fbb4711f7ebf2cb283d841ed32aaa4f2621bbe33e2ab9c8e2635ef420a8e6708

Analysis

max time kernel
300s
max time network
291s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260130-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260130-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
04/04/2026, 22:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Setup.exe
Size 94KB
Sample260404-2kzfpsa15t
SHA256 fbb4711f7ebf2cb283d841ed32aaa4f2621bbe33e2ab9c8e2635ef420a8e6708
MD5 8f59cb11d5deea39b57fd1aad862a033
SHA1 e3fbf90165348db681c0ea3b338d552b2e6f6a7c
SHA512 2307caac2579e8e296e862a89e899131813d900966e63c6dc7e1cbb576269ae798fb28b4b554c468aee61dadbdfa19664ea6a715c2e101b6ca29618055f3c06a
SSDEEP 1536:Ynb4ktkUoY8WIxHHWMpdPa5wiE21M8kJIGFvb1Cwr/d3sbasVp7:YxkUlUwMpdCq/IM8uIGfB/d3sbaW7
TLSH
T1D893F541E62DBDDDE148D4310A76E0F25E24EC3176C4A51EA7F37F0628716A3F90A93A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence spyware stealer

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
8052	ls_crashpad_handler.exe
3968	ls_crashpad_handler.exe

Loads dropped DLL 8 IoCs

pid	Process
8052	ls_crashpad_handler.exe
8052	ls_crashpad_handler.exe
8052	ls_crashpad_handler.exe
8052	ls_crashpad_handler.exe
8052	ls_crashpad_handler.exe
8052	ls_crashpad_handler.exe
3968	ls_crashpad_handler.exe
3968	ls_crashpad_handler.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

pid	Process
5796	Setup.exe
5796	Setup.exe
5796	Setup.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Program crash 3 IoCs

pid	pid_target	Process	procid_target
3472	5796	WerFault.exe	82
3940	5796	WerFault.exe	82
2588	5796	WerFault.exe	82

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dllhost.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2140	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134198160758328225"	chrome.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3579476765-2645189491-1706875375-1000_Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	dllhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3579476765-2645189491-1706875375-1000_Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\AppPath = "C:\\Users\\Admin\\AppData\\Roaming\\Mozilla\\Extensions\\14A25EFF"	dllhost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
5796	Setup.exe
5796	Setup.exe
5796	Setup.exe
5796	Setup.exe
5796	Setup.exe
5796	Setup.exe
5968	chrome.exe
5968	chrome.exe
5968	chrome.exe
5968	chrome.exe
5796	Setup.exe
5796	Setup.exe
5796	Setup.exe

Suspicious behavior: MapViewOfSection 4 IoCs

pid	Process
5796	Setup.exe
5796	Setup.exe
5796	Setup.exe
5796	Setup.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeBackupPrivilege	5796	Setup.exe
Token: SeShutdownPrivilege	5968	chrome.exe
Token: SeCreatePagefilePrivilege	5968	chrome.exe
Token: SeShutdownPrivilege	5968	chrome.exe
Token: SeCreatePagefilePrivilege	5968	chrome.exe
Token: SeShutdownPrivilege	5968	chrome.exe
Token: SeCreatePagefilePrivilege	5968	chrome.exe
Token: SeShutdownPrivilege	5968	chrome.exe
Token: SeCreatePagefilePrivilege	5968	chrome.exe
Token: SeShutdownPrivilege	5968	chrome.exe
Token: SeCreatePagefilePrivilege	5968	chrome.exe
Token: SeShutdownPrivilege	5968	chrome.exe
Token: SeCreatePagefilePrivilege	5968	chrome.exe
Token: SeShutdownPrivilege	5968	chrome.exe
Token: SeCreatePagefilePrivilege	5968	chrome.exe
Token: SeShutdownPrivilege	5968	chrome.exe
Token: SeCreatePagefilePrivilege	5968	chrome.exe
Token: SeShutdownPrivilege	5968	chrome.exe
Token: SeCreatePagefilePrivilege	5968	chrome.exe
Token: SeShutdownPrivilege	5968	chrome.exe
Token: SeCreatePagefilePrivilege	5968	chrome.exe
Token: SeShutdownPrivilege	5968	chrome.exe
Token: SeCreatePagefilePrivilege	5968	chrome.exe
Token: SeShutdownPrivilege	5968	chrome.exe
Token: SeCreatePagefilePrivilege	5968	chrome.exe
Token: SeShutdownPrivilege	5968	chrome.exe
Token: SeCreatePagefilePrivilege	5968	chrome.exe
Token: SeShutdownPrivilege	5968	chrome.exe
Token: SeCreatePagefilePrivilege	5968	chrome.exe
Token: SeShutdownPrivilege	5968	chrome.exe
Token: SeCreatePagefilePrivilege	5968	chrome.exe
Token: SeShutdownPrivilege	5968	chrome.exe
Token: SeCreatePagefilePrivilege	5968	chrome.exe
Token: SeShutdownPrivilege	5968	chrome.exe
Token: SeCreatePagefilePrivilege	5968	chrome.exe
Token: SeShutdownPrivilege	5968	chrome.exe
Token: SeCreatePagefilePrivilege	5968	chrome.exe
Token: SeShutdownPrivilege	5968	chrome.exe
Token: SeCreatePagefilePrivilege	5968	chrome.exe
Token: SeShutdownPrivilege	5968	chrome.exe
Token: SeCreatePagefilePrivilege	5968	chrome.exe
Token: SeShutdownPrivilege	5968	chrome.exe
Token: SeCreatePagefilePrivilege	5968	chrome.exe
Token: SeShutdownPrivilege	5968	chrome.exe
Token: SeCreatePagefilePrivilege	5968	chrome.exe
Token: SeShutdownPrivilege	5968	chrome.exe
Token: SeCreatePagefilePrivilege	5968	chrome.exe
Token: SeShutdownPrivilege	5968	chrome.exe
Token: SeCreatePagefilePrivilege	5968	chrome.exe
Token: SeShutdownPrivilege	5968	chrome.exe
Token: SeCreatePagefilePrivilege	5968	chrome.exe
Token: SeShutdownPrivilege	5968	chrome.exe
Token: SeCreatePagefilePrivilege	5968	chrome.exe
Token: SeShutdownPrivilege	5968	chrome.exe
Token: SeCreatePagefilePrivilege	5968	chrome.exe
Token: SeShutdownPrivilege	5968	chrome.exe
Token: SeCreatePagefilePrivilege	5968	chrome.exe
Token: SeShutdownPrivilege	5968	chrome.exe
Token: SeCreatePagefilePrivilege	5968	chrome.exe
Token: SeShutdownPrivilege	5968	chrome.exe
Token: SeCreatePagefilePrivilege	5968	chrome.exe
Token: SeShutdownPrivilege	5968	chrome.exe
Token: SeCreatePagefilePrivilege	5968	chrome.exe
Token: SeShutdownPrivilege	5968	chrome.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5968	chrome.exe

Suspicious use of WriteProcessMemory 51 IoCs

description	pid	Process	procid_target
PID 5796 wrote to memory of 5968	5796	Setup.exe	91
PID 5796 wrote to memory of 5968	5796	Setup.exe	91
PID 5968 wrote to memory of 684	5968	chrome.exe	93
PID 5968 wrote to memory of 5724	5968	chrome.exe	94
PID 5968 wrote to memory of 2140	5968	chrome.exe	95
PID 5968 wrote to memory of 3588	5968	chrome.exe	96
PID 5968 wrote to memory of 4092	5968	chrome.exe	97
PID 5968 wrote to memory of 2496	5968	chrome.exe	98
PID 5968 wrote to memory of 5516	5968	chrome.exe	99
PID 5968 wrote to memory of 4336	5968	chrome.exe	100
PID 5968 wrote to memory of 5688	5968	chrome.exe	101
PID 5968 wrote to memory of 5508	5968	chrome.exe	102
PID 5968 wrote to memory of 4688	5968	chrome.exe	103
PID 5968 wrote to memory of 2340	5968	chrome.exe	104
PID 5968 wrote to memory of 5128	5968	chrome.exe	107
PID 5968 wrote to memory of 5880	5968	chrome.exe	110
PID 5968 wrote to memory of 1912	5968	chrome.exe	111
PID 5968 wrote to memory of 1444	5968	chrome.exe	112
PID 5968 wrote to memory of 5464	5968	chrome.exe	113
PID 5968 wrote to memory of 2268	5968	chrome.exe	115
PID 5968 wrote to memory of 1004	5968	chrome.exe	116
PID 5968 wrote to memory of 548	5968	chrome.exe	117
PID 5968 wrote to memory of 4424	5968	chrome.exe	118
PID 5968 wrote to memory of 5600	5968	chrome.exe	119
PID 5968 wrote to memory of 4236	5968	chrome.exe	120
PID 5968 wrote to memory of 3600	5968	chrome.exe	121
PID 5968 wrote to memory of 3500	5968	chrome.exe	122
PID 5968 wrote to memory of 5832	5968	chrome.exe	123
PID 5968 wrote to memory of 3440	5968	chrome.exe	124
PID 5968 wrote to memory of 556	5968	chrome.exe	125
PID 5968 wrote to memory of 5912	5968	chrome.exe	126
PID 5968 wrote to memory of 4576	5968	chrome.exe	127
PID 5968 wrote to memory of 3544	5968	chrome.exe	129
PID 5968 wrote to memory of 3100	5968	chrome.exe	130
PID 5968 wrote to memory of 2432	5968	chrome.exe	131
PID 5968 wrote to memory of 3732	5968	chrome.exe	132
PID 5968 wrote to memory of 5516	5968	chrome.exe	135
PID 5968 wrote to memory of 4116	5968	chrome.exe	137
PID 5968 wrote to memory of 5512	5968	chrome.exe	138
PID 5968 wrote to memory of 4460	5968	chrome.exe	139
PID 5968 wrote to memory of 4584	5968	chrome.exe	140
PID 5796 wrote to memory of 1456	5796	Setup.exe	141
PID 5796 wrote to memory of 1456	5796	Setup.exe	141
PID 1456 wrote to memory of 232	1456	chrome.exe	143
PID 5796 wrote to memory of 7792	5796	Setup.exe	144
PID 5796 wrote to memory of 7792	5796	Setup.exe	144
PID 5796 wrote to memory of 912	5796	Setup.exe	146
PID 5796 wrote to memory of 912	5796	Setup.exe	146
PID 5796 wrote to memory of 8552	5796	Setup.exe	148
PID 5796 wrote to memory of 8552	5796	Setup.exe	148
PID 8552 wrote to memory of 8052	8552	dllhost.exe	149

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Setup.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5796
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5796 -s 904
  2⤵
  - Program crash
  PID:3472
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5796 -s 1016
  2⤵
  - Program crash
  PID:3940
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5796 -s 1008
  2⤵
  - Program crash
  PID:2588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  C:\Program Files\Google\Chrome\Application\chrome.exe
  2⤵
  - Drops file in Windows directory
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5968
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5968240659046 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5968240659046\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5968240659046 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x2a0,0x2a4,0x2a8,0x260,0x2ac,0x7ffc18b8c728,0x7ffc18b8c734,0x7ffc18b8c740
    3⤵
    PID:684
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --headless=new --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5968240659046" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=1936,i,10603797059578913580,15602060108629264056,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=1924 /prefetch:2
    3⤵
    PID:5724
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5968240659046" --force-high-res-timeticks=disabled --field-trial-handle=1936,i,10603797059578913580,15602060108629264056,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=1928 /prefetch:3
    3⤵
    - System Time Discovery
    PID:2140
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5968240659046" --force-high-res-timeticks=disabled --field-trial-handle=1936,i,10603797059578913580,15602060108629264056,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:8
    3⤵
    PID:3588
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5968240659046" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=1936,i,10603797059578913580,15602060108629264056,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2684 /prefetch:1
    3⤵
    PID:4092
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5968240659046" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=1936,i,10603797059578913580,15602060108629264056,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2688 /prefetch:1
    3⤵
    PID:2496
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5968240659046" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=1936,i,10603797059578913580,15602060108629264056,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3176 /prefetch:1
    3⤵
    PID:5516
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5968240659046" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=1936,i,10603797059578913580,15602060108629264056,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3208 /prefetch:2
    3⤵
    PID:4336
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5968240659046" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=1936,i,10603797059578913580,15602060108629264056,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3224 /prefetch:2
    3⤵
    PID:5688
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5968240659046" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=1936,i,10603797059578913580,15602060108629264056,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:1
    3⤵
    PID:5508
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5968240659046" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=1936,i,10603797059578913580,15602060108629264056,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:1
    3⤵
    PID:4688
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5968240659046" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=1936,i,10603797059578913580,15602060108629264056,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4076 /prefetch:2
    3⤵
    PID:2340
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5968240659046" --force-high-res-timeticks=disabled --field-trial-handle=1936,i,10603797059578913580,15602060108629264056,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:8
    3⤵
    PID:5128
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5968240659046" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=1936,i,10603797059578913580,15602060108629264056,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3812 /prefetch:1
    3⤵
    PID:5880
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5968240659046" --force-high-res-timeticks=disabled --field-trial-handle=1936,i,10603797059578913580,15602060108629264056,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4684 /prefetch:8
    3⤵
    PID:1912
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5968240659046" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --field-trial-handle=1936,i,10603797059578913580,15602060108629264056,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4200 /prefetch:1
    3⤵
    PID:1444
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5968240659046" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=1936,i,10603797059578913580,15602060108629264056,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4784 /prefetch:1
    3⤵
    PID:5464
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5968240659046" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --field-trial-handle=1936,i,10603797059578913580,15602060108629264056,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4792 /prefetch:1
    3⤵
    PID:2268
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5968240659046" --force-high-res-timeticks=disabled --field-trial-handle=1936,i,10603797059578913580,15602060108629264056,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4796 /prefetch:8
    3⤵
    PID:1004
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5968240659046" --force-high-res-timeticks=disabled --field-trial-handle=1936,i,10603797059578913580,15602060108629264056,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4136 /prefetch:8
    3⤵
    PID:548
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5968240659046" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --field-trial-handle=1936,i,10603797059578913580,15602060108629264056,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2700 /prefetch:1
    3⤵
    PID:4424
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5968240659046" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --field-trial-handle=1936,i,10603797059578913580,15602060108629264056,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4604 /prefetch:1
    3⤵
    PID:5600
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5968240659046" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --field-trial-handle=1936,i,10603797059578913580,15602060108629264056,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4868 /prefetch:1
    3⤵
    PID:4236
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5968240659046" --force-high-res-timeticks=disabled --field-trial-handle=1936,i,10603797059578913580,15602060108629264056,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4800 /prefetch:8
    3⤵
    PID:3600
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5968240659046" --force-high-res-timeticks=disabled --field-trial-handle=1936,i,10603797059578913580,15602060108629264056,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4876 /prefetch:8
    3⤵
    PID:3500
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5968240659046" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --field-trial-handle=1936,i,10603797059578913580,15602060108629264056,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5096 /prefetch:1
    3⤵
    PID:5832
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5968240659046" --force-high-res-timeticks=disabled --field-trial-handle=1936,i,10603797059578913580,15602060108629264056,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:8
    3⤵
    PID:3440
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5968240659046" --force-high-res-timeticks=disabled --field-trial-handle=1936,i,10603797059578913580,15602060108629264056,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4908 /prefetch:8
    3⤵
    PID:556
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5968240659046" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --field-trial-handle=1936,i,10603797059578913580,15602060108629264056,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4864 /prefetch:1
    3⤵
    PID:5912
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5968240659046" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --field-trial-handle=1936,i,10603797059578913580,15602060108629264056,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4896 /prefetch:1
    3⤵
    PID:4576
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5968240659046" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --field-trial-handle=1936,i,10603797059578913580,15602060108629264056,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5112 /prefetch:1
    3⤵
    PID:3544
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5968240659046" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --field-trial-handle=1936,i,10603797059578913580,15602060108629264056,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4840 /prefetch:2
    3⤵
    PID:3100
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5968240659046" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --field-trial-handle=1936,i,10603797059578913580,15602060108629264056,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4824 /prefetch:2
    3⤵
    PID:2432
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5968240659046" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --field-trial-handle=1936,i,10603797059578913580,15602060108629264056,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4760 /prefetch:1
    3⤵
    PID:3732
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5968240659046" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --field-trial-handle=1936,i,10603797059578913580,15602060108629264056,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3148 /prefetch:1
    3⤵
    PID:5516
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --message-loop-type-ui --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5968240659046" --force-high-res-timeticks=disabled --field-trial-handle=1936,i,10603797059578913580,15602060108629264056,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5096 /prefetch:8
    3⤵
    PID:4116
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --message-loop-type-ui --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5968240659046" --force-high-res-timeticks=disabled --field-trial-handle=1936,i,10603797059578913580,15602060108629264056,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:8
    3⤵
    PID:5512
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --message-loop-type-ui --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5968240659046" --force-high-res-timeticks=disabled --field-trial-handle=1936,i,10603797059578913580,15602060108629264056,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:8
    3⤵
    PID:4460
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5968240659046" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --field-trial-handle=1936,i,10603797059578913580,15602060108629264056,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:1
    3⤵
    PID:4584
- C:\Program Files\Google\Chrome\Application\chrome.exe
  C:\Program Files\Google\Chrome\Application\chrome.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1456
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome1456240734000 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome1456240734000\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome1456240734000 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x29c,0x2a0,0x2a4,0x284,0x2a8,0x7ffc18b8c728,0x7ffc18b8c734,0x7ffc18b8c740
    3⤵
    PID:232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  2⤵
  PID:7792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  2⤵
  PID:912
- C:\Windows\SysWOW64\dllhost.exe
  "C:\Windows\SysWOW64\dllhost.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:8552
- - C:\Users\Admin\AppData\Roaming\Mozilla\Extensions\14A25EFF\ls_crashpad_handler.exe
    "C:\Users\Admin\AppData\Roaming\Mozilla\Extensions\14A25EFF\ls_crashpad_handler.exe" "C:\Users\Admin\AppData\Roaming\Mozilla\Extensions\14A25EFF\node_modules.asar"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:8052

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 5796 -ip 5796
1⤵
PID:5604

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 5796 -ip 5796
1⤵
PID:4336

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 5796 -ip 5796
1⤵
PID:5012

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4324

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5972

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3904

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:9136

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3076

C:\Users\Admin\AppData\Roaming\Mozilla\Extensions\14A25EFF\ls_crashpad_handler.exe
C:\Users\Admin\AppData\Roaming\Mozilla\Extensions\14A25EFF\ls_crashpad_handler.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3968

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

993ab86b-ca10-48a0-a1ca-4f91e769dec2.tmp

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5968240659046\993ab86b-ca10-48a0-a1ca-4f91e769dec2.tmp
Size 104KB
SHA256 4b1811b428d1f5dcb07520f02c4bff1704305c58eace1e47db6d7437bf8383e9
MD5 97fec57c000c4624be3e3d6d020a31a2
SHA1 ad5df18eef18f1b254113e861f408775fc905642
SHA512 c4806b1ad30aed0e00f1cbf1fa7131dbc1dbbb310b815a1763f27f2ee83ddddfde2dedfd0caa129f83958deaa5fad3499b63f0081032f5a3d207013f10679632
SSDEEP 1536:+BTLHQz1BK+8bgylZA0XPDLxmsPsiFab07v9qncIRe3XU5uU1HkskW6cgHNrkC5:+BvuKVkMjPxU0ORe3XUw+HkuyL
TLSH
T1B3A3023ED2786DFB0C27429A34543F8219E0321FA7A069A562DBDE5C56DD7C08B27C36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

184ea7c7-80b8-48a5-9cf7-fec2779be5c3.tmp

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5968240659046\Default\184ea7c7-80b8-48a5-9cf7-fec2779be5c3.tmp
Size 17KB
SHA256 4ca78054c86b1036aac2ada58096c86417a8c1d23c665fe5e8df09ed6abcde77
MD5 ce15f744e120e877e1c8bbe74b52e691
SHA1 21320452fc409da6de57923f62468476263e0210
SHA512 20743fde46bdb6006e6a66edab57fd9526a623199611be053ef758860ad20be0d4cfa9b65e7a855a91b5a32bea74e4a4f89ec46b86537db0c7fa936501a9f9f5
SSDEEP 384:2gj657KxkXqKf/pUZNCgVLH2Hfgslcc7pLuLcaVAhXOD6x+ErU3O8HG7eUpUQs:2E657KxkXqKf/pUZNCgVLH2Hfgsuc7pM
TLSH
T1A5720A6B6C4C9E7B0F94C68CD8267E4F9CB5024B65E9886587FA5C1903D5BCF010A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5968240659046\Default\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 ef464b983a61828a40c497ac5814503c2adef77af6bcdbac40c7431c365412d8
MD5 79e09aca6de4395f0f73e805604625c6
SHA1 865fb0ceaa6a432b859522adda256ba0001a8517
SHA512 f1d9949c4469d8fc6b7ac45e1a92bda5fd89efb88ea39f5b7a321c7257155f150b54c5231e8f1f94f049981ef39a806c62ed6d90dede06d9aa08664396ca7f39
TLSH
T174A0021212C54D51CA4017712593068472126E3415176353C3FD08849A722F1451D743
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe587ba3.TMP

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5968240659046\Default\Code Cache\js\index-dir\the-real-index~RFe587ba3.TMP
Size 48B
SHA256 5a98e903584ecd2e0df578ad5d364f3c4e59ba0d9c7e2317dd97981757fcfc24
MD5 d892a8036ff8759dc56898a2db25096c
SHA1 78e4a6753b17d1a8197f30a43d7c800d9ef6a936
SHA512 abfd6b33f634852b2e993700c616ff5afb1b9310e84d49ac8a9e2dc9583702de89d0737bb3ed98820a6fcafe957ab92cd75538c749a59c267c1d5959da579e5c
MD5 SHA1 SHA512

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5968240659046\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.102.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

service_worker_bin_prod.js

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5968240659046\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.102.1_0\service_worker_bin_prod.js
Size 119KB
SHA256 44e1567b23445a6048549ad4e5803f8667cd47dab56f51fdd88af5e197fdfc4c
MD5 18ce505e909a518093e8997d10137e5e
SHA1 28cf223496245138deef2e2024a555bd6bf10dec
SHA512 8007a84c5408ef1f15188104287e21890e77a6a6e0123e223505101b05dff0f317aa23677e2f18693ae9d8fcc656bac6e2f2d8c0435dfe0d17736298d0fa3449
SSDEEP 3072:wFcXPTUeGn+kQ7KcJBiPIvaQLQssqZDUWQm:w04e59VJBLQssqZUm
TLSH
T14FC3E8CDB7A57462436365B5002F000FB23AB8BAE44C85A8F189D9E97DB446D8237F7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5968240659046\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5968240659046\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5968240659046\Default\Network\Network Persistent State
Size 1KB
SHA256 33637635e7afb8a24eb1d6f9c4d27b5e726bdc2d042263e653242627ed90d228
MD5 20813317bc926e56b52541d41aa35b1f
SHA1 3898d2be42ffc1ec623ea764d8f48939dc0e9c3a
SHA512 254e25bda585b3068e3e13126a6d016c0ddde6d7f2491065eabd5d5eb6f87e465d18191e8c2af3a4871ecfd2d1d8042aa5868a1bfb88014e5d7ddeaa63c89763
TLSH
T176318FF7C3E8857D895542F4BB15AE1BCE6E0918432D3C66C8E4AF1F93E2871E14055E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5968240659046\Default\Network\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5968240659046\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5968240659046\Default\Preferences
Size 9KB
SHA256 a10ed1f38eef6d6096296aab41ad1689b517c92c11c40b3b6bd46bc5d365b34a
MD5 3871040e8c8e4fa4d5a3a06f69b4c126
SHA1 e3aaf2e8f5eafe2711b6ef6046dd8e18a780fa58
SHA512 f5f2d3e60aca6b1e135a71ab7bdbc50fb49f4816e502e8d1291ab360f0acb0537c849fc96e6e5f9ac156601a14ac10495dc09089801630437616857749083f32
SSDEEP 192:zRKv1nVQ7v792PRpMTQXsb+WN4aciyIsnAUgE:zRKvtVQDGXRXw40E
TLSH
T1DD12941DAD18A53B9CDAE719F9657B42E2F5203139942D08EBFCC92C28DB6CD2227117
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5968240659046\Default\Preferences
Size 8KB
SHA256 9194a7992fdda1c9d5edf5875f884370f99aff46cb23fc2e44f88067ba13f29e
MD5 a6a5a5fb3375b0a1f8331d4f00e2fbda
SHA1 58899d6d8e0e73b826a7e0a54ee9276962077deb
SHA512 e2c1ea35e42982c74f6a1b215828eb3c4303cd97d4d27e02341cc1f3f69f93f3a6f41101f42ea55b5bd2902615d6f53344b92bb0143fed9cd631947eac83f2e9
SSDEEP 192:zRKv1nVQ7v79APRp2QXsb+WN4KhiyIsnAUge:zRKvtVQDMXHXw4Xe
TLSH
T1BA02932DAD28A53F5CC7E319F9657B42E6F5102139942C48EBFCC92C28DB6CD222B517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5968240659046\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 10afa6787fb49cb24ccbdd5876219263809793b42b6dc11493166eed93bb0254
MD5 ba1815bdeebd3684191716cffd9378a4
SHA1 44f661afdc90651fa197ecc05e1e86e6992a1e13
SHA512 91687e78c80fa0d3b09f2b25aa4852eb03a0d810bacfa08eaf645244c0b74a05ed99a49ef0264b2d03bf9f4f1215b7e782cfaee86c7956ee0f2014708d55e825
TLSH
T1CCB01201E2473D50C80041F03107308963105F2184000742A3F0F9B99C470D49354121
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5890c2.TMP

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5968240659046\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5890c2.TMP
Size 72B
SHA256 e16ddd48b9abfc22fb96f6e1999df4f8b0f5eda06c854a31c3b375e75b8875d9
MD5 ecea4858a185cdfd8ecf4357b4bcbb04
SHA1 3f86f2d6397634fc7e0ecfa86b86bb857d187c50
SHA512 b574ef6d00a8d4392eb90daba8463799d0df398cbb35d6079226caa7e91bfefe34b0d3af45aceef094a2bdcd0c2f520f2705e6aa3ae5a6feceeacb559f476ac0
TLSH
T1BEA0026143459111D21402B028C5A38C5341B9668100221376E08787CC71050A919144
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5968240659046\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5968240659046\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5968240659046\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 c1aae084c3d1688e83318633e7df318e72538d1423980030dc14a644650bfd37
MD5 a352c08219477635f87421659a400e51
SHA1 c288deefc0efd63e4b7b425e0f68a48f38a8f4ac
SHA512 a5597ee9a5ea2088a5443bfd2477b2f716092ef8ea2c63bdb8ee58983b05b7fc223ead78f831baab99efe16637f7b9421ff35b398f1aae10fb5673d6b391db39
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5968240659046\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 4aebef85b11b7886dd35fa16785e40958296cd114e3eab2c0af1e72b2418e78a
MD5 c20653aab2c507d9d9034bc259ac7ec0
SHA1 2669f4dcb09c16ba77676501c02c07b34e048bdb
SHA512 ffa68d19777947a4fd5a1b6409fa95956d1e1a8553b59ffcf033fed61d4acd0abd0956b648a8e6243b033819464f1a4f04966fb32c4414fe2c2101bf31e3dbb2
TLSH
T148A0022542C04435CD0AC27070614A45326588583D65936359B354849C5F1D2470A912
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5968240659046\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnWebGPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5968240659046\Default\shared_proto_db\metadata\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5968240659046\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5968240659046\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5968240659046\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5968240659046\Local State
Size 105KB
SHA256 18449558fd6f98c4b71564e7142aa279740547b207cb07df940ed222e0938f45
MD5 108f9c8cf30fa5a8a4110448f8decea8
SHA1 8d096dbf5ffc4c6d3f3836388000cfa4ee67b2e7
SHA512 7e1357915b94e44bbe97580598fc5644fba65980fa7d31c9c8bba82897564be05b64e11eace0c1062c286585d93ab5c751fd2d620311c5cb1e079aeacc0c6e6f
SSDEEP 1536:CBTLHQz1BK+8bgylZA0XPDLxmsPsiFab07v9qncIRe3XU5uU1HkskW6cgHNrkC5:CBvuKVkMjPxU0ORe3XUw+HkuyL
TLSH
T1AFB3023AE2682DA70C73429934402B425DF0736FA7A4A9A566DF9E1C56CC7C0CF27C36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5968240659046\Local State
Size 105KB
SHA256 b72fb994d03a787495843a14a333db436cb1ca409891736f4d2279a44d93c2ee
MD5 9b61c377d3a39beb3980eb0250270083
SHA1 ba9e03f61f6404de790aab868c393754a325132e
SHA512 d90765196b5ae5ed53a960d0d2b438ea83b6042d261a0aa3c5b8e11791697d6fff3021ade3d57c59c1146b5855dc8f59d9c3620e3b8d7345674fc6f6b730e3ed
SSDEEP 1536:3BTLHQz1BK+8bgylZA0XPDLxmsPsiFab07v9qncIRe3XU5uU1HkskW6cgHNrkC5:3BvuKVkMjPxU0ORe3XUw+HkuyL
TLSH
T102B3023AE2645DEB0C33429934842B425DF0726FA7A49AA567DF9E1C56CC7C0CB27C36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5968240659046\Local State
Size 104KB
SHA256 edfdfb78cfeb51ca239491ed2a9e7dc515246e89d3f9008ab0527987ad644cf8
MD5 13a22a8cb4a0bb2299cc87b881444ccb
SHA1 868e425e5b3dce3a1667c59ca02dfc5dcfb1fc28
SHA512 fd34ce64ebfa6f40382dab6ecb87fee382e326f0a569b9799052453efe64a772f56290081f4b4b0d01d73ec35aea0b35a6e3db37dea1c3846c42ceeed1270fc3
SSDEEP 1536:PBTLHQz1BK+8bgylZA0XPDLxmsPsiFab07v9qncIRe3XU5uU1HkskW6cgHNrkC5:PBvuKVkMjPxU0ORe3XUw+HkuyL
TLSH
T12BA3023ED2786DFB0C27429A34543F8219E0321FA7A069A562DBDE5C56DD7C08B27C36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe5852bf.TMP

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome5968240659046\Local State~RFe5852bf.TMP
Size 1KB
SHA256 f67c8eb20e4f7be3308f44ae0aa8458fb5ac21ac726d4d9ded75c25e97ae0383
MD5 5195d8463002c7fd912fff0bb7130c92
SHA1 152945715382c1ba588ec0f244ba4ff57239fd31
SHA512 8af4cd30588f545c511a222636800bf5af2bd17c9a7a5805e4cdc724996d0d3c3d58cb3f2c0293d5004ff3b54a390ddfdf8a73729088b876c2b9345f4d661ed6
TLSH
T15E11723425FC77296D9B898A5461DBAB0F3412BFC161CB8C6ECC0A01226ABC93313C38
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5968_923666416\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Extensions\14A25EFF\VCRUNTIME140.dll
Size 117KB
SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
MD5 32da96115c9d783a0769312c0482a62d
SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
TLSH
T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Roaming\Mozilla\Extensions\14A25EFF\_ctypes.pyd
Size 139KB
SHA256 3d96bd2fcceac4b94aa4c39a2c28117b67fdef2efb85e8c70153a42232a993f3
MD5 4c2b30ea5dde6369c5e2f757ca4a42c1
SHA1 851aadd8f367fd619fd2fa6718cb13b44b9f5371
SHA512 59769745c33ba4752240dfefc536310b08c89866ba7f3f5df755a69da86622c9c08ce5fdae262f5343f91d865d73c34d8250aaed488add2384193c0e2e015482
SSDEEP 3072:VMUKdJdaAtRdvNu2ZPTbINMVi5bIgcVbnwHLh4dl5rK8IoGPk5:GUyJ0AtRlquVEbIPhkKl5rKE
TLSH
T1BEE37E0B736840A6DAA78138C5739E47FBB1F4521A1097CF42A4C99B2F633926E3F715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Extensions\14A25EFF\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
TLSH
T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ls_crashpad_handler.exe

Path C:\Users\Admin\AppData\Roaming\Mozilla\Extensions\14A25EFF\ls_crashpad_handler.exe
Size 102KB
SHA256 b35f09b876edb18695347860f79acddc68993f711274556156769476cd05ae8a
MD5 e961458d3d879ad7f1f19c99962045a7
SHA1 7407c90d51a900ca290ed1c7783b7f4c77afcb14
SHA512 abcd9fd4fc7f2fccb82cabe13f9b56336ebe84904a108aaffefb7730a77b8552909ccae9a52977a7ef874e661dc786b203dd635ec2aa48925d6c09931ac0c1b6
SSDEEP 1536:YZnTCIxHHWMpdPa5wiE21M8kJIGFvb1CwH/B4syybB89PfIbHYvJr:YZTBwMpdCq/IM8uIGft/B4s5TK
TLSH
T1A1A3E741E62CBDCDE508D4314A75D4F26E24ED327580A51EB7F7BF062871293FA0A93A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

node_modules.asar

Path C:\Users\Admin\AppData\Roaming\Mozilla\Extensions\14A25EFF\node_modules.asar
Size 488KB
SHA256 17942f295631794ab5b83b218762fed70d513110208751f60cadb22ca22af603
MD5 8ffeb9621d83748daf092c7b2936e0ca
SHA1 058905be57e25d70a737d0c4270c4d9785f942c0
SHA512 77d9aff1f146f20940e8db95e2b0486ee571d816689703c12b81ba1fb126f98fa15f9a603b8c28d4e622d6cfb40f88b08d34bb2d7666d441720dc771d5bd3b23
SSDEEP 12288:mJpDtUJCQNXti7mJYmOTLa5eUHM3hbTcKJMfhn9tF6iQLC:0pfmJYm+LYyhUKJK97QLC
TLSH
T110B423D8E5D34DFA211523FD51B8CF904DE60F20A7F983629EAF561DB8A301A13D2758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python3.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Extensions\14A25EFF\python3.dll
Size 73KB
SHA256 482b1c87a8bdd8770ec81f4b0e236de21b5cf3d45a549dc0b051b09732a99dbe
MD5 f1c0a4a859622f79c0fa559196b3e693
SHA1 e11b08542c7bdb82b6a813356bc3d12c8a8eb166
SHA512 026a5e505a1cff26a028810d71f215a93bc6d2faae15105360e3696e4bc640715866d4e757e6356f1da91c6da81bedeb2ec3e0047356a069bd0bdc01764beb82
SSDEEP 1536:RgeqEMJQaQnnujKALOhtuPucLCFha0Zk30Hxs42yp4K2EIlMVOVhki3/oFVYe3/g:RoEMJQn8IoG0QTQ
TLSH
T15D730A525B54F8E2DAB66BFC78D3998D6F2B02CC43258C9CA47D93D20DD6312A62734C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python315._pth

Path C:\Users\Admin\AppData\Roaming\Mozilla\Extensions\14A25EFF\python315._pth
Size 80B
SHA256 c7f3432f90e8f04c78ff2cef76cf51e50a13ed922f0bcc63fa34aa4decc5770c
MD5 226b7a3e899ba566037018eca15b58f4
SHA1 b495729652c313dae06e06e28d9cf8e6ac065630
SHA512 2ed2aa7ee9b0a00c6deb2b6e42be37b10ff94bb9b1f28fcdbd7ffbd0662d98252ceeaed8d934ed686c52f84339354b903e7487cc698bb7703e516d46471da415
TLSH
T165A0220208A30080002022283FC000F88F32330CCB003A0C8EC82E380200E30ABFA02F
MD5 SHA1 SHA512 TLSH

Submit Download

python315.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Extensions\14A25EFF\python315.dll
Size 6.9MB
SHA256 46d30acdb729ca35aefeac6e5ab5e00cf8c2ec823e922e8aebe82a412e832336
MD5 1d42f83fa0e0d4b7fa3b1373106e20ad
SHA1 4ed616b72e92c0e3e08a624c60696028cc3f162f
SHA512 d4dd427309a998a39828c37bc09bdedb40eef66b6879f4a8a7f4a3cbd00e4feef14418320f0f219d185c43dbe02d1895d8338e9ccc64e856a126bd2f5df70bac
SSDEEP 98304:gqTOlq8oFq1Ou0WImwTesHe84OLWv7HDMiEzhct0kymRzP:Vj8oFg5zIFTpHlir1RzP
TLSH
T1B1769D3A735515A5D9BB8036C9030647EBB1BC006A20C34B52A4B6DE2F773A35BEE735
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python315.zip

Path C:\Users\Admin\AppData\Roaming\Mozilla\Extensions\14A25EFF\python315.zip
Size 4.4MB
SHA256 0e029c316b6bc7931064a1b5dd2f18213a0581bf447fffbbf687e6cca573aa21
MD5 d6e54e53978b3d55671595687d974681
SHA1 a6cd0720c1bfafa34cae5d15f1b5247860dff5bc
SHA512 7bc8a419dd5f94fdd5cfd56dcfb2c151fd0c3458d1cc032a056cd8f73d314b7f0458ea558cc768c876ce7d9cccb9afd200d93a80653744fa31fd5bccfa61205c
SSDEEP 98304:5bdnbOs9GsVrCtPBdNZXL54QB1pP7qa2b6Y0KIvQTLDL:pdbr9nle7zXL54QB1t7qao6YbOQ3DL
TLSH
T17A2633A2D668D813D667F23813A4DA0A815DE7D468CCF91FADD871999F434C0E70E88B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5796-1099-0x0000000000A60000-0x0000000000ACF000-memory.dmp

Download

memory/5796-1052-0x0000000000A60000-0x0000000000ACF000-memory.dmp

Download

memory/5796-1004-0x0000000000A60000-0x0000000000ACF000-memory.dmp

Download

memory/5796-990-0x0000000000A60000-0x0000000000ACF000-memory.dmp

Download

memory/5796-1213-0x0000000000A60000-0x0000000000ACF000-memory.dmp

Download

memory/5796-1212-0x0000000000A60000-0x0000000000ACF000-memory.dmp

Download

memory/5796-983-0x000000007F2D0000-0x000000007F2D1000-memory.dmp

Download

memory/5796-981-0x0000000000A60000-0x0000000000ACF000-memory.dmp

Download

memory/5796-1216-0x000000007F420000-0x000000007F467000-memory.dmp

Download

memory/5796-1229-0x000000007F480000-0x000000007F481000-memory.dmp

Download

memory/5796-1231-0x0000000002CF0000-0x0000000002D3D000-memory.dmp

Download

memory/5796-1230-0x0000000000AE0000-0x0000000000AE3000-memory.dmp

Download

memory/5796-1524-0x0000000002CF0000-0x0000000002D3D000-memory.dmp

Download

memory/5796-1523-0x0000000002CF0000-0x0000000002D3D000-memory.dmp

Download

memory/5796-1525-0x0000000002CF0000-0x0000000002D3D000-memory.dmp

Download

memory/5796-1527-0x0000000002CF0000-0x0000000002D3D000-memory.dmp

Download

memory/5796-1529-0x0000000002CF0000-0x0000000002D3D000-memory.dmp

Download

memory/5796-1531-0x0000000002CF0000-0x0000000002D3D000-memory.dmp

Download

memory/5796-1535-0x0000000002CF0000-0x0000000002D3D000-memory.dmp

Download

memory/5796-1539-0x0000000002CF0000-0x0000000002D3D000-memory.dmp

Download

memory/5796-1543-0x0000000002CF0000-0x0000000002D3D000-memory.dmp

Download

memory/5796-1557-0x0000000002CF0000-0x0000000002D3D000-memory.dmp

Download

memory/5796-1561-0x0000000002CF0000-0x0000000002D3D000-memory.dmp

Download

memory/5796-1559-0x0000000002CF0000-0x0000000002D3D000-memory.dmp

Download

memory/5796-1555-0x0000000002CF0000-0x0000000002D3D000-memory.dmp

Download

memory/5796-1553-0x0000000002CF0000-0x0000000002D3D000-memory.dmp

Download

memory/5796-1551-0x0000000002CF0000-0x0000000002D3D000-memory.dmp

Download

memory/5796-1549-0x0000000002CF0000-0x0000000002D3D000-memory.dmp

Download

memory/5796-1547-0x0000000002CF0000-0x0000000002D3D000-memory.dmp

Download

memory/5796-1545-0x0000000002CF0000-0x0000000002D3D000-memory.dmp

Download

memory/5796-1541-0x0000000002CF0000-0x0000000002D3D000-memory.dmp

Download

memory/5796-1537-0x0000000002CF0000-0x0000000002D3D000-memory.dmp

Download

memory/5796-1533-0x0000000002CF0000-0x0000000002D3D000-memory.dmp

Download

memory/5796-1026-0x0000000000A60000-0x0000000000ACF000-memory.dmp

Download

memory/5796-1025-0x0000000000A60000-0x0000000000ACF000-memory.dmp

Download

memory/5796-1040-0x0000000000A60000-0x0000000000ACF000-memory.dmp

Download

memory/5796-1047-0x0000000000A60000-0x0000000000ACF000-memory.dmp

Download

memory/5796-1018-0x0000000000A60000-0x0000000000ACF000-memory.dmp

Download

memory/5796-1062-0x0000000000A60000-0x0000000000ACF000-memory.dmp

Download

memory/5796-1069-0x0000000000A60000-0x0000000000ACF000-memory.dmp

Download

memory/5796-1077-0x0000000000A60000-0x0000000000ACF000-memory.dmp

Download

memory/5796-1076-0x0000000000A60000-0x0000000000ACF000-memory.dmp

Download

memory/5796-1091-0x0000000000A60000-0x0000000000ACF000-memory.dmp

Download

memory/5796-1098-0x0000000000A60000-0x0000000000ACF000-memory.dmp

Download

memory/5796-0-0x000000007F2D0000-0x000000007F2D1000-memory.dmp

Download

memory/5796-1113-0x0000000000A60000-0x0000000000ACF000-memory.dmp

Download

memory/5796-1120-0x0000000000A60000-0x0000000000ACF000-memory.dmp

Download

memory/5796-1127-0x0000000000A60000-0x0000000000ACF000-memory.dmp

Download

memory/5796-1134-0x0000000000A60000-0x0000000000ACF000-memory.dmp

Download

memory/5796-1141-0x0000000000A60000-0x0000000000ACF000-memory.dmp

Download

memory/5796-1146-0x0000000000A60000-0x0000000000ACF000-memory.dmp

Download

memory/5796-1156-0x0000000000A60000-0x0000000000ACF000-memory.dmp

Download

memory/5796-1163-0x0000000000A60000-0x0000000000ACF000-memory.dmp

Download

memory/5796-1170-0x0000000000A60000-0x0000000000ACF000-memory.dmp

Download

memory/5796-1177-0x0000000000A60000-0x0000000000ACF000-memory.dmp

Download

memory/5796-1188-0x0000000000A60000-0x0000000000ACF000-memory.dmp

Download

memory/5796-1197-0x0000000000A60000-0x0000000000ACF000-memory.dmp

Download

memory/5796-1204-0x0000000000A60000-0x0000000000ACF000-memory.dmp

Download

memory/5796-997-0x0000000000A60000-0x0000000000ACF000-memory.dmp

Download

memory/5796-978-0x000000007F2D0000-0x000000007F2D1000-memory.dmp

Download

memory/5796-975-0x000000007F2D0000-0x000000007F2D1000-memory.dmp

Download

memory/5796-972-0x000000007F2D0000-0x000000007F2D1000-memory.dmp

Download

memory/5796-970-0x000000007F2D0000-0x000000007F2D1000-memory.dmp

Download

memory/5796-3-0x000000007F2D0000-0x000000007F2D1000-memory.dmp

Download

memory/5796-14-0x000000007F2D0000-0x000000007F2D1000-memory.dmp

Download

memory/5796-10-0x000000007F2D0000-0x000000007F2D1000-memory.dmp

Download

memory/5796-8-0x000000007F2D0000-0x000000007F2D1000-memory.dmp

Download

memory/5796-969-0x000000007F2D0000-0x000000007F2D1000-memory.dmp

Download

memory/5796-935-0x0000000077193000-0x0000000077194000-memory.dmp

Download

memory/5796-22-0x000000007F2D0000-0x000000007F2D1000-memory.dmp

Download

memory/5796-5-0x000000007F2D0000-0x000000007F2D1000-memory.dmp

Download

memory/5796-6-0x000000007F2D0000-0x000000007F2D1000-memory.dmp

Download

memory/8552-98949-0x0000000004FC0000-0x0000000004FD2000-memory.dmp

Download

memory/8552-98948-0x0000000004BE0000-0x0000000004BFE000-memory.dmp

Download

memory/8552-98947-0x0000000004840000-0x00000000048B6000-memory.dmp

Download

memory/8552-98854-0x0000000002270000-0x00000000022BA000-memory.dmp

Download