phantom_stealer | fa086327bf7fa3957e03d5ffcf43fc926aa47fd24b96b479e29bfbccf3becc07

Analysis

max time kernel
149s
max time network
104s
platform
windows11-21h2_x64
resource
win11-20250619-en
resource tags

arch:x64arch:x86image:win11-20250619-enlocale:en-usos:windows11-21h2-x64system
submitted
13/11/2025, 08:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SecuriteInfo.com.Win32.MalwareX-gen.30848.26229.exe
Size 1.4MB
Sample251113-kaa7pacx2f
SHA256 fa086327bf7fa3957e03d5ffcf43fc926aa47fd24b96b479e29bfbccf3becc07
MD5 11d3d98a4476aa70571df8a619f696e6
SHA1 0b01a3b3ba179a220e83522d7e6d7524e7a91946
SHA512 2e0180f9e460374c92d90d23150ad1eb888b27dfc83970aadd0451c98e117c9fd06c5c77926aa008b86b5fa4aba54fb6aaea63cdc356c7f89a09de7171fa7df3
SSDEEP 24576:npcpvDq4URpr8IEiYdoGMwVPbblGHLCZxEM795ccE0SED90TsXD:uO4UR+iY6Nw9bhGHWzDJfE0NgYD
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

collection discovery phantom_stealer persistence spyware stealer

Malware Config

Extracted

Family

phantom_stealer

Version

v3.5.0

https://discordapp.com/api/webhooks/1436692679583858689/4BHRbWytfZSQzAZTXnDtpPWrXWxCBROSeotn8uBckpwPZ1jtGyY7lgN3_eY-ZBHVKTmg

Mutex

XGJ13HMNGRG5G6RREZHC

Attributes

anti_analysis
0
cb_enables_ssl
0
debug
0
keylogger
1
start_delay
0
startup
1

Signatures

Detects PhantomStealer payload 1 IoCs

resource	yara_rule
behavioral2/memory/5800-9-0x0000000000400000-0x00000000004BE000-memory.dmp	family_phantomstealer

PhantomStealer
Phantom Stealer is a stealer written in C#, forked from the Stealerium family.
stealer phantom_stealer
Phantom_stealer family
phantom_stealer

Executes dropped EXE 2 IoCs

pid	Process
4408	SecuriteInfo.com.Win32.MalwareX-gen.30848.26229.exe
4624	SecuriteInfo.com.Win32.MalwareX-gen.30848.26229.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3534313381-4287935181-1066995225-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	SecuriteInfo.com.Win32.MalwareX-gen.30848.26229.exe
Key opened	\REGISTRY\USER\S-1-5-21-3534313381-4287935181-1066995225-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	SecuriteInfo.com.Win32.MalwareX-gen.30848.26229.exe
Key opened	\REGISTRY\USER\S-1-5-21-3534313381-4287935181-1066995225-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	SecuriteInfo.com.Win32.MalwareX-gen.30848.26229.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3534313381-4287935181-1066995225-1000\Software\Microsoft\Windows\CurrentVersion\Run\SecuriteInfo.com.Win32.MalwareX-gen.30848.26229 = "C:\\Users\\Admin\\AppData\\Roaming\\SecuriteInfo.com.Win32.MalwareX-gen.30848.26229.exe"	SecuriteInfo.com.Win32.MalwareX-gen.30848.26229.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
91	icanhazip.com

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3156 set thread context of 5800	3156	SecuriteInfo.com.Win32.MalwareX-gen.30848.26229.exe	79
PID 4408 set thread context of 4624	4408	SecuriteInfo.com.Win32.MalwareX-gen.30848.26229.exe	156

Drops file in Program Files directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\5676_13407495846707017_5676.pma	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\6368_13407495853350233_6368.pma	setup.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\c7a6d778-fa07-4b15-850d-b88b70fc83d2.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\1508_13407495853401128_1508.pma	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\5264_13407495846656286_5264.pma	setup.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\b61cde7f-9335-4b0c-ba1a-9cafbcdc5ce4.tmp	setup.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\7f1325a2-879a-489f-8236-575063e8bb49.tmp	setup.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\f3966901-1ae3-46fd-ba19-b3671770bb97.tmp	setup.exe

Drops file in Windows directory 48 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\chrome_installer.log	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\metadata	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\chrome_installer.log	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\metadata	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\settings.dat	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\chrome_installer.log	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\settings.dat	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\metadata	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\metadata	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\metadata	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp	setup.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\metadata	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\settings.dat	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\settings.dat	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\metadata	setup.exe
File opened for modification	C:\Windows\SystemTemp\msedge_installer.log	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp\msedge_installer.log	setup.exe
File opened for modification	C:\Windows\SystemTemp	setup.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\metadata	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File opened for modification	C:\Windows\SystemTemp\msedge_installer.log	setup.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File opened for modification	C:\Windows\SystemTemp\msedge_installer.log	setup.exe
File opened for modification	C:\Windows\SystemTemp\chrome_installer.log	chrmstp.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1904	5800	WerFault.exe	79

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SecuriteInfo.com.Win32.MalwareX-gen.30848.26229.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SecuriteInfo.com.Win32.MalwareX-gen.30848.26229.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SecuriteInfo.com.Win32.MalwareX-gen.30848.26229.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SecuriteInfo.com.Win32.MalwareX-gen.30848.26229.exe

Checks processor information in registry 2 TTPs 38 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	SecuriteInfo.com.Win32.MalwareX-gen.30848.26229.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	SecuriteInfo.com.Win32.MalwareX-gen.30848.26229.exe

Enumerates system info in registry 2 TTPs 12 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134074958310113552"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	chrmstp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3534313381-4287935181-1066995225-1000\{0404251C-0786-4663-A721-536C4975EB0E}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3534313381-4287935181-1066995225-1000\{DB14A342-A04A-4764-88CF-5CE6A0A8F5D0}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	chrmstp.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3156	SecuriteInfo.com.Win32.MalwareX-gen.30848.26229.exe
3156	SecuriteInfo.com.Win32.MalwareX-gen.30848.26229.exe
3156	SecuriteInfo.com.Win32.MalwareX-gen.30848.26229.exe
3156	SecuriteInfo.com.Win32.MalwareX-gen.30848.26229.exe
5800	SecuriteInfo.com.Win32.MalwareX-gen.30848.26229.exe
5800	SecuriteInfo.com.Win32.MalwareX-gen.30848.26229.exe
5040	chrome.exe
5040	chrome.exe
5800	SecuriteInfo.com.Win32.MalwareX-gen.30848.26229.exe
5800	SecuriteInfo.com.Win32.MalwareX-gen.30848.26229.exe
5800	SecuriteInfo.com.Win32.MalwareX-gen.30848.26229.exe
5800	SecuriteInfo.com.Win32.MalwareX-gen.30848.26229.exe
5800	SecuriteInfo.com.Win32.MalwareX-gen.30848.26229.exe
5800	SecuriteInfo.com.Win32.MalwareX-gen.30848.26229.exe
5800	SecuriteInfo.com.Win32.MalwareX-gen.30848.26229.exe
5800	SecuriteInfo.com.Win32.MalwareX-gen.30848.26229.exe
5800	SecuriteInfo.com.Win32.MalwareX-gen.30848.26229.exe
3880	firefox.exe
3880	firefox.exe
3880	firefox.exe
3880	firefox.exe
3880	firefox.exe
3880	firefox.exe
3880	firefox.exe
3880	firefox.exe
3880	firefox.exe
3880	firefox.exe
3880	firefox.exe
3880	firefox.exe
3880	firefox.exe
3880	firefox.exe
3880	firefox.exe
3880	firefox.exe
3880	firefox.exe
3880	firefox.exe
3880	firefox.exe
3880	firefox.exe
5800	SecuriteInfo.com.Win32.MalwareX-gen.30848.26229.exe
5800	SecuriteInfo.com.Win32.MalwareX-gen.30848.26229.exe
5800	SecuriteInfo.com.Win32.MalwareX-gen.30848.26229.exe
5800	SecuriteInfo.com.Win32.MalwareX-gen.30848.26229.exe
5800	SecuriteInfo.com.Win32.MalwareX-gen.30848.26229.exe
5800	SecuriteInfo.com.Win32.MalwareX-gen.30848.26229.exe
4408	SecuriteInfo.com.Win32.MalwareX-gen.30848.26229.exe
4408	SecuriteInfo.com.Win32.MalwareX-gen.30848.26229.exe
4408	SecuriteInfo.com.Win32.MalwareX-gen.30848.26229.exe
5800	SecuriteInfo.com.Win32.MalwareX-gen.30848.26229.exe
5800	SecuriteInfo.com.Win32.MalwareX-gen.30848.26229.exe
5800	SecuriteInfo.com.Win32.MalwareX-gen.30848.26229.exe
5800	SecuriteInfo.com.Win32.MalwareX-gen.30848.26229.exe
5800	SecuriteInfo.com.Win32.MalwareX-gen.30848.26229.exe
5800	SecuriteInfo.com.Win32.MalwareX-gen.30848.26229.exe
5800	SecuriteInfo.com.Win32.MalwareX-gen.30848.26229.exe
5800	SecuriteInfo.com.Win32.MalwareX-gen.30848.26229.exe
5800	SecuriteInfo.com.Win32.MalwareX-gen.30848.26229.exe
5800	SecuriteInfo.com.Win32.MalwareX-gen.30848.26229.exe
5800	SecuriteInfo.com.Win32.MalwareX-gen.30848.26229.exe
5800	SecuriteInfo.com.Win32.MalwareX-gen.30848.26229.exe
5800	SecuriteInfo.com.Win32.MalwareX-gen.30848.26229.exe
5800	SecuriteInfo.com.Win32.MalwareX-gen.30848.26229.exe
4916	firefox.exe
4916	firefox.exe
4916	firefox.exe
4916	firefox.exe

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeDebugPrivilege	3156	SecuriteInfo.com.Win32.MalwareX-gen.30848.26229.exe
Token: SeDebugPrivilege	5800	SecuriteInfo.com.Win32.MalwareX-gen.30848.26229.exe
Token: SeShutdownPrivilege	5040	chrome.exe
Token: SeCreatePagefilePrivilege	5040	chrome.exe
Token: SeShutdownPrivilege	5040	chrome.exe
Token: SeCreatePagefilePrivilege	5040	chrome.exe
Token: SeShutdownPrivilege	5040	chrome.exe
Token: SeCreatePagefilePrivilege	5040	chrome.exe
Token: SeShutdownPrivilege	5040	chrome.exe
Token: SeCreatePagefilePrivilege	5040	chrome.exe
Token: SeDebugPrivilege	4408	SecuriteInfo.com.Win32.MalwareX-gen.30848.26229.exe
Token: SeDebugPrivilege	4624	SecuriteInfo.com.Win32.MalwareX-gen.30848.26229.exe
Token: SeShutdownPrivilege	5220	chrome.exe
Token: SeCreatePagefilePrivilege	5220	chrome.exe
Token: SeShutdownPrivilege	5220	chrome.exe
Token: SeCreatePagefilePrivilege	5220	chrome.exe
Token: SeShutdownPrivilege	5220	chrome.exe
Token: SeCreatePagefilePrivilege	5220	chrome.exe

Suspicious use of FindShellTrayWindow 48 IoCs

pid	Process
5040	chrome.exe
5040	chrome.exe
4976	chrmstp.exe
3880	firefox.exe
3880	firefox.exe
3880	firefox.exe
3880	firefox.exe
3880	firefox.exe
3880	firefox.exe
3880	firefox.exe
3880	firefox.exe
3880	firefox.exe
3880	firefox.exe
3880	firefox.exe
3880	firefox.exe
3880	firefox.exe
3880	firefox.exe
3880	firefox.exe
3880	firefox.exe
3880	firefox.exe
3880	firefox.exe
3880	firefox.exe
3880	firefox.exe
4608	msedge.exe
3484	msedge.exe
4916	firefox.exe
4916	firefox.exe
4916	firefox.exe
4916	firefox.exe
4916	firefox.exe
4916	firefox.exe
4916	firefox.exe
4916	firefox.exe
4916	firefox.exe
4916	firefox.exe
4916	firefox.exe
4916	firefox.exe
4916	firefox.exe
4916	firefox.exe
4916	firefox.exe
4916	firefox.exe
4916	firefox.exe
4916	firefox.exe
4916	firefox.exe
4916	firefox.exe
5220	chrome.exe
5220	chrome.exe
4120	chrmstp.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3880	firefox.exe
4916	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3156 wrote to memory of 3176	3156	SecuriteInfo.com.Win32.MalwareX-gen.30848.26229.exe	78
PID 3156 wrote to memory of 3176	3156	SecuriteInfo.com.Win32.MalwareX-gen.30848.26229.exe	78
PID 3156 wrote to memory of 3176	3156	SecuriteInfo.com.Win32.MalwareX-gen.30848.26229.exe	78
PID 3156 wrote to memory of 5800	3156	SecuriteInfo.com.Win32.MalwareX-gen.30848.26229.exe	79
PID 3156 wrote to memory of 5800	3156	SecuriteInfo.com.Win32.MalwareX-gen.30848.26229.exe	79
PID 3156 wrote to memory of 5800	3156	SecuriteInfo.com.Win32.MalwareX-gen.30848.26229.exe	79
PID 3156 wrote to memory of 5800	3156	SecuriteInfo.com.Win32.MalwareX-gen.30848.26229.exe	79
PID 3156 wrote to memory of 5800	3156	SecuriteInfo.com.Win32.MalwareX-gen.30848.26229.exe	79
PID 3156 wrote to memory of 5800	3156	SecuriteInfo.com.Win32.MalwareX-gen.30848.26229.exe	79
PID 3156 wrote to memory of 5800	3156	SecuriteInfo.com.Win32.MalwareX-gen.30848.26229.exe	79
PID 3156 wrote to memory of 5800	3156	SecuriteInfo.com.Win32.MalwareX-gen.30848.26229.exe	79
PID 5800 wrote to memory of 5040	5800	SecuriteInfo.com.Win32.MalwareX-gen.30848.26229.exe	83
PID 5800 wrote to memory of 5040	5800	SecuriteInfo.com.Win32.MalwareX-gen.30848.26229.exe	83
PID 5040 wrote to memory of 5044	5040	chrome.exe	84
PID 5040 wrote to memory of 5044	5040	chrome.exe	84
PID 5040 wrote to memory of 4424	5040	chrome.exe	85
PID 5040 wrote to memory of 4424	5040	chrome.exe	85
PID 5040 wrote to memory of 948	5040	chrome.exe	86
PID 5040 wrote to memory of 948	5040	chrome.exe	86
PID 5800 wrote to memory of 948	5800	SecuriteInfo.com.Win32.MalwareX-gen.30848.26229.exe	86
PID 5800 wrote to memory of 5044	5800	SecuriteInfo.com.Win32.MalwareX-gen.30848.26229.exe	84
PID 5040 wrote to memory of 5548	5040	chrome.exe	87
PID 5040 wrote to memory of 5548	5040	chrome.exe	87
PID 5800 wrote to memory of 5044	5800	SecuriteInfo.com.Win32.MalwareX-gen.30848.26229.exe	84
PID 5040 wrote to memory of 2340	5040	chrome.exe	88
PID 5040 wrote to memory of 2340	5040	chrome.exe	88
PID 5040 wrote to memory of 6012	5040	chrome.exe	89
PID 5040 wrote to memory of 6012	5040	chrome.exe	89
PID 5040 wrote to memory of 4392	5040	chrome.exe	90
PID 5040 wrote to memory of 4392	5040	chrome.exe	90
PID 5040 wrote to memory of 2208	5040	chrome.exe	91
PID 5040 wrote to memory of 2208	5040	chrome.exe	91
PID 5040 wrote to memory of 1956	5040	chrome.exe	92
PID 5040 wrote to memory of 1956	5040	chrome.exe	92
PID 5040 wrote to memory of 2176	5040	chrome.exe	93
PID 5040 wrote to memory of 2176	5040	chrome.exe	93
PID 5800 wrote to memory of 5040	5800	SecuriteInfo.com.Win32.MalwareX-gen.30848.26229.exe	83
PID 5040 wrote to memory of 1480	5040	chrome.exe	94
PID 5040 wrote to memory of 1480	5040	chrome.exe	94
PID 5800 wrote to memory of 5040	5800	SecuriteInfo.com.Win32.MalwareX-gen.30848.26229.exe	83
PID 5800 wrote to memory of 4424	5800	SecuriteInfo.com.Win32.MalwareX-gen.30848.26229.exe	85
PID 5800 wrote to memory of 4424	5800	SecuriteInfo.com.Win32.MalwareX-gen.30848.26229.exe	85
PID 5800 wrote to memory of 1956	5800	SecuriteInfo.com.Win32.MalwareX-gen.30848.26229.exe	92
PID 5800 wrote to memory of 1956	5800	SecuriteInfo.com.Win32.MalwareX-gen.30848.26229.exe	92
PID 5800 wrote to memory of 948	5800	SecuriteInfo.com.Win32.MalwareX-gen.30848.26229.exe	86
PID 5800 wrote to memory of 948	5800	SecuriteInfo.com.Win32.MalwareX-gen.30848.26229.exe	86
PID 5040 wrote to memory of 3128	5040	chrome.exe	95
PID 5040 wrote to memory of 3128	5040	chrome.exe	95
PID 5800 wrote to memory of 2208	5800	SecuriteInfo.com.Win32.MalwareX-gen.30848.26229.exe	91
PID 5800 wrote to memory of 2208	5800	SecuriteInfo.com.Win32.MalwareX-gen.30848.26229.exe	91
PID 5800 wrote to memory of 5044	5800	SecuriteInfo.com.Win32.MalwareX-gen.30848.26229.exe	84
PID 5800 wrote to memory of 5044	5800	SecuriteInfo.com.Win32.MalwareX-gen.30848.26229.exe	84
PID 5800 wrote to memory of 5040	5800	SecuriteInfo.com.Win32.MalwareX-gen.30848.26229.exe	83
PID 5800 wrote to memory of 5040	5800	SecuriteInfo.com.Win32.MalwareX-gen.30848.26229.exe	83
PID 5800 wrote to memory of 6012	5800	SecuriteInfo.com.Win32.MalwareX-gen.30848.26229.exe	89
PID 5800 wrote to memory of 6012	5800	SecuriteInfo.com.Win32.MalwareX-gen.30848.26229.exe	89
PID 5800 wrote to memory of 1480	5800	SecuriteInfo.com.Win32.MalwareX-gen.30848.26229.exe	94
PID 5800 wrote to memory of 1480	5800	SecuriteInfo.com.Win32.MalwareX-gen.30848.26229.exe	94
PID 5800 wrote to memory of 4424	5800	SecuriteInfo.com.Win32.MalwareX-gen.30848.26229.exe	85
PID 5800 wrote to memory of 4424	5800	SecuriteInfo.com.Win32.MalwareX-gen.30848.26229.exe	85
PID 5800 wrote to memory of 5548	5800	SecuriteInfo.com.Win32.MalwareX-gen.30848.26229.exe	87
PID 5800 wrote to memory of 5548	5800	SecuriteInfo.com.Win32.MalwareX-gen.30848.26229.exe	87
PID 5800 wrote to memory of 2176	5800	SecuriteInfo.com.Win32.MalwareX-gen.30848.26229.exe	93
PID 5800 wrote to memory of 2176	5800	SecuriteInfo.com.Win32.MalwareX-gen.30848.26229.exe	93

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3534313381-4287935181-1066995225-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	SecuriteInfo.com.Win32.MalwareX-gen.30848.26229.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3534313381-4287935181-1066995225-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	SecuriteInfo.com.Win32.MalwareX-gen.30848.26229.exe

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.MalwareX-gen.30848.26229.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.MalwareX-gen.30848.26229.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3156
- C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.MalwareX-gen.30848.26229.exe
  "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.MalwareX-gen.30848.26229.exe"
  2⤵
  PID:3176
- C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.MalwareX-gen.30848.26229.exe
  "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.MalwareX-gen.30848.26229.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - outlook_office_path
  - outlook_win_path
  PID:5800
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\s0hj02ch.xpr"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5040
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\s0hj02ch.xpr /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\s0hj02ch.xpr\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\s0hj02ch.xpr --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ffa456fdcf8,0x7ffa456fdd04,0x7ffa456fdd10
      4⤵
      PID:5044
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\s0hj02ch.xpr" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=1916,i,3865511099187903071,10593942774158263340,262144 --variations-seed-version --mojo-platform-channel-handle=1912 /prefetch:2
      4⤵
      PID:4424
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\s0hj02ch.xpr" --field-trial-handle=1996,i,3865511099187903071,10593942774158263340,262144 --variations-seed-version --mojo-platform-channel-handle=2012 /prefetch:11
      4⤵
      PID:948
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\s0hj02ch.xpr" --field-trial-handle=2020,i,3865511099187903071,10593942774158263340,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:13
      4⤵
      PID:5548
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\s0hj02ch.xpr" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=2720,i,3865511099187903071,10593942774158263340,262144 --variations-seed-version --mojo-platform-channel-handle=2784 /prefetch:1
      4⤵
      PID:2340
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\s0hj02ch.xpr" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=2728,i,3865511099187903071,10593942774158263340,262144 --variations-seed-version --mojo-platform-channel-handle=2788 /prefetch:1
      4⤵
      PID:6012
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\s0hj02ch.xpr" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3168,i,3865511099187903071,10593942774158263340,262144 --variations-seed-version --mojo-platform-channel-handle=3180 /prefetch:1
      4⤵
      PID:4392
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\s0hj02ch.xpr" --extension-process --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=3208,i,3865511099187903071,10593942774158263340,262144 --variations-seed-version --mojo-platform-channel-handle=3200 /prefetch:9
      4⤵
      PID:2208
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\s0hj02ch.xpr" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=3264,i,3865511099187903071,10593942774158263340,262144 --variations-seed-version --mojo-platform-channel-handle=3316 /prefetch:1
      4⤵
      PID:1956
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\s0hj02ch.xpr" --extension-process --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=3276,i,3865511099187903071,10593942774158263340,262144 --variations-seed-version --mojo-platform-channel-handle=3392 /prefetch:9
      4⤵
      PID:2176
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\s0hj02ch.xpr" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=4092,i,3865511099187903071,10593942774158263340,262144 --variations-seed-version --mojo-platform-channel-handle=4056 /prefetch:1
      4⤵
      PID:1480
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\s0hj02ch.xpr" --field-trial-handle=4236,i,3865511099187903071,10593942774158263340,262144 --variations-seed-version --mojo-platform-channel-handle=4404 /prefetch:14
      4⤵
      PID:3128
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\s0hj02ch.xpr" --field-trial-handle=4924,i,3865511099187903071,10593942774158263340,262144 --variations-seed-version --mojo-platform-channel-handle=4824 /prefetch:14
      4⤵
      PID:2928
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\s0hj02ch.xpr" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=4948,i,3865511099187903071,10593942774158263340,262144 --variations-seed-version --mojo-platform-channel-handle=5008 /prefetch:1
      4⤵
      PID:1556
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\s0hj02ch.xpr" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=4988,i,3865511099187903071,10593942774158263340,262144 --variations-seed-version --mojo-platform-channel-handle=4956 /prefetch:1
      4⤵
      PID:5676
  - - C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
      4⤵
      Drops file in Windows directory
      PID:3256
    - - C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x244,0x248,0x24c,0x220,0x250,0x7ff6303d1f58,0x7ff6303d1f64,0x7ff6303d1f70
        5⤵
        Drops file in Windows directory
        
        PID:5464
    - - C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\initial_preferences" --create-shortcuts=1 --install-level=0
        5⤵
        Drops file in Windows directory
        Modifies registry class
        Suspicious use of FindShellTrayWindow
        
        PID:4976
      - C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x244,0x248,0x24c,0x220,0x250,0x7ff6303d1f58,0x7ff6303d1f64,0x7ff6303d1f70
        6⤵
        Drops file in Windows directory
        
        PID:5016
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\s0hj02ch.xpr" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=5072,i,3865511099187903071,10593942774158263340,262144 --variations-seed-version --mojo-platform-channel-handle=4824 /prefetch:1
      4⤵
      PID:5968
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\s0hj02ch.xpr" --field-trial-handle=5160,i,3865511099187903071,10593942774158263340,262144 --variations-seed-version --mojo-platform-channel-handle=5116 /prefetch:14
      4⤵
      PID:940
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\s0hj02ch.xpr" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=4952,i,3865511099187903071,10593942774158263340,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:1
      4⤵
      PID:3036
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\s0hj02ch.xpr" --field-trial-handle=5112,i,3865511099187903071,10593942774158263340,262144 --variations-seed-version --mojo-platform-channel-handle=5000 /prefetch:14
      4⤵
      PID:2468
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\bfkseted.kve"
    3⤵
    PID:4848
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir=C:\Users\Admin\AppData\Local\Temp\bfkseted.kve
      4⤵
      Checks processor information in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:3880
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1960 -prefsLen 27097 -prefMapHandle 1964 -prefMapSize 270279 -ipcHandle 2036 -initialChannelId {6e146b15-83e6-41cb-9c02-b212b14cba78} -parentPid 3880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3880" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
        5⤵
        
        PID:2492
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2380 -prefsLen 27133 -prefMapHandle 2300 -prefMapSize 270279 -ipcHandle 2328 -initialChannelId {48007c8c-2f67-4996-b1df-2e39e985b9f3} -parentPid 3880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3880" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
        5⤵
        
        PID:2976
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\0371db49-55f2-426b-b25c-44417d301814.dmp"
        5⤵
        
        PID:3552
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2124 -prefsLen 27133 -prefMapHandle 2880 -prefMapSize 270279 -ipcHandle 2908 -initialChannelId {5b49ca2c-ea30-44e4-9117-d033de22e930} -parentPid 3880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3880" -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 gpu
        5⤵
        
        PID:1960
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\1bf8f880-5d3e-4917-83d8-e67570e3a2ee.dmp"
        5⤵
        
        PID:4876
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2908 -prefsLen 27133 -prefMapHandle 2980 -prefMapSize 270279 -ipcHandle 2616 -initialChannelId {8514d7b8-cf2a-437c-9eb1-e04dc9739fcb} -parentPid 3880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3880" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 gpu
        5⤵
        
        PID:3888
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\a4db5e6c-a67d-4e26-90c8-041c6e579666.dmp"
        5⤵
        
        PID:1368
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2616 -prefsLen 27198 -prefMapHandle 3316 -prefMapSize 270279 -ipcHandle 3768 -initialChannelId {56beaa93-d6fd-40fb-8912-52f9aabefcea} -parentPid 3880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3880" -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 gpu
        5⤵
        
        PID:2728
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3156 -prefsLen 27323 -prefMapHandle 3140 -prefMapSize 270279 -jsInitHandle 3144 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3132 -initialChannelId {e630d6b0-e9b9-4731-8c01-f68a3f430cd3} -parentPid 3880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3880" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 tab
        5⤵
        Checks processor information in registry
        
        PID:1596
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\b266cc35-03b2-4df7-a312-2601c35f4140.dmp"
        5⤵
        
        PID:1524
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3768 -prefsLen 27323 -prefMapHandle 3492 -prefMapSize 270279 -ipcHandle 3796 -initialChannelId {1a9c8c54-99f7-47c3-aa0f-bf69cab96aa5} -parentPid 3880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3880" -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 gpu
        5⤵
        
        PID:3648
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\414260aa-7c4e-4e4d-b39f-9aff820e309a.dmp"
        5⤵
        
        PID:3868
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4300 -prefsLen 27323 -prefMapHandle 4304 -prefMapSize 270279 -ipcHandle 3152 -initialChannelId {3e9091d8-63f5-465b-b3cf-998ba4b659aa} -parentPid 3880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3880" -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 rdd
        5⤵
        
        PID:956
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4820 -prefsLen 34876 -prefMapHandle 4824 -prefMapSize 270279 -jsInitHandle 4828 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4832 -initialChannelId {3e1848d7-0b85-421e-909c-7beb488f1b30} -parentPid 3880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3880" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
        5⤵
        Checks processor information in registry
        
        PID:5100
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 2500 -prefsLen 35010 -prefMapHandle 1428 -prefMapSize 270279 -ipcHandle 5268 -initialChannelId {88aaf047-fe75-400e-82c3-cdf423a07a09} -parentPid 3880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3880" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 utility
        5⤵
        Checks processor information in registry
        
        PID:5308
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4784 -prefsLen 32900 -prefMapHandle 2764 -prefMapSize 270279 -jsInitHandle 2780 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2500 -initialChannelId {7dc349b5-5b3c-4270-9b82-c58ca2af64d0} -parentPid 3880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3880" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
        5⤵
        Checks processor information in registry
        
        PID:3484
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2752 -prefsLen 32900 -prefMapHandle 5208 -prefMapSize 270279 -jsInitHandle 2600 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5344 -initialChannelId {b28b3262-d93d-4270-b5f3-9508dba25760} -parentPid 3880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3880" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
        5⤵
        Checks processor information in registry
        
        PID:4796
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5664 -prefsLen 32900 -prefMapHandle 5668 -prefMapSize 270279 -jsInitHandle 5672 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5680 -initialChannelId {138e9548-11b7-4e6c-9432-fa44e513a58b} -parentPid 3880 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3880" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab
        5⤵
        Checks processor information in registry
        
        PID:5332
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5ctrb5gu.jte"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious use of FindShellTrayWindow
    PID:4608
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\5ctrb5gu.jte /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\5ctrb5gu.jte\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x23c,0x240,0x244,0x238,0x2f0,0x7ffa3300f208,0x7ffa3300f214,0x7ffa3300f220
      4⤵
      PID:768
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5ctrb5gu.jte" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --field-trial-handle=2016,i,15841107793349970090,16903468164399954779,262144 --variations-seed-version --mojo-platform-channel-handle=2012 /prefetch:2
      4⤵
      PID:1396
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5ctrb5gu.jte" --always-read-main-dll --field-trial-handle=1812,i,15841107793349970090,16903468164399954779,262144 --variations-seed-version --mojo-platform-channel-handle=2020 /prefetch:11
      4⤵
      PID:628
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5ctrb5gu.jte" --always-read-main-dll --field-trial-handle=2280,i,15841107793349970090,16903468164399954779,262144 --variations-seed-version --mojo-platform-channel-handle=2448 /prefetch:13
      4⤵
      PID:2992
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5ctrb5gu.jte" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3076,i,15841107793349970090,16903468164399954779,262144 --variations-seed-version --mojo-platform-channel-handle=3124 /prefetch:1
      4⤵
      PID:6072
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5ctrb5gu.jte" --instant-process --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3084,i,15841107793349970090,16903468164399954779,262144 --variations-seed-version --mojo-platform-channel-handle=3128 /prefetch:1
      4⤵
      PID:4740
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5ctrb5gu.jte" --always-read-main-dll --field-trial-handle=3296,i,15841107793349970090,16903468164399954779,262144 --variations-seed-version --mojo-platform-channel-handle=3404 /prefetch:14
      4⤵
      PID:3728
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5ctrb5gu.jte" --always-read-main-dll --field-trial-handle=3300,i,15841107793349970090,16903468164399954779,262144 --variations-seed-version --mojo-platform-channel-handle=3052 /prefetch:14
      4⤵
      PID:5496
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5ctrb5gu.jte" --always-read-main-dll --field-trial-handle=3308,i,15841107793349970090,16903468164399954779,262144 --variations-seed-version --mojo-platform-channel-handle=3432 /prefetch:14
      4⤵
      PID:5812
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5ctrb5gu.jte" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --field-trial-handle=3416,i,15841107793349970090,16903468164399954779,262144 --variations-seed-version --mojo-platform-channel-handle=3448 /prefetch:1
      4⤵
      PID:6008
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5ctrb5gu.jte" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --field-trial-handle=3320,i,15841107793349970090,16903468164399954779,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:9
      4⤵
      PID:588
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5ctrb5gu.jte" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --field-trial-handle=3484,i,15841107793349970090,16903468164399954779,262144 --variations-seed-version --mojo-platform-channel-handle=3412 /prefetch:1
      4⤵
      PID:5720
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5ctrb5gu.jte" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --field-trial-handle=3540,i,15841107793349970090,16903468164399954779,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:9
      4⤵
      PID:4864
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5ctrb5gu.jte" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --field-trial-handle=3560,i,15841107793349970090,16903468164399954779,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:1
      4⤵
      PID:5984
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5ctrb5gu.jte" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --field-trial-handle=3584,i,15841107793349970090,16903468164399954779,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:9
      4⤵
      PID:1664
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5ctrb5gu.jte" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --field-trial-handle=3640,i,15841107793349970090,16903468164399954779,262144 --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:1
      4⤵
      PID:396
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5ctrb5gu.jte" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --field-trial-handle=3664,i,15841107793349970090,16903468164399954779,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:9
      4⤵
      PID:4688
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5ctrb5gu.jte" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --field-trial-handle=3708,i,15841107793349970090,16903468164399954779,262144 --variations-seed-version --mojo-platform-channel-handle=3720 /prefetch:1
      4⤵
      PID:3868
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5ctrb5gu.jte" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --field-trial-handle=3712,i,15841107793349970090,16903468164399954779,262144 --variations-seed-version --mojo-platform-channel-handle=3840 /prefetch:9
      4⤵
      PID:4540
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5ctrb5gu.jte" --always-read-main-dll --field-trial-handle=3844,i,15841107793349970090,16903468164399954779,262144 --variations-seed-version --mojo-platform-channel-handle=3896 /prefetch:14
      4⤵
      PID:3464
    - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=1128
        5⤵
        
        PID:4392
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5ctrb5gu.jte" --always-read-main-dll --field-trial-handle=4912,i,15841107793349970090,16903468164399954779,262144 --variations-seed-version --mojo-platform-channel-handle=4924 /prefetch:14
      4⤵
      PID:3828
    - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=592
        5⤵
        
        PID:5456
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5ctrb5gu.jte" --always-read-main-dll --field-trial-handle=5144,i,15841107793349970090,16903468164399954779,262144 --variations-seed-version --mojo-platform-channel-handle=5136 /prefetch:14
      4⤵
      PID:5272
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5ctrb5gu.jte" --always-read-main-dll --field-trial-handle=5316,i,15841107793349970090,16903468164399954779,262144 --variations-seed-version --mojo-platform-channel-handle=5312 /prefetch:14
      4⤵
      PID:5168
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5ctrb5gu.jte" --always-read-main-dll --field-trial-handle=5444,i,15841107793349970090,16903468164399954779,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:14
      4⤵
      PID:4784
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --no-sandbox --mute-audio --onnx-enabled-for-ee --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5ctrb5gu.jte" --always-read-main-dll --field-trial-handle=5440,i,15841107793349970090,16903468164399954779,262144 --variations-seed-version --mojo-platform-channel-handle=5764 /prefetch:14
      4⤵
      PID:4284
  - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5ctrb5gu.jte" --always-read-main-dll --field-trial-handle=6548,i,15841107793349970090,16903468164399954779,262144 --variations-seed-version --mojo-platform-channel-handle=6612 /prefetch:14
      4⤵
      PID:2912
  - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5ctrb5gu.jte" --always-read-main-dll --field-trial-handle=6548,i,15841107793349970090,16903468164399954779,262144 --variations-seed-version --mojo-platform-channel-handle=6612 /prefetch:14
      4⤵
      PID:2956
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5ctrb5gu.jte" --always-read-main-dll --field-trial-handle=6848,i,15841107793349970090,16903468164399954779,262144 --variations-seed-version --mojo-platform-channel-handle=6828 /prefetch:14
      4⤵
      PID:4960
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5ctrb5gu.jte" --always-read-main-dll --field-trial-handle=7064,i,15841107793349970090,16903468164399954779,262144 --variations-seed-version --mojo-platform-channel-handle=7084 /prefetch:14
      4⤵
      PID:5124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\Installer\setup.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
      4⤵
      Drops file in Program Files directory
      Drops file in Windows directory
      PID:5676
    - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\Installer\setup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x234,0x238,0x23c,0x210,0x240,0x7ff75f266a68,0x7ff75f266a74,0x7ff75f266a80
        5⤵
        Drops file in Windows directory
        
        PID:1404
    - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\Installer\setup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\Installer\setup.exe" --msedge --system-level --verbose-logging --installerdata="C:\Program Files (x86)\Microsoft\Edge\Application\master_preferences" --create-shortcuts=1 --install-level=0
        5⤵
        Drops file in Program Files directory
        Drops file in Windows directory
        
        PID:5264
      - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\Installer\setup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x234,0x238,0x23c,0x210,0x240,0x7ff75f266a68,0x7ff75f266a74,0x7ff75f266a80
        6⤵
        Drops file in Windows directory
        
        PID:6020
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5ctrb5gu.jte" --always-read-main-dll --field-trial-handle=6692,i,15841107793349970090,16903468164399954779,262144 --variations-seed-version --mojo-platform-channel-handle=6984 /prefetch:14
      4⤵
      PID:1868
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5ctrb5gu.jte" --always-read-main-dll --field-trial-handle=6916,i,15841107793349970090,16903468164399954779,262144 --variations-seed-version --mojo-platform-channel-handle=6904 /prefetch:14
      4⤵
      PID:3376
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\s4ftoqtb.fmg"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious use of FindShellTrayWindow
    PID:3484
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\s4ftoqtb.fmg /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\s4ftoqtb.fmg\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x23c,0x240,0x244,0x238,0x24c,0x7ffa3300f208,0x7ffa3300f214,0x7ffa3300f220
      4⤵
      PID:1168
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\s4ftoqtb.fmg" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --field-trial-handle=2076,i,3185711446778748206,11941353045757802016,262144 --variations-seed-version --mojo-platform-channel-handle=2072 /prefetch:2
      4⤵
      PID:4980
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\s4ftoqtb.fmg" --always-read-main-dll --field-trial-handle=1800,i,3185711446778748206,11941353045757802016,262144 --variations-seed-version --mojo-platform-channel-handle=2080 /prefetch:11
      4⤵
      PID:844
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\s4ftoqtb.fmg" --always-read-main-dll --field-trial-handle=2208,i,3185711446778748206,11941353045757802016,262144 --variations-seed-version --mojo-platform-channel-handle=2136 /prefetch:13
      4⤵
      PID:4408
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\s4ftoqtb.fmg" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3008,i,3185711446778748206,11941353045757802016,262144 --variations-seed-version --mojo-platform-channel-handle=3076 /prefetch:1
      4⤵
      PID:3884
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\s4ftoqtb.fmg" --instant-process --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3016,i,3185711446778748206,11941353045757802016,262144 --variations-seed-version --mojo-platform-channel-handle=3080 /prefetch:1
      4⤵
      PID:1548
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\s4ftoqtb.fmg" --always-read-main-dll --field-trial-handle=3220,i,3185711446778748206,11941353045757802016,262144 --variations-seed-version --mojo-platform-channel-handle=3316 /prefetch:14
      4⤵
      PID:5516
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\s4ftoqtb.fmg" --always-read-main-dll --field-trial-handle=3228,i,3185711446778748206,11941353045757802016,262144 --variations-seed-version --mojo-platform-channel-handle=3320 /prefetch:14
      4⤵
      PID:4404
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\s4ftoqtb.fmg" --always-read-main-dll --field-trial-handle=3236,i,3185711446778748206,11941353045757802016,262144 --variations-seed-version --mojo-platform-channel-handle=3340 /prefetch:14
      4⤵
      PID:5972
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\s4ftoqtb.fmg" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --field-trial-handle=3372,i,3185711446778748206,11941353045757802016,262144 --variations-seed-version --mojo-platform-channel-handle=3404 /prefetch:1
      4⤵
      PID:3272
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\s4ftoqtb.fmg" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --field-trial-handle=3400,i,3185711446778748206,11941353045757802016,262144 --variations-seed-version --mojo-platform-channel-handle=3428 /prefetch:9
      4⤵
      PID:5856
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\s4ftoqtb.fmg" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --field-trial-handle=3440,i,3185711446778748206,11941353045757802016,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
      4⤵
      PID:5460
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\s4ftoqtb.fmg" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --field-trial-handle=3480,i,3185711446778748206,11941353045757802016,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:9
      4⤵
      PID:2676
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\s4ftoqtb.fmg" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --field-trial-handle=3496,i,3185711446778748206,11941353045757802016,262144 --variations-seed-version --mojo-platform-channel-handle=3436 /prefetch:1
      4⤵
      PID:1440
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\s4ftoqtb.fmg" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --field-trial-handle=3520,i,3185711446778748206,11941353045757802016,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:9
      4⤵
      PID:2396
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\s4ftoqtb.fmg" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --field-trial-handle=3584,i,3185711446778748206,11941353045757802016,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:1
      4⤵
      PID:5328
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\s4ftoqtb.fmg" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --field-trial-handle=3596,i,3185711446778748206,11941353045757802016,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:9
      4⤵
      PID:1564
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\s4ftoqtb.fmg" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --field-trial-handle=3660,i,3185711446778748206,11941353045757802016,262144 --variations-seed-version --mojo-platform-channel-handle=3684 /prefetch:1
      4⤵
      PID:2880
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\s4ftoqtb.fmg" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --field-trial-handle=3676,i,3185711446778748206,11941353045757802016,262144 --variations-seed-version --mojo-platform-channel-handle=3704 /prefetch:9
      4⤵
      PID:4220
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\s4ftoqtb.fmg" --always-read-main-dll --field-trial-handle=3952,i,3185711446778748206,11941353045757802016,262144 --variations-seed-version --mojo-platform-channel-handle=4484 /prefetch:14
      4⤵
      PID:6340
    - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=1128
        5⤵
        
        PID:6820
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\s4ftoqtb.fmg" --always-read-main-dll --field-trial-handle=5240,i,3185711446778748206,11941353045757802016,262144 --variations-seed-version --mojo-platform-channel-handle=5252 /prefetch:14
      4⤵
      PID:6840
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\s4ftoqtb.fmg" --always-read-main-dll --field-trial-handle=5236,i,3185711446778748206,11941353045757802016,262144 --variations-seed-version --mojo-platform-channel-handle=5000 /prefetch:14
      4⤵
      PID:6928
    - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=596
        5⤵
        
        PID:6980
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\s4ftoqtb.fmg" --always-read-main-dll --field-trial-handle=4704,i,3185711446778748206,11941353045757802016,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:14
      4⤵
      PID:7032
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\s4ftoqtb.fmg" --always-read-main-dll --field-trial-handle=3888,i,3185711446778748206,11941353045757802016,262144 --variations-seed-version --mojo-platform-channel-handle=3796 /prefetch:14
      4⤵
      PID:2200
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --no-sandbox --mute-audio --onnx-enabled-for-ee --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\s4ftoqtb.fmg" --always-read-main-dll --field-trial-handle=4268,i,3185711446778748206,11941353045757802016,262144 --variations-seed-version --mojo-platform-channel-handle=3868 /prefetch:14
      4⤵
      PID:2252
  - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\s4ftoqtb.fmg" --always-read-main-dll --field-trial-handle=6188,i,3185711446778748206,11941353045757802016,262144 --variations-seed-version --mojo-platform-channel-handle=6240 /prefetch:14
      4⤵
      PID:5772
  - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\s4ftoqtb.fmg" --always-read-main-dll --field-trial-handle=6188,i,3185711446778748206,11941353045757802016,262144 --variations-seed-version --mojo-platform-channel-handle=6240 /prefetch:14
      4⤵
      PID:3152
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\s4ftoqtb.fmg" --always-read-main-dll --field-trial-handle=6388,i,3185711446778748206,11941353045757802016,262144 --variations-seed-version --mojo-platform-channel-handle=6372 /prefetch:14
      4⤵
      PID:1936
  - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\Installer\setup.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
      4⤵
      Drops file in Program Files directory
      Drops file in Windows directory
      PID:1508
    - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\Installer\setup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x234,0x238,0x23c,0x210,0x240,0x7ff75f266a68,0x7ff75f266a74,0x7ff75f266a80
        5⤵
        Drops file in Windows directory
        
        PID:5172
    - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\Installer\setup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\Installer\setup.exe" --msedge --system-level --verbose-logging --installerdata="C:\Program Files (x86)\Microsoft\Edge\Application\master_preferences" --create-shortcuts=1 --install-level=0
        5⤵
        Drops file in Program Files directory
        Drops file in Windows directory
        
        PID:6368
      - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\Installer\setup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x234,0x238,0x23c,0x210,0x240,0x7ff75f266a68,0x7ff75f266a74,0x7ff75f266a80
        6⤵
        Drops file in Windows directory
        
        PID:6716
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\s4ftoqtb.fmg" --always-read-main-dll --field-trial-handle=6448,i,3185711446778748206,11941353045757802016,262144 --variations-seed-version --mojo-platform-channel-handle=6476 /prefetch:14
      4⤵
      PID:1036
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\s4ftoqtb.fmg" --always-read-main-dll --field-trial-handle=6840,i,3185711446778748206,11941353045757802016,262144 --variations-seed-version --mojo-platform-channel-handle=6836 /prefetch:14
      4⤵
      PID:2444
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\s4ftoqtb.fmg" --always-read-main-dll --field-trial-handle=6972,i,3185711446778748206,11941353045757802016,262144 --variations-seed-version --mojo-platform-channel-handle=6832 /prefetch:14
      4⤵
      PID:2060
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\s4ftoqtb.fmg" --always-read-main-dll --field-trial-handle=6420,i,3185711446778748206,11941353045757802016,262144 --variations-seed-version --mojo-platform-channel-handle=6960 /prefetch:14
      4⤵
      PID:7004
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\s4ftoqtb.fmg" --always-read-main-dll --field-trial-handle=6360,i,3185711446778748206,11941353045757802016,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:14
      4⤵
      PID:7012
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\s4ftoqtb.fmg" --always-read-main-dll --field-trial-handle=5272,i,3185711446778748206,11941353045757802016,262144 --variations-seed-version --mojo-platform-channel-handle=5268 /prefetch:14
      4⤵
      PID:3460
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\s4ftoqtb.fmg" --always-read-main-dll --field-trial-handle=6924,i,3185711446778748206,11941353045757802016,262144 --variations-seed-version --mojo-platform-channel-handle=6504 /prefetch:14
      4⤵
      PID:6532
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\drvepqrz.t4o"
    3⤵
    PID:5940
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir=C:\Users\Admin\AppData\Local\Temp\drvepqrz.t4o
      4⤵
      Checks processor information in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:4916
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1968 -prefsLen 27097 -prefMapHandle 1972 -prefMapSize 270331 -ipcHandle 2056 -initialChannelId {15a8e368-dead-4f54-b081-865a4129cf1b} -parentPid 4916 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4916" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
        5⤵
        
        PID:248
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2508 -prefsLen 27133 -prefMapHandle 2512 -prefMapSize 270331 -ipcHandle 2520 -initialChannelId {6cbd98b8-039f-43c4-859d-60e9cdd30dfb} -parentPid 4916 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4916" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
        5⤵
        
        PID:2940
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\bb35ca17-a898-4e16-89c1-523ed8aea25a.dmp"
        5⤵
        
        PID:5004
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2120 -prefsLen 27133 -prefMapHandle 2344 -prefMapSize 270331 -ipcHandle 2660 -initialChannelId {2f523b00-7992-4851-aec4-9909ad5c221c} -parentPid 4916 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4916" -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 gpu
        5⤵
        
        PID:3500
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\f09f8556-c641-47b2-a225-701808a8bd2f.dmp"
        5⤵
        
        PID:2148
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2660 -prefsLen 27133 -prefMapHandle 3120 -prefMapSize 270331 -ipcHandle 2820 -initialChannelId {20a41d80-227c-4d24-83f7-1ec1f36250df} -parentPid 4916 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4916" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 gpu
        5⤵
        
        PID:2292
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3804 -prefsLen 27274 -prefMapHandle 3808 -prefMapSize 270331 -jsInitHandle 3812 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3820 -initialChannelId {7df10fc2-4f14-44a6-870a-90c0c89ff74b} -parentPid 4916 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4916" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
        5⤵
        Checks processor information in registry
        
        PID:5340
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\0ff43633-fa8b-4e8a-9466-5226c67df8fb.dmp"
        5⤵
        
        PID:6732
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2820 -prefsLen 27274 -prefMapHandle 3208 -prefMapSize 270331 -ipcHandle 3388 -initialChannelId {444f04f4-68ad-49d4-981f-1ef650ae8eb3} -parentPid 4916 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4916" -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 gpu
        5⤵
        
        PID:6440
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\4e8677b3-5859-4028-8be9-eac49287f22d.dmp"
        5⤵
        
        PID:2152
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4192 -prefsLen 27274 -prefMapHandle 4196 -prefMapSize 270331 -ipcHandle 4220 -initialChannelId {510befd1-3e67-4851-93ad-4d31b1e20a40} -parentPid 4916 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4916" -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 rdd
        5⤵
        
        PID:6876
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4548 -prefsLen 34827 -prefMapHandle 4552 -prefMapSize 270331 -jsInitHandle 4556 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4564 -initialChannelId {a884a2f6-54b0-496c-8a4a-536ba69dd2ed} -parentPid 4916 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4916" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
        5⤵
        Checks processor information in registry
        
        PID:7096
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4880 -prefsLen 34876 -prefMapHandle 4884 -prefMapSize 270331 -ipcHandle 4856 -initialChannelId {cf9bbf03-6ff5-49ff-a38e-74b9481b8163} -parentPid 4916 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4916" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 utility
        5⤵
        Checks processor information in registry
        
        PID:2092
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5248 -prefsLen 32818 -prefMapHandle 5244 -prefMapSize 270331 -jsInitHandle 5240 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5268 -initialChannelId {8bfb051b-d881-44e1-bc0a-10b08c8ce011} -parentPid 4916 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4916" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
        5⤵
        Checks processor information in registry
        
        PID:2084
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5212 -prefsLen 32818 -prefMapHandle 5208 -prefMapSize 270331 -jsInitHandle 5204 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5400 -initialChannelId {0b90818b-5279-4cab-bae6-f6c8325993d2} -parentPid 4916 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4916" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
        5⤵
        Checks processor information in registry
        
        PID:6348
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5592 -prefsLen 32818 -prefMapHandle 5596 -prefMapSize 270331 -jsInitHandle 5600 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5608 -initialChannelId {99588594-6a67-46a9-adaf-3d3883c24c4e} -parentPid 4916 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4916" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
        5⤵
        Checks processor information in registry
        
        PID:6272
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\30ouqyim.fcv"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    PID:5220
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\30ouqyim.fcv /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\30ouqyim.fcv\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\30ouqyim.fcv --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ffa4117dcf8,0x7ffa4117dd04,0x7ffa4117dd10
      4⤵
      PID:2260
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\30ouqyim.fcv" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=2384,i,5453529977920112464,15413973244918139921,262144 --variations-seed-version --mojo-platform-channel-handle=2372 /prefetch:2
      4⤵
      PID:1084
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\30ouqyim.fcv" --field-trial-handle=1764,i,5453529977920112464,15413973244918139921,262144 --variations-seed-version --mojo-platform-channel-handle=2388 /prefetch:11
      4⤵
      PID:5976
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\30ouqyim.fcv" --field-trial-handle=2044,i,5453529977920112464,15413973244918139921,262144 --variations-seed-version --mojo-platform-channel-handle=2572 /prefetch:13
      4⤵
      PID:4432
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\30ouqyim.fcv" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=2892,i,5453529977920112464,15413973244918139921,262144 --variations-seed-version --mojo-platform-channel-handle=2904 /prefetch:1
      4⤵
      PID:1052
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\30ouqyim.fcv" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=2908,i,5453529977920112464,15413973244918139921,262144 --variations-seed-version --mojo-platform-channel-handle=2980 /prefetch:1
      4⤵
      PID:6208
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\30ouqyim.fcv" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3140,i,5453529977920112464,15413973244918139921,262144 --variations-seed-version --mojo-platform-channel-handle=3260 /prefetch:1
      4⤵
      PID:5556
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\30ouqyim.fcv" --extension-process --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=3276,i,5453529977920112464,15413973244918139921,262144 --variations-seed-version --mojo-platform-channel-handle=3284 /prefetch:9
      4⤵
      PID:6728
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\30ouqyim.fcv" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=3308,i,5453529977920112464,15413973244918139921,262144 --variations-seed-version --mojo-platform-channel-handle=3772 /prefetch:1
      4⤵
      PID:2220
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\30ouqyim.fcv" --extension-process --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=3324,i,5453529977920112464,15413973244918139921,262144 --variations-seed-version --mojo-platform-channel-handle=3828 /prefetch:9
      4⤵
      PID:6224
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\30ouqyim.fcv" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=2896,i,5453529977920112464,15413973244918139921,262144 --variations-seed-version --mojo-platform-channel-handle=4048 /prefetch:1
      4⤵
      PID:6072
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\30ouqyim.fcv" --field-trial-handle=4156,i,5453529977920112464,15413973244918139921,262144 --variations-seed-version --mojo-platform-channel-handle=4408 /prefetch:14
      4⤵
      PID:6296
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\30ouqyim.fcv" --field-trial-handle=4912,i,5453529977920112464,15413973244918139921,262144 --variations-seed-version --mojo-platform-channel-handle=4924 /prefetch:14
      4⤵
      PID:6436
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\30ouqyim.fcv" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=5008,i,5453529977920112464,15413973244918139921,262144 --variations-seed-version --mojo-platform-channel-handle=5068 /prefetch:1
      4⤵
      PID:6880
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\30ouqyim.fcv" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=5036,i,5453529977920112464,15413973244918139921,262144 --variations-seed-version --mojo-platform-channel-handle=5020 /prefetch:1
      4⤵
      PID:460
  - - C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
      4⤵
      Drops file in Windows directory
      PID:2196
    - - C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x244,0x248,0x24c,0x220,0x250,0x7ff6303d1f58,0x7ff6303d1f64,0x7ff6303d1f70
        5⤵
        Drops file in Windows directory
        
        PID:940
    - - C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\initial_preferences" --create-shortcuts=1 --install-level=0
        5⤵
        Drops file in Windows directory
        Modifies registry class
        Suspicious use of FindShellTrayWindow
        
        PID:4120
      - C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x254,0x258,0x25c,0x230,0x260,0x7ff6303d1f58,0x7ff6303d1f64,0x7ff6303d1f70
        6⤵
        Drops file in Windows directory
        
        PID:2188
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\30ouqyim.fcv" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=4960,i,5453529977920112464,15413973244918139921,262144 --variations-seed-version --mojo-platform-channel-handle=5104 /prefetch:1
      4⤵
      PID:6068
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\30ouqyim.fcv" --field-trial-handle=5160,i,5453529977920112464,15413973244918139921,262144 --variations-seed-version --mojo-platform-channel-handle=5072 /prefetch:14
      4⤵
      PID:6620
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\30ouqyim.fcv" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=5040,i,5453529977920112464,15413973244918139921,262144 --variations-seed-version --mojo-platform-channel-handle=5024 /prefetch:1
      4⤵
      PID:5352
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\30ouqyim.fcv" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --field-trial-handle=5316,i,5453529977920112464,15413973244918139921,262144 --variations-seed-version --mojo-platform-channel-handle=5000 /prefetch:1
      4⤵
      PID:7032
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\30ouqyim.fcv" --field-trial-handle=5324,i,5453529977920112464,15413973244918139921,262144 --variations-seed-version --mojo-platform-channel-handle=5312 /prefetch:14
      4⤵
      PID:4876
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\30ouqyim.fcv" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --field-trial-handle=5296,i,5453529977920112464,15413973244918139921,262144 --variations-seed-version --mojo-platform-channel-handle=5280 /prefetch:1
      4⤵
      PID:6644
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5800 -s 3076
    3⤵
    - Program crash
    PID:1904

C:\Users\Admin\AppData\Roaming\SecuriteInfo.com.Win32.MalwareX-gen.30848.26229.exe
C:\Users\Admin\AppData\Roaming\SecuriteInfo.com.Win32.MalwareX-gen.30848.26229.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4408
- C:\Users\Admin\AppData\Roaming\SecuriteInfo.com.Win32.MalwareX-gen.30848.26229.exe
  "C:\Users\Admin\AppData\Roaming\SecuriteInfo.com.Win32.MalwareX-gen.30848.26229.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:4624

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3712

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 5800 -ip 5800
1⤵
PID:6900

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

c7a6d778-fa07-4b15-850d-b88b70fc83d2.tmp

Path C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\c7a6d778-fa07-4b15-850d-b88b70fc83d2.tmp
Size 344B
SHA256 fd668d6edcf6b6cc176edd9bf7b0d7f1881fe2f0d94ebae656127c27a359550e
MD5 1b7cdddfb06152ae01f12d9f253237d6
SHA1 1ef358781a086a0727f4fa95cd53510eb328bc52
SHA512 4705c93b233be92dd2d04649d404b538bc76607bbe655d5e35a739653ac1af776ecdd12ec1cbf81476070ec5bae633f891817155014730a06939efb21bd132ea
MD5 SHA1 SHA512

Submit Download

SecuriteInfo.com.Win32.MalwareX-gen.30848.26229.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SecuriteInfo.com.Win32.MalwareX-gen.30848.26229.exe.log
Size 1KB
SHA256 4c17576f64dea465c45a50573ee41771f7be9962ab2d07f961af4df5589bdcce
MD5 7e1ed0055c3eaa0bbc4a29ec1ef15a6a
SHA1 765b954c1adbb6a6ecc4fe912fdaa6d0fba0ae7d
SHA512 de7c784c37d18c43820908add88f08ab4864c0ef3f9d158cc2c9d1bab120613cb093dd4bfc5d7ed0c289414956cfe0b213c386f8e6b5753847dec915566297c8
MD5 SHA1 SHA512

Submit Download

activity-stream.contile.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\f12v27nn.default-release\activity-stream.contile.json
Size 4KB
SHA256 35069c7637d1e67d8916a426e751e0359e86a04af151f33c6840baf9deddd517
MD5 6ed263d3c80c4960629cd01d9fb71743
SHA1 8126b00816dbbe2fd6bbaf46571e3a5e9dbc243b
SHA512 bc8b385949547132c6d6b6a512888bd99019da7dc1a53c8866e7a2579634dfd8301bdc9ac321809879f61c16e8a26757af92dc5b0783df4e855fcfdaf4742963
SSDEEP 96:KTBgvt3JQRxdhVcid5mAxvmAPaXNnDCmd/YK:KTyt3JQ7dhxdZdPCQK
MD5 SHA1 SHA512 SSDEEP

Submit Download

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\f12v27nn.default-release\activity-stream.discovery_stream.json
Size 23KB
SHA256 6e51a51ee458bf8a58ff07f5f3aed187fecaff987c366b263c5b3f6061f16b8f
MD5 9580fc54e68838316f219d3733f723f1
SHA1 831e076f254b875b0f9da0c773f30df60ff62e73
SHA512 aa956808c46b984665f4cf7f9a27212b5fbef4ea14e7c6f2a01afdfbf9121e3302825f67b645865040abd708538612b1e005884dde5547271d2eb7ec3d1324e4
SSDEEP 384:UyaZf8MM2GFnUc0a1ChW0G4mWAoY8Y9Zr:Uykf8MvGaNa1ChW0G4mWAoYVzr
MD5 SHA1 SHA512 SSDEEP

Submit Download

2567A55DF6897DCFEB90E1C946DEAE0B7D01BAF5

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\f12v27nn.default-release\cache2\entries\2567A55DF6897DCFEB90E1C946DEAE0B7D01BAF5
Size 13KB
SHA256 7c15468fc909aff7eac84432c49495cd387a7bf2052b6fb4c3d0202ea49cf5fe
MD5 bc445db3b451ddf8b5662de4c6dbd3a0
SHA1 c06a8adf6584f27c631a0e47f5ffa79188c5c93f
SHA512 0c0a2f83eb36e6680ebf488bd45a8db1ee83b88a1987bbbaf707c937c23e5f5203c9daffe5e7403923464ce325c0b16fdbdd5e9ee759ae44bad664afa4528e22
SSDEEP 384:HAEbFiO024Yi7hSznZOML+CbcxDEclrIVy8edvQvKS:gPZYi7hSz8MLPbcxDEcVIVy8/
MD5 SHA1 SHA512 SSDEEP

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\f12v27nn.default-release\startupCache\webext.sc.lz4
Size 104KB
SHA256 01f7e7f517d6c32052f13598434df3fd86cda8c5f8e32730d3a8bd544eb1ca10
MD5 9438f7adba7125c76c2e05d03783d312
SHA1 96f4894c3ae68e84f5b42dccdd3e7589cbff8b45
SHA512 fe5a27e15f610309a34f395cf58e31cfcf55c8e2e0f33eb4bcc8d8e1dc290036189ddab820f1eb5eefc2a4aea92f310a7b4f3258f8291c03852a6dd34909f3b1
SSDEEP 3072:j3lyLUL/uxs1pGEauhY2LXeBxvJMTusadJr:pyauSntaAY0OBx6uBr
MD5 SHA1 SHA512 SSDEEP

Submit Download

26b29c67-8e65-48c2-a59f-1c2be6c1b431.tmp

Path C:\Users\Admin\AppData\Local\Temp\26b29c67-8e65-48c2-a59f-1c2be6c1b431.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5 SHA1 SHA512 SSDEEP

Submit Download

32.png

Path C:\Users\Admin\AppData\Local\Temp\30ouqyim.fcv\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\32.png
Size 1KB
SHA256 f18dcb72e3b35b082a4ff8e36897a0e571eea9ce3faa4df01c25db03e242cadb
MD5 2e53a0da3d561ad9fd7d70f2797242d3
SHA1 74c07d8e040d385168885859ebb084dbcfc278f3
SHA512 2128a52cd3e8ee8d6485742324409e716cffec6f0a404178d6ebd532948ee6a9b973515a5d68d4f787b914f18427b99d50fd86b391f6e1d9a757bd8eb4bfb0b3
MD5 SHA1 SHA512

Submit Download

48.png

Path C:\Users\Admin\AppData\Local\Temp\30ouqyim.fcv\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\48.png
Size 1KB
SHA256 1957de0f0d150691cf50136cc8af5557c69594578292632284981dc90bcf20c3
MD5 d6b943b4b8bbeb32f00a8874ef1e706f
SHA1 5f1666f9f8546e8e044b01f98753016d31467203
SHA512 2dd204e93ab1d6847d3ef182ee35dc9dcc78c5e807d5881aa562f407c7a78a08bdebd0007bc836970691740398dd567e13bfcd256ec07b97a13a26f046675b1f
MD5 SHA1 SHA512

Submit Download

64.png

Path C:\Users\Admin\AppData\Local\Temp\30ouqyim.fcv\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\64.png
Size 1KB
SHA256 26ef3a9f36aac1eca1805249a02f749d420c7d1513847adb25a2e4ec887bd17e
MD5 5de2b8db0c9986b3eee601b1009ef623
SHA1 9a267178a3ecb89904d1f6a973a659f9ff8dee61
SHA512 1e3e4cc7f663dd47a7ccbf4721f7a0f28eed3df8b5193492279217e30a8b1330131625a1e2030e923a3914593097b700fd2073be66dfda315f38e785fc97f264
MD5 SHA1 SHA512

Submit Download

128.png

Path C:\Users\Admin\AppData\Local\Temp\30ouqyim.fcv\Default\Web Applications\Temp\scoped_dir5220_14089757\Icons\128.png
Size 7KB
SHA256 dece52000cc113eccfeaab6a5aefdf1868fbfd3eb61b0ab2ab1d71530b6ad8a5
MD5 2483da6f42e84bf1d8c39b67b849a78e
SHA1 38a1f27fa44a777c27043ee0ede1048c052b1d54
SHA512 e43b074870ac2fab95d1aebd11154f0cd44664c1d2e2d36013896b8cba92346d8d08bf4f7cf933579d781315fb48b3b375e7964658052ee7e1288b105f6dfe47
SSDEEP 192:2O7p4JBy5Fo0g5luSqNacpC9JciUzxmXDiNij1:ReJ29PNpC9JciUtkRj1
MD5 SHA1 SHA512 SSDEEP

Submit Download

192.png

Path C:\Users\Admin\AppData\Local\Temp\30ouqyim.fcv\Default\Web Applications\Temp\scoped_dir5220_14089757\Icons\192.png
Size 5KB
SHA256 1ad0085b5820af862f2231bf9460048b37ef068c624cd920691f94252c2c5fd7
MD5 d18dee0302e5264d474f04018f2b3e90
SHA1 14af07666741fda9efc2b51c00aa53d7cb27e5a0
SHA512 9fec0ad33361a7acd86463c501e3f70cc317e3b605bfca1a2739f43080da7ab674bec7feb860662f4190e31bd8eeec557f0812ab1d44fe4814d71f598d66eb2b
SSDEEP 96:lL7vg2ThS+PZZ8RL8gduPe9ttGssuO0K+ab9uF9iaZVcLKjrenv/P+OPs:17vtTTPb8RL8suPattdO8apufiaZVbyY
MD5 SHA1 SHA512 SSDEEP

Submit Download

256.png

Path C:\Users\Admin\AppData\Local\Temp\30ouqyim.fcv\Default\Web Applications\Temp\scoped_dir5220_14089757\Icons\256.png
Size 19KB
SHA256 4477ecf5ee15b7c1e557976487a49a3c9031db8df4fdab15f0819208146d2b94
MD5 a3c33fa42dbc99db0a6b8a56ee33bf81
SHA1 857b35462ac7a919c6b618a95fbce9e91cdb0adb
SHA512 ccc1fd4837721f4b972d34981e294cdc7b4556ade953a0106fb410bbd6e51c371ace5b114e613229be4d2a4e4ab030567467b9fd2149329bee1eeec7d9b1fb30
SSDEEP 384:9SXGtW841VZccYCmLRUsBpRCFxM0G3NGt6VkO7RPB8cMO0yptjSC1+gl:9IGt/ZCDsB/CFoBOAMO/zSC+0
MD5 SHA1 SHA512 SSDEEP

Submit Download

96.png

Path C:\Users\Admin\AppData\Local\Temp\30ouqyim.fcv\Default\Web Applications\Temp\scoped_dir5220_14089757\Icons\96.png
Size 5KB
SHA256 8c3748c8c5b7d44116cba13eada8b4e501f4edd304e4593edacc2c7b21ec9ee8
MD5 d5e0b5fd1fa76c4d463db97ba4d445fe
SHA1 9d70eb36f2f450bbab7cc96279712581b77b4770
SHA512 5033b7209ef27e3fca4f79f855083ddf2406bfe4eecc0fa87e97537b6e6a71cafeaba990c17297c86d54fa96af36a13b65510e61755cfc22389c983a4987852d
SSDEEP 96:KgDYdm3U+IKJGiVLmaItVv4xsXr2PbbClGRlFn+LiTTSF3jZrQlCPN8ODza:KgDYdw8yRyaItVv4xs78vzn+Li6BZsCO
MD5 SHA1 SHA512 SSDEEP

Submit Download

192.png

Path C:\Users\Admin\AppData\Local\Temp\30ouqyim.fcv\Default\Web Applications\Temp\scoped_dir5220_736022666\Icons\192.png
Size 2KB
SHA256 9cfd1ad226821af533499bd832a5674df52a720b19e054580a2b999e19dd7b1a
MD5 22ba8844019e231a435903176a618bf5
SHA1 0ce576800f66bc2145c8df72b9efbe0c7431aff8
SHA512 2e754fce3268dac2f8f9261f4d4337a7990a990121327c9d491f27fba5c4680968c7589bfa0d04082410f975cda97c46912ba8e1c39f8a6da15cb32c02929cfa
MD5 SHA1 SHA512

Submit Download

256.png

Path C:\Users\Admin\AppData\Local\Temp\30ouqyim.fcv\Default\Web Applications\Temp\scoped_dir5220_736022666\Icons\256.png
Size 11KB
SHA256 f64a3d1e393f9a114632d22bc8a01b328895127ff1796e2c3d18b206622fab1c
MD5 024859c892ef6882e8a3e1be4675d23c
SHA1 30ba3b6255e2514b9782ee29f6b8b55ed350a29e
SHA512 58caafadba7cda1db596f5a3c2f94fd3a167cbc21ad98387820ebd808a52eff0e23a5a8292b34a8e284aec4bf2573998ca62f0effb5b647af1bee96ded8bb384
SSDEEP 192:F4aCtq9F5vnIb8/0yNBlV28QNP716enZiP3dGu5yIs9gGDyIMWQo2BkL6O1sSO:Veq9vvPdBrQNL8PNoIsPGYwBO1sP
MD5 SHA1 SHA512 SSDEEP

Submit Download

96.png

Path C:\Users\Admin\AppData\Local\Temp\30ouqyim.fcv\Default\Web Applications\Temp\scoped_dir5220_736022666\Icons\96.png
Size 3KB
SHA256 6c5f0e1efa0cf592b01bc20be9c3f348a4285e4604e555216c064b64a05961c0
MD5 7b0532144ec2ce1915a3707ec9084aab
SHA1 81cab7df8538d1f757a3e58318716a9a1ed08d5a
SHA512 aefca0ca127e2b91a5c7206b8103b2afd977258643c12e972a292522152964da1beceaaba0b8f4f40e85e705bb9c9e5826ba49eb2d9b925dc07964096863dcaf
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\5ctrb5gu.jte\Crashpad\settings.dat
Size 280B
SHA256 efc6dce2b2da9812148ba1523f66a86193620d7f38d52df34ee680fed1a9f12d
MD5 cd7655eac6048cf22bb76c27e73a12f1
SHA1 d57d1b5e261b229b216a150891e2c7b7d60ab678
SHA512 c9eeb33ef7270247c13c8da0f043b2088c8e7287828e2257ec9bcd7c890637fa5da99932e9c948fd97c6ff385b4d1c9fe21b3fedad7f3001da75b724445f521f
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\5ctrb5gu.jte\Crashpad\settings.dat
Size 280B
SHA256 b5fd996b920fe6a0f32f6ccf4574663a69184736efcb78c547a879efadba00ff
MD5 7ad7c572e8243dc19da1d6aedd8969c6
SHA1 8493a2f3fb665b175f999af88a065feac1c4efaf
SHA512 94efe65f09556b548f4dde67678403fb20b20c065382f89c33cfebaf34915d7bf556c54725b35b114e103f0bc742fff0c1f023929efb326e38e5f7ab033da532
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Temp\5ctrb5gu.jte\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

56ff8214-2ba7-4b7b-a5c3-9b56192bf95b.tmp

Path C:\Users\Admin\AppData\Local\Temp\5ctrb5gu.jte\Default\56ff8214-2ba7-4b7b-a5c3-9b56192bf95b.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\5ctrb5gu.jte\Default\Code Cache\wasm\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

Network Action Predictor

Path C:\Users\Admin\AppData\Local\Temp\5ctrb5gu.jte\Default\Network Action Predictor
Size 12KB
SHA256 7cb1b71ddf26f1f8f065e80a24fa4083dd7a40610d35221473ebe3f22e325454
MD5 1e7a47720c028952f1bc02e2b7248690
SHA1 e159adc2eb044b9f1f6c76a0912984bae89adbaf
SHA512 5f5c9756c7928a3ff8fad853bec6741bf83d5b34558da4918fa98cecb6785aec6b87f64a73ac2e3aa7116ac6d97ce8d1d0d3d3fd9e16cd5583eb043debce26bd
SSDEEP 12:TLDrVPwinoi9HwPi+k6z2KXV4iIiyPWOT/:TLXTFf+FzfXVVlYWOT/
MD5 SHA1 SHA512 SSDEEP

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Temp\5ctrb5gu.jte\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 192B
SHA256 0c8d8db61bee1443b1e2b1ff404a1557682cc3663d22b4fb2a038f6bf9e42c1e
MD5 6924475a1c9c66494180f7dcc3f5eb73
SHA1 ff788001476d4b76fbf7aab30c8378b8e1322a7b
SHA512 0854c7fe5528c8ac15b2356c5922cd42679602e855f0d5ab3f086af4760cdcf50c0683f35b6b46760f231d76c931217c2cbfa82e1aee037493c14b2c389507be
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Temp\5ctrb5gu.jte\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 257B
SHA256 9f0abb0782c6d0cb30c42c75c2fe67781d82d48ccf38cddbe494423a560ea78e
MD5 255ec4a76e5009d2cb4fdbd2fa296842
SHA1 d748f186cbd3fd42e844a401dc60122d2ad2d680
SHA512 a005854573f8217d6819aa607697bcae6ee6de8f9fee05ba33b06909d1740fe1cd15cbd7d57a1ddb8d567d0389e164f2629a1f906ffa4d746e5268be85a627b9
MD5 SHA1 SHA512

Submit Download

index.txt~RFe57d590.TMP

Path C:\Users\Admin\AppData\Local\Temp\5ctrb5gu.jte\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt~RFe57d590.TMP
Size 119B
SHA256 0d2489016598adfaab31d865b91c3f1fbb57b35b69371a5afeccdce01e3d68c8
MD5 97402fc95f9aad76739bd4e50b792f9b
SHA1 10ddff3015c1cf0c69a8ca0e36a51fdfd5f92f4f
SHA512 a53220f530f7cca5717f39e207c89940548a8b09c42c5c367fa9b9d638b024dc0b7d032618d13663989a44ddc44ce29d2dbfbf94132cd2cd9a0db76f889accb2
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Temp\5ctrb5gu.jte\Default\Sync Data\Logs\sync_diagnostic.log
Size 2KB
SHA256 d8fc4ef9d02bf532c8929ba8822aae50d34304fc404360919ae4c0fcd93e31ed
MD5 172d1921ba28c764a23396ef5f79305b
SHA1 13ce67086f25b5046424aad7aa5c2f6f92b6afe4
SHA512 916d3e903b054a4124ea90140cb9c3c279d9bf1f537649cd4e19bc0047c02b0151754eeddc266e87d045de36d9bd39b0cf797b884a767a78a29f12d887bbe36d
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\5ctrb5gu.jte\GrShaderCache\data_1
Size 8KB
SHA256 35bb2f189c643dcf52ecf037603d104035ecdc490bf059b7736e58ef7d821a09
MD5 259e7ed5fb3c6c90533b963da5b2fc1b
SHA1 df90eabda434ca50828abb039b4f80b7f051ec77
SHA512 9d401053ac21a73863b461b0361df1a17850f42fd5fc7a77763a124aa33f2e9493fad018c78cdff63ca10f6710e53255ce891ad6ec56ec77d770c4630f274933
SSDEEP 3:MsEllllkXl:/M/6
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\5ctrb5gu.jte\Local State
Size 3KB
SHA256 6e54dd29ee0dae8bd1792858762c14c6e9341855e417843011a3ef7712aa28c6
MD5 954b69ec7232972fc0f23cec82781cbb
SHA1 78513e829445311033dcd12742f32e95c1ed8555
SHA512 11140dd68a4c1181830899d1359c9154bb8ca7aed45f3b48ae7658f27b389075519c7a3a3d20bf22740708c0bb703f1e062e8745e1fede2f440ccc68ca1a3723
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\5ctrb5gu.jte\Local State
Size 4KB
SHA256 a4387a77c10cc2f6caab8f3cd8eef71ced18f5a169934ddcb718683b0708b286
MD5 eecd843680e7ab1c213f2e1a073cbc9f
SHA1 52cb38ed5ff69c8604e52445f779059bafc47304
SHA512 9e83aa4ed7f978d1582c611b6c3b53d5ba67ea0598b445cfd3ff4b344f746bcb16cfe36007103bec2f50643bb9262ac467e5d069906584824da23d2308af2faa
SSDEEP 96:pqGNkCufoaumI58Frh/cInURoDotovmODkvBwPbgsvMU5WVdlJZCUjviBOa:QGNbyuqooDUwfkZibx5QrwUje
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State~RFe57c9a9.TMP

Path C:\Users\Admin\AppData\Local\Temp\5ctrb5gu.jte\Local State~RFe57c9a9.TMP
Size 1KB
SHA256 8d7bc091676f4048f06d84313884340224a5e6c1c0be0c7e0b086d2a8e57448f
MD5 aa103ea1458bda322cb3b53b859121d7
SHA1 a3b8d2a687644a48e333b3e47d24efac60410774
SHA512 88fb51dd921890507add2377dd899f41a2d85df58a6cc0a27d8604910d2f69b7a3c546c24171b613f99b1f019596613c75f34c45710500d1d065d9741883598d
MD5 SHA1 SHA512

Submit Download

ee83e412-87c1-42f2-9143-ffce07939f6b.tmp

Path C:\Users\Admin\AppData\Local\Temp\ee83e412-87c1-42f2-9143-ffce07939f6b.tmp
Size 154KB
SHA256 a468f5875b4e55ea732e3df283b4f4ea941be738b238122979ca5d8006a3a8fe
MD5 4ad81f6ccc657d1da582c75c5db037cb
SHA1 ab0370e7d32ebed71fe9787d3a4a2fc0c652a28e
SHA512 66461474f8b36d6d470797df9d4a3cc4698bceb7054c97166eed98b74def84f58486fdb909928aaeafee793799a436210b5d7091acce6232b23eb6ba926ad227
SSDEEP 3072:OqeD5sKZ7XcbMSqnDhcfXE0IfnpWpyKIrFn2wNkR7aUPuWm6u:yD5sIXcYSqDGc0kkpIZ2weeX6u
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\s0hj02ch.xpr\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\s0hj02ch.xpr\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\s0hj02ch.xpr\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

32.png

Path C:\Users\Admin\AppData\Local\Temp\s0hj02ch.xpr\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\32.png
Size 1KB
SHA256 c0b2a99e82bfa9b629fc903c77bd36fd3b148b25fb67ae196cbda262c593efcf
MD5 b422f26131f7d87105b2ef5bcc8996d1
SHA1 5bebedb12720c3b09dbafe9204bdc8eb0f7971d4
SHA512 1a4b3406afb311ad824a1adfcb33f336de09efab34c66e058936a57d4f73ac33431eacf1fdb11f516f56107a93741aab3b9fa5c85d805466ca58c3e24bcc9c28
MD5 SHA1 SHA512

Submit Download

48.png

Path C:\Users\Admin\AppData\Local\Temp\s0hj02ch.xpr\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\48.png
Size 2KB
SHA256 a16b7fa466101581d443223247589ff21fdf73f1b09d43ac740fa128d0252931
MD5 33da9ad751e4a3b21bfccca9e6727e8f
SHA1 05d5ceb6a2b80de82a2f70442f68ae803dad22f4
SHA512 5af9ef87eb7c050158b7add761ca06273094a5a2d5dba87991c7ab20fa2dfb7e7f7ebf1fbae21286781144ec1fe3531457deaedfd2a668975dc7184020c6f0a9
MD5 SHA1 SHA512

Submit Download

64.png

Path C:\Users\Admin\AppData\Local\Temp\s0hj02ch.xpr\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\64.png
Size 3KB
SHA256 4fea2d966296665a3ae1d35c0eae541b0ef7b9b1a9890e9e65314f80db5a3e21
MD5 1efcc119d02c61752598ca121cd0babd
SHA1 6d0736581b02aee66d51fe29e68babca6a59fdb5
SHA512 8d5554a167907f96720a126e901aa25f01e1f58f9469f8366e7f2352ce16da82fa3963845cdd586837c5aeafb3092a2aec6d3e755bec2031d12325b4799d44e1
MD5 SHA1 SHA512

Submit Download

32.png

Path C:\Users\Admin\AppData\Local\Temp\s0hj02ch.xpr\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\32.png
Size 1KB
SHA256 3197a2ac164c5bacb65f02fd9a6eb9c0a533fdf3b24f43043bbe9af65ed6608a
MD5 60953b3aca67505c2c7ea1a902e84d51
SHA1 5e6a8e04a96e36306c66409edd4775a606f13f54
SHA512 2e65ec84471c3f703617171aa32f1a0d6c57d73e1d5c074b92d20d580df78e7ac4eef5ce54ab7defd0027bb38e33c44a6602d3e123a2fd310e514af0f5b38086
MD5 SHA1 SHA512

Submit Download

48.png

Path C:\Users\Admin\AppData\Local\Temp\s0hj02ch.xpr\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\48.png
Size 2KB
SHA256 9bdfc3aa03d4e41b0d83862ce02f9fe7fdb55a492280d86d551b91a24efd47ca
MD5 1625c1dd7bab831d8ab5308a1a71d525
SHA1 f1c145985a7c8c18891caaba0f46729bcbd1f63b
SHA512 75079bcb02482abd10b121d81fe39607dcac17bb3107ca274c549b570bb473260dfdbdd13df769b1745425ac5433a22fd392a2a1d815897e0c2091b787bada8e
MD5 SHA1 SHA512

Submit Download

64.png

Path C:\Users\Admin\AppData\Local\Temp\s0hj02ch.xpr\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\64.png
Size 2KB
SHA256 57d5cd9fa59f944ffc78ec2a12633a79e2f923124fc50676ffbecaef5021b4a9
MD5 e6671b804d6013a6706ea598e2d854c5
SHA1 40e4f401fe4afbf7bda49a02fe94f5308868460e
SHA512 7b11a47497ae5810ec4c7038ebf8358f03d79126886feb6daffd92d116fd606f530ecced9c3d635c0f57b9f9eb80ed9e8fa4eb98b029f9fd798d9b89ccd279a8
MD5 SHA1 SHA512

Submit Download

128.png

Path C:\Users\Admin\AppData\Local\Temp\s0hj02ch.xpr\Default\Web Applications\Temp\scoped_dir5040_992131091\Icons\128.png
Size 5KB
SHA256 99b19cf47ea4e47b933229e92b87a474fbd5af7936bdf885c2240d0e6f4bdaaa
MD5 6a371e7bbf132a71f031772845249b9c
SHA1 36f499f3a2e2bf885019d914a0cc6e8b3e035a79
SHA512 b1fdcd5af84fa476808b8e89794d9df9f8e48b3e7c1a2239deae10832834d01bf311803ac95b3774d781be791b47389310ca866e1a6b497925ca6e2f004555a6
SSDEEP 96:n0NgAMSinf795k4ITgiEAyaD39SOOcqS+e60qq/zsB:n0Ngpf795k4CwG9ST3S0wzsB
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\s0hj02ch.xpr\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\s0hj02ch.xpr\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\s0hj02ch.xpr\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\s0hj02ch.xpr\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\s4ftoqtb.fmg\Crashpad\settings.dat
Size 280B
SHA256 cdbc4d1663c3d423af226cd2492e9621f96502fbca86758278c56249ed9a8604
MD5 c040597ed64b6a6a77f0d2e7f8e632da
SHA1 10f5939bcca4a0f59d89c9be7a52283106efea3a
SHA512 69d0ebda2e92a6dc51fbf1c3de48dd21d3106a488027f7d601d724becb2509da252db880ae381a10586a5d8f26133191dcdea8d60e176ebbeadd05394a4f258d
MD5 SHA1 SHA512

Submit Download

f_000001

Path C:\Users\Admin\AppData\Local\Temp\s4ftoqtb.fmg\Default\Cache\Cache_Data\f_000001
Size 34KB
SHA256 8c97e1a3437f857eb8a346a360274ea339a09eda1b965ee1445d870c09b066ca
MD5 4227139d34ecd3be139bf6c7d75fce5b
SHA1 0e984113aa96daf31d002392523ad0dfc9cc3870
SHA512 bdb38f430aa623a17b26044288841a07c82691ee858325b158423839fad99a75b192fe0df269898cd76e22a7e54250611f852ccb763ce82db2f7d1c4eb6fcb52
SSDEEP 768:iFPCuSWxAknP3gQlE3brX+48360GKKAC4FZ8ELh/SAE9gnmlV:iFPCuSonPJErr18ZGKK1oLQH95
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000002

Path C:\Users\Admin\AppData\Local\Temp\s4ftoqtb.fmg\Default\Cache\Cache_Data\f_000002
Size 99KB
SHA256 cad25cfcc108f11e81cf1a339916e956b5ccd3ab3da38a3bd7a3a7a01adcd3f4
MD5 86e9c0ad8befdb46f1ecda1d3f2c70ad
SHA1 cf9520c235db04ac02e98a7f7c9f3d5d631d4199
SHA512 30a1265891f03df0c46d4f310d97ffa312b84d485a214d895a1c5e260474260d6637592b20d9cf4efa507c131694f63253577fdb352e8e0c46505e02183e0ab4
SSDEEP 1536:GAqrSnLU5BxYE4bP9zel9rbvjJvNCLtY25wJ0qPKldrT6LTMyT2ItH3RHTZ:GAqrSLSvYEwsVbrTfUPdqL4S2iTZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000003

Path C:\Users\Admin\AppData\Local\Temp\s4ftoqtb.fmg\Default\Cache\Cache_Data\f_000003
Size 63KB
SHA256 8384ba710b07cbd5070d5f227d5c8ab5049307b026689c62538e82b35ca475be
MD5 0f249c355871422187e3d90d40001601
SHA1 1bb7d7d97a5d3f1e983deb22a747c022f898d81d
SHA512 d10560d110afa974c88d80492d280c0ab213a1fd7e840b1076afac3601e37659365766e63ab62b43e66dbd9494728978d74e7c41ded0f354c20759bda5d253a2
SSDEEP 1536:yUWzei8jmJcVsaP8Y3fMBZMrCGhwpqOjuv2evw:yUWZ86J1hMGGiIOco
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000005

Path C:\Users\Admin\AppData\Local\Temp\s4ftoqtb.fmg\Default\Cache\Cache_Data\f_000005
Size 384KB
SHA256 0bac06bedfec7f191c67723dbce5b3d43c779983b55856fce7d3b118510563d6
MD5 3ac58b6180b0a84111950fa958b3eeb5
SHA1 2dda24176d58addde6ac3b9d6fe7ff500c4ba164
SHA512 d6620ad8890f60bd7293de9bb40aa183328794a001cf13f8a0e5371f014f21a831e0ca624f717ff035cbbc1c9ee12b2a9df55e9d7008c5143fc36452326d16e0
SSDEEP 6144:OsdCXZA/g+3ylTgf+ZJbMyhU8N9zC0aHipW+X3SI98M9EgZUTMrur6Sko/ql58/B:dCsgPti+ZJDhE7GrnSI98OJcqDgS+
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00000a

Path C:\Users\Admin\AppData\Local\Temp\s4ftoqtb.fmg\Default\Cache\Cache_Data\f_00000a
Size 28KB
SHA256 b421c05a340e40d4d4bd1831521268b6f0afd0461ec3991cfa8d5314bf3207b4
MD5 57f9a7c7e2be49102533a2ceb7a05e51
SHA1 850ab0a80577b7f7effe196cba037899e71594c5
SHA512 66406d54a1d1a44f30e19a9bff1242b50fdcfbf66c33e4c23daaa756c06f50a2e39c991e7a8dfd9a81184cc37c2062d0406070be132e28a22307896e63b55447
SSDEEP 768:dT+CJ4QL+F8S4bApn9Ua0ndjCaixJ/fVW2/AGYnS:TJ45F8SgjXnNCa4fVWVnS
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00000b

Path C:\Users\Admin\AppData\Local\Temp\s4ftoqtb.fmg\Default\Cache\Cache_Data\f_00000b
Size 73KB
SHA256 1532ed202d3f6503783ce7a00962edbccc97014949e7bc5ef2ef963397f3e654
MD5 8e2f25080b5557d516a7361a5581acb9
SHA1 5d91cb84ae3981a430032ee9f674fc923b82f3cf
SHA512 d7ecfbcac49148a849fafe214ac1849736cd270395c02afba687033bd7b60394e90d829060894ee27fe5beb43bcf3ce646a4f029858e79f514447fdf7752dfbf
SSDEEP 1536:QzgSYVPjsocNefFlT0ZjfIVuNZY7BBwsQOb82t2FPzIwbes:JSYlsRgfFR0yVqaZQOY2tmbb
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000012

Path C:\Users\Admin\AppData\Local\Temp\s4ftoqtb.fmg\Default\Cache\Cache_Data\f_000012
Size 70KB
SHA256 42c629409cdb91fe048a591f990396258cb1bc076dde78008bd099050e012293
MD5 b5ea3dfcbc44075663320b28e7e9c20d
SHA1 2138d47decd4f679578b169b7dab0d2128ba8b98
SHA512 f1f9146821ea3fa84c7dcde9ef646dbaa5b8cccbd150f1f73eb280db2f8e80ce2f3df52370b02d8494da0989ad9373dc02a656b95ec5d5d59047fca854afcbee
SSDEEP 1536:n6dzyUMSNC+BG2/ia8SIinyLy512lau7GtsQqzMdfVaJkjrYGRS7pa:OyxJ+Bd8SE25clau2FqzMdf1kc
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000014

Path C:\Users\Admin\AppData\Local\Temp\s4ftoqtb.fmg\Default\Cache\Cache_Data\f_000014
Size 68KB
SHA256 26f2d056c43cc9d83e59c76d08a50092b7c546505ff5ccad5a2cd8cca61a4aef
MD5 06358bda6e5c43e7eb8610a3cae99bb9
SHA1 d941da5ea4fd37d27212d06aab764e844c65e742
SHA512 a3bfc5dfa155ae60fea32f82b0b60ff599ace12dc12d0d6cfe8cdc0f5adc9eb829d2bcfdabd7faf77e9cbe529770607e0d35039cac4fb5f20423321a750f1270
SSDEEP 1536:WCE4MCFi8pkFZLGftTXq+fvXZMEDu/Zg4IQLroZpZwtyF8PDxVSH:tRMKUZ5UJMZ/G4IQYpoBPD3M
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000015

Path C:\Users\Admin\AppData\Local\Temp\s4ftoqtb.fmg\Default\Cache\Cache_Data\f_000015
Size 17KB
SHA256 46e83651a0249d8f3d70d455426739c9bf3367277b49733c73cb470ab6b19ab9
MD5 efac1951f0070a46e5af8f9d937d602b
SHA1 3ec61e8e60aa2d75ad4e5920d1d1c0620f5529d0
SHA512 8276da8f96ad70c40a63b470d21c11dbef74426d6f50d43f385acd1469729ebe1f3fcbe791fe89dba44497a2f8ed6e2e6006b3a3ca0698306daadf566a35235d
SSDEEP 384:H515PQlYvSX7FHdc2tMcK7iRtu/rCmzXwRYZ0TqoOzwn3+k:Hv5PfvSX7F9cNcK79mNOknuk
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000019

Path C:\Users\Admin\AppData\Local\Temp\s4ftoqtb.fmg\Default\Cache\Cache_Data\f_000019
Size 18KB
SHA256 10ecd4dc162d2ac7d826b2dfa79e706dd852053d2bc5df5eda1433f2466547f6
MD5 1a4d4e9b989359f7fb708c51304434d8
SHA1 c711062c8eecbdc6a4d456dc09cc78e575f37c97
SHA512 c76aa1fae1adecd3ad2520dd2b27440003bcaa9eb85bf3e83a00c3a0974912c9e13e749a5ec4f883dd3ae00882ade2048464f2f6c43a4bcb6f1aad5d1b35de89
SSDEEP 384:3+YQ/TozCH1DqiTTMbL6t5Vzhrl7/nO/OfMfUi3GHZvntV:3W/U61DzY6//lTO/OUUiWHZftV
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000020

Path C:\Users\Admin\AppData\Local\Temp\s4ftoqtb.fmg\Default\Cache\Cache_Data\f_000020
Size 16KB
SHA256 23cebdde3aa3c9b38e0647ae2bd6daedae2f62adee6521dbf726731d00bf14b5
MD5 fdbdb95b5ac5c4edecb625ceaccf87b5
SHA1 8da620668bc6b3ee6c2eac8c258d80afa06ead0c
SHA512 08c9c96ffa14e4be65c50bed0683a5d817ea190a493cca1119dbec30807a9e5846baa86c96dd97603620ee67c3acee2cda678cb246fdbd033aed1805aef1d2f1
SSDEEP 384:BhBYbM/UQhdWQz2xB4uINwHHKwq2Lx+J7Yj83GyEskVvyWpg5Fe:DqQUwWQz2xBrnnbNLUBYI2yEVVKWpn
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000026

Path C:\Users\Admin\AppData\Local\Temp\s4ftoqtb.fmg\Default\Cache\Cache_Data\f_000026
Size 33KB
SHA256 3ff6fb4e850a17b9ed245cfd23e4354e00a96508560ecbff981fc5c54de7ecbe
MD5 a96c89b3b67e130169a6b851fafe7543
SHA1 32e302a5898b11f43a0822b33c9c5df1b980f4a5
SHA512 fd4507e0a7238622d50ecd772d89edd72eab17fac6ee36e5fc829a54fc97394e233ad219b21fe5b760a08483909b5e17445ff9d4d6f05db32d5588b53160b65c
SSDEEP 768:3y5Ihp54MtQQ0p4WJIYbl5LSTvEJlmU6Tw1yo1PL:3y5I1t0p4PYbl5GT81dyo1PL
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000034

Path C:\Users\Admin\AppData\Local\Temp\s4ftoqtb.fmg\Default\Cache\Cache_Data\f_000034
Size 38KB
SHA256 83b2272bc68acbb16385b46d49015df576d02a6a6247c644bb1fdbcc2b32d2ce
MD5 1bfa4903ff3d4cf9969d346e19239aa5
SHA1 42d011512ff5900015564acec15d7407dba04f80
SHA512 daeee96a056135966d810b648e9640c561784a3bfa1c1cbf9145da0f0481910268aeca6e78347851da6d18e559ac85b6ed1080bf58e8bfa62dd7476871a83ba7
SSDEEP 768:HszpXJbhkAWv4QZOYTi2qelkIakzly5EVZUQNmsrcC8AjKiuOXD+Ny:HsFXlORYYTi5okxyimZrNrx8qKiJ+E
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000036

Path C:\Users\Admin\AppData\Local\Temp\s4ftoqtb.fmg\Default\Cache\Cache_Data\f_000036
Size 17KB
SHA256 fe333faeae331924f55207e6eaded3ba32070f480e8154e169b09b84554ad6a0
MD5 fe1ea89caee6e626201ba413be6e58d2
SHA1 358679cf0518f3eac97f3221009dc49d68abdb8e
SHA512 35168fe5b0f4bca2bf61cd6e667f4c4010a58061b2a0acf8b36bc963310554c24d07496a1f926b24f18ad20361e9102e1dbf9646eabb52651ac44d1983e1edb9
SSDEEP 384:fnRfPuMBan/RZ4Nan/whU8qhRJw9mCL+1uyOCP8JyRmTgXndt:53rBan/RZ4N4/N8qmmCiPfP8JyRmTgX3
MD5 SHA1 SHA512 SSDEEP

Submit Download

0d9012c4-3eee-4e7e-b52c-d827eaf09f11.tmp

Path C:\Users\Admin\AppData\Local\Temp\s4ftoqtb.fmg\Default\DualEngine\0d9012c4-3eee-4e7e-b52c-d827eaf09f11.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Temp\s4ftoqtb.fmg\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
MD5 SHA1 SHA512 SSDEEP

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Temp\s4ftoqtb.fmg\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 324B
SHA256 e0640f728fb2913a989c73c421d8ff334bfe497e0e37926c03c5658fcbf35753
MD5 3ceff433ee1b6490611beb7bfdc1cb34
SHA1 6ffa6ac35e1bc7f380df53699716b8a699bc4cfb
SHA512 8fe8754029623959105901e76870d129aa2483567c0c8ecdc0efda0612cfec913560f3ea53e64d026c5a319596eb8563e6b3660ed9e7a43e9b8edf42cb546251
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Temp\s4ftoqtb.fmg\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 186B
SHA256 8b89e148c04c76002ba9fe6bc89e35ff2aa4fde73fe4f15c11fb56f044bde61e
MD5 4fbe68ba8cddfbbfd73a6672cd98d8f2
SHA1 69e4d4568ae0a76b46d79703f73ba802b91c12eb
SHA512 4b78d5468fa8810349a3f64de78cbfeae08d3ff2760393a9900b2e9fe5ec647dab1e4a7ad21f91c57fbb991b682d846ea8e59c95f54c0b3f42e2a3abbcb508ed
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Temp\s4ftoqtb.fmg\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 259B
SHA256 50b62dbbfc218a7e21920370be08f8b08f8e7bd27c1eb10ca53c7dcb08f5ad35
MD5 d07cab4380b313c81115b4f8f20ff63f
SHA1 43fabf52417ede33bc710ab0cdfa6e1033619763
SHA512 e639938d361ecf38458cf415b85bd6858adf222326c6b1745034e57c9b3aa88de2f009e02da544430f24d78e8e9e91b43952a90ff5121c6fdda9ec24ad5c8a80
MD5 SHA1 SHA512

Submit Download

index.txt~RFe57f4b0.TMP

Path C:\Users\Admin\AppData\Local\Temp\s4ftoqtb.fmg\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt~RFe57f4b0.TMP
Size 120B
SHA256 5b7dadf1592a17b34c89db0375132ad239ebfbcafff74ce67ef51ffca336b384
MD5 4cf2b0ab15e1487bdbbda61d06a6e91d
SHA1 a5d1ba574e67b28bf520549b1e698729c0e7412e
SHA512 1385a00399357fbbb543cedb87de84e9ea672b6a66d5e0e59c362c36a367b7392204d5fa57d04a3ea6df30d3fcfdb3540351c8a236af8dc70f0a8bbee8df8188
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Temp\s4ftoqtb.fmg\Default\Sync Data\Logs\sync_diagnostic.log
Size 300B
SHA256 9394ddacbfc4a311e8a2d54efd571d8b0ccfbb677846c47d1d17fc68f55fcb2b
MD5 ba0d9dc502a98f92b86d1f3b062170b1
SHA1 cf4144fd2a3ce05573a3aa4c84ad2bf182c579a5
SHA512 9fae9e8bcfc1cb9487e389197eeb05d24bd864b894b5682b75ecc4a9f76dc0bd35e82cface0edff391e180be1ecd23c91e4dc76688ed5058cc72b4b20a4eee97
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\s4ftoqtb.fmg\Local State
Size 3KB
SHA256 9d1211fec3f92647a71922a36b42117574a5e124e6cc94318d95e28a906a78fc
MD5 6de28e9576278527188785b7bd732038
SHA1 c49f9e43ae769112c958afd02b90edc680459fdc
SHA512 90cab00fc85e04a6ced95bfc80bc991324645a0bf24ddd1069748785b137be0a994b745c50db04058c02b68c810f5191e9f3baa2b999b58e6dcc5a936c4c2688
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\s4ftoqtb.fmg\Local State
Size 4KB
SHA256 fc9cd2ee306fa0304d9e6d53d98d88cb9034487787852e7e1feedb6508151669
MD5 349b9e366450836415cf477abf211cc6
SHA1 5e9a8ee09ff4a1bbebadbaeee798f9a9155a25b8
SHA512 05ffe10492a04385061197c57fa067b124200723805e77a372aa1ab2a2e0e78c91b2d02cc84f926da032270a7a4cd2f55998f2b9037959c7eea324da52562557
SSDEEP 96:JqGNkCufoa2sAS8c58Frh/cInURoDotovZaDGkBRPovKDGZD5JVCUdzBYDa:wGNbyd3EooDUw+DpiD/sUd2G
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State~RFe57ea02.TMP

Path C:\Users\Admin\AppData\Local\Temp\s4ftoqtb.fmg\Local State~RFe57ea02.TMP
Size 1KB
SHA256 c4f456e638246b5c6fa26590e5ed4ee32f6ea44b9b27c63d9b0fd1b2c45e5f5b
MD5 e7f448caaf79a02bf3f97fdfa14c22e5
SHA1 88019a3642588da8ae6a26de82aa8cd29287d2b5
SHA512 d059a80435c4caa766c2b0437153901b56eafd6fa88fe4ae3983a97d723f8ed6df1984a8e82ff22502d8f8a0ab181e257c18611979a36447ac0311fc0f930cd8
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3484_293646770\CRX_INSTALL\manifest.json
Size 626B
SHA256 279bf453dd0572dcf4a326cb7df9fa9d296a2921ef96abdb1956a813268d78cb
MD5 b9d00380c0947d7ba5fd1efcbb8a7347
SHA1 fa8ef5bce53e46999cdd957da6113b37d04e116d
SHA512 577b235564c77be3050f2aa0e1b6986bcd3d38b09a792a01f943d7d85efccc43bdc9659aaa3b81311bddc1bcce47faf4f3d3eca77d955ee2fe93fa6b095f0c13
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3484_53978694\CRX_INSTALL\manifest.json
Size 1KB
SHA256 f04b41a409ec4bf2f539b6f5334c36b0b14b8bf99746e0386980e4e12202dee8
MD5 3e85528d9e5a25bed8020634a653d296
SHA1 e63ee52c7e4c37559d1ece52216382af67894c01
SHA512 9916c110bb90ed25de689b7981472375b00574ff46b17f9c628501434e4bcf298f6eb5f8c01cf2ce0e12ca068b2f1796eefe676c2a76fbfb42283a41a54bb51d
MD5 SHA1 SHA512

Submit Download

Google Chrome (2).lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome (2).lnk
Size 2KB
SHA256 41a2d6ab63ff251f6578daf3c2a804bf01481b379e6f948a9907e33b25cc3bc3
MD5 8071a935cc017c124adc0f9404660fb5
SHA1 5c83729af5d11edc4bd14ec02caf48cf7c3ef434
SHA512 3a11508b70348c4bab065cf6c68d6920dab2b04272f71001dacfb3bf806ce8700d3613ac135008d0c456fbdad01a23e1c8bde6d8ed11a84a3808d181bbe36ffc
MD5 SHA1 SHA512

Submit Download

U4XPB849BWLZPRA41VHE.temp

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\U4XPB849BWLZPRA41VHE.temp
Size 4KB
SHA256 ab2e8fc7185ec8cb25403197a737b7a7744abeed7d6dc874aa5420b1be2f2197
MD5 13aa269f2da1280ad30887fb2a9bf049
SHA1 02ff611ece3867a5d3d14ea02d2616ebb761ca70
SHA512 06724fd0866ffb972006c95ea9cbcba5fe04b7ae703bbe51c92c7f2cd58c843c886be6c98fb82ddef24cdc54104ea0ae935d40a0e15366f7eb81884b46a2820e
SSDEEP 48:OKe4dOy56nJYsmJ9zUoYYYCdLXuHpixGiHpI+7e4dOy56nJYsmJ9zvYYYXgdLXuB:fE+JUoNYqu8xLH2sE+JvNYXIu8xLm7
MD5 SHA1 SHA512 SSDEEP

Submit Download

ccba5a5986c77e43.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Size 4KB
SHA256 43bec5adf40558d535c1599b813f991c55d06c3a1ef8cdd9771a5c86ef0e4fc9
MD5 d1e744c5295a2f68cb5d304ab91e5958
SHA1 05deeaea6f7320635dad7dafb6938ebb64f9eb1f
SHA512 7b84bb31ba88c018c031e2b9eddb5fef97e23e3775137a2c1f5b7520952b64331ed5dd5b44e454bd6c0b6e472159f4a826fb47bb60f88e8e9594147b9ffe4d2f
SSDEEP 48:D6Ke4dOy56nJYsmJ9zUoYyIdLXuHpixGiHpIz67e4dOy56nJYsmJ9zvYydgdLXuB:3E+JUolAu8xLH2UE+JvldIu8xLm7
MD5 SHA1 SHA512 SSDEEP

Submit Download

0371db49-55f2-426b-b25c-44417d301814.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\0371db49-55f2-426b-b25c-44417d301814.dmp
Size 67KB
SHA256 8b82d61d5119e698c8dbbf449fa394d28026e4b181ac5a189f44dc30123d063b
MD5 1f5273d9628ef590a5842f617167cbdc
SHA1 ad748572ef5d6375fbab9e2ee38296aeda0ea3c7
SHA512 6d1b147a6586aa8acb25bef65ff35aa9234caf76b32026cd22e492bb2c5a6da47e893c5264c4dd0678b0a9b5d51d9afaa90d90146875dc56db58d27855feba76
SSDEEP 768:ViLTw4V19Kc34Dcq56S4cP+12HzW8qeIuIKfkKun:YLU47B4Dcq5McPYX8qeIuIKhun
MD5 SHA1 SHA512 SSDEEP

Submit Download

0371db49-55f2-426b-b25c-44417d301814.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\0371db49-55f2-426b-b25c-44417d301814.extra
Size 1KB
SHA256 0b7f59a32ffe373582697c55352a723739883dd15e7ca1a7d32812599adb5330
MD5 c211ace25dff0903b88a95f398fb1257
SHA1 f0d970fdf5d91cda57260c97ed6455c6ac2bcdb4
SHA512 d327e0fec1f5021271cd01403c14826149a29fbfdd93a8f76cb5f0ba9455bb8be20659af2e9a97aae79637be1e7ce4e63e7c4feca75cb70932ae89e3c07af2cd
MD5 SHA1 SHA512

Submit Download

0371db49-55f2-426b-b25c-44417d301814.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\0371db49-55f2-426b-b25c-44417d301814.extra
Size 3KB
SHA256 385df38272a96622282cfb5e59b43135effab6026c38d4b4aeec92cbef7ff3eb
MD5 a1558f96a2ddac22c05ff1605fc91a2e
SHA1 2246720a594ac08cebdf69f1016a18c168edc4ce
SHA512 abb71ddf76d521e353dacf177f79da17c4e9fb2b81b04037db136dab51dd5b7cc0d9e88237ef5f0020683884dc8040bf344f4c3cbe510071cc98308b0cbf6540
MD5 SHA1 SHA512

Submit Download

1bf8f880-5d3e-4917-83d8-e67570e3a2ee.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\1bf8f880-5d3e-4917-83d8-e67570e3a2ee.dmp
Size 62KB
SHA256 e6570f9f09bb58f06e7304c65349e157a6d69478dda1198d52817ec38250788b
MD5 505051a4ae6e3d350c815257ed86ab1e
SHA1 4b6786109c2bc44b751ccb088b3ca25647fa1553
SHA512 1f559d5c4c64b399cff4701cd851551062c5c026832916310b8a0a2d18f9624a131bd1aa2721c7e635ce199a0338edab874a5e56dfabd8a0ad788f54946acb56
SSDEEP 384:3rbSpUa5JE2eSGlZQcSZAPCfRHdUHNhW8qeIuIKfkKdsdYAnB:3H8L7h2HYGPk2HzW8qeIuIKfkKun
MD5 SHA1 SHA512 SSDEEP

Submit Download

1bf8f880-5d3e-4917-83d8-e67570e3a2ee.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\1bf8f880-5d3e-4917-83d8-e67570e3a2ee.extra
Size 10KB
SHA256 ce73f46bef202bad742c9827f44caa545f5827a8ea4df137b2820c6d6c12db02
MD5 c0d4e8e65ab1d6b29884a48559e8c62b
SHA1 d4aa178185a10a26913983db7c436cc43d4b87fd
SHA512 85bd01070e03afebd4416a88a5e4dcc48ed09b57f6801c8519ecea573b136bd40413750550d6d4378b89efaeb3d4fb672c79684a6ce3c746f56b10f89732cad7
SSDEEP 96:STWCNxTjaY6pw6lF29dt40Rh7CTvBb1d05DjMLlIrLlhTLlaXv7a7utILfcBCqw+:S5NByYb/7WvZ8dLDxsP5wlARfoU
MD5 SHA1 SHA512 SSDEEP

Submit Download

1bf8f880-5d3e-4917-83d8-e67570e3a2ee.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\1bf8f880-5d3e-4917-83d8-e67570e3a2ee.extra
Size 10KB
SHA256 c5c5dfd7a8a4c51ed72cd324815cae9cf459d17caaa19da657096c149955d858
MD5 cb7e7d7d32c967d21c219315379dc3e4
SHA1 dd97b2d2bbec367a09388283353532edf7294528
SHA512 8f0c24f63103797a7cc14bc3648c0e159a8c7c46a8cbf9e5dfac8690cc613dbb2585949a5c409fab00a666eea266c4739f675b9524686c83c28931d27d5d14b4
SSDEEP 192:S5NecFQiR4M4DnQYaVdVxzPXWBHj4T/fKNtaloRfo8bLbKX5:i8cFQiUDW1/WBHj4TmaGA8A
MD5 SHA1 SHA512 SSDEEP

Submit Download

414260aa-7c4e-4e4d-b39f-9aff820e309a.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\414260aa-7c4e-4e4d-b39f-9aff820e309a.dmp
Size 63KB
SHA256 c9e6a78fb44967a6cbefcfa65517f638faea96749a7d9bbb2016fc306ffdfacd
MD5 a487263ab59ff146fed4f7b4a4a0c41c
SHA1 ede6cd1b2a0c896a31cfb2373fdf5d58b0dc601a
SHA512 743372eece7e92a730ff63931d819a838ad0852414c275591ee7e02a3dc8765616146243707d646482728f428722acbd885905a5738790aa5adb5a11fade3d18
SSDEEP 768:EPLbKIWlG4VAR3XDAGzwab2HzW8qeIuIKfkKun:OLWIWlG4+BzACw2X8qeIuIKhun
MD5 SHA1 SHA512 SSDEEP

Submit Download

414260aa-7c4e-4e4d-b39f-9aff820e309a.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\414260aa-7c4e-4e4d-b39f-9aff820e309a.extra
Size 10KB
SHA256 87007922b5e22c51f0470f0c546151142d0f4e298bd6d0c8531a6ca113d04cf7
MD5 e71bbd923a45cfd88a3caa528961562d
SHA1 31a2dc678ef9d5258b97780a3cf0edbee0a27aca
SHA512 24c28c13335e9b3c835d5f26bc4ddcae1efa1f5fd911eaeca743dcabcbb79393801f1f44ecbe2ec044bf6ed3a0da3c24b9976bd945ae0fc3f571b2e28d38a6f8
SSDEEP 96:STWCgl5xTjaY6pw6lF29dt40Rh7CsevBb1d05DjMLlIrLlhTLlaXv7a8utILfcB/:S5gl5ByYb/7uvZ8dLKxsP5wlB/foN
MD5 SHA1 SHA512 SSDEEP

Submit Download

414260aa-7c4e-4e4d-b39f-9aff820e309a.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\414260aa-7c4e-4e4d-b39f-9aff820e309a.extra
Size 10KB
SHA256 f5b322b1c4f5508852ae8cb26fd89ea5a9c71a4b95f4799fa17385f6315247d1
MD5 361a7df4b485fdbd60327f90b2e6197f
SHA1 694974dc23969e00187478a5b2dd3a95813ba008
SHA512 761ca1b579f7a37a38c15886eee3a8651efdf059161d6a6d223779d1b33656f279ceb09d0a2927da639dbb61b6527de3ffe415593702c193fc2324952691dbe2
SSDEEP 192:S5gl5ecFQiR4M4DnQYapdVxzPXWBHW4T/fKNtalZ/foBbLbKX5:igGcFQiUDI1/WBHW4TmaHABA
MD5 SHA1 SHA512 SSDEEP

Submit Download

a4db5e6c-a67d-4e26-90c8-041c6e579666.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\a4db5e6c-a67d-4e26-90c8-041c6e579666.dmp
Size 62KB
SHA256 61668c126eb7cfcb7df21a46519ad7797ee5184f34562e298dee5cd5f5052e49
MD5 0b2b4cf54d8595e174592ef2ad4a0ac0
SHA1 ce7d5856982f10006ed1a5ba4684113a7f0f5a82
SHA512 c863aa4e2c566715404693ca39e8e3ec278c02ae66d110788bd89f742c273e8b4fcffbfb7bd0b0a0adfdc5341a8847f9f2c3d14fe9bcda4660f76151ff6d11ea
SSDEEP 768:7N8TrqP4xCtDHpl0Ty2HzW8qeIuIKfkKun:x8SJ4yX8qeIuIKhun
MD5 SHA1 SHA512 SSDEEP

Submit Download

a4db5e6c-a67d-4e26-90c8-041c6e579666.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\a4db5e6c-a67d-4e26-90c8-041c6e579666.extra
Size 10KB
SHA256 4b0af04badc90fa4c901a139a8731354e819e34aede54601bc1684d91f743470
MD5 a13990f218ebff6c31af7fa21758be9b
SHA1 d9b0cbe2664cc311cdd7e7588332b3674a2bc6b7
SHA512 4ee338d8e8b3b778b822b6dfff846b0546598bdb3eb9294321dd37f359fc574f4e9ad3cc9aef417c61575dda00ad8372d91db64a574f39bdf89e759728d72f71
SSDEEP 96:STWCSxTjaY6pw6lF29dt40Rh7CsevBb1d05DjMLlIrLlhTLlaXv7a/utILfcBCqp:S5SByYb/7uvZ8dLPxsP5wl5ffoT
MD5 SHA1 SHA512 SSDEEP

Submit Download

a4db5e6c-a67d-4e26-90c8-041c6e579666.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\a4db5e6c-a67d-4e26-90c8-041c6e579666.extra
Size 10KB
SHA256 620b71242c8c0b6aab91c13e276fd72316313663e2b29553dcbcf492916e8a82
MD5 057cfff12c1e80c8b9ade2f8009394fb
SHA1 7740bb685ce9747b25d6c9f200b7712634e9054b
SHA512 1ea2f6374ed25a2a09cd2be1c5a0ba0c294db25a2ab8bba5cf6e19ff74129827ce17cdff2981685cb3cec384a1617b0e0cbb90ba759cf2c078b73db43be32aa5
SSDEEP 192:S5SecFQiR4M4DnQYapdVxzPXWBHb4T/fKNtalRffo/bLbKX5:ifcFQiUDI1/WBHb4Tma/A/A
MD5 SHA1 SHA512 SSDEEP

Submit Download

b266cc35-03b2-4df7-a312-2601c35f4140.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\b266cc35-03b2-4df7-a312-2601c35f4140.dmp
Size 64KB
SHA256 426b5afde526e47a36287652bfab41b35389b5f37bb5bf3258eaf9ae5eaad3e9
MD5 594c7be236b545009c81c21bb68c29e4
SHA1 918be4dcb77d40bcb1f23dd12765917ca708d66f
SHA512 f282e58f8596fbf3c1424c6f5088584fa74a110c9b4da2cfdc146ed68a0467282a3a1117d129c2d04a03770d1a06660e8aa366832f1ed68e7006e294171f5716
SSDEEP 384:+aJpFlO6pZOjsWOs+xH2lWjWMEtn2FsNsJ/FdUHNhW8qeIuIKfkKdsdYAnB:+aLFkXs2ojsNsv2HzW8qeIuIKfkKun
MD5 SHA1 SHA512 SSDEEP

Submit Download

b266cc35-03b2-4df7-a312-2601c35f4140.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\b266cc35-03b2-4df7-a312-2601c35f4140.extra
Size 10KB
SHA256 f94b1211291c897bc855f35e21cdcc050d24f9dabce83322ea265e23f4728b7d
MD5 e22c762ce6504610e699b92d9d98e1bf
SHA1 15d4d28b6df12176bf4e641b73802a27bd6def3d
SHA512 e0dd1b889df60e6e991bf8c5680876bf9546aee3f743e97c84d42db0424955a37e1a8967f350850a5caac9a37023d35d727a234f035072878c6f30b52c469120
SSDEEP 96:STWCuxTjaY6pw6lF29dt40Rh7CsevBb1d05DjMLlIrLlhTLlaXv7aHutILfcBCq7:S5uByYb/7uvZ8dLHxsP5wllffol
MD5 SHA1 SHA512 SSDEEP

Submit Download

b266cc35-03b2-4df7-a312-2601c35f4140.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\b266cc35-03b2-4df7-a312-2601c35f4140.extra
Size 10KB
SHA256 39f9828480a0f68a92b2594bd86e07b6fcd6b4b1fdfe8fcd6328cfb7eeae9304
MD5 d01cac7135d459a3483fce7979aa58db
SHA1 f6a47d6861f7e860f7b9a6b7247537dae69c9c6b
SHA512 60f563e19e10f3735102e42a1d8383d352a57f7250ba56ddbbda8f83aba1d513bc1c6f3e3d71094d67559fb76cfe958c1e88aa5ae5e5261e22bf7495d96b7d0f
SSDEEP 192:S5uecFQiR4M4DnQYapdVxzPXWBHt4T/fKNtalNffopbLbKX5:i7cFQiUDI1/WBHt4Tma/ApA
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f12v27nn.default-release\AlternateServices.bin
Size 6KB
SHA256 2ec5a18f8640b944274a7a1f85ab1b88edd4f86adb96cba8fc361cab4be4be5a
MD5 cd60829c2542a576bc42cc8b0bfc237c
SHA1 c2fa81a13404e59d97c481ed5d9c7fb020f4527b
SHA512 1c86713063fd4ac0fdacc3f386b09100102a4a5c7547bcb428646f6a58cb2644f470ad64684139b84944cbb3f2e50bdb12f97b55344d4a6f72ba1bf10619b6d6
SSDEEP 12:9W8gQpB8gQWgQtRGrwn2ZQp1x2ZQMNZQHc495pR5cgrHc46MQphMQSQ0RGrw:QuB1oQkugu1xgRbwBpR5cOHZuhMZpk
MD5 SHA1 SHA512 SSDEEP

Submit Download

compatibility.ini

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f12v27nn.default-release\compatibility.ini
Size 198B
SHA256 252b7fff962848c61092e82a3d87adca163849767713a93ab533bb397f1f53bb
MD5 ce9ef13caa8a74c25157b184aa038475
SHA1 db03a9935d8bb3ce6b120aca98feade536805160
SHA512 0f6f5053e78167ef5cc5fa70ed3a87dd116df0671a590299277a197341bed983e3d77e37ad2c33cd4afe880fab9ed1c7f7502210040617a01f97a81c1e1d4f29
MD5 SHA1 SHA512

Submit Download

store.json.mozlz4.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f12v27nn.default-release\crashes\store.json.mozlz4.tmp
Size 6KB
SHA256 b28affbc197769935a748d70721bb077877664d5f87947b800b512ac03aed0a2
MD5 87311483d65bbf0b20050394057e629f
SHA1 b827cff28f79b904f0424d5488a377d5de272b21
SHA512 1864800ae971e135af22434acfb00461cc3e7199488682e09b25a05e4063b6c6cb29ef2ce5573ea0acca199fbb3dd9cb45d0f2ebee64f7301dc40732be92290a
SSDEEP 192:eka1Me6AP4ZstIQ0wrk3MZlid7q6PSjsE99MlLeScW53qI7:iKSwp9wrkcZlitE0GA3/
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f12v27nn.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 b7fec2d1f087c44264844aaa170f4e7945b001049ac97ce45cb99fc6b007ec46
MD5 74392d7b34f7009f5391f1c962e44158
SHA1 35849fbfa6a141e5b3ee8c6687b8819ae203b2fe
SHA512 217ba19a8e966e346462f01fe285411677cbdc7325a8793642a42014de232507d2412ed68e7cc2d748036ccc89fbd2ae8d7bbea72c628a32bfe5f23bf2ac243b
SSDEEP 192:4Ov5zboHe2ZBpyjFmMkB8kfp1/66Joz0dzgCl6mSSdz:Dbo+2ZBpyj7kB8kfn/66JozQzgC1bd
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f12v27nn.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 f5305d5aec68efd85b60bdc216476e022ad8b7b6cc413675a964faee275cdece
MD5 d4dab13a4e3daab5a7ddb8dfd456a22c
SHA1 c426fe5cea01ff88e7228e1c43ea5c03d23fe8d4
SHA512 6cb72a24e0bd2a80e581fd432f0dc6db5e2dd5d5f9a5c6513491edf700a4df3c9d7a620bc5b4bdc214d8a02e09b26309d4f210dd213d6128fa52e058959cdbd0
SSDEEP 192:7Bpfp1/66Joz0dzgCl6mSSd1Ov5zbo/ZBpyjFmF:7Bpfn/66JozQzgC1bkbo/ZBpyju
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f12v27nn.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 7260d10b54085ea4af3c7da80c631fca8dd85d7ac1ea7143d7bb8047bb839e24
MD5 bd4382a8a611165855fdd7d7f6351847
SHA1 50e471810c49e73b6814d5647a66d182cdb28165
SHA512 511aefff18fb1c5e4fe1e84b31cb6a77f8ed5923b248c079b0a94feffe1eab736cecf542afa8520d3a57e13d778eca871e50911eed733342458fb1bb7017994d
SSDEEP 192:1Ov5zboHSZBpyjFmBffp1/66Joz0dzgCl6mSSd:qboyZBpyjUffn/66JozQzgC1b
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f12v27nn.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 f013e62587f6cb2904b5f05c52c58aba94a36a020dcada9e57472bd27849df70
MD5 33aaba344b8496464813ce47359eb653
SHA1 71bf54d58fbaac0d8666c34b1f22dfb3d347e90a
SHA512 a9ded1bcdee4c736d8490753ac2b188d670df72da2798ee006538474b993756e1ea973a596461f235710949c2b328263f56d2d6e6431500ddef6fdbec67fc83f
SSDEEP 192:7Gfp1/66Joz0dzgCl6mSSd1Ov5zbo/ZBpyjFmF:7Gfn/66JozQzgC1bkbo/ZBpyju
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f12v27nn.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 ee2495639c687301daa2d00bcdff27ae5aa910c96c320d71a922232e0ba74691
MD5 3546f5549a13802389bc919d8cb50910
SHA1 85087f372d9c40ce54c5fc5c4d70d736c702ac5b
SHA512 5f60d0cf806252310a9d5d79750fce26ca3c3925d7e49245d4dc07f09c3a1d64834746dde9bc54413cf3843588d92d3cdf86ae0f8f4c2bcafa3334ac7a7d3234
SSDEEP 192:4Ov5zboHSZBpyjFmBBfp1/66Joz0dzgCl6mSSdz:DboyZBpyjUBfn/66JozQzgC1bd
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f12v27nn.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 1502321a624d2600a6cd21d26e25a1f9bf6e0d004a3ea3c2a603b2cf7e642cc9
MD5 d881a4fbbad589b2628a6e8825db43b2
SHA1 c1b6c5cd0ce80e462bcaceaff28bca9f8c56ff09
SHA512 606c76d7bac32fb742b304b195de592358d074e74bacd63ac8377c54592039d84484f4cc486a5f8318719fb5cb3b65f9f0fc52de2aa3edac434f828c7dc5d8b1
SSDEEP 192:Z3kfp1/66Joz0dzgCl6mSSd+Ov5zbob2bBpyjFm:Z3kfn/66JozQzgC1bvbob2bBpyj
MD5 SHA1 SHA512 SSDEEP

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f12v27nn.default-release\datareporting\glean\events\events
Size 1KB
SHA256 555534c69830db3d59c919e42b7aa703063463bd6542b63f08244b12d2ed147a
MD5 55c905110678280cd70f79cd41f03d1d
SHA1 e62ea4f3a7217454e7e9b2cecd79ea5aa6356db6
SHA512 5d0cc1e32c3d112fea3d5b206365ee5e320c7e9da308c715681a5e8e17440b1ccb2b644bdfe6606a1f47f9fd9578df8696f2ac33717dfbb5fa8e23554b042fb6
MD5 SHA1 SHA512

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f12v27nn.default-release\datareporting\glean\events\events
Size 1KB
SHA256 f6ab0d1ca7101be6935b3cbaac52782564ec604a3d94234fc1af4d2590084592
MD5 8da7cce4709a4d5c8f2ef275c320b797
SHA1 5f94e47268fff7331954e201e067fd2b9520260e
SHA512 07a1ac23ffb90f9ff22ad19afc7149b53b6c53802ed61b152c90db534c1602c159d6a425387b1269567c9c80667e532f12a6b11c7ca77da5dc61564962c3dc43
MD5 SHA1 SHA512

Submit Download

0119fb81-d29d-4a4d-ba34-a1d1c505af78

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f12v27nn.default-release\datareporting\glean\pending_pings\0119fb81-d29d-4a4d-ba34-a1d1c505af78
Size 883B
SHA256 93d64e804c31ee46ee33149bae390764b4b8856d34832c58bcfa2049ffd34b66
MD5 f2f2824a1d8e07195e815f71383deea1
SHA1 247b432401dbe0722a5e9a4babb51a3f94acbd94
SHA512 1e38ba17167d585fdffe5dfb5eb7285c259880fda80150d65c20a5d8be8e6392dc426ecc9c016851c22a3c59f4604ac4188316f5b74bcef9c2d1acfb401a255e
MD5 SHA1 SHA512

Submit Download

0358ce8d-8b52-42dc-a174-b34e698bee3e

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f12v27nn.default-release\datareporting\glean\pending_pings\0358ce8d-8b52-42dc-a174-b34e698bee3e
Size 235B
SHA256 20594b97c51487ae27a4ba8090a15c45015ac428506775fc9d20d47c60b33901
MD5 b90ced34c5a80bd67d62a116fd995bfe
SHA1 0c3a3bacb060a28d2c233b9f948b68a7338ce3dc
SHA512 adfbdb5c55c2b39fd15e466200de75f2f3bebc7692ff1f8cd0dbecf07ca203894ceeaf1d08a3bbb6b182f8010134e7fa5928400ff04f190b3f9720bbe8e36cb0
MD5 SHA1 SHA512

Submit Download

107c8f4a-a54c-484d-b8ae-967463b2c7c4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f12v27nn.default-release\datareporting\glean\pending_pings\107c8f4a-a54c-484d-b8ae-967463b2c7c4
Size 2KB
SHA256 dcacc80cb3595212805460c265b24db0a2bad0fe686789a114517db38ceadedf
MD5 e3a777fceeeafabb684999e75a992001
SHA1 55df96d44f895a11cc5688c636fa3485ce7f49f4
SHA512 0b75158aea0065321708a8eb6480ace57c33a20b2334234543debd4cc6d90d0414b2b31ad0367a0be0bb88e98c4b9cc6dc5c47e74272a885443f89a3a5ea4942
MD5 SHA1 SHA512

Submit Download

239df0dc-daab-43ed-8372-6ef925b78af1

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f12v27nn.default-release\datareporting\glean\pending_pings\239df0dc-daab-43ed-8372-6ef925b78af1
Size 3KB
SHA256 572c5b58a5ac3b89ca7d280b7af0024f1012f550986b9855343640b5b1ab6636
MD5 9bcc0ce73771dfd54875cd88c6929b62
SHA1 85719f773a2408e16a6867ca880dc27c0b84081e
SHA512 f5614dd2669c419d8cfa21ecee689eb5ca5e6e87f279f27d009e0705f806cdae30cf70f45ab3eba0281a9904219a3c6ca3c52aa0094329cc22167e0de2e802c7
MD5 SHA1 SHA512

Submit Download

2eda2efb-e0a0-4834-89b0-7800c8f9c24a

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f12v27nn.default-release\datareporting\glean\pending_pings\2eda2efb-e0a0-4834-89b0-7800c8f9c24a
Size 3KB
SHA256 26588db541c561b5ba9da9967ab2001200e858e8ce1221e9b285a65baa95e98c
MD5 683943d980ed7ec7fda5fe3a8a2f3ec8
SHA1 f13d83f23ccebce3837d1ad57d13b2bbdef46db6
SHA512 0cb1d291e5092f3da72b1871554af3d19215e36783c4b6a8ea11fb2bb81cb605072251f7fb6b0218f924d18e0583f4d2637e049fc4080a024d6713dfb0c68835
MD5 SHA1 SHA512

Submit Download

303ba0f3-a3b9-4201-b87e-547496fb3c58

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f12v27nn.default-release\datareporting\glean\pending_pings\303ba0f3-a3b9-4201-b87e-547496fb3c58
Size 3KB
SHA256 695ebf3cd6f10d6b5428e5ee61c45a20bc1564070092c46c8a681e323071f507
MD5 73b15d0b7d78c02a213063f187f33f5d
SHA1 3d54d42673eaa19b61b112727d1f26a845a937ea
SHA512 630d268363219c0af8fd14d3d8d7fc2fa9526202b124746886934ebaa9f579eb40a1111d6106816c7b3d410cae7d65f9fbc39389c1182e2a44b33f132b829c0c
MD5 SHA1 SHA512

Submit Download

37523a1b-c40b-4cf7-9b9b-f5199601a9c7

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f12v27nn.default-release\datareporting\glean\pending_pings\37523a1b-c40b-4cf7-9b9b-f5199601a9c7
Size 3KB
SHA256 3a3fc5f299535eb81f155e2e22b40d315999ca922d7645b33346dde87fba8e29
MD5 546ee61b091375857a95f04361f8b220
SHA1 d7bff713a00205bfcfe3f06b8295979e2ac4abd8
SHA512 994a8234e2bb570d49cbae5a05daa19a3e0fb1e202190de4c1d88418ed43f9a81b40848c7248176b5fc7b5dbf1b1c973a2c5e7907a4070e591b9593ed251f9cf
MD5 SHA1 SHA512

Submit Download

45613437-f448-4a7e-b7ee-e5ca89bedee6

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f12v27nn.default-release\datareporting\glean\pending_pings\45613437-f448-4a7e-b7ee-e5ca89bedee6
Size 235B
SHA256 f2a02e79aa38aef2a0274e89273a6a94efb6200fe9a24970d73a478350a8d4e0
MD5 5613a26c26ba648e1a5011e5c713d232
SHA1 d5605d90512a26c794ea1431c1eb22984664f0cc
SHA512 e65970c9393c9f64b6050ccdff2bc40ca82676d8e613d032cb3a79458646b1d363410beedf43ce31f0efebee02938bf146aa9665731d67b4e49f7114c171e1a9
MD5 SHA1 SHA512

Submit Download

4ca190dc-4230-4a84-bf11-4c9db83a0603

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f12v27nn.default-release\datareporting\glean\pending_pings\4ca190dc-4230-4a84-bf11-4c9db83a0603
Size 2KB
SHA256 6e0bbbed25589af5c49d7e454bb3f65a22b43a18254f8276b91b535cd6c29e42
MD5 69d75cf6c3aa9b5eebe2d24d5cde57a9
SHA1 135e0b24d7b630a708be699cbb8a18e2607add0c
SHA512 304cfd6571aa9ebc5ddbe7c2297134c6a5e9c1f6bc38ede1c59394a1e8b5540c9eb3bce9be6444e7ef83c84d752de45065f0653391c18449f67bd59cfd72d9f5
MD5 SHA1 SHA512

Submit Download

6641186e-c2a9-40e1-81f3-03411ac12841

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f12v27nn.default-release\datareporting\glean\pending_pings\6641186e-c2a9-40e1-81f3-03411ac12841
Size 3KB
SHA256 f8b27d8abbe13d188963d1c62e0a6016c93c942ed2712fa17276f04a5c1d319b
MD5 88c35c027dadeb532f7785815ae7307e
SHA1 125d6612feb346e0e217284225ff842aa297db33
SHA512 292a2a3db3e72f912938c402acb2e07d03d64b1fa92190cb13da078d2d400a7b776a5ece1e0758775e4377bdf6049299e946ec356a3e2e4df34cadafcd1408c6
MD5 SHA1 SHA512

Submit Download

78a4eb43-55e2-4f4b-868a-bfcac70dbf8e

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f12v27nn.default-release\datareporting\glean\pending_pings\78a4eb43-55e2-4f4b-868a-bfcac70dbf8e
Size 235B
SHA256 1c99eaac3e83e1d5922ba352f00e3aeaee086c17199dade246cbe7ec350799db
MD5 ee3af6fdb4df19edc1a15ec8732342f9
SHA1 39747bed575a74f519c668606a9171cfe1c640c5
SHA512 817f3f68728af5bc285a347992981eb1ff3bccb830289a0caba6425dd2d003676db8fd6222ee6a9185a4b8ce331250a245ac206687d822c91a906fcc9aafddec
MD5 SHA1 SHA512

Submit Download

7b526277-1335-41be-a15e-4838bde9185a

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f12v27nn.default-release\datareporting\glean\pending_pings\7b526277-1335-41be-a15e-4838bde9185a
Size 235B
SHA256 971dff3e0a670e770d77eeb44fc0017a0730019e552cf19bd7f627eb91aed4ac
MD5 a8692c320d30bda30a9884bcc0b7c019
SHA1 1198ff25418f784974e95e1b3581c77cc6f1fd05
SHA512 f820dcc588710ad0f8b6df4ae7394b40429dea3585319001c7e2c544d73070caa2d81edc92d5c9ea9897f01a08fe8b747940876af9f72e29d45f5ac483f7c8a4
MD5 SHA1 SHA512

Submit Download

8e302686-40a0-4dd9-b596-41b9a2f9a9a0

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f12v27nn.default-release\datareporting\glean\pending_pings\8e302686-40a0-4dd9-b596-41b9a2f9a9a0
Size 3KB
SHA256 8f5b6754ab7e860d8c963b08b98139333333b3a0ddf4ba57c4fc0c31f7546245
MD5 3e02a47f931ca29b7938c3bbfcc5cc7b
SHA1 2ac898494c9bf56046af9578f28593de2f55ac1c
SHA512 ff4a0e3cadf475f43c93b6b2c4d8bf65d8184fab34c6d5b2feb61d6f33f936e047cefa90bb253514dbdcf4b7ab9417cd25f71e34226d6ed8da8ae1d86230d17f
MD5 SHA1 SHA512

Submit Download

907df6eb-3206-4218-85a7-4e1fa946cdc0

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f12v27nn.default-release\datareporting\glean\pending_pings\907df6eb-3206-4218-85a7-4e1fa946cdc0
Size 17KB
SHA256 6f96554687f00116066f91654b0123f82524eaccdac4038369317ccab4998be9
MD5 75f5192f7763b3266c504fa1215eb589
SHA1 55b92da263193928f9c2acb1f908a527ff5949fa
SHA512 eb4d550b48d566c874aef1d602013e1b4ce3a1b5a2fbe797b2432fc7cad8db48aae856e298ee5d613c89bf2b5ec4c49dd7e895299869d489eb42b0bb7f3dc0c8
SSDEEP 384:QCPQ0ibRe7xhqw8qnZ7vqY5LO0VUqONqekf:QCPQL+qAOSzOQf
MD5 SHA1 SHA512 SSDEEP

Submit Download

aa0e8068-0470-45eb-a698-ba00f33dadc5

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f12v27nn.default-release\datareporting\glean\pending_pings\aa0e8068-0470-45eb-a698-ba00f33dadc5
Size 3KB
SHA256 b837d9116f5bef7d3ba6094eb4bd308363c0c9b6e7022d4802a43bbf79f5f206
MD5 8bab5ed964b11c8be670d3f423169afd
SHA1 a3ebe25f70170e5a530d25d3223973fdc9f2e9f9
SHA512 b9a32c1435b333fe6a8ee292d3708e0418d0989e5b3a9a4732a9b60630c40bf678254343e11e7f7689fe349775bda6a60f8c83aa0989e1c0fa853bf4b255de05
MD5 SHA1 SHA512

Submit Download

af35c9c0-795f-48fb-be23-4faec4eb19b4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f12v27nn.default-release\datareporting\glean\pending_pings\af35c9c0-795f-48fb-be23-4faec4eb19b4
Size 871B
SHA256 05ec725d70722a1b9d1487d4d9833dcbaf0490db50c3d158270a6148c65e363c
MD5 15b37f84164fc527b7ec7ea3c4a8dd1e
SHA1 6cbd28255ab368aef95094d7fc6402cb25ba710f
SHA512 feb979306c804ec70a4c691d210c64c467761fe2fec4389dd50db8b2a6d287483b3e2b29759d8a0dc8e029de705d7e44fd46534351b6c0810cc1d394d8c8ada8
MD5 SHA1 SHA512

Submit Download

b8e3cfd9-4a8e-4348-9942-e760c3b981d3

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f12v27nn.default-release\datareporting\glean\pending_pings\b8e3cfd9-4a8e-4348-9942-e760c3b981d3
Size 3KB
SHA256 4d5037852d89a33367b2fbd184d47b8c35c7c19b5c8ed2f9728446aa03d8d2f3
MD5 db7048cb19c37bb42f707f1cce418da4
SHA1 5a101828ed63a746e3cf0dafcb6f53221b9e10eb
SHA512 1117191c5aaf594dff72a44142594ba5b97c57d43bd6a43ff564f2d07cd7446d9c9521790e1a1949606577c034f5e9448bca7e6f28d59e4883409901e4cd39b6
MD5 SHA1 SHA512

Submit Download

cd28d9fa-e3f9-4ecf-a1a0-96cd347d1bf1

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f12v27nn.default-release\datareporting\glean\pending_pings\cd28d9fa-e3f9-4ecf-a1a0-96cd347d1bf1
Size 886B
SHA256 831aa69a3e848a0a1a15d39c71701f7f0b716f8adf6f49d10d79c00d707ca9df
MD5 14b1b3a6ef0cfd50430b51d1bf8701d7
SHA1 ebee89a3aa0c85b5dce6156f9e24bd7ac40c8936
SHA512 85163aa1d8825cbc63c7673062ec29f56c1aff9db29b4317c937fbb00a931b1ca92267a1de07642c03ee0a39659813eb317a3122084ebe886c07f2863edafca5
MD5 SHA1 SHA512

Submit Download

cedd73f1-30b6-41ae-81ed-36bbada2d051

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f12v27nn.default-release\datareporting\glean\pending_pings\cedd73f1-30b6-41ae-81ed-36bbada2d051
Size 3KB
SHA256 0b64d48f9e16d723c310dfdf34e834e20c8016049ad3a467538b235a41f29446
MD5 ffc89640b6fd73b5ae7a485efba3e3d1
SHA1 3e75806ec72b759ee85cfcc54bf92e05b1708f3b
SHA512 85afad57f906fc0511b8607c7867ef492e8f112914543647437ed236e6fdb5a616debf51c2dc95a8e31b91add0a53b8226603dfb5e7fcf63de0d04b1173df706
MD5 SHA1 SHA512

Submit Download

ee8cc5ff-4d85-4f35-a03d-292a1beefd60

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f12v27nn.default-release\datareporting\glean\pending_pings\ee8cc5ff-4d85-4f35-a03d-292a1beefd60
Size 886B
SHA256 f8e994003c3b26a83ae7bdc9831e62e5dd045ec4a57797e5c975c7b344d65dbf
MD5 ff07146943966534766570bd16294208
SHA1 e868eabaa40817580808d7ddaeb31ea642b32604
SHA512 f4f4d96d1244121472bfa37971f9a29bea715c7af64982bf2f353548cfac59cbdd4e3dbd3b1310ee1001475848dbe823b44c778f4aad1047cfabc14c3502dd3e
MD5 SHA1 SHA512

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f12v27nn.default-release\prefs-1.js
Size 6KB
SHA256 d871836528fb314e80fff19444d194ab928f5a2d5b35a296110896fb8bf39bcc
MD5 9bd737f64dd516a89231408810ebfb94
SHA1 ffc9ff8085995b09ab33a7761f13cb5afbfa7b7a
SHA512 10b536ad51b897e5774ef15ffb62164833946f1cf88c7bba0621c444a0bf06466adfa749309bf2803c1f25f7e0bbb411ef29341acba4b6a9e7d27ca2dc2bb972
SSDEEP 96:xH6+UTU9qGqgfvKpno1zS/SSlIdv9j7ncH26iBw88H8L4cnpKF:LwRgfvqo+SSj26iBw883
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f12v27nn.default-release\prefs-1.js
Size 6KB
SHA256 45ed4bef6871243f7f0ca1ca2eb734d2e9bea56ae445f3f3e34c9959b7e6968c
MD5 8e9f0e7b93fa3497c192d783cbb4833e
SHA1 654ce6aef48b35f2fb5ca67f88f56d0a98c1ebf9
SHA512 9df10a60d0a7ee0ec9837ce2ad5210c2985df1e41abc5d27081ae2cefad25ae48d29a9bcd558186e4fa1110339e4aa5dec642b6e17b4501da9f76eaf62b26e15
SSDEEP 96:xH6+UTU9qGqgfvKpno1zSySSlIdv9jcncH26iBw88H8L4cnp7HF:LwRgfvqorSSo26iBw88O
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f12v27nn.default-release\prefs.js
Size 6KB
SHA256 387a89433f62f95cfb69018d7056d6f057f5a341b5c75d4d59e8ed5697bd4154
MD5 e05e6819bb363c55b9b1b9e7cb33225e
SHA1 2043f4ba88f0783dce540025a4ce909fc5973d13
SHA512 410eb348d20301b72205a6108e3b6762e44128a0c792712c981628e916a81e827165a725a3b9342315c7d18bb957fb4afb26e81ca76d87f6bfdd4a7c1afb138f
SSDEEP 96:xH6+UTU9qGqgfv141zS/SSlIdv9jcncH26iBw88H8L4cnpKF:LwRgfv14CSSw26iBw883
MD5 SHA1 SHA512 SSDEEP

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f12v27nn.default-release\sessionCheckpoints.json
Size 90B
SHA256 00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2
MD5 c4ab2ee59ca41b6d6a6ea911f35bdc00
SHA1 5942cd6505fc8a9daba403b082067e1cdefdfbc4
SHA512 71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2
MD5 SHA1 SHA512

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f12v27nn.default-release\sessionCheckpoints.json
Size 53B
SHA256 792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da
MD5 ea8b62857dfdbd3d0be7d7e4a954ec9a
SHA1 b43bc4b3ea206a02ef8f63d5bfad0c96bf2a3b2a
SHA512 076ee83534f42563046d25086166f82e1a3ec61840c113aec67abe2d8195daa247d827d0c54e7e8f8a1bbf2d082a3763577587e84342ec160ff97905243e6d19
MD5 SHA1 SHA512

Submit Download

SecuriteInfo.com.Win32.MalwareX-gen.30848.26229.exe

Path C:\Users\Admin\AppData\Roaming\SecuriteInfo.com.Win32.MalwareX-gen.30848.26229.exe
Size 1.4MB
SHA256 fa086327bf7fa3957e03d5ffcf43fc926aa47fd24b96b479e29bfbccf3becc07
MD5 11d3d98a4476aa70571df8a619f696e6
SHA1 0b01a3b3ba179a220e83522d7e6d7524e7a91946
SHA512 2e0180f9e460374c92d90d23150ad1eb888b27dfc83970aadd0451c98e117c9fd06c5c77926aa008b86b5fa4aba54fb6aaea63cdc356c7f89a09de7171fa7df3
SSDEEP 24576:npcpvDq4URpr8IEiYdoGMwVPbblGHLCZxEM795ccE0SED90TsXD:uO4UR+iY6Nw9bhGHWzDJfE0NgYD
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Windows\SystemTemp\Crashpad\settings.dat
Size 40B
SHA256 1de90c6860036250ba6d87354d773c2ef1bfab6e17836442c0ba61d4ccefa96f
MD5 bc93078169d8ef482961e17a2eb33b0c
SHA1 1b2693ab839a17b08841f7c3a5a9b71124429f67
SHA512 917eb560d79cee45f09d5dc84e2dd29771a9f35eac1e83bdea36868a6b2bb9f9b982e46ab2cb740f48188c37224db985c6addf6a4905a9da0a61ba0ec4ec88c5
MD5 SHA1 SHA512

Submit Download

chrome_installer.log

Path C:\Windows\SystemTemp\chrome_installer.log
Size 7KB
SHA256 e14634fa06928a40a89206773d26724a2256f87fa3dbef97028919bbb9e192f8
MD5 66d50ff2232264cb0fbff204c0701518
SHA1 db1a56234abac6473fedc25598b419ebb7836dbe
SHA512 4e10550bdd95641b4dc98735b3e17ff45ba7abc32e1d4b0dd176ef4440770497118f7befa3a462bffa61cc0fd56e2682fdf0e88bb5cca74a95e0c57b7f43d463
SSDEEP 96:yhZw4cmkbbA/wK3lK3IZmEAAL4wK2ZK25R57LEPMwK3cK3j:+ZkpbDiPiATv3YP7X2
MD5 SHA1 SHA512 SSDEEP

Submit Download

msedge_installer.log

Path C:\Windows\SystemTemp\msedge_installer.log
Size 115KB
SHA256 25db511487b68f82f888d4ae44b7caa0195b2548bd6cb98732bdd41dd3ef3acf
MD5 b53377c4aa669ff332f3976f99b6fe2a
SHA1 4115016b4009baca5df5cd64109d52f9c1a0b165
SHA512 5b1e6cbff6faeab1e4b67ab9967550692a853b3174de3e702435f58f383137673c544018e105770991a38542aaf42d9aa6db7ce261197134b016f653199a2e5f
SSDEEP 3072:LzgGEK3X410D5OQM4P/ee0pilwWjJVYmOs40t:LzgGJ5OQM4PKpilnjJVYmOs40t
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/940-3864-0x0000000000290000-0x0000000000291000-memory.dmp

Download

memory/2188-3876-0x00000206F5260000-0x00000206F53D4000-memory.dmp

Download

memory/2188-3874-0x0000000000AB0000-0x0000000000AB1000-memory.dmp

Download

memory/2956-1908-0x0000000000710000-0x0000000000711000-memory.dmp

Download

memory/3152-3034-0x0000000000D50000-0x0000000000D51000-memory.dmp

Download

memory/3156-6-0x00000000050B0000-0x00000000050C0000-memory.dmp

Download

memory/3156-7-0x00000000069A0000-0x0000000006AA2000-memory.dmp

Download

memory/3156-1-0x00000000053A0000-0x0000000005946000-memory.dmp

Download

memory/3156-5-0x0000000005380000-0x0000000005392000-memory.dmp

Download

memory/3156-2-0x0000000004E90000-0x0000000004F22000-memory.dmp

Download

memory/3156-3-0x00000000050B0000-0x00000000050C0000-memory.dmp

Download

memory/3156-8-0x0000000009050000-0x00000000090EC000-memory.dmp

Download

memory/3156-4-0x0000000004E80000-0x0000000004E8A000-memory.dmp

Download

memory/3156-0-0x0000000000250000-0x00000000003C4000-memory.dmp

Download

memory/4408-22-0x0000000005600000-0x0000000005612000-memory.dmp

Download

memory/4408-21-0x00000000054D0000-0x00000000054E0000-memory.dmp

Download

memory/4408-893-0x00000000054D0000-0x00000000054E0000-memory.dmp

Download

memory/4608-1562-0x0000024B755E0000-0x0000024B75754000-memory.dmp

Download

memory/4740-1133-0x000001D8A1C00000-0x000001D8A1D74000-memory.dmp

Download

memory/4980-2038-0x000001CCED400000-0x000001CCED574000-memory.dmp

Download

memory/5016-384-0x0000000000D30000-0x0000000000D31000-memory.dmp

Download

memory/5044-97-0x000002844FBD0000-0x000002844FD44000-memory.dmp

Download

memory/5172-3112-0x00000000006A0000-0x00000000006A1000-memory.dmp

Download

memory/5464-392-0x0000000000190000-0x0000000000191000-memory.dmp

Download

memory/5800-25-0x0000000006100000-0x0000000006150000-memory.dmp

Download

memory/5800-3935-0x0000000006E00000-0x0000000007157000-memory.dmp

Download

memory/5800-12-0x0000000005DE0000-0x0000000005E46000-memory.dmp

Download

memory/5800-3965-0x0000000008100000-0x0000000008138000-memory.dmp

Download

memory/5800-17-0x0000000005F50000-0x0000000006002000-memory.dmp

Download

memory/5800-27-0x0000000006460000-0x000000000647E000-memory.dmp

Download

memory/5800-24-0x0000000006080000-0x00000000060F6000-memory.dmp

Download

memory/5800-476-0x0000000005200000-0x0000000005210000-memory.dmp

Download

memory/5800-11-0x0000000005200000-0x0000000005210000-memory.dmp

Download

memory/5800-9-0x0000000000400000-0x00000000004BE000-memory.dmp

Download

memory/5800-26-0x00000000068D0000-0x0000000006DFC000-memory.dmp

Download

memory/5800-3934-0x0000000006850000-0x0000000006872000-memory.dmp

Download

memory/5800-23-0x00000000061D0000-0x0000000006392000-memory.dmp

Download

memory/6716-3126-0x0000000000D90000-0x0000000000D91000-memory.dmp

Download