.png
Size 3KB
SHA256 273b4c4d8e7800bcc91c8f1daac5bef4249c73ae1d51342e141aa4502fce4052
MD5 b12ad41d5fb2b2a8b248e427f2b5757c
SHA1 5586969ae9e0c0de1a464a53c748bae54323e03f
SHA512 87a57b0516cb513d646f87ed6569181bcb3d8577298bbe691f0894ff48ed4fddcb9266b9d38713181f4cfc9d081f913e1c7781c8a18a1fbe0db1720b23f5fe13
MD5 SHA1 SHA512

Submit Download

96.png

Path C:\Users\Admin\AppData\Local\Temp\ykkjfujr.b5d\Default\Web Applications\Temp\scoped_dir6596_280148027\Icons\96.png
Size 1KB
SHA256 9239ef543d26c9a2bc73d7a826ba42a43d46ddaaeb4883b324b481028a5a9de3
MD5 fa3494c7f0d4df8b9fc33e847739aa90
SHA1 d29337aff80f984626a6fef1666d266383940696
SHA512 daaa35051ecf3013f16d0820a5d9b9464ea4abc66f16893e897929e73b2fe685b7edd9708102eadd8e4a6c769b7eed72a671802e91c6174097673e22ec0404bf
MD5 SHA1 SHA512

Submit Download

128.png

Path C:\Users\Admin\AppData\Local\Temp\ykkjfujr.b5d\Default\Web Applications\Temp\scoped_dir6596_85277650\Icons\128.png
Size 3KB
SHA256 956bd19ad9a62b83792bed90a6e6457e0812abb36ef85763f62883d70f65241b
MD5 654cafa7846b64b91835e202c3efca65
SHA1 4e0fa549b16a47ca9e22e0a510229f528740d51b
SHA512 65db6e4824ee4caa38fa4ec837c2ee4290e34c8d2c5099b33720e7b6ab83997608ae8a6d47961d8506be3d23606b179cf792cc040a7c6c3f251855c294b26223
MD5 SHA1 SHA512

Submit Download

192.png

Path C:\Users\Admin\AppData\Local\Temp\ykkjfujr.b5d\Default\Web Applications\Temp\scoped_dir6596_85277650\Icons\192.png
Size 1KB
SHA256 a4df6887324e092ba148308cb571e44432929ced46e6b81f2fe5237f2003eaa2
MD5 1484d4323c7fd08c0f41b19bf9c90b21
SHA1 0946c1dfe36afa560a3065e2dfe6a952cfd91f3e
SHA512 27d3749d6126a0ed0e156fd0cece916241f6475e434788653c2c2d9bd7e3a6cc4beb331c5a6d6eddc1ae32cdc2fed6adf75d9d8e609c603625f757b773e9ef86
MD5 SHA1 SHA512

Submit Download

256.png

Path C:\Users\Admin\AppData\Local\Temp\ykkjfujr.b5d\Default\Web Applications\Temp\scoped_dir6596_85277650\Icons\256.png
Size 5KB
SHA256 0697629ecdfb67c2a96d72d46684252c4d5081fdcc15a49c2d4bcc3277373055
MD5 9b6367a8d512a86517f252c018ff545c
SHA1 98e02e81062342fc7a1b6b712520480c7215860a
SHA512 d5314fa7f354a09c1c897f0b9a17d6d05ef785714c0fdedceee790e9cee4f507e3cb8c19cac7e63220d730ae8bd13627d781a94c1909281b082889b1e7d27ec4
SSDEEP 96:J+FE0zWj39NhE+m8RRXIG+rrrrrrrO/lX6goYfYCbBaE1bRUhWGAp8OrTIhZ7SIv:J+FE0S5UJ8RRXIJrrrrrrrYXwYnVaE1+
MD5 SHA1 SHA512 SSDEEP

Submit Download

96.png

Path C:\Users\Admin\AppData\Local\Temp\ykkjfujr.b5d\Default\Web Applications\Temp\scoped_dir6596_85277650\Icons\96.png
Size 2KB
SHA256 e5b127387cfd3e4a676fce11c91900c6901bc434231a36187aca9e7a0ae9657e
MD5 fdd521054c40ff2e9086d59b337ac9ba
SHA1 4a5d1ebe3639933130a7d68974063d844e3dbad9
SHA512 e11a1048a0dceb664832a51f955f6564946b0eb3f12ea51deba58ec0d692ab717fadf24fa090c4feae3a8d0ce514c9f358dc4784cb9c9f489870e19f0617c742
MD5 SHA1 SHA512

Submit Download

Google Chrome (3).lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome (3).lnk
Size 2KB
SHA256 6cb05634fd103e9e270d3ffebf40f2eae5b874004ef0b918d2ca78374629c679
MD5 34cf9409e56d61f8d2dcadc180ab7dc2
SHA1 fe19c46db8979a1b2add85d40954c9d81220175d
SHA512 ce514ff3ebf11ad236761dfe1ba853de092a579166056c09692c5ad6ea42088c79df9b12aee4ff061d62d929591e81a7fe36623de580b6f563cd7118b981cd88
MD5 SHA1 SHA512

Submit Download

5HZ4VYLWTDIKCJFIE5PH.temp

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\5HZ4VYLWTDIKCJFIE5PH.temp
Size 4KB
SHA256 060c0f189842b62edf9e0640e7930bb8e09701b3331af56190529aa685f400b0
MD5 ade54741a3f722f2b1caa2c892d737f6
SHA1 ed8f15dc9469a994c5ddc9b9a284e60dd982f25f
SHA512 0cfbc771a3d1608849d530ebcfb1e7441113f3575742212fa88813b48e623afb6c72bbce11668998806af165a5c28537099cfefe478be83456f2c627526c8fbc
SSDEEP 48:yG8dOn58BLgJ9zUoYbOigdLXuHBpyG8dOn58BLgJ9zvYbOggdLXuHY2I:pJUoTbuhHJvTgIu4
MD5 SHA1 SHA512 SSDEEP

Submit Download

ccba5a5986c77e43.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Size 4KB
SHA256 e02f487ca0d3c0673fec2a8d1ae545a75e53ab731a42b74e72a0509b09ee2dc7
MD5 7b8d3e6c77d371b21c3637e29c76cfe9
SHA1 dcc0940da52186401949e908fb82319ba4800da8
SHA512 9461519eaacd94b5adf02f93449ad10e80a72c7d64805b2c43466f9e8421f88fdf2cb0f233d4dbe5ff7a4dc4bf66b78c0209a945bda6a229aa21c974a0f7a312
SSDEEP 48:jG8dOn58BLgJ9zUoYTdLXuHBp3G8dOn58BLgJ9zvYGgdLXuHY2I:QJUo0uh2JvpIu4
MD5 SHA1 SHA512 SSDEEP

Submit Download

store.json.mozlz4.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5rm9ff4w.default-release\crashes\store.json.mozlz4.tmp
Size 7KB
SHA256 db1095a13104322fd2b6e30c34cfb94bc2d4a7aaf15d0d9d964dbba99a61ae72
MD5 065224470b6818e67385cb37b09d032f
SHA1 930e8064462c3da7cad66840a43836e80ee80e8f
SHA512 95654b3b2d1a405b5fcf2bc682f6add20e207bb987244c82db9c14fdce051c09294fd7c92f8fb4b4f6f309ecdae2c310866b850cddff9365f10d3caf1c047407
SSDEEP 192:lsKM36QVSNH6xEijrFY3gDebvP9H2MosSSEHulgbk83LCi+:2Vj2eEgriwDZu2kHi+
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5rm9ff4w.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 8da53e5534acee243398c84997ab61a9befead1f30e1f7f513ba52d42f60cbeb
MD5 4c11e485cf97bb75839ea06dd5781d11
SHA1 57ea0b34967cfe52788bc64a4de55c391e75ff0a
SHA512 72df9892e9d75e9a028f17e2f032ef936c637f2aae56107621048c3dcddc58050c82c7b9ad9ec908ae34c0c85390dd2a43c0502792661719abf82d3209175bf8
SSDEEP 192:akcOv5zboHBbvGyyja+O4J1/66Joz0dzgCl6mSSdz:akfbohbvGyyjaSH/66JozQzgC1bd
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5rm9ff4w.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 7b9c81c7bc64040d9af87e928ca3b05b6d2b5a2ef26030ef9d9ca8eaeb3a7b21
MD5 83cd8e845020a6e7086ae4f4087033ab
SHA1 d747892c2be3877e7df1ab2ffc2cb2740155b2b0
SHA512 3b2798fad734d0c3f892d57be221a6056855c3c988cce8e6f1de1bfd2973259fb6e82d38d029d694d65796633220eb83b2802ee17b9fcb074308482f1c1eac45
SSDEEP 192:ykcOv5zboHBZvGyyja+O1k1/66Joz0dzgCl6mSSdz:ykfbohZvGyyja7u/66JozQzgC1bd
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5rm9ff4w.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 d609d477f82f9619faf16403b1c1aad66fca7ece8cb710bb64cb29d1b996ffd3
MD5 85e4664930d1c1a889ee2604ce380e10
SHA1 3e0c3cba03f682d0f1535a758c4e6d73c6400095
SHA512 a03c784968511e59a8341d6e617eb0dde30af26bb4fbb75e0fe08569d95e9c71e06f23a74c07bd9d638fa13a9295ef357daa7cf93ca8682a7c2dfe93cd4a7c53
SSDEEP 192:af1/66Joz0dzgCl6mSSdWkcOv5zboobvGyyja+:at/66JozQzgC1bokfboobvGyyja
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5rm9ff4w.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 12ef60d308b381d63fbaa822877d26d2af6219f1a283a8b6b862fcc60e60c75d
MD5 55dc97840a739cdeabfe77960f501a57
SHA1 65579f9f5faccf739c10b3d5e4ef03337e1c792c
SHA512 0fa1c774ff7e962f5eadf048f721e724cc51d0517766a98c11bbaa256305def69a7476c8afb0f8d93c6736dfa14bcd585ae200deb0d754b34e166de3855ee242
SSDEEP 192:OkcOv5zboxZvGyyja+Oyf1/66Joz0dzgCl6mSSdz:OkfboxZvGyyjaAt/66JozQzgC1bd
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5rm9ff4w.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 5aa5c7276e696c965b2d047a337b4061a58282892b314a7c3239dc4eda2c786f
MD5 a0a6f9bc7a443794c059703bc955d704
SHA1 3292598685a4f66041af97640fd7eeb8b387a8eb
SHA512 00b4aa300774c25bd2134868872bfad7a66817f5fc8b723939e3c2063ee739e94bba7a545ce24747932a32129836b46b752c62723415f97a9e4016b279f0b010
SSDEEP 192:R11/66Joz0dzgCl6mSSdOkcOv5zboHoZvGyyja+ON:Rz/66JozQzgC1bQkfboIZvGyyjaz
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5rm9ff4w.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 a003b2d9004156e236820dc20a091f0cf1167b8c53aa6fe58046dbc7cd5c7a5e
MD5 5c3d1d8c6234876921c2957da029e6ca
SHA1 bb29aeea7df4a6b343545e11e2a27214bc7ba728
SHA512 b2309e09b8c53d6665c5fdd53359138837b4234a37c809ee02ec1d8a909fbd505c44b168530632cf3da460503c4fed0d3cf57899f2484edacbf19a4cb198b9d7
SSDEEP 192:XkcOv5zboobvGyyja+O91/66Joz0dzgCl6mSSd:XkfboobvGyyjal/66JozQzgC1b
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5rm9ff4w.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 b644ee388727bf3878785f42812b4a6cbb3a19d963704557329e0b9ea16848b2
MD5 4901fb6a645e5aeeac5e6d870fd60346
SHA1 f28c7b71736c93d9c974bb59ab95475812fdf7ab
SHA512 33973e9e205afea368612ed5dd2a5e7bfcb5894ac1689c47d809820ba1f48b0e707f0ee19f3de0396a2777de7b458347b405b3c216c2b6c93f182c84b5b98283
SSDEEP 192:ykcOv5zboHoZvGyyja+OrH1/66Joz0dzgCl6mSSdz:ykfboIZvGyyjalV/66JozQzgC1bd
MD5 SHA1 SHA512 SSDEEP

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5rm9ff4w.default-release\datareporting\glean\events\events
Size 1KB
SHA256 991f9ecd7551b6233d00304c5a60cdf6eea51e40defb23cf6715f2519f53b5b2
MD5 3cf2ae95ba6db9166f38cd2768c50fd1
SHA1 a238473a40472f96acb0788bd4a3d173b1b27067
SHA512 5c90691877c7ad4ebb84bfa096219915d9e2e35fabba1e547b43867dea4f1fde6b6c7fa31e00022c3d1b5efa9d7a6a6b2b2d8fdfb5ff3d5e58aa2d9ec00376a4
MD5 SHA1 SHA512

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5rm9ff4w.default-release\datareporting\glean\events\events
Size 1KB
SHA256 0d23c594c46316b6a9386540b1c7d28c9565f8859343eb8411be30b3ddd3391b
MD5 4993d189bfae88e630b6edf39963704a
SHA1 cb7a2129650b2bfddbc9b7e8ab78bc9f576f8e6f
SHA512 f8a6807340898b5548f6141b5817279292e6ac1bc58eeead8321e7d355942785d1acf979385e896b8e3810e69fe8eda39549222c0bf636cc56af596ff7ca8834
MD5 SHA1 SHA512

Submit Download

004948e5-d1f6-43f2-a633-90b2deb11da2

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5rm9ff4w.default-release\datareporting\glean\pending_pings\004948e5-d1f6-43f2-a633-90b2deb11da2
Size 871B
SHA256 d833a9f079d58b6530452595ae48df89bfa0af33bf87249786eed381e5feee34
MD5 ce5d97a97ed3bf060a2c77042fad5fcb
SHA1 648668302828f6281a5b5b343df68d565ed05b77
SHA512 3b1327879e15869e41ba5c4689b72577fb5b2d8e4e41711334054f7b717c1788fd62c397c644878b53cc5b693801896d338307d926603817cfcf4cf803243438
MD5 SHA1 SHA512

Submit Download

11de16a4-fe2a-40ee-a157-c4c56127f7c3

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5rm9ff4w.default-release\datareporting\glean\pending_pings\11de16a4-fe2a-40ee-a157-c4c56127f7c3
Size 3KB
SHA256 0be164b735c77a1d3e2079cdd5d87e4ab57325b91273b0e4ef45ea1b5ec0a542
MD5 83ae5cb909d4074632a01b734669da51
SHA1 8b2a20399c0911ac3db4acbb5a9d79ba195db7c7
SHA512 eee748f2445d0284c86dca2b0c77ac93f4ca0cd8e6d132ba927792069333c50ff6556ac531cb2852cbd86af9107399459de5ed4b4d05c5dd0053b92137adf2b3
MD5 SHA1 SHA512

Submit Download

18a97fe7-26e6-4ee4-8b96-84cb547a9971

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5rm9ff4w.default-release\datareporting\glean\pending_pings\18a97fe7-26e6-4ee4-8b96-84cb547a9971
Size 3KB
SHA256 da31bfabe13f77744dfd2939acb9d751677b173389e3ce168bae70f5348f6a7e
MD5 3fc2a15d2bb55654fba5a3cf6ca2cea8
SHA1 804a4472f21ee1db6a9445c2aee04ef4704cc5f5
SHA512 aa2bdd47c04a3e10d7bca4b96b4e6edd6c486e8a4819f6f385a51c2e67b2848be5b80d257f1a4d4422c8c09e847d07329120634f86c6dbff50a8c2fcf99dd484
MD5 SHA1 SHA512

Submit Download

19754239-7a8b-47a6-b928-15c26732505f

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5rm9ff4w.default-release\datareporting\glean\pending_pings\19754239-7a8b-47a6-b928-15c26732505f
Size 16KB
SHA256 12804bfb53ecf3ccc29a136191efaede045ab013a88d217778c74ae39b77c4a9
MD5 45a78976052452b6b42321547db35b16
SHA1 bf96921827502dc373ec7b86c474bf5118d9cbd2
SHA512 39ec9b6cd0e51feba20219703979dc050ca9aa920bf2bed7aac69ebe2e1873a695b09976325f0e2208abc59fa53a639e2f1bb4991764367fdbe5a7fcdd876926
SSDEEP 384:414DJPpK2SWclVjSJFNYZZ1fV5u3x/moxIX:VJhhSVXfVa8ow
MD5 SHA1 SHA512 SSDEEP

Submit Download

28efcbeb-22cd-4b72-8c8c-351400531d38

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5rm9ff4w.default-release\datareporting\glean\pending_pings\28efcbeb-22cd-4b72-8c8c-351400531d38
Size 235B
SHA256 0ca9efd35c9dfb16050e1ccb1e3b4d287cd1f33002ce6ea19d52c64c9ef0f654
MD5 1e993caa9f3e599c5eefa831f886a88b
SHA1 8a3a27d1e13dc4bb62ee31ef9b2f45c4c17734c8
SHA512 a749a6f90953111c025d11f72e1f94c599506324a1c2f3fab91b8b94513a20ea8b7c5c3024386c89ad1fc30673c7ae6d0b0a96124ef34644dff1202a8a326cff
MD5 SHA1 SHA512

Submit Download

42c01d7d-77f6-464d-a0ff-21a9ce49fcd2

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5rm9ff4w.default-release\datareporting\glean\pending_pings\42c01d7d-77f6-464d-a0ff-21a9ce49fcd2
Size 3KB
SHA256 c777615e4684cbce8a5468b26900a9bc2ff2c952af5fba23121bf9a985fb8e6e
MD5 4eb97d725b2ae69baeb1dcdb6e7e0a84
SHA1 431a8a59a4984e3d4617e6792e6f252e99f81166
SHA512 de24841837812aa98e539700f30ab5498558dc9325afd5cba83205e7abe5be7a4e83efaaf1869dd3c7ee72d3d4605164ce1394ad7b973d06b6ea081e1a5119d7
MD5 SHA1 SHA512

Submit Download

54c02346-6de3-4a83-a45e-68f4e46c47ce

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5rm9ff4w.default-release\datareporting\glean\pending_pings\54c02346-6de3-4a83-a45e-68f4e46c47ce
Size 2KB
SHA256 a8d3e7cbd4b0c4b13254ff4d2f01b1b9f0fa5ab9cd6ba5166518309c3e1b8568
MD5 ec75e91834ac77020bf6e84d473762e6
SHA1 8764d73684639e84d40c7cfbdaeb77f962cace52
SHA512 b0e064caac14d4c018a3af9d4756dcc7aab18ad53ef1b2a002410d9df2ce9912d7d7f94d212b70671a48acaecc5653a1524a93a4b718b51af84e4cb20ef0f7a7
MD5 SHA1 SHA512

Submit Download

5827a3ef-0305-4f6f-85fc-66b695778d47

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5rm9ff4w.default-release\datareporting\glean\pending_pings\5827a3ef-0305-4f6f-85fc-66b695778d47
Size 235B
SHA256 7500ef5f65584614e8e5b4e29bec54a31124ecff50a39cfb8155f1b5f210532d
MD5 9148bdeb99f12b76815d8838fc345c67
SHA1 bb1fd6e91ebe8049796e3a806835a80d031c05ea
SHA512 3b2f0516b654980d34d0b118c419e5208a6487e19dd4eb8d30b4728559419ede9e50b71e5da86d5171c3ecff508199e630caa38bb92f88a082e3a291dfa43af7
MD5 SHA1 SHA512

Submit Download

582f1e17-7956-411c-b151-d4b20ab483dd

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5rm9ff4w.default-release\datareporting\glean\pending_pings\582f1e17-7956-411c-b151-d4b20ab483dd
Size 886B
SHA256 8eefe10cff3dd4d20797cded99d03a268912265b9de0911bca9d57188e593123
MD5 98f35f3d5e5202c8a9100893b9387d40
SHA1 4d2693490ea0984b3d54aded57afa78a09c9d40f
SHA512 8cf77b61a714ea2720187a5fa0f85fb9dec84b70ac3aeb61cf317ef7c8a27acc12720d3350c1ffe9d100f0509ccda63866cf87bc9d70860c4304fa2438abe65b
MD5 SHA1 SHA512

Submit Download

59a4944f-2d38-43da-b912-e83486bca0c2

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5rm9ff4w.default-release\datareporting\glean\pending_pings\59a4944f-2d38-43da-b912-e83486bca0c2
Size 3KB
SHA256 017f65e90520141ef9a160d225af85a2bcdcca72caeff855ae8a0d1a44acb408
MD5 0c2b604c87c0c5d8fb797cbcde904d4f
SHA1 cdb5d6d194a1d7e7110c6c0ff9529c877c4edb0d
SHA512 5d4118ed471cab47197b2f538ba3cea1f104988c6ad1fa79245325d384ecec6aef424f612578ee5b5faa9514fd1701bdc69e194e4fe3119dc5b5a85d6dcf482c
MD5 SHA1 SHA512

Submit Download

644e2104-9c1c-49f1-b95d-c2dab754fba8

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5rm9ff4w.default-release\datareporting\glean\pending_pings\644e2104-9c1c-49f1-b95d-c2dab754fba8
Size 3KB
SHA256 0f044b393f929da2028414ba4685d4cd7fcf4c19048cbbd6760da805fe2b852e
MD5 fe54c44d5803ff6a459b0905a42c0290
SHA1 98207e332eddfa9180a5b8d546c3a27f458f42b2
SHA512 240cc196c74f335b0720daf23acd89acd99a9f5daa16ebf086adf52d2f047f07e1980101d3486807ac50892241e5ed6a7b30c38723f0e81f8e271962c76f9129
MD5 SHA1 SHA512

Submit Download

68e9f4c2-d6e6-4cfd-a547-c34b728fc6f7

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5rm9ff4w.default-release\datareporting\glean\pending_pings\68e9f4c2-d6e6-4cfd-a547-c34b728fc6f7
Size 2KB
SHA256 da6e1a5b7a9d3542c00052803db9765628ac34be1bad34598ca5b7516489197d
MD5 577cc39f3ac094c9634eab4ec90c4c34
SHA1 85760909a75e522dc3bf3d62f7fb3f4aafbbf87a
SHA512 d4464dd94de37b133b96b5bc6191444343ced52dec1f1225ae034981c1fda346c792fe69813c6c2c995d541fded0205a24a099483ab8fc201d61e948ead928de
MD5 SHA1 SHA512

Submit Download

8b1e16f7-3b7c-4b4c-890e-001784da312a

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5rm9ff4w.default-release\datareporting\glean\pending_pings\8b1e16f7-3b7c-4b4c-890e-001784da312a
Size 235B
SHA256 d85e8fb30c5851a05868f75ccc8d872bc0d5bee93f083eb0e4877d6a8e9deeb2
MD5 5093a87084c115f715c6378d1fb48827
SHA1 4bf8470f2a244978ee9988f7066f6aadcf6adf34
SHA512 ea0b4bf00ffc82ebf811c71589bc93026c1126c1a5a98026de285b491bcdc6933ae6e8badcb9665ae856e64d0ca6738510757f2d14b62bff7e84a2c7d894e805
MD5 SHA1 SHA512

Submit Download

a1ed4ede-52b3-47c9-8c26-d0d447af3e03

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5rm9ff4w.default-release\datareporting\glean\pending_pings\a1ed4ede-52b3-47c9-8c26-d0d447af3e03
Size 3KB
SHA256 30eca772d74396e50cf9df2e9d3ee173d141edd16e445eee16177f18c4d51ab1
MD5 e9ae3dab7bfc468ff57caf4c446b1193
SHA1 ef3a48d61cad321cd471b07ef8bef5006099571f
SHA512 c6cde88047b6f1883aef9d3ffbc8091540130830c44d789230de5d61b98d5249112db5582e0b220fc1267cf33b09be5bf7c12c84b79d348b009e26e2bec00c67
MD5 SHA1 SHA512

Submit Download

c2bc01bc-3319-4072-ada5-59199b1452de

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5rm9ff4w.default-release\datareporting\glean\pending_pings\c2bc01bc-3319-4072-ada5-59199b1452de
Size 883B
SHA256 0784e1652b3f3db5c126748ec42da8dc80a02799da53fabdc89edac88788c5c5
MD5 c2ffa5393f3d4c2bc3eb5990e8b14ba8
SHA1 ad2153fd3a3f6a95250d8efed7630a3feca52397
SHA512 938662b33648db6158381f08c01da57dda8b85096c8d725173e2327fd85345d89ce2b2e8ea56cc50bed596726078523a3b024066eb5abfbc13cb447bcb8f9ed7
MD5 SHA1 SHA512

Submit Download

cba8c7ec-28a8-4f96-aa76-d543fe301e88

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5rm9ff4w.default-release\datareporting\glean\pending_pings\cba8c7ec-28a8-4f96-aa76-d543fe301e88
Size 3KB
SHA256 6b4b44e9c31958f442efd4b87957551cac0f7d1fbddc7d1a22f79c9614421722
MD5 a95858e01127528547972b3d7816a2b1
SHA1 60b650a5b275108cd4a3b4879535c1fc9212573d
SHA512 e43b36dbb8aabb991e52f4cd0b88d57f24c2c0651fb2d7b4a6cfaea9aad58ff730b9c2c95f4a6c8500df4a103841536aaab9c6b39d0b50b2c953d69a8ac76c72
MD5 SHA1 SHA512

Submit Download

e7e21719-85aa-462c-8da6-d3e248c4884a

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5rm9ff4w.default-release\datareporting\glean\pending_pings\e7e21719-85aa-462c-8da6-d3e248c4884a
Size 3KB
SHA256 7b7d9dbfd61f669806dfed5eb2f6232fd091a627a4e699b218f97b221c55abe1
MD5 f290b60651cec805654237d069fb3198
SHA1 0b824c6d917fad47efe9802a9f25057b230f7a24
SHA512 ee36ab9725f8e8978fb873c7fd98213e63b5d3aea12ff1be5c52cea281f462ce6a0161a61483983114df6e32ea97cd4af68a732db66fe92afcf0e98d7920d9dc
MD5 SHA1 SHA512

Submit Download

ec770b01-6f61-46a5-87d3-c91506147053

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5rm9ff4w.default-release\datareporting\glean\pending_pings\ec770b01-6f61-46a5-87d3-c91506147053
Size 886B
SHA256 5ee83c0a859dabb5513c054c41ac6b81a91f66c9004081636c9e7644e006643e
MD5 1dcdf36f348137b262d9013225d19901
SHA1 b4d6c0634205a9e9e3a87b712b042b5aa66d922b
SHA512 c0024affafd26978631290dd207572a00ec8f7a9ad17e3d9de27f132bc75b3e4e48951c76a6481ceb55aaaaef0b6b9d633be74643ee5c74d2c4917ee5d6fb3c5
MD5 SHA1 SHA512

Submit Download

ee285e62-cd56-43fa-b626-3842a677b704

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5rm9ff4w.default-release\datareporting\glean\pending_pings\ee285e62-cd56-43fa-b626-3842a677b704
Size 3KB
SHA256 17e7677a264ad7191ef27a2c79aca88c714fd780f7aa2ce75890321dec95f90d
MD5 cff5e3d75a24b7d2e202b8f3902575b4
SHA1 5d26a2cd6cdc31f510701c3a53dedafac249aa3f
SHA512 ae8fead998a40d3bc0245ba69be48d52200cd90ae7a9bc3710a8d2f1b07d48619df7d25f324d4b70ef35eceeb8393f02fd2573fcc525a131fb27683259c4fb3f
MD5 SHA1 SHA512

Submit Download

fe60ead7-2b18-4b1b-b747-fa08ce23cac6

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5rm9ff4w.default-release\datareporting\glean\pending_pings\fe60ead7-2b18-4b1b-b747-fa08ce23cac6
Size 235B
SHA256 faff6ba2d4543c7aee80770000eef789635b0ba7d92dfd6d463c47247da5ccc7
MD5 c6a13c239e0bef1026440ece4a8f8b51
SHA1 ac64195dd822567738e1444a4c4530904342e348
SHA512 5f9c070fbcd1b2319f815fe793834ec2a8fe90933a1b6eac2d2ae6eb9f9e0b31fc106f673d6e07ce740b54c9b79fb5f5f63a4ede909de6088771c4673f4d1002
MD5 SHA1 SHA512

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5rm9ff4w.default-release\prefs-1.js
Size 6KB
SHA256 3783d9237c38f9a4f150aa3af6ef5c90fdd99d33366fbf504d5eef08cd600c40
MD5 84d943c11218a5dd6a0543ad56182ae3
SHA1 0215f5666977b9e6e604eb7c38f09ba20af0f2b9
SHA512 68c5913da7ae45a1fa373a96db27810f7c268bc8e67332772599db8a8d2c335379acb2dfbba7d42e95caa3a8fe49091712d60645eefbbc86ca8cc376fac4caf0
SSDEEP 96:xH9UTUmqGqgfKKDnH1zS1bOSSlhdv9jhnJHMO9JBw88H8L4cnl8DJNFZ:XBRgfKwHhSSTnHBw88ZZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5rm9ff4w.default-release\prefs.js
Size 6KB
SHA256 86551b9aadb37ccaa51e4f3fbb4ee7ab6b06d14b2f07492fc53bfc253f8cecd0
MD5 dd683376bcb4e8e5a961ce86055ed19a
SHA1 f966fd442c96c5c628af6069389b2dce98bbe58a
SHA512 8c357598ab688dc14e478c1ea020473a50fd98ac0a3c1cac9a56dab5ccd07d3765204f134dbd229635b7f141db2ddc7bb739f52d47b0935a86bf1ac4a32d1a45
SSDEEP 96:xH9UTUmqGqgfKKunZ1zSNR0SSlhdv9jlnJHMO9JBw88H8L4cnl8wNFZ:XBRgfKxZ+R0SS3nHBw88MZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5rm9ff4w.default-release\prefs.js
Size 6KB
SHA256 bef269e92203ee26012939c52e745cf06e4fed248b2ea3dd34df900e1add8e25
MD5 70851f3d946e5a6b61cbace86d5612d3
SHA1 7a41333bfcbc9d527fb66d0ac708b1f7ea9473c6
SHA512 576c76cddfc3228a670eed5867a430455303cfa9e751197ff51e054113c20870d418c27dbe6e0509ee7bf7909335c7a572a1a100d9282365af547579cd09384b
SSDEEP 96:xH9UTUmqGqgfKKDnH1zStSSlhdv9jRnJHMO9JBw88H8L4cnl8DJNFZ:XBRgfKwHcSSznHBw88ZZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5rm9ff4w.default-release\sessionCheckpoints.json
Size 90B
SHA256 00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2
MD5 c4ab2ee59ca41b6d6a6ea911f35bdc00
SHA1 5942cd6505fc8a9daba403b082067e1cdefdfbc4
SHA512 71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2
MD5 SHA1 SHA512

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5rm9ff4w.default-release\sessionCheckpoints.json
Size 53B
SHA256 792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da
MD5 ea8b62857dfdbd3d0be7d7e4a954ec9a
SHA1 b43bc4b3ea206a02ef8f63d5bfad0c96bf2a3b2a
SHA512 076ee83534f42563046d25086166f82e1a3ec61840c113aec67abe2d8195daa247d827d0c54e7e8f8a1bbf2d082a3763577587e84342ec160ff97905243e6d19
MD5 SHA1 SHA512

Submit Download

aKjaHHPf.exe

Path C:\Users\Admin\AppData\Roaming\aKjaHHPf.exe
Size 1.2MB
SHA256 b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c
MD5 c714eda54303d9235a46ce4537efc074
SHA1 17b5a790e2250b4e7a12ae2c0b35cc56103f0910
SHA512 4d7191bddb61ac099b7e19e65287c51952e52aee4b34d1420d6ddda0d44bcbb5caf63191736512c9e97074b603704bfb2a1d054cbadc679f6a4afe42bc791a7b
SSDEEP 24576:XL21q+uS0KBjzt2a1IzFVgZB31PLNqw2Tak+RECk59vIzy2kNRcL:ahuTMv31KXgnFP5eTak+mNjv8y2
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Windows\SystemTemp\Crashpad\settings.dat
Size 40B
SHA256 2bb1c1196648cfa46e535b8b9f59501fdae107e85a7d2f5856869b4a9740e9f3
MD5 2dcc2b10f917219e1a41c57abc433460
SHA1 253035fcee05589f7b30cab948494dc85fe3f99d
SHA512 f2bb47beeb8497dc7cc2816c5d8d3e06a74a6ed8541a36fbd8decc439fc329927dcffe5b04a38f7fab5f12d9cc5fc864285a89212490b70335abbb9025df74e0
MD5 SHA1 SHA512

Submit Download

chrome_installer.log

Path C:\Windows\SystemTemp\chrome_installer.log
Size 7KB
SHA256 ad6453150727292cc6dcf00af04f3c179d75bf703c6fc9679b2d16f031590d27
MD5 a07680b818cc0ef7fce1b521054c27cb
SHA1 5c1c3cbafa58ceff01461ab4b2d87ed56c9587d1
SHA512 61fc99bec514bca0a7562edf0c3c43e897b3ca7f178763215e65740eb605bd3855ed31ae98b0a6c8de4f86f021436373a56f203a2c7db0a545da43b5fed59d54
SSDEEP 96:8hvteEhGkwK3QK35WILQkwK2LK2ZVRViGFgwK3sK3p:Uk+GTnnoQTl5LFfXq
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/8-21-0x0000000005650000-0x00000000056B6000-memory.dmp

Download

memory/8-45-0x00000000709D0000-0x0000000070A1C000-memory.dmp

Download

memory/8-39-0x0000000005D10000-0x0000000005D2E000-memory.dmp

Download

memory/8-61-0x0000000007690000-0x0000000007D0A000-memory.dmp

Download

memory/8-62-0x0000000007050000-0x000000000706A000-memory.dmp

Download

memory/8-63-0x00000000070D0000-0x00000000070DA000-memory.dmp

Download

memory/8-41-0x0000000006280000-0x00000000062CC000-memory.dmp

Download

memory/8-22-0x00000000056C0000-0x0000000005726000-memory.dmp

Download

memory/8-20-0x0000000004E80000-0x0000000004EA2000-memory.dmp

Download

memory/8-16-0x00000000049E0000-0x00000000049F0000-memory.dmp

Download

memory/8-17-0x00000000049E0000-0x00000000049F0000-memory.dmp

Download

memory/8-18-0x0000000005020000-0x000000000564A000-memory.dmp

Download

memory/8-66-0x0000000007290000-0x000000000729E000-memory.dmp

Download

memory/1016-1794-0x000000006F620000-0x000000006F66C000-memory.dmp

Download

memory/1068-14-0x0000000004C00000-0x0000000004C10000-memory.dmp

Download

memory/1068-15-0x0000000004C00000-0x0000000004C10000-memory.dmp

Download

memory/1068-67-0x0000000007430000-0x0000000007445000-memory.dmp

Download

memory/1068-68-0x0000000007530000-0x000000000754A000-memory.dmp

Download

memory/1068-69-0x0000000007520000-0x0000000007528000-memory.dmp

Download

memory/1068-64-0x0000000007470000-0x0000000007506000-memory.dmp

Download

memory/1068-60-0x0000000006E90000-0x0000000006F34000-memory.dmp

Download

memory/1068-59-0x0000000006E60000-0x0000000006E7E000-memory.dmp

Download

memory/1068-44-0x0000000006E00000-0x0000000006E34000-memory.dmp

Download

memory/1068-46-0x00000000709D0000-0x0000000070A1C000-memory.dmp

Download

memory/1068-35-0x00000000059C0000-0x0000000005D17000-memory.dmp

Download

memory/1068-13-0x0000000002690000-0x00000000026C6000-memory.dmp

Download

memory/1068-65-0x00000000073F0000-0x0000000007401000-memory.dmp

Download

memory/1904-143-0x0000023B9EB40000-0x0000023B9EC74000-memory.dmp

Download

memory/2020-2377-0x0000000000240000-0x0000000000241000-memory.dmp

Download

memory/3760-8-0x0000000006CB0000-0x0000000006DB2000-memory.dmp

Download

memory/3760-2-0x0000000005530000-0x00000000055C2000-memory.dmp

Download

memory/3760-0-0x0000000000940000-0x0000000000A74000-memory.dmp

Download

memory/3760-4-0x00000000055D0000-0x00000000055DA000-memory.dmp

Download

memory/3760-5-0x0000000005830000-0x00000000058CC000-memory.dmp

Download

memory/3760-6-0x00000000059F0000-0x0000000005A04000-memory.dmp

Download

memory/3760-7-0x0000000005660000-0x0000000005670000-memory.dmp

Download

memory/3760-3-0x0000000005660000-0x0000000005670000-memory.dmp

Download

memory/3760-1-0x0000000005A40000-0x0000000005FE6000-memory.dmp

Download

memory/4004-1471-0x000002B1C76C0000-0x000002B1C77F4000-memory.dmp

Download

memory/4344-2397-0x00000267587A0000-0x00000267597A0000-memory.dmp

Download

memory/4344-2391-0x0000000000830000-0x0000000000831000-memory.dmp

Download

memory/4344-2218-0x0000000000820000-0x0000000000821000-memory.dmp

Download

memory/4444-2356-0x0000000000330000-0x0000000000331000-memory.dmp

Download

memory/4584-43-0x00000000051C0000-0x00000000051D4000-memory.dmp

Download

memory/4728-2754-0x0000027CBC8D0000-0x0000027CBCA04000-memory.dmp

Download

memory/4832-2522-0x0000017526E00000-0x0000017526F34000-memory.dmp

Download

memory/4844-343-0x00000000009D0000-0x00000000009D1000-memory.dmp

Download

memory/4904-76-0x0000000006330000-0x00000000063A6000-memory.dmp

Download

memory/4904-37-0x0000000000400000-0x00000000004BE000-memory.dmp

Download

memory/4904-4505-0x0000000007110000-0x0000000007467000-memory.dmp

Download

memory/4904-74-0x0000000006200000-0x00000000062B2000-memory.dmp

Download

memory/4904-75-0x0000000006480000-0x0000000006642000-memory.dmp

Download

memory/4904-79-0x00000000067C0000-0x00000000067DE000-memory.dmp

Download

memory/4904-78-0x0000000006B80000-0x00000000070AC000-memory.dmp

Download

memory/4904-77-0x00000000063B0000-0x0000000006400000-memory.dmp

Download

memory/5668-1495-0x0000000006950000-0x000000000699C000-memory.dmp

Download

memory/5668-1833-0x0000000007E80000-0x0000000007E95000-memory.dmp

Download

memory/5668-1382-0x0000000006510000-0x0000000006867000-memory.dmp

Download

memory/5668-1760-0x000000006F620000-0x000000006F66C000-memory.dmp

Download

memory/5668-1778-0x0000000007B30000-0x0000000007BD4000-memory.dmp

Download

memory/5668-1812-0x0000000007E40000-0x0000000007E51000-memory.dmp

Download

memory/6108-409-0x000002B7BA9C0000-0x000002B7BAAF4000-memory.dmp

Download

memory/7088-3332-0x000002023D0E0000-0x000002023E0E0000-memory.dmp

Download