phantom_stealer | bc1dc392e02bfa41b619b2af7a6f5dc3c30d3d0e2c8659ddf597a6db39171396

Analysis

max time kernel
150s
max time network
92s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
06/03/2026, 15:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bc1dc392e02bfa41b619b2af7a6f5dc3c30d3d0e2c8659ddf597a6db39171396.exe
Size 1.5MB
Sample260306-sss48abv4y
SHA256 bc1dc392e02bfa41b619b2af7a6f5dc3c30d3d0e2c8659ddf597a6db39171396
MD5 201ba00a05dedcbbc1e4a37538fe1e5e
SHA1 321b1d216c750ddbfc2d54c7dbdb87b51fc9d92f
SHA512 bae500e019f7260e839fa24f6cd5bff03db67342fda414f04bd728138dc7ccaf6f817e294d7acd7d7e3ebeb9692202ee25eeba4226ae89da5a6db206e99ad0c9
SSDEEP 24576:9ajYc6edu/L9qZKi5bpFjcGPXv/Rfa3xdlV0fAGKXiQVGjTWXJdmw:9aj7I5i5VFjcUX+HVE8XAjOTmw
TLSH
T1EB6523496786D813E4A523741972F2B0177D2EDEB811D3078FFCEDEBB9A2A559C04283
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

collection discovery phantom_stealer persistence privilege_escalation spyware stealer

Malware Config

Extracted

Family

phantom_stealer

Version

v3.5.0

Credentials

Protocol
smtp
Host
mail.azarakhshbrick.com
Port
587
Username
[email protected]
Password
Nr5mYgvbh
Email to
[email protected]

Mutex

83RDZ9AN61Y115SJGC8Z

Attributes

anti_analysis
0
cb_enables_ssl
0
debug
0
keylogger
0
start_delay
0
startup
0

Signatures

Detects PhantomStealer written in C# 1 IoCs

resource	yara_rule
behavioral2/memory/4016-15-0x0000000000400000-0x00000000004BE000-memory.dmp	family_phantomstealer

PhantomStealer
Phantom Stealer is a stealer written in C#, forked from the Stealerium family.
stealer phantom_stealer
Phantom_stealer family
phantom_stealer

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\xvsejxpevNGf.lnk	bc1dc392e02bfa41b619b2af7a6f5dc3c30d3d0e2c8659ddf597a6db39171396.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	bc1dc392e02bfa41b619b2af7a6f5dc3c30d3d0e2c8659ddf597a6db39171396.exe
Key opened	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	bc1dc392e02bfa41b619b2af7a6f5dc3c30d3d0e2c8659ddf597a6db39171396.exe
Key opened	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	bc1dc392e02bfa41b619b2af7a6f5dc3c30d3d0e2c8659ddf597a6db39171396.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
31	icanhazip.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4644 set thread context of 4016	4644	bc1dc392e02bfa41b619b2af7a6f5dc3c30d3d0e2c8659ddf597a6db39171396.exe	79

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\deba6262-7794-4028-b6af-da3843301a7e.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\4292_13417284265292990_4292.pma	setup.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\a21f4ee0-0651-45eb-b46f-710a0004dd6f.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\4008_13417284265352245_4008.pma	setup.exe

Drops file in Windows directory 24 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\metadata	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\chrome_installer.log	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\metadata	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\chrome_installer.log	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\metadata	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp	setup.exe
File opened for modification	C:\Windows\SystemTemp\msedge_installer.log	setup.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\settings.dat	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\msedge_installer.log	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\metadata	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\settings.dat	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat	setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bc1dc392e02bfa41b619b2af7a6f5dc3c30d3d0e2c8659ddf597a6db39171396.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bc1dc392e02bfa41b619b2af7a6f5dc3c30d3d0e2c8659ddf597a6db39171396.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
5636	cmd.exe
3808	netsh.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2208	chrome.exe
3740	msedge.exe

Checks processor information in registry 2 TTPs 20 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	bc1dc392e02bfa41b619b2af7a6f5dc3c30d3d0e2c8659ddf597a6db39171396.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	bc1dc392e02bfa41b619b2af7a6f5dc3c30d3d0e2c8659ddf597a6db39171396.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134172842513890796"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	chrmstp.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3119821332-640943685-2562343641-1000\{F7A16596-1D3F-4D0C-B7E5-6C12C70E89D0}	msedge.exe

Suspicious behavior: EnumeratesProcesses 47 IoCs

pid	Process
4644	bc1dc392e02bfa41b619b2af7a6f5dc3c30d3d0e2c8659ddf597a6db39171396.exe
4644	bc1dc392e02bfa41b619b2af7a6f5dc3c30d3d0e2c8659ddf597a6db39171396.exe
892	powershell.exe
892	powershell.exe
4016	bc1dc392e02bfa41b619b2af7a6f5dc3c30d3d0e2c8659ddf597a6db39171396.exe
4016	bc1dc392e02bfa41b619b2af7a6f5dc3c30d3d0e2c8659ddf597a6db39171396.exe
1996	chrome.exe
1996	chrome.exe
4016	bc1dc392e02bfa41b619b2af7a6f5dc3c30d3d0e2c8659ddf597a6db39171396.exe
4016	bc1dc392e02bfa41b619b2af7a6f5dc3c30d3d0e2c8659ddf597a6db39171396.exe
4016	bc1dc392e02bfa41b619b2af7a6f5dc3c30d3d0e2c8659ddf597a6db39171396.exe
4016	bc1dc392e02bfa41b619b2af7a6f5dc3c30d3d0e2c8659ddf597a6db39171396.exe
4016	bc1dc392e02bfa41b619b2af7a6f5dc3c30d3d0e2c8659ddf597a6db39171396.exe
4016	bc1dc392e02bfa41b619b2af7a6f5dc3c30d3d0e2c8659ddf597a6db39171396.exe
4016	bc1dc392e02bfa41b619b2af7a6f5dc3c30d3d0e2c8659ddf597a6db39171396.exe
4016	bc1dc392e02bfa41b619b2af7a6f5dc3c30d3d0e2c8659ddf597a6db39171396.exe
4016	bc1dc392e02bfa41b619b2af7a6f5dc3c30d3d0e2c8659ddf597a6db39171396.exe
4016	bc1dc392e02bfa41b619b2af7a6f5dc3c30d3d0e2c8659ddf597a6db39171396.exe
5648	firefox.exe
5648	firefox.exe
5648	firefox.exe
5648	firefox.exe
5648	firefox.exe
5648	firefox.exe
5648	firefox.exe
5648	firefox.exe
5648	firefox.exe
5648	firefox.exe
5648	firefox.exe
5648	firefox.exe
5648	firefox.exe
5648	firefox.exe
5648	firefox.exe
5648	firefox.exe
5648	firefox.exe
5648	firefox.exe
5648	firefox.exe
5648	firefox.exe
4016	bc1dc392e02bfa41b619b2af7a6f5dc3c30d3d0e2c8659ddf597a6db39171396.exe
4016	bc1dc392e02bfa41b619b2af7a6f5dc3c30d3d0e2c8659ddf597a6db39171396.exe
4016	bc1dc392e02bfa41b619b2af7a6f5dc3c30d3d0e2c8659ddf597a6db39171396.exe
4016	bc1dc392e02bfa41b619b2af7a6f5dc3c30d3d0e2c8659ddf597a6db39171396.exe
4016	bc1dc392e02bfa41b619b2af7a6f5dc3c30d3d0e2c8659ddf597a6db39171396.exe
4016	bc1dc392e02bfa41b619b2af7a6f5dc3c30d3d0e2c8659ddf597a6db39171396.exe
4016	bc1dc392e02bfa41b619b2af7a6f5dc3c30d3d0e2c8659ddf597a6db39171396.exe
4016	bc1dc392e02bfa41b619b2af7a6f5dc3c30d3d0e2c8659ddf597a6db39171396.exe
4016	bc1dc392e02bfa41b619b2af7a6f5dc3c30d3d0e2c8659ddf597a6db39171396.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: SeDebugPrivilege	4644	bc1dc392e02bfa41b619b2af7a6f5dc3c30d3d0e2c8659ddf597a6db39171396.exe
Token: SeDebugPrivilege	4016	bc1dc392e02bfa41b619b2af7a6f5dc3c30d3d0e2c8659ddf597a6db39171396.exe
Token: SeDebugPrivilege	892	powershell.exe
Token: SeShutdownPrivilege	1996	chrome.exe
Token: SeCreatePagefilePrivilege	1996	chrome.exe
Token: SeShutdownPrivilege	1996	chrome.exe
Token: SeCreatePagefilePrivilege	1996	chrome.exe
Token: SeShutdownPrivilege	1996	chrome.exe
Token: SeCreatePagefilePrivilege	1996	chrome.exe
Token: SeShutdownPrivilege	1996	chrome.exe
Token: SeCreatePagefilePrivilege	1996	chrome.exe
Token: SeShutdownPrivilege	1996	chrome.exe
Token: SeCreatePagefilePrivilege	1996	chrome.exe

Suspicious use of FindShellTrayWindow 12 IoCs

pid	Process
1996	chrome.exe
1996	chrome.exe
1164	chrmstp.exe
5648	firefox.exe
5648	firefox.exe
5648	firefox.exe
5648	firefox.exe
5648	firefox.exe
5648	firefox.exe
5648	firefox.exe
5648	firefox.exe
1524	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5648	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4644 wrote to memory of 4016	4644	bc1dc392e02bfa41b619b2af7a6f5dc3c30d3d0e2c8659ddf597a6db39171396.exe	79
PID 4644 wrote to memory of 4016	4644	bc1dc392e02bfa41b619b2af7a6f5dc3c30d3d0e2c8659ddf597a6db39171396.exe	79
PID 4644 wrote to memory of 4016	4644	bc1dc392e02bfa41b619b2af7a6f5dc3c30d3d0e2c8659ddf597a6db39171396.exe	79
PID 4644 wrote to memory of 4016	4644	bc1dc392e02bfa41b619b2af7a6f5dc3c30d3d0e2c8659ddf597a6db39171396.exe	79
PID 4644 wrote to memory of 4016	4644	bc1dc392e02bfa41b619b2af7a6f5dc3c30d3d0e2c8659ddf597a6db39171396.exe	79
PID 4016 wrote to memory of 1996	4016	bc1dc392e02bfa41b619b2af7a6f5dc3c30d3d0e2c8659ddf597a6db39171396.exe	83
PID 1996 wrote to memory of 3772	1996	chrome.exe	84
PID 1996 wrote to memory of 4712	1996	chrome.exe	85
PID 1996 wrote to memory of 2208	1996	chrome.exe	86
PID 1996 wrote to memory of 1384	1996	chrome.exe	87
PID 4016 wrote to memory of 4712	4016	bc1dc392e02bfa41b619b2af7a6f5dc3c30d3d0e2c8659ddf597a6db39171396.exe	85
PID 4016 wrote to memory of 4712	4016	bc1dc392e02bfa41b619b2af7a6f5dc3c30d3d0e2c8659ddf597a6db39171396.exe	85
PID 1996 wrote to memory of 3964	1996	chrome.exe	88
PID 1996 wrote to memory of 1728	1996	chrome.exe	89
PID 1996 wrote to memory of 4248	1996	chrome.exe	90
PID 1996 wrote to memory of 3076	1996	chrome.exe	91
PID 4016 wrote to memory of 1996	4016	bc1dc392e02bfa41b619b2af7a6f5dc3c30d3d0e2c8659ddf597a6db39171396.exe	83
PID 4016 wrote to memory of 1996	4016	bc1dc392e02bfa41b619b2af7a6f5dc3c30d3d0e2c8659ddf597a6db39171396.exe	83
PID 4016 wrote to memory of 2208	4016	bc1dc392e02bfa41b619b2af7a6f5dc3c30d3d0e2c8659ddf597a6db39171396.exe	86
PID 4016 wrote to memory of 2208	4016	bc1dc392e02bfa41b619b2af7a6f5dc3c30d3d0e2c8659ddf597a6db39171396.exe	86
PID 1996 wrote to memory of 3828	1996	chrome.exe	92
PID 4016 wrote to memory of 3772	4016	bc1dc392e02bfa41b619b2af7a6f5dc3c30d3d0e2c8659ddf597a6db39171396.exe	84
PID 4016 wrote to memory of 3772	4016	bc1dc392e02bfa41b619b2af7a6f5dc3c30d3d0e2c8659ddf597a6db39171396.exe	84
PID 4016 wrote to memory of 1384	4016	bc1dc392e02bfa41b619b2af7a6f5dc3c30d3d0e2c8659ddf597a6db39171396.exe	87
PID 4016 wrote to memory of 1384	4016	bc1dc392e02bfa41b619b2af7a6f5dc3c30d3d0e2c8659ddf597a6db39171396.exe	87
PID 1996 wrote to memory of 3680	1996	chrome.exe	93
PID 4016 wrote to memory of 4712	4016	bc1dc392e02bfa41b619b2af7a6f5dc3c30d3d0e2c8659ddf597a6db39171396.exe	85
PID 4016 wrote to memory of 4712	4016	bc1dc392e02bfa41b619b2af7a6f5dc3c30d3d0e2c8659ddf597a6db39171396.exe	85
PID 4016 wrote to memory of 3076	4016	bc1dc392e02bfa41b619b2af7a6f5dc3c30d3d0e2c8659ddf597a6db39171396.exe	91
PID 4016 wrote to memory of 3076	4016	bc1dc392e02bfa41b619b2af7a6f5dc3c30d3d0e2c8659ddf597a6db39171396.exe	91
PID 4016 wrote to memory of 1996	4016	bc1dc392e02bfa41b619b2af7a6f5dc3c30d3d0e2c8659ddf597a6db39171396.exe	83
PID 4016 wrote to memory of 1996	4016	bc1dc392e02bfa41b619b2af7a6f5dc3c30d3d0e2c8659ddf597a6db39171396.exe	83
PID 1996 wrote to memory of 5108	1996	chrome.exe	94
PID 4016 wrote to memory of 3680	4016	bc1dc392e02bfa41b619b2af7a6f5dc3c30d3d0e2c8659ddf597a6db39171396.exe	93
PID 4016 wrote to memory of 3680	4016	bc1dc392e02bfa41b619b2af7a6f5dc3c30d3d0e2c8659ddf597a6db39171396.exe	93
PID 4016 wrote to memory of 4248	4016	bc1dc392e02bfa41b619b2af7a6f5dc3c30d3d0e2c8659ddf597a6db39171396.exe	90
PID 4016 wrote to memory of 4248	4016	bc1dc392e02bfa41b619b2af7a6f5dc3c30d3d0e2c8659ddf597a6db39171396.exe	90
PID 4016 wrote to memory of 3828	4016	bc1dc392e02bfa41b619b2af7a6f5dc3c30d3d0e2c8659ddf597a6db39171396.exe	92
PID 4016 wrote to memory of 3828	4016	bc1dc392e02bfa41b619b2af7a6f5dc3c30d3d0e2c8659ddf597a6db39171396.exe	92
PID 4016 wrote to memory of 1728	4016	bc1dc392e02bfa41b619b2af7a6f5dc3c30d3d0e2c8659ddf597a6db39171396.exe	89
PID 4016 wrote to memory of 1728	4016	bc1dc392e02bfa41b619b2af7a6f5dc3c30d3d0e2c8659ddf597a6db39171396.exe	89
PID 4016 wrote to memory of 2208	4016	bc1dc392e02bfa41b619b2af7a6f5dc3c30d3d0e2c8659ddf597a6db39171396.exe	86
PID 4016 wrote to memory of 2208	4016	bc1dc392e02bfa41b619b2af7a6f5dc3c30d3d0e2c8659ddf597a6db39171396.exe	86
PID 4016 wrote to memory of 3772	4016	bc1dc392e02bfa41b619b2af7a6f5dc3c30d3d0e2c8659ddf597a6db39171396.exe	84
PID 4016 wrote to memory of 3772	4016	bc1dc392e02bfa41b619b2af7a6f5dc3c30d3d0e2c8659ddf597a6db39171396.exe	84
PID 4016 wrote to memory of 1384	4016	bc1dc392e02bfa41b619b2af7a6f5dc3c30d3d0e2c8659ddf597a6db39171396.exe	87
PID 4016 wrote to memory of 1384	4016	bc1dc392e02bfa41b619b2af7a6f5dc3c30d3d0e2c8659ddf597a6db39171396.exe	87
PID 4016 wrote to memory of 4712	4016	bc1dc392e02bfa41b619b2af7a6f5dc3c30d3d0e2c8659ddf597a6db39171396.exe	85
PID 4016 wrote to memory of 4712	4016	bc1dc392e02bfa41b619b2af7a6f5dc3c30d3d0e2c8659ddf597a6db39171396.exe	85
PID 4016 wrote to memory of 3076	4016	bc1dc392e02bfa41b619b2af7a6f5dc3c30d3d0e2c8659ddf597a6db39171396.exe	91
PID 4016 wrote to memory of 3076	4016	bc1dc392e02bfa41b619b2af7a6f5dc3c30d3d0e2c8659ddf597a6db39171396.exe	91
PID 4016 wrote to memory of 1996	4016	bc1dc392e02bfa41b619b2af7a6f5dc3c30d3d0e2c8659ddf597a6db39171396.exe	83
PID 4016 wrote to memory of 1996	4016	bc1dc392e02bfa41b619b2af7a6f5dc3c30d3d0e2c8659ddf597a6db39171396.exe	83
PID 4016 wrote to memory of 3680	4016	bc1dc392e02bfa41b619b2af7a6f5dc3c30d3d0e2c8659ddf597a6db39171396.exe	93
PID 4016 wrote to memory of 3680	4016	bc1dc392e02bfa41b619b2af7a6f5dc3c30d3d0e2c8659ddf597a6db39171396.exe	93
PID 4016 wrote to memory of 4248	4016	bc1dc392e02bfa41b619b2af7a6f5dc3c30d3d0e2c8659ddf597a6db39171396.exe	90
PID 4016 wrote to memory of 4248	4016	bc1dc392e02bfa41b619b2af7a6f5dc3c30d3d0e2c8659ddf597a6db39171396.exe	90
PID 4016 wrote to memory of 3828	4016	bc1dc392e02bfa41b619b2af7a6f5dc3c30d3d0e2c8659ddf597a6db39171396.exe	92
PID 4016 wrote to memory of 3828	4016	bc1dc392e02bfa41b619b2af7a6f5dc3c30d3d0e2c8659ddf597a6db39171396.exe	92
PID 4016 wrote to memory of 1728	4016	bc1dc392e02bfa41b619b2af7a6f5dc3c30d3d0e2c8659ddf597a6db39171396.exe	89
PID 4016 wrote to memory of 1728	4016	bc1dc392e02bfa41b619b2af7a6f5dc3c30d3d0e2c8659ddf597a6db39171396.exe	89
PID 4016 wrote to memory of 2208	4016	bc1dc392e02bfa41b619b2af7a6f5dc3c30d3d0e2c8659ddf597a6db39171396.exe	86
PID 4016 wrote to memory of 2208	4016	bc1dc392e02bfa41b619b2af7a6f5dc3c30d3d0e2c8659ddf597a6db39171396.exe	86
PID 4016 wrote to memory of 3772	4016	bc1dc392e02bfa41b619b2af7a6f5dc3c30d3d0e2c8659ddf597a6db39171396.exe	84

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	bc1dc392e02bfa41b619b2af7a6f5dc3c30d3d0e2c8659ddf597a6db39171396.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	bc1dc392e02bfa41b619b2af7a6f5dc3c30d3d0e2c8659ddf597a6db39171396.exe

C:\Users\Admin\AppData\Local\Temp\bc1dc392e02bfa41b619b2af7a6f5dc3c30d3d0e2c8659ddf597a6db39171396.exe
"C:\Users\Admin\AppData\Local\Temp\bc1dc392e02bfa41b619b2af7a6f5dc3c30d3d0e2c8659ddf597a6db39171396.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4644
- C:\Users\Admin\AppData\Local\Temp\bc1dc392e02bfa41b619b2af7a6f5dc3c30d3d0e2c8659ddf597a6db39171396.exe
  "C:\Users\Admin\AppData\Local\Temp\bc1dc392e02bfa41b619b2af7a6f5dc3c30d3d0e2c8659ddf597a6db39171396.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - outlook_office_path
  - outlook_win_path
  PID:4016
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ccnx5ezh.k5z"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1996
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\ccnx5ezh.k5z /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\ccnx5ezh.k5z\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\ccnx5ezh.k5z --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x104,0x108,0x10c,0x80,0x110,0x7ff8e224c728,0x7ff8e224c734,0x7ff8e224c740
      4⤵
      PID:3772
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ccnx5ezh.k5z" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1580,i,14513556130766095655,11901269559200523581,262144 --field-trial-handle=1936,i,18100475749112504708,17125821915601898621,262144 --variations-seed-version --mojo-platform-channel-handle=1932 /prefetch:2
      4⤵
      PID:4712
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ccnx5ezh.k5z" --force-high-res-timeticks=disabled --metrics-shmem-handle=2020,i,10300749469151017437,16143296157538228609,524288 --field-trial-handle=1936,i,18100475749112504708,17125821915601898621,262144 --variations-seed-version --mojo-platform-channel-handle=2028 /prefetch:11
      4⤵
      System Time Discovery
      PID:2208
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ccnx5ezh.k5z" --force-high-res-timeticks=disabled --metrics-shmem-handle=2160,i,1541425606541849730,1466287873047725826,524288 --field-trial-handle=1936,i,18100475749112504708,17125821915601898621,262144 --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:13
      4⤵
      PID:1384
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ccnx5ezh.k5z" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2904,i,12411461602206835951,12371249026785578632,2097152 --field-trial-handle=1936,i,18100475749112504708,17125821915601898621,262144 --variations-seed-version --mojo-platform-channel-handle=2912 /prefetch:1
      4⤵
      PID:3964
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ccnx5ezh.k5z" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2916,i,16050911910956235145,10282136930171448801,2097152 --field-trial-handle=1936,i,18100475749112504708,17125821915601898621,262144 --variations-seed-version --mojo-platform-channel-handle=2920 /prefetch:1
      4⤵
      PID:1728
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ccnx5ezh.k5z" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3124,i,10502505452431675264,9071874422928462392,2097152 --field-trial-handle=1936,i,18100475749112504708,17125821915601898621,262144 --variations-seed-version --mojo-platform-channel-handle=3136 /prefetch:1
      4⤵
      PID:4248
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ccnx5ezh.k5z" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3148,i,16389849648533152835,5882760039724362573,2097152 --field-trial-handle=1936,i,18100475749112504708,17125821915601898621,262144 --variations-seed-version --mojo-platform-channel-handle=2768 /prefetch:9
      4⤵
      PID:3076
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ccnx5ezh.k5z" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4008,i,596594567143221893,4182934675625178048,2097152 --field-trial-handle=1936,i,18100475749112504708,17125821915601898621,262144 --variations-seed-version --mojo-platform-channel-handle=4040 /prefetch:1
      4⤵
      PID:3828
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ccnx5ezh.k5z" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4352,i,6264744455780806742,9206681745000634861,2097152 --field-trial-handle=1936,i,18100475749112504708,17125821915601898621,262144 --variations-seed-version --mojo-platform-channel-handle=4368 /prefetch:9
      4⤵
      PID:3680
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ccnx5ezh.k5z" --force-high-res-timeticks=disabled --metrics-shmem-handle=4444,i,4789158199774171217,7779070032149349701,524288 --field-trial-handle=1936,i,18100475749112504708,17125821915601898621,262144 --variations-seed-version --mojo-platform-channel-handle=4456 /prefetch:14
      4⤵
      PID:5108
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ccnx5ezh.k5z" --force-high-res-timeticks=disabled --metrics-shmem-handle=5044,i,15953399619709049284,1034766740254110078,524288 --field-trial-handle=1936,i,18100475749112504708,17125821915601898621,262144 --variations-seed-version --mojo-platform-channel-handle=5052 /prefetch:14
      4⤵
      PID:3872
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ccnx5ezh.k5z" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5056,i,8630702220655971984,399279614846685665,2097152 --field-trial-handle=1936,i,18100475749112504708,17125821915601898621,262144 --variations-seed-version --mojo-platform-channel-handle=5080 /prefetch:1
      4⤵
      PID:3808
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ccnx5ezh.k5z" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5124,i,3350239570496091906,16998984122332419596,2097152 --field-trial-handle=1936,i,18100475749112504708,17125821915601898621,262144 --variations-seed-version --mojo-platform-channel-handle=5116 /prefetch:1
      4⤵
      PID:5060
  - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
      4⤵
      Drops file in Windows directory
      PID:4636
    - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x244,0x248,0x24c,0x220,0x250,0x7ff7461e55a0,0x7ff7461e55ac,0x7ff7461e55b8
        5⤵
        Drops file in Windows directory
        
        PID:1052
    - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\initial_preferences" --create-shortcuts=1 --install-level=0
        5⤵
        Drops file in Windows directory
        Modifies registry class
        Suspicious use of FindShellTrayWindow
        
        PID:1164
      - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x244,0x248,0x24c,0x220,0x250,0x7ff7461e55a0,0x7ff7461e55ac,0x7ff7461e55b8
        6⤵
        Drops file in Windows directory
        
        PID:3020
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ccnx5ezh.k5z" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5164,i,14081492990389132113,1184952445582500172,2097152 --field-trial-handle=1936,i,18100475749112504708,17125821915601898621,262144 --variations-seed-version --mojo-platform-channel-handle=5080 /prefetch:1
      4⤵
      PID:3732
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ccnx5ezh.k5z" --force-high-res-timeticks=disabled --metrics-shmem-handle=5260,i,13676831111959427269,6872436725557902989,524288 --field-trial-handle=1936,i,18100475749112504708,17125821915601898621,262144 --variations-seed-version --mojo-platform-channel-handle=5316 /prefetch:14
      4⤵
      PID:2412
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ccnx5ezh.k5z" --force-high-res-timeticks=disabled --metrics-shmem-handle=5232,i,219281567112328741,12823455693798956034,524288 --field-trial-handle=1936,i,18100475749112504708,17125821915601898621,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:14
      4⤵
      PID:4968
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ccnx5ezh.k5z" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5384,i,10289056064187860732,11475999762898486891,2097152 --field-trial-handle=1936,i,18100475749112504708,17125821915601898621,262144 --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:1
      4⤵
      PID:4424
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ccnx5ezh.k5z" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=5516,i,7751152096856131428,15291772415265841727,2097152 --field-trial-handle=1936,i,18100475749112504708,17125821915601898621,262144 --variations-seed-version --mojo-platform-channel-handle=5080 /prefetch:1
      4⤵
      PID:4628
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ccnx5ezh.k5z" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=5284,i,2024854826963300488,12717053712952744044,2097152 --field-trial-handle=1936,i,18100475749112504708,17125821915601898621,262144 --variations-seed-version --mojo-platform-channel-handle=5052 /prefetch:1
      4⤵
      PID:3396
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ccnx5ezh.k5z" --force-high-res-timeticks=disabled --metrics-shmem-handle=5552,i,17098241637344166347,14089840285940242052,524288 --field-trial-handle=1936,i,18100475749112504708,17125821915601898621,262144 --variations-seed-version --mojo-platform-channel-handle=5148 /prefetch:14
      4⤵
      PID:1824
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ccnx5ezh.k5z" --force-high-res-timeticks=disabled --metrics-shmem-handle=5540,i,1561861364812570421,7538528911017868582,524288 --field-trial-handle=1936,i,18100475749112504708,17125821915601898621,262144 --variations-seed-version --mojo-platform-channel-handle=5084 /prefetch:14
      4⤵
      PID:4652
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ccnx5ezh.k5z" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=5384,i,7623948935717089705,17873333185192642431,2097152 --field-trial-handle=1936,i,18100475749112504708,17125821915601898621,262144 --variations-seed-version --mojo-platform-channel-handle=5064 /prefetch:1
      4⤵
      PID:5736
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ccnx5ezh.k5z" --force-high-res-timeticks=disabled --metrics-shmem-handle=5520,i,17060073370746733566,15068195625476141152,524288 --field-trial-handle=1936,i,18100475749112504708,17125821915601898621,262144 --variations-seed-version --mojo-platform-channel-handle=5044 /prefetch:14
      4⤵
      PID:5744
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ccnx5ezh.k5z" --force-high-res-timeticks=disabled --metrics-shmem-handle=5488,i,4906324551656905877,8470590716169395685,524288 --field-trial-handle=1936,i,18100475749112504708,17125821915601898621,262144 --variations-seed-version --mojo-platform-channel-handle=5516 /prefetch:14
      4⤵
      PID:5752
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ccnx5ezh.k5z" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=5288,i,4779880254981105923,5361045814262820174,2097152 --field-trial-handle=1936,i,18100475749112504708,17125821915601898621,262144 --variations-seed-version --mojo-platform-channel-handle=5148 /prefetch:1
      4⤵
      PID:5472
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ccnx5ezh.k5z" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=5548,i,9819773210989464015,553645471209387050,2097152 --field-trial-handle=1936,i,18100475749112504708,17125821915601898621,262144 --variations-seed-version --mojo-platform-channel-handle=5288 /prefetch:1
      4⤵
      PID:5244
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ccnx5ezh.k5z" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=5088,i,11789602251102093954,2413955194490673478,2097152 --field-trial-handle=1936,i,18100475749112504708,17125821915601898621,262144 --variations-seed-version --mojo-platform-channel-handle=5064 /prefetch:9
      4⤵
      PID:5252
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ccnx5ezh.k5z" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=4432,i,15328590858733597422,5191759524761736744,2097152 --field-trial-handle=1936,i,18100475749112504708,17125821915601898621,262144 --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:9
      4⤵
      PID:5452
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\y4iiop2e.znf"
    3⤵
    PID:4472
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir=C:\Users\Admin\AppData\Local\Temp\y4iiop2e.znf
      4⤵
      Checks processor information in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:5648
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1924 -prefsLen 27097 -prefMapHandle 1936 -prefMapSize 270279 -ipcHandle 2020 -initialChannelId {2a19c12a-d5a2-42f2-bca5-1ce46ebf6ae5} -parentPid 5648 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5648" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
        5⤵
        
        PID:4484
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2024 -prefsLen 27133 -prefMapHandle 2224 -prefMapSize 270279 -ipcHandle 2292 -initialChannelId {40ceaa88-4876-4bb7-9b19-2ab950781f56} -parentPid 5648 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5648" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
        5⤵
        
        PID:5948
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\a81cadc2-5573-4464-8561-942118c1f885.dmp"
        5⤵
        
        PID:6008
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2204 -prefsLen 27133 -prefMapHandle 2760 -prefMapSize 270279 -ipcHandle 2780 -initialChannelId {c63fc578-7fbd-4e3f-badb-6819a70b4f21} -parentPid 5648 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5648" -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 gpu
        5⤵
        
        PID:6040
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\af8a7c9e-83a4-4bb2-8261-6d1bf4dac336.dmp"
        5⤵
        
        PID:5864
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2560 -prefsLen 27133 -prefMapHandle 2868 -prefMapSize 270279 -ipcHandle 2856 -initialChannelId {0a04952a-dcb6-4f0a-b8c2-bbee562ecce9} -parentPid 5648 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5648" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 gpu
        5⤵
        
        PID:5372
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\488c9d42-7305-42ae-b682-fd6dd4be03c7.dmp"
        5⤵
        
        PID:3248
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2856 -prefsLen 27198 -prefMapHandle 3472 -prefMapSize 270279 -ipcHandle 3476 -initialChannelId {d000895c-1b5d-4998-97e6-d59ae0c9a954} -parentPid 5648 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5648" -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 gpu
        5⤵
        
        PID:4504
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3824 -prefsLen 27323 -prefMapHandle 3828 -prefMapSize 270279 -jsInitHandle 3832 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3852 -initialChannelId {39f920cc-7ac9-4bb2-a12d-566a0e9b27d8} -parentPid 5648 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5648" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 tab
        5⤵
        Checks processor information in registry
        
        PID:5152
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\18e27004-9ed1-4b3f-ba39-ae9654d435b9.dmp"
        5⤵
        
        PID:5176
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3476 -prefsLen 27323 -prefMapHandle 3992 -prefMapSize 270279 -ipcHandle 4032 -initialChannelId {7777417b-60d3-44d1-898f-a8cc686aadb4} -parentPid 5648 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5648" -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 gpu
        5⤵
        
        PID:5220
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\f96c0908-4049-4c92-8562-0c87574411b1.dmp"
        5⤵
        
        PID:5884
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4132 -prefsLen 27323 -prefMapHandle 4148 -prefMapSize 270279 -ipcHandle 4156 -initialChannelId {60b43cbd-bd47-4967-b285-a4d9f666b1f6} -parentPid 5648 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5648" -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 rdd
        5⤵
        
        PID:2928
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4640 -prefsLen 34822 -prefMapHandle 4644 -prefMapSize 270279 -jsInitHandle 4648 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4656 -initialChannelId {af808b9f-93c6-4e15-a5b5-19bf17182144} -parentPid 5648 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5648" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
        5⤵
        Checks processor information in registry
        
        PID:2468
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5032 -prefsLen 35010 -prefMapHandle 4028 -prefMapSize 270279 -ipcHandle 4024 -initialChannelId {3fcd6aaf-2e26-490a-b5f6-0db7a3a90c8a} -parentPid 5648 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5648" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 utility
        5⤵
        Checks processor information in registry
        
        PID:4008
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4932 -prefsLen 32900 -prefMapHandle 2204 -prefMapSize 270279 -jsInitHandle 4024 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5032 -initialChannelId {645ee30f-925f-43ba-8bca-b7bfd38c7941} -parentPid 5648 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5648" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
        5⤵
        Checks processor information in registry
        
        PID:4112
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5228 -prefsLen 32900 -prefMapHandle 5224 -prefMapSize 270279 -jsInitHandle 5220 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5212 -initialChannelId {dff9cf13-5490-4d66-a87f-f05772e6d018} -parentPid 5648 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5648" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
        5⤵
        Checks processor information in registry
        
        PID:5252
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5464 -prefsLen 32952 -prefMapHandle 5460 -prefMapSize 270279 -jsInitHandle 5456 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5524 -initialChannelId {ffc08153-2b37-4530-8650-666c36c8c7c9} -parentPid 5648 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5648" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab
        5⤵
        Checks processor information in registry
        
        PID:2604
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\sfgcnuh2.ul1"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious use of FindShellTrayWindow
    PID:1524
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\sfgcnuh2.ul1 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\sfgcnuh2.ul1\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x27c,0x7ff8df90c188,0x7ff8df90c194,0x7ff8df90c1a0
      4⤵
      PID:1008
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\sfgcnuh2.ul1" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --metrics-shmem-handle=1648,i,12106467928090228587,12978579983000071666,262144 --field-trial-handle=2268,i,11748704914593406457,14950920718372453762,262144 --variations-seed-version --mojo-platform-channel-handle=2264 /prefetch:2
      4⤵
      PID:5800
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\sfgcnuh2.ul1" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1780,i,1933439379798482588,7843120429120967851,524288 --field-trial-handle=2268,i,11748704914593406457,14950920718372453762,262144 --variations-seed-version --mojo-platform-channel-handle=2272 /prefetch:11
      4⤵
      System Time Discovery
      PID:3740
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\sfgcnuh2.ul1" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2348,i,4390253040915121627,594553957576538570,524288 --field-trial-handle=2268,i,11748704914593406457,14950920718372453762,262144 --variations-seed-version --mojo-platform-channel-handle=2600 /prefetch:13
      4⤵
      PID:5876
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\sfgcnuh2.ul1" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3104,i,6267284436036790291,7650923863866184640,2097152 --field-trial-handle=2268,i,11748704914593406457,14950920718372453762,262144 --variations-seed-version --mojo-platform-channel-handle=3156 /prefetch:1
      4⤵
      PID:5980
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\sfgcnuh2.ul1" --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3108,i,15144410240224939420,18412157505768913798,2097152 --field-trial-handle=2268,i,11748704914593406457,14950920718372453762,262144 --variations-seed-version --mojo-platform-channel-handle=3176 /prefetch:1
      4⤵
      PID:4864
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\sfgcnuh2.ul1" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3324,i,4677499324516035416,15188654218956403469,524288 --field-trial-handle=2268,i,11748704914593406457,14950920718372453762,262144 --variations-seed-version --mojo-platform-channel-handle=3068 /prefetch:14
      4⤵
      PID:5292
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\sfgcnuh2.ul1" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3336,i,12184862453943667650,1176023940953610949,524288 --field-trial-handle=2268,i,11748704914593406457,14950920718372453762,262144 --variations-seed-version --mojo-platform-channel-handle=3412 /prefetch:14
      4⤵
      PID:5280
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\sfgcnuh2.ul1" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3332,i,5114166980128673969,3934714195669010931,524288 --field-trial-handle=2268,i,11748704914593406457,14950920718372453762,262144 --variations-seed-version --mojo-platform-channel-handle=3444 /prefetch:14
      4⤵
      PID:5180
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\sfgcnuh2.ul1" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=3396,i,13692220065218537350,12344296458954788304,2097152 --field-trial-handle=2268,i,11748704914593406457,14950920718372453762,262144 --variations-seed-version --mojo-platform-channel-handle=3404 /prefetch:1
      4⤵
      PID:1684
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\sfgcnuh2.ul1" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=3416,i,2347721122640142179,5830401883878613744,2097152 --field-trial-handle=2268,i,11748704914593406457,14950920718372453762,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:9
      4⤵
      PID:3664
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\sfgcnuh2.ul1" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=3436,i,11304775924647061134,1459599132242843514,2097152 --field-trial-handle=2268,i,11748704914593406457,14950920718372453762,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
      4⤵
      PID:5692
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\sfgcnuh2.ul1" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3448,i,3416741753487577515,1621266166027658004,2097152 --field-trial-handle=2268,i,11748704914593406457,14950920718372453762,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:9
      4⤵
      PID:5424
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\sfgcnuh2.ul1" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=3568,i,9351364209409547020,7474111319858503243,2097152 --field-trial-handle=2268,i,11748704914593406457,14950920718372453762,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:1
      4⤵
      PID:4292
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\sfgcnuh2.ul1" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=3596,i,12101059845615438621,15830512410553725537,2097152 --field-trial-handle=2268,i,11748704914593406457,14950920718372453762,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:9
      4⤵
      PID:5884
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\sfgcnuh2.ul1" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=3632,i,18060218305534570097,177245594474350642,2097152 --field-trial-handle=2268,i,11748704914593406457,14950920718372453762,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:1
      4⤵
      PID:1700
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\sfgcnuh2.ul1" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=3644,i,16486796382847972781,2487056952034799192,2097152 --field-trial-handle=2268,i,11748704914593406457,14950920718372453762,262144 --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:9
      4⤵
      PID:5388
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\sfgcnuh2.ul1" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=3640,i,4680548913602698094,4012763136474013076,2097152 --field-trial-handle=2268,i,11748704914593406457,14950920718372453762,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:1
      4⤵
      PID:5184
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\sfgcnuh2.ul1" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=3656,i,6522979447113066620,8776974195951796782,2097152 --field-trial-handle=2268,i,11748704914593406457,14950920718372453762,262144 --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:9
      4⤵
      PID:5960
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\sfgcnuh2.ul1" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4444,i,8849114340062144003,7262414767891448164,524288 --field-trial-handle=2268,i,11748704914593406457,14950920718372453762,262144 --variations-seed-version --mojo-platform-channel-handle=4416 /prefetch:14
      4⤵
      PID:1392
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=1128
        5⤵
        
        PID:1760
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\sfgcnuh2.ul1" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5324,i,4991527759263885826,5675484283836064423,524288 --field-trial-handle=2268,i,11748704914593406457,14950920718372453762,262144 --variations-seed-version --mojo-platform-channel-handle=5048 /prefetch:14
      4⤵
      PID:2272
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=592
        5⤵
        
        PID:4112
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\sfgcnuh2.ul1" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5368,i,11547923223426828517,5052735450911973798,524288 --field-trial-handle=2268,i,11748704914593406457,14950920718372453762,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:14
      4⤵
      PID:1556
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\sfgcnuh2.ul1" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5048,i,1504734717103358564,5488760682846045969,524288 --field-trial-handle=2268,i,11748704914593406457,14950920718372453762,262144 --variations-seed-version --mojo-platform-channel-handle=4444 /prefetch:14
      4⤵
      PID:1884
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\sfgcnuh2.ul1" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3328,i,10126715539553395570,13076531029927297403,524288 --field-trial-handle=2268,i,11748704914593406457,14950920718372453762,262144 --variations-seed-version --mojo-platform-channel-handle=4404 /prefetch:14
      4⤵
      PID:2156
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --no-sandbox --mute-audio --onnx-enabled-for-ee --user-data-dir="C:\Users\Admin\AppData\Local\Temp\sfgcnuh2.ul1" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4456,i,10822281945943092334,10373717072296368368,524288 --field-trial-handle=2268,i,11748704914593406457,14950920718372453762,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:14
      4⤵
      PID:6100
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\sfgcnuh2.ul1" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6384,i,6817062822294286346,16507661026300381161,524288 --field-trial-handle=2268,i,11748704914593406457,14950920718372453762,262144 --variations-seed-version --mojo-platform-channel-handle=6400 /prefetch:14
      4⤵
      PID:5148
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\sfgcnuh2.ul1" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6384,i,6817062822294286346,16507661026300381161,524288 --field-trial-handle=2268,i,11748704914593406457,14950920718372453762,262144 --variations-seed-version --mojo-platform-channel-handle=6400 /prefetch:14
      4⤵
      PID:4112
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\sfgcnuh2.ul1" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6784,i,9925893975487196858,5957014000795085149,524288 --field-trial-handle=2268,i,11748704914593406457,14950920718372453762,262144 --variations-seed-version --mojo-platform-channel-handle=6788 /prefetch:14
      4⤵
      PID:3332
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\sfgcnuh2.ul1" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6828,i,2689551612837480792,2021668801772057404,524288 --field-trial-handle=2268,i,11748704914593406457,14950920718372453762,262144 --variations-seed-version --mojo-platform-channel-handle=6620 /prefetch:14
      4⤵
      PID:3844
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
      4⤵
      Drops file in Program Files directory
      Drops file in Windows directory
      PID:4008
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x7ff6cc3904c8,0x7ff6cc3904d4,0x7ff6cc3904e0
        5⤵
        Drops file in Windows directory
        
        PID:1664
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe" --msedge --system-level --verbose-logging --installerdata="C:\Program Files (x86)\Microsoft\Edge\Application\master_preferences" --create-shortcuts=1 --install-level=0
        5⤵
        Drops file in Program Files directory
        Drops file in Windows directory
        
        PID:4292
      - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x230,0x234,0x238,0x20c,0x23c,0x7ff6cc3904c8,0x7ff6cc3904d4,0x7ff6cc3904e0
        6⤵
        Drops file in Windows directory
        
        PID:1700
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4688
  - - C:\Windows\SysWOW64\chcp.com
      chcp 65001
      4⤵
      System Location Discovery: System Language Discovery
      PID:5528
  - - C:\Windows\SysWOW64\netsh.exe
      netsh wlan show networks mode=bssid
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      PID:5604
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:5636
  - - C:\Windows\SysWOW64\chcp.com
      chcp 65001
      4⤵
      System Location Discovery: System Language Discovery
      PID:5476
  - - C:\Windows\SysWOW64\netsh.exe
      netsh wlan show profile
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:3808
  - - C:\Windows\SysWOW64\findstr.exe
      findstr All
      4⤵
      System Location Discovery: System Language Discovery
      PID:1832

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:892

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4708

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1164_13417284251286208.pma

Path C:\Program Files\Google\Chrome\Application\SetupMetrics\1164_13417284251286208.pma
Size 696B
SHA256 bd91df686ccc3c827bc97292f418e66e8ba2e194331920574cf262c91db51a28
MD5 fd9203a7333a088eb94b46c24fc10837
SHA1 8f8fc8abb330c8199aa7d65fc408d37ede21fbbe
SHA512 e458c00f84a3211ac0e6b0ddee8ab59e73e151d1d7444e26f362dca3c20918e64af4767b8aaae6ea02e3ecd45eced1d2508df049afbfa547e437f7795a63f70b
TLSH
T118010E46A3144F77CC428D3584FE27512BB0FA501B821BBF7B10724F2E422C89E99168
MD5 SHA1 SHA512 TLSH

Submit Download

4636_13417284251322572.pma

Path C:\Program Files\Google\Chrome\Application\SetupMetrics\4636_13417284251322572.pma
Size 344B
SHA256 fd668d6edcf6b6cc176edd9bf7b0d7f1881fe2f0d94ebae656127c27a359550e
MD5 1b7cdddfb06152ae01f12d9f253237d6
SHA1 1ef358781a086a0727f4fa95cd53510eb328bc52
SHA512 4705c93b233be92dd2d04649d404b538bc76607bbe655d5e35a739653ac1af776ecdd12ec1cbf81476070ec5bae633f891817155014730a06939efb21bd132ea
TLSH
T159E0A79677648B7BD446CD31457B03523F6AF8501F81176F4740758F1E522D88E06420
MD5 SHA1 SHA512 TLSH

Submit Download

bc1dc392e02bfa41b619b2af7a6f5dc3c30d3d0e2c8659ddf597a6db39171396.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\bc1dc392e02bfa41b619b2af7a6f5dc3c30d3d0e2c8659ddf597a6db39171396.exe.log
Size 1KB
SHA256 8fb27f11815bb8193509ca9cd0c0bde69eeb02c41a9efdca85a20ec927b4f5fa
MD5 b2f90fd5ea3ad7a38ddb9662d14f6286
SHA1 25bb9521052f4a474fdb3a4d277e9333731d07aa
SHA512 6fc57ada3b1ddf1c98aaa7f49ab3bfcc29d893cdc466f2f91002b0636650013b724812525a918d7141b32322b97b25f8ab081d3a2fcfd4650714d8ef6f67966f
TLSH
T168214B303231B5D94D422F520C586AC566FF0749BAB8DF5CBA59335EDD2A0479B221F3
MD5 SHA1 SHA512 TLSH

Submit Download

06fb8b78-a503-4f5f-83ca-d827e3f2b591.tmp

Path C:\Users\Admin\AppData\Local\Temp\06fb8b78-a503-4f5f-83ca-d827e3f2b591.tmp
Size 242KB
SHA256 81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82
MD5 541f52e24fe1ef9f8e12377a6ccae0c0
SHA1 189898bb2dcae7d5a6057bc2d98b8b450afaebb6
SHA512 d779d78a15c5efca51ebd6b96a7ccb6d718741bdf7d9a37f53b2eb4b98aa1a78bc4cfa57d6e763aab97276c8f9088940ac0476690d4d46023ff4bf52f3326c88
SSDEEP 3072:r+nmRykNgoldZ8GjJCiUXZSk+QSVh85PxEalRVHmcld9R6yYfEp4ABUGDcaKklrv:k3oF4Z4h45P99Fld9RBQYBVcaxlnfL
TLSH
T1F63402BD7D8AE686D006A17676C0B48BE1199F4E41CB7C0F668A89010D70F8C57B9DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

30a69bce-ced3-482b-b775-c2095db6ef7c.tmp

Path C:\Users\Admin\AppData\Local\Temp\30a69bce-ced3-482b-b775-c2095db6ef7c.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

48373d5a-ecc0-4cd7-ab84-5c5b5cf07993.tmp

Path C:\Users\Admin\AppData\Local\Temp\48373d5a-ecc0-4cd7-ab84-5c5b5cf07993.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

5325e3a9-2219-4b1e-91ce-8e611b55a6fc.tmp

Path C:\Users\Admin\AppData\Local\Temp\5325e3a9-2219-4b1e-91ce-8e611b55a6fc.tmp
Size 146KB
SHA256 31e3cb755cf2d66510c7f94c42df615dc13575ad2e8fd5a63887ca145424d34e
MD5 98144a4b67ce21832c45a0d20d3163fc
SHA1 d5d7d718eb78e4332899326f111796da8604a2d3
SHA512 3e25330d1ce5810426da57aff275d2ecdd09b6c0cbe4f7534cf8bf17c39f595dcca147b204b6f74396b23160757cc030753c4c227b0dbea54f489b9016459ae8
SSDEEP 3072:w0mACj/voHPqreKLgf7UxnNvVx0v23PPb3jLqX0kj2y7uzTs/oGIZnn:w0mACj/Yq76U5zx+cPP73qX0kj2yEZn
TLSH
T1D8E3E06C6EDAC806C45B60BAB915F0CBC5068F3BAB49741FA64948684D70B4E07F1EFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_wijhqfkf.3zb.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wijhqfkf.3zb.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\ccnx5ezh.k5z\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Temp\ccnx5ezh.k5z\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.101.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

service_worker_bin_prod.js

Path C:\Users\Admin\AppData\Local\Temp\ccnx5ezh.k5z\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.101.1_0\service_worker_bin_prod.js
Size 119KB
SHA256 7bf8b391139fa764921d130518feec5758958c755a202a111a03528aa24cf6a7
MD5 f207c34493908ab7a5a722e215863bd3
SHA1 8b44c1130f91f1f3bef664d4d5c419262ed6b032
SHA512 1c72db2b46831170584959f75af89045aeb3f18f17b205b930a52456a752c004e9fcd3a9f699bafbe8d05855e381999acd381960442bc4bbe8a56761355431db
SSDEEP 3072:jpaEVZn8sRWKx0fe55E+u7qQhwbGyIUndp:j/K0/0fVMbGyIwp
TLSH
T115C3E8CDB6A57462436365F5002F000FB23AB8AAE44C85A8F189D9E97DB446D8337F7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\ccnx5ezh.k5z\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Temp\ccnx5ezh.k5z\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\ccnx5ezh.k5z\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\ccnx5ezh.k5z\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\ccnx5ezh.k5z\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

32.png

Path C:\Users\Admin\AppData\Local\Temp\ccnx5ezh.k5z\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\32.png
Size 1KB
SHA256 bff3a19327fd09a24c1aa4e7f34c508d7e668a8eb32f2cc7c33bcaa7e9ee2319
MD5 2f1881da261cfaea89605ee7a5e33e40
SHA1 fe61ed428aa3636adcfbeb66162f43f0ee091d25
SHA512 a9d8a4172c83030bf4472e900540b2ef3bbbb5e565c39f278cb8aae355354f063a4723c5ed8c3b32dcea45c70903271d170e56879a096b169697fc28dc768494
TLSH
T1FC413B2333F81ABFD81CD69BE465C8A50F395483DA39060706031CE8116343B19DDAF9
MD5 SHA1 SHA512 TLSH

Submit Download

48.png

Path C:\Users\Admin\AppData\Local\Temp\ccnx5ezh.k5z\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\48.png
Size 2KB
SHA256 afbfdd55b59a6385a28bfe27ef81ffae07f9d77b8c073dc299c6060b5d964a89
MD5 4d5d17c7e7c06b887bb383077131f50e
SHA1 8b29cf29af8358672e31bee5472025b7b07e7df8
SHA512 ccb20424ba2566e11a359bd04cbcb54bc21947bc254f4939c334f7db8c784a1da35461f60a1fc559ab5bde5cda443c82b633b8cc5bda89f5019b391148050be3
TLSH
T179515DED0389C698FB6F764206866917621D39F824EC51E09AE816A3EB101AC1CC1FD2
MD5 SHA1 SHA512 TLSH

Submit Download

64.png

Path C:\Users\Admin\AppData\Local\Temp\ccnx5ezh.k5z\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\64.png
Size 3KB
SHA256 02bd0f5d045eb5247e576d8151da19d36dc0eee7746c9a426d4dc92ee83125c8
MD5 aceb6eccca82014c9472e49e8b4b6eb4
SHA1 91d2c703fe33ea1867dd3d87b760aa2e5e68a55a
SHA512 b18d0edf51fb6245dc730b5aca21601dc40c762d6c3d96c950b38312406bce16fe7165e786bd0d6ee106d95c90139094bfc4fca08b0f37eb88c086606821ade4
TLSH
T111814D53467373A8BC788965CBCDD0EA8D732D594E4244F884CAD93429D54049825BDF
MD5 SHA1 SHA512 TLSH

Submit Download

32.png

Path C:\Users\Admin\AppData\Local\Temp\ccnx5ezh.k5z\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\32.png
Size 1KB
SHA256 ccefdc2d816137b5954b591e8954c392e0cf27388fef2e437991e3999d9ad3d8
MD5 efa437b6fe5031994d5917a91c19990f
SHA1 d46a1115227ead4e92346b600c28e9ac72cce96f
SHA512 ab52261f15a3f21728b41b4765da5ec6c9e71051b720204ee2decf6f09ac8a0c9a5c12313d921f232f1e698a7425d34415eca8db21a37f423535806bcdf238bb
TLSH
T1F3310AC7644047BA52EDDAF37F6B0C57DC12210107D4A440599F56E17FEEEC86015478
MD5 SHA1 SHA512 TLSH

Submit Download

48.png

Path C:\Users\Admin\AppData\Local\Temp\ccnx5ezh.k5z\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\48.png
Size 2KB
SHA256 bff87e21fa845d8ce3c266db6d904e9c7a3bf9fc2b95a1f1a5ca375f3fdb045a
MD5 097f67b0d583db3f8487ac27379c7eae
SHA1 18acf62fb9bc4e95899c4597cd72de66b6bef763
SHA512 0b6b323fa14e5b0dd6bb87fce791bbd0b7a867988d8332385ba76a35d93d4dd5b67f6be9be5a69fbdcd5da68c30bc840712daa83b9a0187b727d963dc9a9a045
TLSH
T15E514C54BEF34CB2EBC67C7254E65BF5A564C1E62D407A0C86B9CA1245BDD410CCD003
MD5 SHA1 SHA512 TLSH

Submit Download

64.png

Path C:\Users\Admin\AppData\Local\Temp\ccnx5ezh.k5z\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\64.png
Size 3KB
SHA256 abe4eaa1a6fa423bcef61b423dc72386a9cf1968b1041de5270c56a7780254ad
MD5 8e589c60e0ba95ca1b178bad0a8298db
SHA1 d981cd3f9eb63636471e3bd4c0fd7585460ad6fd
SHA512 e8c7b5d340e698f3b1b42d6c3b7653b666e0add095611c00f502782928eb788070ca977b54b42f9515127861e55138a3cc0f02540f0bc2e44694fb0ea595ee34
TLSH
T196517D1B4B8AC56A0E53770E02E57ED454996C569EF383CC2106E7C0081A99F43EBBE7
MD5 SHA1 SHA512 TLSH

Submit Download

32.png

Path C:\Users\Admin\AppData\Local\Temp\ccnx5ezh.k5z\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\32.png
Size 952B
SHA256 e566796c18517e7084e3a892b3291cc189b85e7830800503c256998ab697a507
MD5 bf7aa030f9cbc7aba123d10adb3ab321
SHA1 d210f3194a494a65d1e32ade703e24fbbef7b444
SHA512 3be8123811222e1d5aa92e7144d41a8ace20ea1d5b082aa51d11df8f573c17f294ead72ee9e94b31259035ebd0eecb904686cf4bb22f0e5313a02756e210b8a6
TLSH
T1E311889E6EAA8CBDD1C3AE4FBD2D22904F13CE54C534BA1B4C4759573A26E54704B501
MD5 SHA1 SHA512 TLSH

Submit Download

48.png

Path C:\Users\Admin\AppData\Local\Temp\ccnx5ezh.k5z\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\48.png
Size 1KB
SHA256 6a379d8e9545ee7885dcff4c53f1ca553dc9fb0cbaa18a0c71c0b75c8883d044
MD5 c053b2219c4c9e7e7080cbe4e6e3981e
SHA1 0470cf45babbbe1fad32b4dec3593e8ab7a8ac39
SHA512 1271ac3ef670f3b7104c3f4e678ef4bc9990d9427826b104bfa8d31f904895da50ed0f1b673727d39355428f6270d015c0953521b26d8f10f842854b79ec5525
TLSH
T1E021B7BE5B25DE1B97EEA61F72DA9900D89221E27183A6052ECFCB6057145A33C24172
MD5 SHA1 SHA512 TLSH

Submit Download

64.png

Path C:\Users\Admin\AppData\Local\Temp\ccnx5ezh.k5z\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\64.png
Size 1KB
SHA256 3772d9c9a6fabba60ac0c7b9c93bf230e3c99ebac9af480efc6c778d9881dd85
MD5 cf9a569f60db18903e86e6612cf90efc
SHA1 379dccdc92399b0e4e658ad8f04276bf99501836
SHA512 58f0b5130318069511452b11b1fbdfd898577c714150f5f88a4a4ff80320b33c287c103e464ef24c8543d90de71713f2ee293f538fb078ec2099f9871cef2caa
TLSH
T132210853AFCF4AAE5834129F565C460FFBA3623E2952D409DB2A41AB08CDC14E8462C3
MD5 SHA1 SHA512 TLSH

Submit Download

128.png

Path C:\Users\Admin\AppData\Local\Temp\ccnx5ezh.k5z\Default\Web Applications\Temp\scoped_dir1996_1182410280\Icons\128.png
Size 5KB
SHA256 63be4dfbc222f0c026579113af9aa7dea61e78a166ab9af053b46c1e172240ff
MD5 9cafc16ce8040254ec411cc5a8f954f2
SHA1 0d9841be48e134edf43c7ef970d24ddf852d155e
SHA512 aa1e0ac8d0647ee6c0b481e671b20fc68ff253dc72748b2aaf22f15bd8decd2b9723b16f8cd4c19d9a250abaa8d517101bad6ebfed7fd3a90ceefce02c1b3b75
SSDEEP 96:ALdfTPsPOWpgaNHQxO20qtLppvSFLtGaoFuPhQd1YDzpsE60tkuuAaw:m16NHQgoLjvSVtY2h6CDzpsErVu0
TLSH
T119C17E55555D711FD09D157110AF4A0F31A7E2AAC3785720C97E1BD0F88DE4603A3EB9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\ccnx5ezh.k5z\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\ccnx5ezh.k5z\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\ccnx5ezh.k5z\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\ccnx5ezh.k5z\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1996_666252883\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\sfgcnuh2.ul1\Crashpad\settings.dat
Size 280B
SHA256 bf0253d64849383692af1ef92a9f6b2cb13d89e6f5886a2c7bbb2e5d91259835
MD5 f5116dc10162b8fefa52d6601fa2c999
SHA1 7b7e3f655d06e8891f54db2cf735b84c360d54cf
SHA512 082945410553e11df274cd685534698fff3dda5aa2b860ca6a82318a762c2fe817cb66c43a908ca02c8f4059e750a2bd0b1e1c93c3605a3d73effb61ab7a8f2c
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\sfgcnuh2.ul1\Crashpad\settings.dat
Size 280B
SHA256 949ec6ddc08c8dccedc47bb60752fcbd6e2b02d951be1bea97c4be8ad73ffdbf
MD5 5a83384151c661c64c8b74d22af69106
SHA1 5b92a12ed1ff2a6969db0406634dde37b2a0ca88
SHA512 1248e2c143abbf40203917555de9f762cbe3584f3e05a7211e8fd0e8e6603d94e7282ce58d9d19c69d0aa13f5bea9c1cecbfc00f25dfd1d15f58d1f785a012fc
TLSH
T1D3D02230BF308232EE08A232B0FC0202BC808300082302C08C80088208C0033B03ECF2
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Temp\sfgcnuh2.ul1\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Temp\sfgcnuh2.ul1\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 279B
SHA256 4384b3f78cd6484c3773cdc56f16075ac0b57327fa792abdfdb35d956613fb82
MD5 33e3f7e02c99d3fd627a471cfd55744b
SHA1 ba910030caee5cfde198a2de44131af3e676cb76
SHA512 1e62d8646e3e8f8c58683b732dd17ee697886260d13f73cc0c9de232b90bf5cfde70b638f739376263dca27677959245a24e168899ff89942ab8588839ec0fa0
TLSH
T1B7D02BFB1AA60424DDAF46E250B1449184567D98894AEC4A106D718724B1319661BD72
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Temp\sfgcnuh2.ul1\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 375B
SHA256 754bcf2a062f193a356c32fdac7e39bf7c8c6ad48fec19c8d3062e61aae5789d
MD5 75d4b55cf4d444487981cede08af9894
SHA1 71b3b74efd023477a83f75d0bb0ddb27db2e7039
SHA512 26443d52db943a5831c325649738f92d6aa074dd76c6a88d0e0f599f63a398de496adf6d94e0ddf3e19f424ae106940b0c5869fd976b18b2f850bb3742ce4302
TLSH
T135E068B71EE30820FEAB43D214B140904415BD59C54AEC8F202A71C320B1314590BD62
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe58996c.TMP

Path C:\Users\Admin\AppData\Local\Temp\sfgcnuh2.ul1\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt~RFe58996c.TMP
Size 153B
SHA256 985991bc72eced438272dfaf8d9fe229d03f81e4f27717ead2b1f697fa607a67
MD5 dccceb5951843ec174260d9cff77ce04
SHA1 66a35c4eb46593be8396ccca2eaca2966192e2da
SHA512 8718e8c1b9b08c35cf604d95cf751d16daf07fd4ccf778ccf397a63c3e41599bbd7736cf8cd0fa243475dd7e924c76ec15ad914e1f73a7fa756c1fde07bd2f23
TLSH
T142C02BFB0EA80400EE4642D1013188D9C11B7CCC8A89FC4A102F71D330703223627C32
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\sfgcnuh2.ul1\Local State
Size 4KB
SHA256 ead556f544c390bfa344d74ced766a4702c488bec5cc92c79f2213efd039531f
MD5 433d626ab9fa6508783b07f9ed4d82ce
SHA1 fda710eb5c1129af4eab9b4078b1bd7fd974146b
SHA512 031bf3e9ddc1a2ec54d939112caa8a5d9a3057c483f45acfd087f1be6fcc83c09f4a3e5ca55cc698f6314d9e9ba23d9eb3a985e5e21035ea15b8324c9cc66376
SSDEEP 96:bqGNkVsFfgbaobFuTe1xIDmBjPS4vqJYAyR0eUnIyC59yUq4a:+GNG8cFfM2TSXyRqIN592
TLSH
T1EC81A8716C28ED234AE5AA48B4992693DE783473DC51EF48E6D8931804D779D2F0E83B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\sfgcnuh2.ul1\Local State
Size 5KB
SHA256 d387ce7dbb1b7e5625efa315b6bf39c9e1ce2cb1ed7879fb2830e82b7605f387
MD5 446113c065fe7c95c20f86c4045c9633
SHA1 331ea71eeaf3eb26d6a3e3492b20187ecfac8c61
SHA512 1c34c906adb65025b1108bb3d84074d11aab130014bee64c4241402064dd8e8e0ebab928daf8a122dd2f9062908afb06a897a2298fba4ed4b16cff248879f22c
SSDEEP 96:bqGNkaQsFfgbaobFuTe58Frh/cInURoDotov0JD9BjPS4vqJYAyR0eUnIyC59yU4:+GNG8cFkooDUwKjTSXyRqIN592
TLSH
T195B1A9716C78EC274EE5ED48B4C92793AEA42473E894BF88E6E8570C04D77D9170A827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe589093.TMP

Path C:\Users\Admin\AppData\Local\Temp\sfgcnuh2.ul1\Local State~RFe589093.TMP
Size 1KB
SHA256 eaa0a7b0fb8e1a5ae1a1c60c9461e83048b17a40ca9604eb6c73c18ce962fa1a
MD5 fe322d1504390d302a55c12fb64df9ab
SHA1 7d5c786315743ea2e90065a2e688eee7fe128618
SHA512 56c13cc9e096e7119c3842fcf4548bf8fc550675d5760f31e6f704b85b4a7ad08468a5bfce144985f60f97005a2e4867f770bd9c642c3247400d17c5fe549f49
TLSH
T1C431B8B17CA82973EDD19A89918D7B93AD342531C0A4AD8891FC870C09E32ED551EC3E
MD5 SHA1 SHA512 TLSH

Submit Download

Google Chrome (2).lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome (2).lnk
Size 2KB
SHA256 7450524cd395bd7ff1c627c3a1d2ec534045246d5f8783051929e9eb41bf4173
MD5 226dcde97d5b30fa1eb66fa162d8553d
SHA1 9ae4c7623be54ae1a87483ce5dc08fc867761585
SHA512 84a0b0764991239eb2e1dc1ab1df144f378f53e675d1bf19d09f3e034d8e2f9dea35dd07f55b01e72eafee9e646573ef6856c4324d3b0ed9bb2e4de8833c3180
TLSH
T12D419B1677F9171AF3F34E726AB33B200F7BFC16E2A8572D4191428408A1614499DF73
MD5 SHA1 SHA512 TLSH

Submit Download

ccba5a5986c77e43.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Size 4KB
SHA256 386122bc9ef769c61e58fce72cd808885644c7bbe672eef5d436daba872f2150
MD5 98cd2b4d1dfeaef3bc0151470c5007c6
SHA1 0b18b4e9c8a8d7aaa9b45a147da91298398f76dc
SHA512 0274fb3b0b19a9de0a2ae472ed429ea13c79369d17cb02cf1818008cd0ef341e52b7d65b18928f975811a22e2527fffcb420f7a382ad920aae0b4566680b380e
SSDEEP 48:KWvZNdOHEOeajJ9zCNYEsdLXuHDp9WuZNdOHEOeajJ9zvYEfgdLXuH+2S:3I1JoCuje11JvpIuk
TLSH
T18E91DE119BD60956F3F7BA7165B377216B3BF8498E18DF0D418142180C32B09AA7DFA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xvsejxpevNGf.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\xvsejxpevNGf.lnk
Size 1KB
SHA256 f71dbc042ed6b636e279d33e8198533092536089aca0e7e338d7c98ce56d7921
MD5 d068ccc08d541e90e4d3e6971c0318fe
SHA1 ea4753d00a0f44a28bfcc77c9552031ab8e44b81
SHA512 19ebfb0fc9f8993ce1347329bfac322bc9bce02c413873764fc2be551e0b406478e7661fe3b548fae77dda3e0eb271f515ad70a5f6c715a3ef668f017f800b0f
TLSH
T1F731B1110BF71709D3F3877574B773204A367CA5EFA59F4E019096994C25215E864F2B
MD5 SHA1 SHA512 TLSH

Submit Download

18e27004-9ed1-4b3f-ba39-ae9654d435b9.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\18e27004-9ed1-4b3f-ba39-ae9654d435b9.dmp
Size 65KB
SHA256 d84d8abddc962a65a096ccb4558d29451834be9d4d578b584d33be99cbe1726d
MD5 e83788c7355f22beea945ddbc282e3cf
SHA1 04c8372e625c309fd04e7f9010b0ef23a6a542a6
SHA512 cfbd71f1c06535bd572d2bf4abf79ee008f4cc2e770a4cf4cc517fd0ab9b4a88b9fecf5867285a17453a54d9b523266f9fbdc49b7f4aacaca9ce6edeb099a62a
SSDEEP 384:3B6Nb2LnjaxThAYB5A0vM36m8/c43GLVUzXYNEubm:x6ZwjgThAYBy0Zv3JYNTa
TLSH
T15F63EC12A7940A79D73D0A3A5BE3A37C3BF6E4149793435B22186A7F9CA73446C31ED0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

18e27004-9ed1-4b3f-ba39-ae9654d435b9.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\18e27004-9ed1-4b3f-ba39-ae9654d435b9.extra
Size 10KB
SHA256 f6a7a8f33f1d7a505bb9f85d8ab2dfb9943526228edfc5a5b985b96a0630ddac
MD5 bdc84c79e76510748aa3269529524e71
SHA1 88d7d113e6a58aec1e0da96d7d7b24d7190ec87f
SHA512 2910f3e7123ca62f79ed0b6ff220b88aefc6a5413386d57fccb3449ace5628224e74d63a014111391445b7f9fda7075b4c87645e450d80595cbba105e57b3ffb
SSDEEP 96:STWCWnTlmCY6pw6lFFdtH0Rh7CsevBb1d0FjMLlIrLlhTLlaXv7a8utILfcBCqwi:S5YhFbG7uvZ8RLKxsP5wlqDfoI
TLSH
T114227253878724B7AD4198C4BC30AE7C45EC6FAA51F958A802CD4D47FA468F81FB44F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

18e27004-9ed1-4b3f-ba39-ae9654d435b9.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\18e27004-9ed1-4b3f-ba39-ae9654d435b9.extra
Size 10KB
SHA256 2724e159b29485271e45d0ac6db1774761664990da5532745f1506d41c0c713a
MD5 f31f86a699d74517b3c66872b3fa2018
SHA1 ec91b4ffb182ec0685a039ecbf960e7531a3f3a5
SHA512 a00f7bf88e0a38367b9cc54adcf547fcbda14de165696cd59ea3675ad9a2577718bd3bc409d9404e647f227d29d40d03ed42fe6a0b444f0e1f76ceb7198c4b46
SSDEEP 192:S5acFQiR4p4DnTYapdVxzPjWBHy4T/fKNtaliDfo4bL9E+LX:iacFQi5Dz1LWBHy4Tma6A4v
TLSH
T1B322D831081CDC37E7D6AC8DBB393E3AD66D7B1A00E6789C41CCCA89C1A9478A779553
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

488c9d42-7305-42ae-b682-fd6dd4be03c7.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\488c9d42-7305-42ae-b682-fd6dd4be03c7.dmp
Size 63KB
SHA256 badbbc44987ecc6e8f6617e416eb5cc4e7a4b34ceb1980c09b1cb1ce36c4369e
MD5 273ae3516df3c24bbfb878437a2e4af5
SHA1 676fb14a89255212349abe8ee28635ac7d2103c5
SHA512 9bec2cfc64d43ec9e6e92ebd9b2e1dc956e9ee9957b4aa75b6c8e237b7ad2f41a0e97f05026ea0bc13c48ef5a799f7572874bd383244d563d2fbc6b0b423e2d4
SSDEEP 384:N80ruAZjAJ9l558cfckisqUz1++Yqdubm:NqbJ9l5RC+Yqga
TLSH
T19853CA22E7940436D63A8E39EAE7A33937F7E4141B9343EB5211A2FE9C673446C71E11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

488c9d42-7305-42ae-b682-fd6dd4be03c7.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\488c9d42-7305-42ae-b682-fd6dd4be03c7.extra
Size 10KB
SHA256 ccb6b6cf16d74b2550422a1c502c8b77b113dc7c8c6d2597a796775dbd98cb14
MD5 a06059c8d925c634247dd0c2edad6f0c
SHA1 ef8e3f3d8d0d4a93d0037bfb3a4509e4ec1af3aa
SHA512 56c633288765f5c891d81ce30d1f1915a67305f3f1043ab2391a7705c294ca0dd73575c86e3a302ed5fc67928d79701def21335d4d9aabdc7982933fa53cb18a
SSDEEP 96:STWCWvTlmCY6pw6lFFdtH0Rh7CsevBb1d0FjMLlIrLlhTLlaXv7aiutILfcBCqwX:S5shFbG7uvZ8RLgxsP5wl/Ifot
TLSH
T155228353878724B7AD4198C4BC30AE7C45EC6FAA61F958A802CD4D47FA468F81FB44F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

488c9d42-7305-42ae-b682-fd6dd4be03c7.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\488c9d42-7305-42ae-b682-fd6dd4be03c7.extra
Size 10KB
SHA256 a477083df1ec0190bd6c3528f502aaef4c8cd29e9659b32b2240f9009f433d3a
MD5 6b313f28b515b5ea4d9ca08973eebe13
SHA1 a838cbe0ab9fd541a57a661ed5170d313c5e94b9
SHA512 5e1e60a08f23999a019fc4a0fd6c52b9aa6fded66ccf7520891e215ddee79fe302a9b723cbf3703fab610b881d512eac3bcd6de3a3846c77b9c8f12e7dde4c57
SSDEEP 192:S5+cFQiR4p4DnTYapdVxzPjWBHm4T/fKNtalnIfohbL9E+LX:i+cFQi5Dz1LWBHm4TmaiAhv
TLSH
T15122D831081CDC37E7D6AC8DBB393E3AD66D7B1A00E6789C41CCCA89C1A9478A779553
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a81cadc2-5573-4464-8561-942118c1f885.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\a81cadc2-5573-4464-8561-942118c1f885.dmp
Size 65KB
SHA256 f0ce7568e60a18c8cb13f09d10c5537880afb7b18fc93ea0cecc30b912881d12
MD5 68956fe614a2a21219661d4903f89b28
SHA1 11ab38ac2c3b58c970fda9afdb78ff29e452a499
SHA512 357b255b6a401a6d9bf6728347c09c6175e19f714ec9b4e0eba72cbb45f14692a63622a47acdf6666221df59b4d16a8d5b890aa76e7bf773b8d2330c0d10ca07
SSDEEP 384:W6hZOzaUj53jRv+5BOJD7j/KV3YfxwFQubm:WCPUj3+5BE2VofxwFfa
TLSH
T1E7630A22A7D40676D53D7B391AE3A3333BF7E81417938B9B5201527E9C6B3856E31E20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a81cadc2-5573-4464-8561-942118c1f885.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\a81cadc2-5573-4464-8561-942118c1f885.extra
Size 1KB
SHA256 a10aad2562d2073b3dda0103e093b0cff249cdfabf550a3c57801bba3b6bf0d9
MD5 03bfd1e9e7f74edd1a82bebb4c27d604
SHA1 da41a714806a362b514dc4c96a4b8817eed7b5ab
SHA512 b57ed68c4607a1205af2dd36358ecc1f4b9e15784e4f30eec98c56c2896471eb853eeec1593af54933a370908b47c98e74cf17dd5da45aea097da61cd03563d0
TLSH
T1633160B3C1AC2D2299578AA8763B130289A9B72745D35D4C25CD4A08868E4DCE362AC3
MD5 SHA1 SHA512 TLSH

Submit Download

a81cadc2-5573-4464-8561-942118c1f885.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\a81cadc2-5573-4464-8561-942118c1f885.extra
Size 3KB
SHA256 c3f0e921a76c6dbf0f28b8ed140e4e9d8ddde84b2795eb47073281c560b15e61
MD5 7fcd0b1d2dba0a7aecbd257f587937f5
SHA1 6cce35cb65e534109db5f43b2f0c3474b1dc887b
SHA512 eeb6322a61bba51aead34b8a0558df321dc551c27fd5cf897f8e71ad0056c138ef42f058dbaba6bf0a24e8c44465740056fbdecf1aba5587d3eed202222aa256
TLSH
T17381F232044CE9776AEA5D9EB3377D1D899EB31998A22E8C95CEC7580178CF4B386143
MD5 SHA1 SHA512 TLSH

Submit Download

af8a7c9e-83a4-4bb2-8261-6d1bf4dac336.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\af8a7c9e-83a4-4bb2-8261-6d1bf4dac336.dmp
Size 67KB
SHA256 b1ab1c413364f23874c707ba5fbd009851577f15b1839221319c16c2cef17f20
MD5 c2bd5e1051a801d2a78c9d3a269665c6
SHA1 100dafe321cb8e7760d5fdd0ccc30672a3dbd50e
SHA512 14194d6c6385cd90ffe81293ff3a0f95eeb13f3fa9f91be7bae2b12f234900da45aeb2eb49ad6532012dca6bf41fa77a24b83c2b7a9da067880c664307e41019
SSDEEP 384:C7fSjAOYaQGiJ5lRuVWH5jAB9nSRRJCqMJTuLubm:Cj7siJ1leBsRRQqMJSSa
TLSH
T1D163D922A7D40836D5291A3D2EF7F3353BF6E8041753639B2E01927E9C6B344AE31E15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

af8a7c9e-83a4-4bb2-8261-6d1bf4dac336.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\af8a7c9e-83a4-4bb2-8261-6d1bf4dac336.extra
Size 10KB
SHA256 315d72275aed25692708a65c1838af1dbdfc8f08b40e218e7c360cdcdd31d5a3
MD5 9ab407fc0679571c265c35fc4bdf43ad
SHA1 60ddd0862ff74f19768437a67f3a198dc08bc321
SHA512 d5e0ed78be039eccd8758dd0725aed0e3235f7c4641813e8b53edb0c9530996049338e3d50f1fcbe297c18a97164cf8cc7962fdf4b770305d8c1ba7b1bc114a0
SSDEEP 96:STWCWVTlmCY6pw6lFFdtH0Rh7CTvBb1d0FjMLlIrLlhTLlaXv7aputILfcBCqwvS:S5ShFbG7WvZ8RL5xsP5wlaAfoJ
TLSH
T19B227353878724B79D4198C4BC30AE7C45EC6FAA61F958A802CD4D47FA4A8F81FB44F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

af8a7c9e-83a4-4bb2-8261-6d1bf4dac336.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\af8a7c9e-83a4-4bb2-8261-6d1bf4dac336.extra
Size 10KB
SHA256 8daca8c2093c384e8fd1cabe47aa770224b760261941654e92a24f7fa403ba8f
MD5 1e083ecd875059eae6c05149647abdef
SHA1 d59ff59b3e73296d934953fb76d7d5b442970a9d
SHA512 8534a373ee1565e9cb9dd3bc99508b6ec40ebd166d635f3fc823ddf270e5498e1c4afb4a9b56e09126bc29ff759542ee2dcc416f15c989573399c179f4096a99
SSDEEP 192:S5AcFQiR4p4DnTYaVdVxzPjWBHB4T/fKNtalSAfoFbL9E+LX:iAcFQi5D/1LWBHB4TmapAFv
TLSH
T1F522E931081CDC37E7D6AC8DBB393E3AD66D7B1A00E6789C41CCCA89C1A9478A779553
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f96c0908-4049-4c92-8562-0c87574411b1.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\f96c0908-4049-4c92-8562-0c87574411b1.dmp
Size 64KB
SHA256 b93ba54218d78f9a53fd36c16dcbf8e57869e7fc830f120eb3fc04f42a9eb31e
MD5 c19d45f0c17406777efdd55667c479dc
SHA1 242d6edd6b4526d5ad9b74251c5bc445e9e4d55b
SHA512 1b8ba4e8d5b03825d90c2258d52e9e8ba9ee1872ab5c6e2c00294759a91ef2c8181c409f1e2692cd659719f837a494e63f1606769d74507dc63ecbf185ef8f1a
SSDEEP 192:g3aghBsFM21y22TjLH1yVTuFKulpa/lHTNUWUKDxxion7llLhzS2TJIkwBYyQnPK:gai2vSYqa/5h93BSUwBG+DKlKhKPubm
TLSH
T1E453D922B7904A36C6394B3957F7A33C7BF6E4145793475F4A01F2AAAC537846E32E20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f96c0908-4049-4c92-8562-0c87574411b1.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\f96c0908-4049-4c92-8562-0c87574411b1.extra
Size 10KB
SHA256 d4f567d67b0b1d68c4d7b9c2f94c2d8894128a68ef5438f65348aac9aea7c1a6
MD5 9e8e1e92a8b944ed333bec3e4af026e6
SHA1 a1963a3dd4edaf9df70c3c88da0cde13f5e35b7e
SHA512 b8782b0c42f8c753bd347df72724adb721ddeccc83d6cef2525a1121b6d116618491883adb8e228912de9b4f8ef5edd569dcb9f09028bfca511c89b565002fa0
SSDEEP 96:STWCWKZTlmCY6pw6lFFdtH0Rh7CsevBb1d0FjMLlIrLlhTLlaXv7a3utILfcBCqQ:S55phFbG7uvZ8RLXxsP5wl37foY
TLSH
T148227253878724B7AD4198C4BC30AE7C45EC6FAA61F958A802CD4D46FA468F81FB44F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f96c0908-4049-4c92-8562-0c87574411b1.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\f96c0908-4049-4c92-8562-0c87574411b1.extra
Size 10KB
SHA256 25f656871761b11b0e828600bd9a06a36c163c92213ce57a0bff922dbe312634
MD5 b57d544297603edadc65f9b3d9a0b958
SHA1 be4e32b7cc265f5318358ee6df8641672456ea96
SHA512 22b502943bae75d7f479d7d2ced8b780ee313596b5bc428f9024dc03a3de40ca44602b7f9b894bd8155b4f6dd61e7943064cd0c092cd4f367c68f5e456b7212e
SSDEEP 192:S55tcFQiR4p4DnTYapdVxzPjWBHd4T/fKNtalP7foobL9E+LX:ircFQi5Dz1LWBHd4TmatAov
TLSH
T1FF32E931081CD837E7D6AC8DFA393E3AD66D7B1A00E67C9C40CCCA89C1A9478A779553
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

compatibility.ini

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85vpkkl6.default-release\compatibility.ini
Size 198B
SHA256 252b7fff962848c61092e82a3d87adca163849767713a93ab533bb397f1f53bb
MD5 ce9ef13caa8a74c25157b184aa038475
SHA1 db03a9935d8bb3ce6b120aca98feade536805160
SHA512 0f6f5053e78167ef5cc5fa70ed3a87dd116df0671a590299277a197341bed983e3d77e37ad2c33cd4afe880fab9ed1c7f7502210040617a01f97a81c1e1d4f29
TLSH
T1C1D022818BC7848C9D4AA8E4537C38086BF2EE0E0604492A32827F0B4164F09023C3F9
MD5 SHA1 SHA512 TLSH

Submit Download

store.json.mozlz4.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85vpkkl6.default-release\crashes\store.json.mozlz4.tmp
Size 6KB
SHA256 e526777759c3efc917445fe8fed28159687804da603938d5400a2ba67ff2f267
MD5 dd5f8d8f1cba4b07c45376bbbaa21a1b
SHA1 7979a8360a5c194b5c20637aa29b500450ef3d54
SHA512 1793b52b29997fd2d12239308f5ad44e7751c29b6b853c1dfa44f198ad022dc2e69a81a7e337a866e60538cbcac7c63135691fc0f2df168cfec8d2ee0d7f9728
SSDEEP 192:ki5Ml6sKDuX9ABr33mZlDBkSmWfYWqbqRm9SAqL0fHVkEpK0:1ObmC9ABr32ZlDSk3oqI1kZ0
TLSH
T122E19F63CE09799505D05821B0E26B8E52213E57B0D8C38F3C8DB3796DF36180FB839A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85vpkkl6.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 6338a7f094d2e824e9a4ef8394c67bb5e409a831dffc88f4a98902f826fe167f
MD5 57e38d476215e5da408623d72d9ebfed
SHA1 b57fe7857256d523eddb32b699d5801fffc93593
SHA512 8ce8cd1ccea437509f3b345c05cab89d84de5e8cdb76023ea24bf2c3c7acb19b563dbe9b46a30d575b9b8a073a4c1f5f3e730f8bd845afe35fa3656a5bbd1fd6
SSDEEP 192:wD91d66Joz0dzgCl6mc0dqOv5zboVbRJyj9j:Ud66JozQzgC1jLboVbRJyj
TLSH
T1DAD10CA4F638863BC408437BCCA51F411F36385B988E3F19319C65482D5B2DE7A8E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85vpkkl6.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 e463d18db4404158947c1a9d55e77d8865ce976719bfe4868d8e0129b83dbbcd
MD5 5a18392dd4405e11339e00bb6c4444e5
SHA1 780ee8d9682b959c30405cab744dbd380ca48324
SHA512 764e9d70024f8d6d1a3b585583113e5df109dee154a9c713356cd6076fdc85d8492dca0ef886af3778b83ae50bdbbaff9b844dde44052913ee99eebb3676868a
SSDEEP 192:WJo91d66Joz0dzgCl6mc0dHOv5zboHgZRJyj9jI:OYd66JozQzgC1jqboAZRJyj+
TLSH
T1D9E1FEA4E628863BC414027BDCB61F411F35389A988E3F19359C654C2D572DE7ACE1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85vpkkl6.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 b6babb1057653e91118dd9bedc1a5be58d9c3865f247c0adc1252a293f73f206
MD5 80b63a227e1e086b68e041cffd2b4eba
SHA1 fc4d22a027776cc66b45dd69263bbc63b5a165cd
SHA512 ac3e847903e8e881788e49a88d4c98906ce1bbfd46246afd896269c2da1d18ed0c8bf241277a5d0b1116c361f40cc74fd478e16064e71cd7ed77a21447a65471
SSDEEP 192:0Ov5zboHgbRJyj9jLJb91d66Joz0dzgCl6mc0dz:XboAbRJyj7vd66JozQzgC1jd
TLSH
T1D4E11CA4E638863BC418037BDCA51F411F36385B988E3F19359C65482D5729E7A8E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85vpkkl6.default-release\datareporting\glean\events\events
Size 1KB
SHA256 55e730edd436d4d382133ed79b13068f425662785f86b2c8039d0293360a7e2f
MD5 2664929487e8dc5a0d515c4052bca80b
SHA1 bf7fe1f0fa233023e70ed1a5ed5169c1894a4a8a
SHA512 6057702ae965ce5d50b8feb29528627ce402eb69dce314a01dcfda2a676bcac83e2c556f1278521138e5b50d1ea54cd13e17f73183f4e4efaa6fd06c73bbea05
TLSH
T1EB21DC4C3DBA4C2A98C7E29C7841018E53058E0344C31E838F43EF8CCEC4AE9322E438
MD5 SHA1 SHA512 TLSH

Submit Download

295ac016-a3d8-4b70-bd88-ea940c3c52a9

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85vpkkl6.default-release\datareporting\glean\pending_pings\295ac016-a3d8-4b70-bd88-ea940c3c52a9
Size 3KB
SHA256 ac55efe242506865186b6fdb4eff488cb033c9136a3ca9046b7ffd92f72c5322
MD5 970d71ac7049dbf8c3594e30ee3e0191
SHA1 afdbdbf555f2d079ab7922fbf33114176733d90d
SHA512 d164e0c03b813083b6a15d96268d0a156260285bb52fcc4566e2946bf05590b522e53e3bf1540a8172182ef9181d6d278d6659effc16abbe8fe211f37930e1b3
TLSH
T17B6187710658BAB38EE8B145D3777E848ADE33CF14470EC961ADCDA442F8468578B25B
MD5 SHA1 SHA512 TLSH

Submit Download

4f0a2c5e-5789-4ea8-b908-29227295c8ed

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85vpkkl6.default-release\datareporting\glean\pending_pings\4f0a2c5e-5789-4ea8-b908-29227295c8ed
Size 3KB
SHA256 2b6024c3dd5a2bb46d79ff93736f24862b417f35e6c09c2f396c26a44ce9430c
MD5 9f5b606e40fe24eb782ccc6902f4ae5e
SHA1 74b3657c1fd10b67de86c845c799a4f1f92a97d1
SHA512 5b337b3308fd7e75adf32c5c5bc62c53069ffd34336a7981910314367643d5d1cfea02f8e6a52a093d999c8498fb0f371f633698414dac42b39ff011ac6f6437
TLSH
T1616145711558BA738EE8B005E3777E858ADE338F58830ECA256DCDA442F846457CF25B
MD5 SHA1 SHA512 TLSH

Submit Download

54715e91-dec0-406d-a088-2e4546c5e3e2

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85vpkkl6.default-release\datareporting\glean\pending_pings\54715e91-dec0-406d-a088-2e4546c5e3e2
Size 235B
SHA256 86a4a6642a788c9aa5b816a7f8fff4ffc1935522d767690d9a8fa199b2907416
MD5 e08eaaef1ea0eee9164ad3ffbbf47647
SHA1 90ed2b5db02b85c0571567b08f5675b00203a26d
SHA512 f2095cada56b2414e642119b43e30df6fd4c698dd90121e5033551f470d4f040c743f661f9816162cb43a7b2882372341d39f40a986441e2c77f95191888b108
TLSH
T121D097881488276C081C0F03F0B03AC230AE4C3328A8A820DA6042789AF9AC4026286A
MD5 SHA1 SHA512 TLSH

Submit Download

726ccba3-876d-4e1f-b45f-0dd6a09be897

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85vpkkl6.default-release\datareporting\glean\pending_pings\726ccba3-876d-4e1f-b45f-0dd6a09be897
Size 3KB
SHA256 d889d9ef5035430786308ba2432193ec798bcb2caa262da8f9b6783429838cac
MD5 f278a5336e4fddbbae27421265c523a5
SHA1 6785ac8cf34e49e1fe887112eca9e577ec3b3f42
SHA512 9a5c7a0ad24b81fdf8e61547e1eb807ca9919ab3c62ce2b043264a7719de20e6f6097d829535cf9ff4a3dbb2bb1e85c292dcb45476ab4d0844885d201fe11283
TLSH
T1966165310558AAB38EE8B105A377BE458ADE33DF08870FCD21ADDD6442F8468578B25B
MD5 SHA1 SHA512 TLSH

Submit Download

8aa67a9d-440e-480f-aeaf-4bb9b6e31a33

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85vpkkl6.default-release\datareporting\glean\pending_pings\8aa67a9d-440e-480f-aeaf-4bb9b6e31a33
Size 883B
SHA256 57b43565407f60f632e8835c89fc0f544c30c13952ad391bb1d8d5ceef215bb4
MD5 6c7354cf0c13fd593e29b43c85115d0e
SHA1 7befa17d3b8a73487ed86a9c85caeef51d9ce1f0
SHA512 cdec99d2dc31a8b27fc5e90044ac99d39e3af958c311b02999e70c1910094c319cba6eaf555636213bdef8f7bc460a18ef34ea735414c0017b838affb25b6be8
TLSH
T11211C09193317573CD68D28FC5D57B4267F47523C0CA88147EE44A180DBE51ED3AB507
MD5 SHA1 SHA512 TLSH

Submit Download

9cd3dc10-5fcc-4136-9f55-50bdb800f549

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85vpkkl6.default-release\datareporting\glean\pending_pings\9cd3dc10-5fcc-4136-9f55-50bdb800f549
Size 16KB
SHA256 aec9d15643fed80bfe7f03f8e8209426ed6a4ffec89f4ca52823969a96fad6af
MD5 8ad61ae3cd5b8c58085abbf03da54c1f
SHA1 06e2c22f09fe14dcfb17f59eb0806cfd339db69d
SHA512 0b6dfc06450aa9ae4cc1f34ed199efaebf679c3e733c9a31913dc221b23c449d4ca97763269d81a444a3fed6531a93fda3e27330763da758716f25479422c355
SSDEEP 192:7SNrDETLIJeoo838e1l18uQ2SzdF0YTyalmsQ3BqB1+qxUEYsslivPIR6UY2IVh7:7SNrDEpK8E/8uQ2SP0YTyawHk7DRj
TLSH
T15972BA56286045BA8691E39994F8BFC3E6F538CF4C414FCD9BE4BD086DDE0AE112784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a403850e-99a2-4a72-bfc8-21c220d2c02b

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85vpkkl6.default-release\datareporting\glean\pending_pings\a403850e-99a2-4a72-bfc8-21c220d2c02b
Size 235B
SHA256 c72a473d399219a927cc7ef17e25e48e43e6cd6bcb530f50fc53900ec76bd4af
MD5 d1f87f3d532bedd4fe5139e7bc73f5a6
SHA1 5d2115c3c74d5f555d3c3e9f83dd1ed1ca791c42
SHA512 1c27218798e90d03dbbe82af24636d7e168847344a10f4e21fccdd171b82831b7649d09ce7b8e68471a5ae7b5091bcda7f518a15302561700940a71fced6315f
TLSH
T154D097D05498BFAC48101F1FB0A069C274868C376870B814D9710134ADB9EC44112D16
MD5 SHA1 SHA512 TLSH

Submit Download

b966b811-c5bc-4ff2-bb05-ef91786650cf

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85vpkkl6.default-release\datareporting\glean\pending_pings\b966b811-c5bc-4ff2-bb05-ef91786650cf
Size 2KB
SHA256 62915b0ab190aa406221dcef2772857a35dd2604afac8bf4e6071e4f36b47b4f
MD5 790b91c748f9a3f86fa85a8a376cb9e1
SHA1 1f934c9031e11256ef5443a33d46b52bc3213d02
SHA512 f44bb3a1906a0271757fc2e12252afaffc5c72e6c27c840ab0cde4af93f0e19466464c93aa4945135a6ee738e29a7878b2a67b6dff28da9cc576b981f6777cfa
TLSH
T11641135C36785DBB8CCAE1DD9482268E53B44D0340C61CC36E52CE4C9C9A6DE736B81A
MD5 SHA1 SHA512 TLSH

Submit Download

ce2feacf-5398-495a-bea2-e919b5f90d25

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85vpkkl6.default-release\datareporting\glean\pending_pings\ce2feacf-5398-495a-bea2-e919b5f90d25
Size 3KB
SHA256 fc85b924f940509ffe637b0c2213184c461f9d06d4c502e3a35f28cf3b8658f9
MD5 b6bdcd062a6565cfb64a4c2c988c5440
SHA1 3cc1ea7dbd570a2b1917ad440b54b24eaa2a82e5
SHA512 7b66078e21e71e30328ef7df698627823261dd6361c13c276140b4c65f045a96989b7bee5b48be8a5eeadabad08087e2be734be73855275e249adfdebf0ea6ea
TLSH
T1E46165710558B9738EE8B105A3777D458ADE33CF58470FCA21AD8DA442F8468578B25B
MD5 SHA1 SHA512 TLSH

Submit Download

f70f9651-90c0-4c7b-bbad-6531479753cd

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85vpkkl6.default-release\datareporting\glean\pending_pings\f70f9651-90c0-4c7b-bbad-6531479753cd
Size 3KB
SHA256 e371cebb123700c5654fa1bc0c1817b4e2ac2615a0064fdd5a7ff2ad1e3876bf
MD5 a9dc4328b79706f354250a13a88585d5
SHA1 47f895c4c9012988c555490442d39eed3d3a9b16
SHA512 93f045ec6bcd148484de1f96befa25caf1f0fe71ff1619a1493c1a0acb447143ef54648e18506aceb85e9889a60587c90290b3892368d602fd0153971216ce34
TLSH
T14F6155710658BA738AE8B005E3777E858ADE33CF08470FC925ADCDA442F8468578B25B
MD5 SHA1 SHA512 TLSH

Submit Download

fa2497b4-3cfd-4a6e-baad-e98da89989da

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85vpkkl6.default-release\datareporting\glean\pending_pings\fa2497b4-3cfd-4a6e-baad-e98da89989da
Size 886B
SHA256 1ae9c995c3b2b72f169593ac50ab90fdab435e4d66d72ca68dd7bad8e9275600
MD5 423b90fbc2afee84f590f803d70dc2a7
SHA1 9f4930a44f0d11d24ab618626304c2b378e1a651
SHA512 3e860bf98b98564f071a515ca9e2af41e05ddd67037f0ffa8869ccd4c44f9100997a5a11a607af924ab16a8358a27472ad69a41dca9bfe0d71889ab6089b4881
TLSH
T1371100D18674BAB3CC38C28BC5E17B4267F4702380CA1904BDD48B080DFE52EA39A607
MD5 SHA1 SHA512 TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85vpkkl6.default-release\prefs.js
Size 6KB
SHA256 1b9b0c3dcb552b8cebe0e43c2178de5e5cb952eab03920b01e69d2520a2a196f
MD5 590d3dac43485d67e0cd5f5be157a06d
SHA1 e4f79b179a12c001eef2821c5bea98295f90961a
SHA512 f6a4f71f1c64b046994fcd19d19ef61cea6451305cacad708a709f4108a89dc35a92db31f8941dbe0453cc141d2b51d4b0005d0ee600068eab56fe9bedbf0f9f
SSDEEP 96:xHHJUTUtBoqGqV0fYKjzDnjb1zSVSSlldv9jOnYtHFLkBw88H8L4cnZhLMR:njRmfYcDfISSbFoBw886s
TLSH
T16AE1207895088F7FA4B677ACAC6488316AB2013B7BBF68C750B544C4054CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Windows\SystemTemp\Crashpad\settings.dat
Size 40B
SHA256 5e01aadb4555b733c81eb2344bb6811db548905895a2506d2d5ac77530caa281
MD5 202e4d79db6f609bed203570b1ba78a1
SHA1 1ceae686c63b4c326922a58fe228cb7cbcb65bbd
SHA512 fd7029a8a648288c24b23359866a782d41a3030d5d3b83d44c56f5f7c01e38aaa7f1149db621720368db178b644de0577a0b923cb21fcdaf16369c5149ec999b
MD5 SHA1 SHA512

Submit Download

chrome_installer.log

Path C:\Windows\SystemTemp\chrome_installer.log
Size 8KB
SHA256 85edffd668d9dc57553da36e523e40634b545e01624852b3d474428f13694bad
MD5 75eaa3e2eac3ef07eb6762d4b3495ed6
SHA1 941717ab846e6d416ad8042cc0fe9ede2646d707
SHA512 1cd2c1cc22aace34a2d958a6a61eff760bc42a53ce7c30d5529193f09ed460f44a0e0c4f710dd0143d942d45e96afee9aa39fe9edfb3928981f6e184576de9e9
SSDEEP 192:P4/0AHc4xb8J7AEdohYYv2bD/cAPIVfMVAzfAMAA/UjiHHWJEKe1A0KEMIdJSVZ0:P4/0AHc4xb8J7AEdohYYv2bD/cAPIVfL
TLSH
T1D512BDC68F02487F7B86CB6B325321516EAB640BC7E5A4B23BEF5502B4CA965001F1F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/892-1158-0x000001C9E65C0000-0x000001C9E65D0000-memory.dmp

Download

memory/892-25-0x000001C9E6500000-0x000001C9E6522000-memory.dmp

Download

memory/892-1155-0x000001C9CC730000-0x000001C9CC761000-memory.dmp

Download

memory/892-1156-0x000001C9CDF50000-0x000001C9CDF5C000-memory.dmp

Download

memory/892-21-0x000001C9E65C0000-0x000001C9E65D0000-memory.dmp

Download

memory/892-1157-0x000001C9E64B0000-0x000001C9E64C2000-memory.dmp

Download

memory/892-22-0x000001C9E65C0000-0x000001C9E65D0000-memory.dmp

Download

memory/892-30-0x000001C9E69B0000-0x000001C9E69F6000-memory.dmp

Download

memory/892-1113-0x000001C9E65C0000-0x000001C9E65D0000-memory.dmp

Download

memory/1052-1106-0x000001B5BCED0000-0x000001B5BCF01000-memory.dmp

Download

memory/1052-1082-0x0000000000950000-0x0000000000951000-memory.dmp

Download

memory/1052-434-0x0000000000940000-0x0000000000941000-memory.dmp

Download

memory/1164-332-0x000001FE31FC0000-0x000001FE31FF1000-memory.dmp

Download

memory/1664-2572-0x00000000006E0000-0x00000000006E1000-memory.dmp

Download

memory/1664-2591-0x000001FA65E20000-0x000001FA65E51000-memory.dmp

Download

memory/1700-2590-0x000001585F970000-0x000001585F9A1000-memory.dmp

Download

memory/1760-1769-0x0000028F92610000-0x0000028F92641000-memory.dmp

Download

memory/1760-1770-0x0000028F92800000-0x0000028F92809000-memory.dmp

Download

memory/3020-614-0x00000000000F0000-0x00000000000F1000-memory.dmp

Download

memory/3020-1087-0x0000000000100000-0x0000000000101000-memory.dmp

Download

memory/3020-1107-0x000002BB74350000-0x000002BB74381000-memory.dmp

Download

memory/3248-1459-0x00000208CC870000-0x00000208CC8A1000-memory.dmp

Download

memory/3808-2598-0x0000000003000000-0x0000000003019000-memory.dmp

Download

memory/4008-2538-0x000001E883D40000-0x000001E883D71000-memory.dmp

Download

memory/4016-1151-0x0000000006290000-0x00000000062F7000-memory.dmp

Download

memory/4016-20-0x0000000006300000-0x0000000006366000-memory.dmp

Download

memory/4016-2603-0x0000000005BC0000-0x0000000005BD1000-memory.dmp

Download

memory/4016-35-0x0000000006DD0000-0x00000000072FC000-memory.dmp

Download

memory/4016-36-0x0000000005B40000-0x0000000005B5E000-memory.dmp

Download

memory/4016-34-0x0000000006600000-0x0000000006650000-memory.dmp

Download

memory/4016-2610-0x0000000005BC0000-0x0000000005BD1000-memory.dmp

Download

memory/4016-2605-0x0000000006420000-0x000000000643F000-memory.dmp

Download

memory/4016-809-0x0000000005620000-0x0000000005630000-memory.dmp

Download

memory/4016-2612-0x0000000006420000-0x000000000643F000-memory.dmp

Download

memory/4016-33-0x0000000006580000-0x00000000065F6000-memory.dmp

Download

memory/4016-19-0x0000000005620000-0x0000000005630000-memory.dmp

Download

memory/4016-32-0x00000000066D0000-0x0000000006892000-memory.dmp

Download

memory/4016-15-0x0000000000400000-0x00000000004BE000-memory.dmp

Download

memory/4016-2593-0x0000000007400000-0x0000000007757000-memory.dmp

Download

memory/4016-2619-0x0000000006420000-0x000000000643F000-memory.dmp

Download

memory/4016-31-0x0000000006440000-0x00000000064F2000-memory.dmp

Download

memory/4016-2372-0x0000000006420000-0x000000000643F000-memory.dmp

Download

memory/4016-1152-0x0000000005BC0000-0x0000000005BD1000-memory.dmp

Download

memory/4016-2626-0x0000000006420000-0x000000000643F000-memory.dmp

Download

memory/4016-1153-0x0000000006370000-0x0000000006385000-memory.dmp

Download

memory/4016-1154-0x0000000006420000-0x000000000643F000-memory.dmp

Download

memory/4112-2441-0x0000000000490000-0x0000000000491000-memory.dmp

Download

memory/4112-2592-0x0000021B28B20000-0x0000021B28B51000-memory.dmp

Download

memory/4112-2540-0x00000000004A0000-0x00000000004A1000-memory.dmp

Download

memory/4112-1782-0x000001EA2DB40000-0x000001EA2DB71000-memory.dmp

Download

memory/4112-1783-0x000001EA2DD10000-0x000001EA2DD19000-memory.dmp

Download

memory/4292-2529-0x000002768E100000-0x000002768E131000-memory.dmp

Download

memory/4636-339-0x00000213931E0000-0x0000021393211000-memory.dmp

Download

memory/4644-9-0x0000000006450000-0x00000000065AC000-memory.dmp

Download

memory/4644-10-0x0000000006680000-0x000000000671C000-memory.dmp

Download

memory/4644-2-0x0000000004FB0000-0x0000000005042000-memory.dmp

Download

memory/4644-8-0x0000000005160000-0x0000000005170000-memory.dmp

Download

memory/4644-3-0x0000000005160000-0x0000000005170000-memory.dmp

Download

memory/4644-7-0x0000000005170000-0x0000000005231000-memory.dmp

Download

memory/4644-6-0x0000000005620000-0x000000000563A000-memory.dmp

Download

memory/4644-4-0x0000000005060000-0x000000000506A000-memory.dmp

Download

memory/4644-5-0x0000000006EB0000-0x0000000006ED2000-memory.dmp

Download

memory/4644-1-0x0000000005650000-0x0000000005BF6000-memory.dmp

Download

memory/4644-0-0x00000000003A0000-0x000000000051C000-memory.dmp

Download

memory/4644-18-0x0000000005170000-0x0000000005231000-memory.dmp

Download

memory/4712-57-0x000001B2D2330000-0x000001B2D24AC000-memory.dmp

Download

memory/5176-1471-0x0000022439F10000-0x0000022439F41000-memory.dmp

Download

memory/5604-2597-0x0000000001370000-0x0000000001389000-memory.dmp

Download

memory/5864-1452-0x0000023DCE960000-0x0000023DCE991000-memory.dmp

Download

memory/5884-1472-0x000002687D0D0000-0x000002687D101000-memory.dmp

Download

memory/6008-1203-0x000001AE1E260000-0x000001AE1E291000-memory.dmp

Download