solaris_loader | 0b260900b5779bae269c97c0d73a05e32310772798e96aca9585f122d8fcd327

Analysis

max time kernel
24s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/08/2026, 22:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-11_9386d08f36e6e3199e13970f0527e8aa_cobalt-strike_icedid_satacom_vidar.exe
Size 16.2MB
Sample260811-2fekqstbmd
SHA256 0b260900b5779bae269c97c0d73a05e32310772798e96aca9585f122d8fcd327
MD5 9386d08f36e6e3199e13970f0527e8aa
SHA1 d5c2bb990148e7cb528beb1b9de8498727f5098d
SHA512 dfe01fcacb3da87629388004b3e466567e17488a9ea9b511fd220350caa50a57fd11998ba54e32f9ed88d670274ba5f7bc80fffbf1773b3b58e64b470109ef9d
SSDEEP 393216:mNCfPs++vrNYn/1hcyc4qqvKiV6JnI2taSYyn:mNCfPv+xqtdNqqvKRI2cvy
TLSH
T1E307339AEAF279FDC41E22B5378BC641731B7ED79741EF96A1521200CF4B9D18C2A80D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

run discovery downloader execution solaris_loader stealc svcstealer installer loader persistence stealer

Malware Config

Extracted

Family

solaris_loader

196.251.107.186
192.162.199.186
196.251.107.163

Extracted

Family

stealc

Botnet

http://196.251.107.163

rc4.plain

Extracted

Family

svcstealer

http://196.251.107.186/acovp/post.php
http://192.162.199.186/usovp/post.php
http://196.251.107.163/bioxp/post.php

Attributes

build_id
Dropped
srv_delay
1
srv_retry
1

Signatures

Family: SolarisLoader
SolarisLoader is a Windows loader written in C.
loader solaris_loader
Family: Stealc
Stealc is an infostealer written in C++.
stealer stealc
Family: SvcStealer, Diamotrix
SvcStealer aka Diamotrix Clipper is a stealer/downloader written in C++.
stealer downloader svcstealer

Detects Reflective DLL injection artifacts 5 IoCs

resource	yara_rule
behavioral2/memory/4388-39-0x00000165BDC00000-0x00000165BDC03000-memory.dmp	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/memory/1452-71-0x0000000004050000-0x0000000004095000-memory.dmp	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/memory/1452-96-0x00000000066A0000-0x00000000066E5000-memory.dmp	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/memory/1452-234-0x00000000040A0000-0x00000000040E5000-memory.dmp	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/memory/1452-1686-0x00000000040F0000-0x0000000004135000-memory.dmp	INDICATOR_SUSPICIOUS_ReflectiveLoader

Executes dropped EXE 12 IoCs

pid	Process
4268	i6i11w1q.exe
1896	frdpb_v2.exe
2236	prhh39gh.exe
5684	qcau1rcy.exe
3048	hyjqarwg.exe
4440	icyirp1d.exe
3216	prhh39gh.tmp
5132	n9c7ydzf.exe
2068	edcabfbdbebac.exe
1180	ofejl.exe
3068	winhost.exe
5904	n9c7ydzf.exe

Loads dropped DLL 1 IoCs

pid	Process
3216	prhh39gh.tmp

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\System Component Manager = "C:\\Users\\Admin\\AppData\\Roaming\\vauiz\\ofejl.exe"	qcau1rcy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\edcabfbdbebac = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\n9c7ydzf.exe\""	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\edcabfbdbebac = "\"C:\\ProgramData\\edcabfbdbebac.exe\""	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\edcabfbdbebac = "\"C:\\ProgramData\\edcabfbdbebac.exe\""	n9c7ydzf.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	frdpb_v2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	prhh39gh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	prhh39gh.tmp

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2472	chrome.exe
4824	msedge.exe

Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/files/0x000d00000001c4e4-19.dat	innosetup
behavioral2/memory/2236-23-0x0000000000DD0000-0x0000000000ED6000-memory.dmp	innosetup
behavioral2/memory/2236-111-0x0000000000DD0000-0x0000000000ED6000-memory.dmp	innosetup

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1224	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3048	hyjqarwg.exe
3048	hyjqarwg.exe
5132	n9c7ydzf.exe
5132	n9c7ydzf.exe
5684	qcau1rcy.exe
5684	qcau1rcy.exe
1180	ofejl.exe
1180	ofejl.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1452	explorer.exe

Suspicious use of AdjustPrivilegeToken 52 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1452	explorer.exe
Token: SeCreatePagefilePrivilege	1452	explorer.exe
Token: SeShutdownPrivilege	1452	explorer.exe
Token: SeCreatePagefilePrivilege	1452	explorer.exe
Token: SeDebugPrivilege	5684	qcau1rcy.exe
Token: SeShutdownPrivilege	1452	explorer.exe
Token: SeCreatePagefilePrivilege	1452	explorer.exe
Token: SeShutdownPrivilege	1452	explorer.exe
Token: SeCreatePagefilePrivilege	1452	explorer.exe
Token: SeShutdownPrivilege	1452	explorer.exe
Token: SeCreatePagefilePrivilege	1452	explorer.exe
Token: SeShutdownPrivilege	1452	explorer.exe
Token: SeCreatePagefilePrivilege	1452	explorer.exe
Token: SeShutdownPrivilege	1452	explorer.exe
Token: SeCreatePagefilePrivilege	1452	explorer.exe
Token: SeShutdownPrivilege	1452	explorer.exe
Token: SeCreatePagefilePrivilege	1452	explorer.exe
Token: SeShutdownPrivilege	1452	explorer.exe
Token: SeCreatePagefilePrivilege	1452	explorer.exe
Token: SeShutdownPrivilege	1452	explorer.exe
Token: SeCreatePagefilePrivilege	1452	explorer.exe
Token: SeShutdownPrivilege	1452	explorer.exe
Token: SeCreatePagefilePrivilege	1452	explorer.exe
Token: SeShutdownPrivilege	1452	explorer.exe
Token: SeCreatePagefilePrivilege	1452	explorer.exe
Token: SeShutdownPrivilege	1452	explorer.exe
Token: SeCreatePagefilePrivilege	1452	explorer.exe
Token: SeShutdownPrivilege	1452	explorer.exe
Token: SeCreatePagefilePrivilege	1452	explorer.exe
Token: SeDebugPrivilege	1180	ofejl.exe
Token: SeShutdownPrivilege	1452	explorer.exe
Token: SeCreatePagefilePrivilege	1452	explorer.exe
Token: SeShutdownPrivilege	1452	explorer.exe
Token: SeCreatePagefilePrivilege	1452	explorer.exe
Token: SeShutdownPrivilege	1452	explorer.exe
Token: SeCreatePagefilePrivilege	1452	explorer.exe
Token: SeShutdownPrivilege	1452	explorer.exe
Token: SeCreatePagefilePrivilege	1452	explorer.exe
Token: SeShutdownPrivilege	1452	explorer.exe
Token: SeCreatePagefilePrivilege	1452	explorer.exe
Token: SeShutdownPrivilege	1452	explorer.exe
Token: SeCreatePagefilePrivilege	1452	explorer.exe
Token: SeShutdownPrivilege	1452	explorer.exe
Token: SeCreatePagefilePrivilege	1452	explorer.exe
Token: SeShutdownPrivilege	1452	explorer.exe
Token: SeCreatePagefilePrivilege	1452	explorer.exe
Token: SeShutdownPrivilege	1452	explorer.exe
Token: SeCreatePagefilePrivilege	1452	explorer.exe
Token: SeShutdownPrivilege	1452	explorer.exe
Token: SeCreatePagefilePrivilege	1452	explorer.exe
Token: SeShutdownPrivilege	1452	explorer.exe
Token: SeCreatePagefilePrivilege	1452	explorer.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 3708 wrote to memory of 4268	3708	2026-08-11_9386d08f36e6e3199e13970f0527e8aa_cobalt-strike_icedid_satacom_vidar.exe	88
PID 3708 wrote to memory of 1896	3708	2026-08-11_9386d08f36e6e3199e13970f0527e8aa_cobalt-strike_icedid_satacom_vidar.exe	89
PID 3708 wrote to memory of 2236	3708	2026-08-11_9386d08f36e6e3199e13970f0527e8aa_cobalt-strike_icedid_satacom_vidar.exe	90
PID 3708 wrote to memory of 5684	3708	2026-08-11_9386d08f36e6e3199e13970f0527e8aa_cobalt-strike_icedid_satacom_vidar.exe	91
PID 5684 wrote to memory of 5160	5684	qcau1rcy.exe	92
PID 3708 wrote to memory of 3048	3708	2026-08-11_9386d08f36e6e3199e13970f0527e8aa_cobalt-strike_icedid_satacom_vidar.exe	94
PID 5684 wrote to memory of 620	5684	qcau1rcy.exe	95
PID 3048 wrote to memory of 4388	3048	hyjqarwg.exe	58
PID 3048 wrote to memory of 4444	3048	hyjqarwg.exe	59
PID 3048 wrote to memory of 5144	3048	hyjqarwg.exe	79
PID 3048 wrote to memory of 1452	3048	hyjqarwg.exe	80
PID 3708 wrote to memory of 4440	3708	2026-08-11_9386d08f36e6e3199e13970f0527e8aa_cobalt-strike_icedid_satacom_vidar.exe	97
PID 2236 wrote to memory of 3216	2236	prhh39gh.exe	98
PID 3708 wrote to memory of 5132	3708	2026-08-11_9386d08f36e6e3199e13970f0527e8aa_cobalt-strike_icedid_satacom_vidar.exe	99
PID 5132 wrote to memory of 1452	5132	n9c7ydzf.exe	80
PID 5684 wrote to memory of 1224	5684	qcau1rcy.exe	100
PID 5684 wrote to memory of 1452	5684	qcau1rcy.exe	80
PID 5684 wrote to memory of 1452	5684	qcau1rcy.exe	80
PID 1452 wrote to memory of 4700	1452	explorer.exe
PID 1452 wrote to memory of 4404	1452	explorer.exe
PID 1452 wrote to memory of 3528	1452	explorer.exe
PID 1452 wrote to memory of 4536	1452	explorer.exe
PID 1180 wrote to memory of 3276	1180	ofejl.exe	109
PID 1180 wrote to memory of 1452	1180	ofejl.exe	80
PID 1180 wrote to memory of 1452	1180	ofejl.exe	80

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4388

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4444

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:5144
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Adds Run key to start application
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1452
- - C:\Users\Admin\AppData\Local\Temp\2026-08-11_9386d08f36e6e3199e13970f0527e8aa_cobalt-strike_icedid_satacom_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-11_9386d08f36e6e3199e13970f0527e8aa_cobalt-strike_icedid_satacom_vidar.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3708
  - - C:\Users\Admin\AppData\Local\Temp\i6i11w1q.exe
      C:\Users\Admin\AppData\Local\Temp\i6i11w1q.exe
      4⤵
      Executes dropped EXE
      PID:4268
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --log-level=3 --headless=new
        5⤵
        
        PID:108
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome108240794437 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome108240794437\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome108240794437 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0x108,0x138,0x7ffde912c728,0x7ffde912c734,0x7ffde912c740
        6⤵
        
        PID:4296
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome108240794437" --no-pre-read-main-dll --force-high-res-timeticks=disabled --field-trial-handle=2324,i,11664091555646329364,7537553940624955555,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=2360 /prefetch:11
        6⤵
        System Time Discovery
        
        PID:2472
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --headless=new --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome108240794437" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2324,i,11664091555646329364,7537553940624955555,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=2320 /prefetch:2
        6⤵
        
        PID:2924
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome108240794437" --force-high-res-timeticks=disabled --field-trial-handle=2324,i,11664091555646329364,7537553940624955555,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=2412 /prefetch:13
        6⤵
        
        PID:4848
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome108240794437" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=2324,i,11664091555646329364,7537553940624955555,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=3244 /prefetch:1
        6⤵
        
        PID:4284
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome108240794437" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=2324,i,11664091555646329364,7537553940624955555,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=3292 /prefetch:1
        6⤵
        
        PID:5344
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome108240794437" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=2324,i,11664091555646329364,7537553940624955555,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=3728 /prefetch:9
        6⤵
        
        PID:4896
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome108240794437" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=2324,i,11664091555646329364,7537553940624955555,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=3544 /prefetch:1
        6⤵
        
        PID:3232
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome108240794437" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=2324,i,11664091555646329364,7537553940624955555,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=4080 /prefetch:9
        6⤵
        
        PID:5744
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome108240794437" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=2324,i,11664091555646329364,7537553940624955555,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=4496 /prefetch:9
        6⤵
        
        PID:5864
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome108240794437" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=2324,i,11664091555646329364,7537553940624955555,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=3388 /prefetch:1
        6⤵
        
        PID:2500
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome108240794437" --force-high-res-timeticks=disabled --field-trial-handle=2324,i,11664091555646329364,7537553940624955555,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=5176 /prefetch:14
        6⤵
        
        PID:5028
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome108240794437" --force-high-res-timeticks=disabled --field-trial-handle=2324,i,11664091555646329364,7537553940624955555,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=5412 /prefetch:14
        6⤵
        
        PID:688
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome108240794437" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=2324,i,11664091555646329364,7537553940624955555,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=5720 /prefetch:1
        6⤵
        
        PID:5096
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome108240794437" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=2324,i,11664091555646329364,7537553940624955555,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=5732 /prefetch:1
        6⤵
        
        PID:5112
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome108240794437" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=2324,i,11664091555646329364,7537553940624955555,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=4312 /prefetch:1
        6⤵
        
        PID:4716
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome108240794437" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=2324,i,11664091555646329364,7537553940624955555,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=4308 /prefetch:1
        6⤵
        
        PID:5700
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome108240794437" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --field-trial-handle=2324,i,11664091555646329364,7537553940624955555,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=6756 /prefetch:1
        6⤵
        
        PID:5268
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome108240794437" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --field-trial-handle=2324,i,11664091555646329364,7537553940624955555,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=6332 /prefetch:1
        6⤵
        
        PID:1576
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome108240794437" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --field-trial-handle=2324,i,11664091555646329364,7537553940624955555,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=6312 /prefetch:1
        6⤵
        
        PID:6020
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome108240794437" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --field-trial-handle=2324,i,11664091555646329364,7537553940624955555,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=5744 /prefetch:1
        6⤵
        
        PID:3948
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome108240794437" --force-high-res-timeticks=disabled --field-trial-handle=2324,i,11664091555646329364,7537553940624955555,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=3740 /prefetch:14
        6⤵
        
        PID:5400
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome108240794437" --force-high-res-timeticks=disabled --field-trial-handle=2324,i,11664091555646329364,7537553940624955555,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=3728 /prefetch:14
        6⤵
        
        PID:1092
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome108240794437" --force-high-res-timeticks=disabled --field-trial-handle=2324,i,11664091555646329364,7537553940624955555,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=4236 /prefetch:14
        6⤵
        
        PID:4300
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome108240794437" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --field-trial-handle=2324,i,11664091555646329364,7537553940624955555,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=4384 /prefetch:1
        6⤵
        
        PID:4084
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome108240794437" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --field-trial-handle=2324,i,11664091555646329364,7537553940624955555,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=4308 /prefetch:9
        6⤵
        
        PID:2896
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome108240794437" --force-high-res-timeticks=disabled --field-trial-handle=2324,i,11664091555646329364,7537553940624955555,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=4236 /prefetch:14
        6⤵
        
        PID:1548
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome108240794437" --force-high-res-timeticks=disabled --field-trial-handle=2324,i,11664091555646329364,7537553940624955555,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=6004 /prefetch:14
        6⤵
        
        PID:3720
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome108240794437" --force-high-res-timeticks=disabled --field-trial-handle=2324,i,11664091555646329364,7537553940624955555,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=3356 /prefetch:14
        6⤵
        
        PID:2524
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome108240794437" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --field-trial-handle=2324,i,11664091555646329364,7537553940624955555,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=5836 /prefetch:9
        6⤵
        
        PID:4840
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome108240794437" --force-high-res-timeticks=disabled --field-trial-handle=2324,i,11664091555646329364,7537553940624955555,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=5724 /prefetch:14
        6⤵
        
        PID:2952
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome108240794437" --force-high-res-timeticks=disabled --field-trial-handle=2324,i,11664091555646329364,7537553940624955555,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=5896 /prefetch:14
        6⤵
        
        PID:4936
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome108240794437" --force-high-res-timeticks=disabled --field-trial-handle=2324,i,11664091555646329364,7537553940624955555,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=3716 /prefetch:14
        6⤵
        
        PID:2812
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --log-level=3 --headless=new
        5⤵
        
        PID:4596
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\HeadlessEdge4596240827375 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\HeadlessEdge4596240827375\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x25c,0x260,0x264,0x258,0x26c,0x7ffde8f5c188,0x7ffde8f5c194,0x7ffde8f5c1a0
        6⤵
        
        PID:5000
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --headless=new --noerrdialogs --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --field-trial-handle=2200,i,6571259689801601986,1785725502139741307,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=2196 /prefetch:2
        6⤵
        
        PID:3420
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2200,i,6571259689801601986,1785725502139741307,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=2324 /prefetch:11
        6⤵
        System Time Discovery
        
        PID:4824
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2200,i,6571259689801601986,1785725502139741307,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=2340 /prefetch:13
        6⤵
        
        PID:5412
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=2200,i,6571259689801601986,1785725502139741307,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=3416 /prefetch:1
        6⤵
        
        PID:4956
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=2200,i,6571259689801601986,1785725502139741307,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=3428 /prefetch:1
        6⤵
        
        PID:2668
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=2200,i,6571259689801601986,1785725502139741307,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=4020 /prefetch:1
        6⤵
        
        PID:3860
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --field-trial-handle=2200,i,6571259689801601986,1785725502139741307,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=4040 /prefetch:9
        6⤵
        
        PID:2120
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --field-trial-handle=2200,i,6571259689801601986,1785725502139741307,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=4108 /prefetch:9
        6⤵
        
        PID:1748
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --field-trial-handle=2200,i,6571259689801601986,1785725502139741307,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=4076 /prefetch:1
        6⤵
        
        PID:3656
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --field-trial-handle=2200,i,6571259689801601986,1785725502139741307,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=4168 /prefetch:1
        6⤵
        
        PID:3444
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --field-trial-handle=2200,i,6571259689801601986,1785725502139741307,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=4204 /prefetch:9
        6⤵
        
        PID:5956
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --field-trial-handle=2200,i,6571259689801601986,1785725502139741307,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=4152 /prefetch:1
        6⤵
        
        PID:3372
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --field-trial-handle=2200,i,6571259689801601986,1785725502139741307,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=4164 /prefetch:9
        6⤵
        
        PID:4988
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --field-trial-handle=2200,i,6571259689801601986,1785725502139741307,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=5464 /prefetch:9
        6⤵
        
        PID:1936
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --field-trial-handle=2200,i,6571259689801601986,1785725502139741307,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=4856 /prefetch:9
        6⤵
        
        PID:3684
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --field-trial-handle=2200,i,6571259689801601986,1785725502139741307,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=5468 /prefetch:9
        6⤵
        
        PID:4576
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --field-trial-handle=2200,i,6571259689801601986,1785725502139741307,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=5480 /prefetch:9
        6⤵
        
        PID:4308
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --field-trial-handle=2200,i,6571259689801601986,1785725502139741307,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=5364 /prefetch:9
        6⤵
        
        PID:4456
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --field-trial-handle=2200,i,6571259689801601986,1785725502139741307,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=3396 /prefetch:1
        6⤵
        
        PID:4192
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --noerrdialogs --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2200,i,6571259689801601986,1785725502139741307,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=6524 /prefetch:14
        6⤵
        
        PID:4168
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --noerrdialogs --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2200,i,6571259689801601986,1785725502139741307,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=5356 /prefetch:14
        6⤵
        
        PID:4956
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --noerrdialogs --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2200,i,6571259689801601986,1785725502139741307,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=4996 /prefetch:14
        6⤵
        
        PID:2908
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --noerrdialogs --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2200,i,6571259689801601986,1785725502139741307,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=4004 /prefetch:14
        6⤵
        
        PID:5848
      - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --noerrdialogs --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2200,i,6571259689801601986,1785725502139741307,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=7248 /prefetch:14
        6⤵
        
        PID:4840
      - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --noerrdialogs --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2200,i,6571259689801601986,1785725502139741307,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=7248 /prefetch:14
        6⤵
        
        PID:1012
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2200,i,6571259689801601986,1785725502139741307,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=7456 /prefetch:14
        6⤵
        
        PID:5880
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2200,i,6571259689801601986,1785725502139741307,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=7628 /prefetch:14
        6⤵
        
        PID:4428
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2200,i,6571259689801601986,1785725502139741307,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=7552 /prefetch:14
        6⤵
        
        PID:5680
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2200,i,6571259689801601986,1785725502139741307,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=7760 /prefetch:14
        6⤵
        
        PID:2304
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --noerrdialogs --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2200,i,6571259689801601986,1785725502139741307,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=7596 /prefetch:14
        6⤵
        
        PID:5352
  - - C:\Users\Admin\AppData\Local\Temp\frdpb_v2.exe
      "C:\Users\Admin\AppData\Local\Temp\frdpb_v2.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1896
  - - C:\Users\Admin\AppData\Local\Temp\prhh39gh.exe
      "C:\Users\Admin\AppData\Local\Temp\prhh39gh.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2236
    - - C:\Users\Admin\AppData\Local\Temp\is-4EK0B93F8Z.tmp\prhh39gh.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-4EK0B93F8Z.tmp\prhh39gh.tmp" /SL5="$14005C,4057916,1011712,C:\Users\Admin\AppData\Local\Temp\prhh39gh.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:3216
  - - C:\Users\Admin\AppData\Local\Temp\qcau1rcy.exe
      C:\Users\Admin\AppData\Local\Temp\qcau1rcy.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:5684
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks.exe /query /tn "Windows Defender Security Scanner" /fo LIST /v
        5⤵
        
        PID:5160
    - - C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /query /tn "Windows Defender Security Scanner"
        5⤵
        
        PID:620
    - - C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /sc minute /tn "Windows Defender Security Scanner" /tr "C:\Users\Admin\AppData\Roaming\vauiz\ofejl.exe"
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1224
  - - C:\Users\Admin\AppData\Local\Temp\hyjqarwg.exe
      "C:\Users\Admin\AppData\Local\Temp\hyjqarwg.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:3048
  - - C:\Users\Admin\AppData\Local\Temp\icyirp1d.exe
      "C:\Users\Admin\AppData\Local\Temp\icyirp1d.exe"
      4⤵
      Executes dropped EXE
      PID:4440
  - - C:\Users\Admin\AppData\Local\Temp\n9c7ydzf.exe
      C:\Users\Admin\AppData\Local\Temp\n9c7ydzf.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:5132

C:\Users\Admin\AppData\Roaming\vauiz\ofejl.exe
C:\Users\Admin\AppData\Roaming\vauiz\ofejl.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1180
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks.exe /query /tn "Windows Defender Security Scanner" /fo LIST /v
  2⤵
  PID:3276

C:\ProgramData\edcabfbdbebac.exe
"C:\ProgramData\edcabfbdbebac.exe"
1⤵
- Executes dropped EXE
PID:2068

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Services\winhost.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Services\winhost.exe
1⤵
- Executes dropped EXE
PID:3068

C:\Users\Admin\AppData\Local\Temp\n9c7ydzf.exe
"C:\Users\Admin\AppData\Local\Temp\n9c7ydzf.exe"
1⤵
- Executes dropped EXE
PID:5904

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4336

C:\Users\Admin\AppData\Roaming\vauiz\ofejl.exe
"C:\Users\Admin\AppData\Roaming\vauiz\ofejl.exe"
1⤵
PID:2576
- C:\Windows\system32\schtasks.exe
  schtasks.exe /query /tn "Windows Defender Security Scanner" /fo LIST /v
  2⤵
  PID:4112

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4300

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5968

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:5280

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1368

C:\Users\Admin\AppData\Roaming\vauiz\ofejl.exe
"C:\Users\Admin\AppData\Roaming\vauiz\ofejl.exe"
1⤵
PID:4696
- C:\Windows\system32\schtasks.exe
  schtasks.exe /query /tn "Windows Defender Security Scanner" /fo LIST /v
  2⤵
  PID:5732

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

edcabfbdbebac.exe

Path C:\ProgramData\edcabfbdbebac.exe
Size 90KB
SHA256 706409b4cfeba987355f41d23c31e047f9b1c851ccacaf49fc243a692f7a3e22
MD5 b4994740359f6302a3047feb3e6d3453
SHA1 723990132e40adab04d65fd38e15e2d3044ceeae
SHA512 e4bdd846611147115d00368b28ce8d2d100cc4934c8000913b5bde137130ba3681d411d5f2119a68c93980770e913fe2654bdedd88dcbe3ea467724d41450254
SSDEEP 1536:/Dq9NyTUi+O2IOiJ3hP51h/SeDIiG0hL47okrNTWIxUtGsNTfqroYD4c76j:/Dq99jwx51xhDJXL4DrNTWoU7rqrfD41
TLSH
T1D293CFA7279414F5D9AAD678D5A18F23F2F3B8894A15871F03B8C9852F23362723D707
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

01e7cc67-ba8a-4008-8979-bab3f3c50d22.tmp

Path C:\Users\Admin\AppData\Local\Temp\01e7cc67-ba8a-4008-8979-bab3f3c50d22.tmp
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome108240794437\Default\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 72a3ed76dc1b2563b7dbc1fc506ea07c63be96e251dd6b1ce81e4d93ff7894a3
MD5 9a60538f8ada0b515466c1be9022ecfe
SHA1 2c55bf98751c82d9ed26bcafab5824d0f396457c
SHA512 e8af67a7f28cd4ef1b840da6652aa200b92f98fc7b78b73f1daba2b41b48bbb96107de5f0775a2ef269d29af5eff8985f9e03ca3df8b03bd4bbec6c90655c35f
TLSH
T1C4A0021113D11822CB406674559D47D427114E7603216B13C2F004D8CC632F94503555
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a8e86.TMP

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome108240794437\Default\Code Cache\js\index-dir\the-real-index~RFe5a8e86.TMP
Size 48B
SHA256 f4bfe3b2f5e1661cb9d6ab8d0366a12b6465add0c19f47220abeb177bfa173c1
MD5 9bf2b8474de35cbcbcc7307b92c5b39b
SHA1 4d90e713057900fd46296bb64b5f3d2cf8795101
SHA512 408a0ee30df30a6cbadce528f10d374669d560ade77e0c60880031b99a26751bf5d2ef87270d67a7dcf0de3f3381603643e04da3dab036a929a2d808ba4d74cc
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome108240794437\Default\Extension Rules\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome108240794437\Default\Extension Scripts\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome108240794437\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.108.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

service_worker_bin_prod.js

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome108240794437\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.108.1_0\service_worker_bin_prod.js
Size 131KB
SHA256 5b83ed539c1e9c2769e4e3cd4aa397a66bdd6cfa763e230414c0a885a350903a
MD5 8b795eb263421a7d53c5d4a95646bc45
SHA1 4e48ea3d490b84aa4260a74217ed414bef6b6ad8
SHA512 fb78511b7a274d3c280da40341f19fcd3c2455f6132c41f3e46696e458126a3cec6b27d41b28b2398c622c435a3bb93a2f731fe3e8ed453d365c042b71b8b0dc
SSDEEP 3072:JXNTunelO5KQOpZgLJqVPgbcBJptE/ml/3y7:JAPJOrgmptE/mlP0
TLSH
T17AD3DACCB7A5B4224363A5F5002F010BB23AB8AAE44C85A8F188D9E97D7546D4737F7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome108240794437\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome108240794437\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome108240794437\Default\Network\Network Persistent State
Size 1KB
SHA256 a124bfe04e922ec4629af3cd3c3799ab169dd7aa7f187cc397af7436fdbcac59
MD5 176f4ecea25a338fc9a176e8ecae983a
SHA1 2690acb62b081cdc3997e06e5cd4a76872b44c8f
SHA512 a44ed48d87bda6d3dcf8bfb909af3a1cf1428af39bbbad1d4a0596df9f1b361eb0a8f6ba69c99c2a67a08a2d9ffda70d9ecb6f2fc52e2bfc40d1f58c6bdbf55f
TLSH
T1BF319BF7C3E8857D895242F8AB157E1BCE2A0A18432C3D56C8E4AF5F93E2871E15095E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5ab9eb.TMP

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome108240794437\Default\Network\Network Persistent State~RFe5ab9eb.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome108240794437\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome108240794437\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 d804f731ffccb2982807ea5b01d4786246485a76a573980a3ff7829a6a81e777
MD5 322cbd15f1794e7a1c423c85d876ed73
SHA1 8d71e534f679458bdf96fa7fa99792d9c409995a
SHA512 5e04112567cdb35a526a2ca43f72da565a5dd233e2cab00d1bbe09c97b1b2e332416cc7b1e26eda6ad532c7786cfa4edee4a22cc08474d0232c903d0d9ca2666
TLSH
T12EB02202C0022203C0C0E3B020C880CC3AB2EF38CF023A02C3E00AC3C80F2F00330800
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a98a7.TMP

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome108240794437\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5a98a7.TMP
Size 72B
SHA256 7fdf574e5311827df64459f65fc25e20d77db85a9855d11402982b844a21ffde
MD5 d57ee467a6e167fe0bd913a6663512af
SHA1 da92847e96735260ca4cbeb9810997e7f0b63019
SHA512 8ed5b8699787bc68a8fe60d7ac746e401f77508fa8dc4fcf9246881f49722c7cda17ca795f897cb749d9249b66cd6845ad4a69bd122600516968261423bc80c1
TLSH
T1CAA0021143C1C550C12047F42805D7C91350BD75C100021377D0438ADDA01504D15195
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome108240794437\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome108240794437\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome108240794437\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome108240794437\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome108240794437\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome108240794437\Local State
Size 123KB
SHA256 9d9c429acfc52265a7e863642ed8f2e42fe391327f95a7b14ad1ce5a3b9d0fc5
MD5 164502db116a684bc5a703f3797305d8
SHA1 a9e2a81e69925bffba2de5d4ceadcba108bade31
SHA512 6be6752342e2256513945121be375af3af95224c477069b107903d743685ed5dbacf0381cb3cc4f7bf96140c8e24eded5f7d8a6486e5736d0a4c415ac8325f60
SSDEEP 3072:uLqi2/AFNBqxqg22pTXGaixDN5GmfW9MBeJ/eSQu1ZnH:aNmqgFXHid39fWeG/eDun
TLSH
T121C312B1EE455FF2028AD29561BA7B347EA09005665CEF33C8BFEE0D16A3E059771039
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe5a638e.TMP

Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome108240794437\Local State~RFe5a638e.TMP
Size 1KB
SHA256 1824482eb327d5ea55d096ff5168a98831730e15ab66607830cab7a955bf1665
MD5 388fb4e4ef292922b9cb33313661cac3
SHA1 ab03292d65002368bb30839dd587963ee10b7a15
SHA512 439ff82a744f746c0c8d312741be444ac8123dc9ba1e1de266766669e9bcefcfa0a027590db9a1f406e50f05ffa98a09270d1c5b18126ee8577eba7493fbd8f2
TLSH
T1AA11D5B0343C77323491459CE5029EB6ED31A223D453C91C9BEC2545097B39C320AC3C
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge4596240827375\Crashpad\settings.dat
Size 280B
SHA256 8d97e6dd0235b0b98897e247104ff02d1ea5b94b9bbb9848c6f994f67737838f
MD5 d295b9cece5bbfac59a000ec03eaedb8
SHA1 5e05d6e2ab74a65bb3b8696f72618eb7c78a0c6b
SHA512 746f6e368afef9a7c153cf7e85a8524336c3a3e9b24d328b06048c5c39901ad6d50f55e989eef454f4880fcc0ca5b7a5ac119aed1f645f09fa10571989e4c310
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge4596240827375\Crashpad\settings.dat
Size 280B
SHA256 d8d27ebdc3064243ee640758df5a9bcf88f41d88461142fab785d4773814172d
MD5 c241459d9cea1928fa155fd66ca5240e
SHA1 e7d557ee764474e75a2a068cd364223c694e2741
SHA512 4e5040e6b5e3ed4cc6ea10ba2d30d8ec7090af40d856069bc103417b9666beebd79b8945f801f2ad4422310ee309c57ce6d73260e5f7b20748467bdf2ed4a1eb
TLSH
T151D022A033C8FB00FF0C22330882E3380300832800A2FB0A0CA303A30E28AC0088B0C0
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge4596240827375\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

128.png

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge4596240827375\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.108.1_0\128.png
Size 4KB
SHA256 41b21cd721317759a1391ec66ec4606b1f1b0a66fc6542ec3e69f9a6ba9a60d3
MD5 a6e517fba00c44d26f516d2bc473042f
SHA1 bcedbf549056bfacff8820cac38713a1eacd95b9
SHA512 8c58b58a05b60420ff187c2dc8b71e019fc36cd6bcec050257b5532f131ba50ecd00fe2ca734805753a39f6911125d2d8684286207b1d1d039e862904279a145
SSDEEP 96:4niq7dWteEb8MsIhE+bf+rgEPQCGJxc4bOdpI0xeblJpzSkLqdsQ4pXnW3P:e97kteEnJEu+rxoi4b3RJpfhQ45nGP
TLSH
T14AA1AFFA12E3DA94303E91711B20659B4D7909385624364DDBB2AC7140C7A0D9B7CF63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge4596240827375\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.108.1_0\_locales\en_US\messages.json
Size 1KB
SHA256 102b586b197ea7d6edfeb874b97f95b05d229ea6a92780ea8544c4ff1e6bc5b1
MD5 578215fbb8c12cb7e6cd73fbd16ec994
SHA1 9471d71fa6d82ce1863b74e24237ad4fd9477187
SHA512 e698b1a6a6ed6963182f7d25ac12c6de06c45d14499ddc91e81bdb35474e7ec9071cfebd869b7d129cb2cd127bc1442c75e408e21eb8e5e6906a607a3982b212
TLSH
T161210707DA04AB37827A6136BC656685F33007EE2201E86F7DBCD50C5F229A791A7798
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge4596240827375\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.108.1_0\manifest.json
Size 2KB
SHA256 bbdc79c9ab2f2514cbc298b3b7fb7506f9e746b597b132c59ad004619c7b9a87
MD5 88668a1cd61c9f5afac6c089f45d6244
SHA1 f064a4ddb0e8110f87a7fc90c9a914e98f6d4ace
SHA512 03db2f0c91ff68a9c3f9e75c728b76599cf786c6f414607601c53987d6c1f9ab42fc234c058d09cb31f00095ed6d054b201a06cc638413e2e45bf66f86f7d65b
TLSH
T10F516DFBBC10AC634BB08594991A710EF729735E45CFC4DBB2BC60734BE4CAA1D60598
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge4596240827375\Default\Network\Network Persistent State
Size 1KB
SHA256 b6195dd304ece46485f6c06b4212f68673964c9028f5543f21abbb2c2458bcd2
MD5 132eee644a07c9648e5944330047338c
SHA1 4b21d6320f07a0fb2126e3cadf780fa2de4dd24c
SHA512 21436fe060dc98a0d025497eb5660c411e890499b0be5752ba97142c16d907a150a74b009816af563b3a063a1baf681de922282b74b05a8c2b7e7344fe49e4a8
TLSH
T12131AFF3C2E8866D890156F0AA187E1BCF2D0914432C3D5AC8E4EF5F93E2871D141D5E
MD5 SHA1 SHA512 TLSH

Submit Download

d0c5aff3-faa3-4f74-8c49-8a97ab0249dc.tmp

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge4596240827375\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\d0c5aff3-faa3-4f74-8c49-8a97ab0249dc.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge4596240827375\Local State
Size 15KB
SHA256 60e11b71c9cf6f80f1e61c51d45202eaecd8a0433ae1903e1b46745b8213d1c6
MD5 4e66572e94dbd063421dd6d7a7395530
SHA1 877d5e193775f4ab05db03c1dec8b07a9d0f49d7
SHA512 5490bb73a3c7ec269eb12e8d2eeee63f9b156cd1571629b63edae29fb4238ffb4133ea7171cc3aa70d93ea7f7c1bb48853840ffefab1d0f167cde715fe08ef3c
SSDEEP 192:uu2sm+xasuheOwQxMG8N+kTfWocDUueKFtldC1hnOPhZ0YtHFpmF8C/TBU+jrZYl:neZcIh8N+MAdrbaOPrXLpe8C/TBq
TLSH
T1FE628DB169786D63A9F6DE45F58927039FF8A037F0E06A98D9FCDB1C05E76550302C22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge4596240827375\Local State
Size 4KB
SHA256 3f5f223cabf7f6ddcab93ebd5d67f9cc3f358dc1a1cfee09ea5833e803ea337f
MD5 ea9eb2f84e2cb3e882d6bcd1e753ca52
SHA1 5f009d7a74f41a5e588256e80fb71a23e2136ed1
SHA512 de34e4579464b4d968ecd1cc004ca3ab00aa24132a93c1c11f7d6b06535e7d3cb0e807723d671584bb1380a9006733ecc934396b2480704e7451d8674e5c4e9a
SSDEEP 96:UqGNknQsFfDu11j58Frh/cInURcDotov8VDjB8QvwLAC0eUcQwEmnq4a:fGNHWtocDUwM90AC1h4
TLSH
T1D9A1A6B16578BC779FF29E09B4866713AFA4613BE0557F94DAEC1A2C04E73980301C23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge4596240827375\Local State
Size 3KB
SHA256 ce1a3c88d1c36997be8c99a794019f6e66c43fc234c22b9dfdef3b7c74e92671
MD5 0bca111e5bcd898411be0f955cba9bd6
SHA1 fe60335c5abe1c43d14ceb27b6aa8ad456b9566d
SHA512 4973fa66d941f1a98b5b968d3891827a088022ce4ebbd86b7c464b5678174082660eac20327b711ba2796a960b7686c61cfa43043c87f701cd67056910fface0
TLSH
T18D8184B16978BD7797F28F09B44A6A23DFB4713BE4217A54EAE8172C04E76581305C32
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe5abdb4.TMP

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge4596240827375\Local State~RFe5abdb4.TMP
Size 1KB
SHA256 667b95f7e462f1b771e740e73eff4f077a0796e5ab4176ea6438ca49a199697c
MD5 276cae6673c04383a3e9cde0855efcdb
SHA1 3374d7d56b1fce0acbd9719b71245171ee5a9341
SHA512 33d5721ec11685a3b18b40d4957d1fb4321624993d776b470592ae8715bd9f9b23882a95f65dfaa143336518fcd9fe5542bf13652a2aa0fe8f9f0f600e5d4762
TLSH
T1533197F069AC6D77A9D04609B186BBA76F34A177A011FA5891FD162C05F329C0319C37
MD5 SHA1 SHA512 TLSH

Submit Download

fee2209d-c32d-4be1-bf27-cdebebd60497.tmp

Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge4596240827375\component_crx_cache\fee2209d-c32d-4be1-bf27-cdebebd60497.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

ee298ba7-60a1-45e5-8674-66a3f07b1be2.tmp

Path C:\Users\Admin\AppData\Local\Temp\ee298ba7-60a1-45e5-8674-66a3f07b1be2.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

frdpb_v2.exe

Path C:\Users\Admin\AppData\Local\Temp\frdpb_v2.exe
Size 1.7MB
SHA256 3b569fe9359d1a91e9df0a4b3f5038661cc8a65eed4d9c49c56c4023208c8938
MD5 c05c6bb8032190167234792e63df92ed
SHA1 8cf5b722ee18ee7bb2b081e1c951a7729d9ed269
SHA512 522d5586cd638bb72a8f50260c9f54d2290e9013b02d320fe401ec713087a5580e80d58b02b0a26f4db7af62dd91092e821eb149afc05030e6f7cc0782789d12
SSDEEP 24576:PrW3AN4f+lJuNr8/UddEwB2Slj+J8B+AtJa8S7v0QBTZ6:PbLk4SIJ88Atk8SXTc
TLSH
T187856A53B39610BBC0A25B3A4C3B97605D3BBA60AA675C472FF05C4C2F35A413C7AA57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hyjqarwg.exe

Path C:\Users\Admin\AppData\Local\Temp\hyjqarwg.exe
Size 57KB
SHA256 eb4c2dc7db21d6a8a889c74c7b90eaac0e095205063ae3e348a400e253c6bdd8
MD5 51242d1f06d41c80ea8c6fa541be3d6e
SHA1 a01f91e44b2a59f24b9e9c72e46e2207b6f86526
SHA512 bc7bde4ea9431f0e7c5345ea9cd1da7ec2f6a27da9f0bcfbd86b15dcfb2df3f416603d29986b849668b5e85c73678b76ad518d98cdecc6b8ae504a284fd90ff6
SSDEEP 1536:sKWHka5dALVp1V8YJVqJMX0jl0w15GXC0rOB7CD:sKm5dAppRdX0jlP1wT0E
TLSH
T184433A58A6DE624DD836D4B5D6A5D333FBA3F8427235974F0132C91E0F22B26BD28E05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i6i11w1q.exe

Path C:\Users\Admin\AppData\Local\Temp\i6i11w1q.exe
Size 175KB
SHA256 af6479e3b2a695104671b8b58ad505e47f735fa84ac724028e3b42e0620b0ed9
MD5 36a47bf18b29128aab0039036270b04d
SHA1 45d1a7a237c17c1a2c22829ffe14359a5e947b6f
SHA512 4f0e597debf6ea5e35d2506c9000954ab83432d7c0e13b32ee5336908103bc1aa71ada50c2db25cb5fd966db5eb8bdf4f4e34eb9cabfb4d4986291b788463bfb
SSDEEP 3072:P2PYNMZKq+nFIiAxXnPra8seTpCxIpylMbmFXR2Q7SkugstR:PNysOxXPra8seNCGyXFXMccgst
TLSH
T16A043A5BD5D541EDEC19CA38899AE237A4B3FC461925BA4F2BA0DF111B90B30B71EF04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icyirp1d.exe

Path C:\Users\Admin\AppData\Local\Temp\icyirp1d.exe
Size 771KB
SHA256 2e76d6a4c45848c9a1bbe5ffdf3b6a17050789b50b27584b8b2ca850ee022987
MD5 51281be022faea9c9a00e0b324a11ecc
SHA1 28528684dc899c00f00a95541d767da2fe5bda55
SHA512 d277bf12f8b6b8a07bc874023eb50913b2b666760e81158e24b5de61943676a934df6de7a79b1102ee71eac30506463596788356cfb9c5eb392058b92d097aa1
SSDEEP 12288:fJmtSx7mW7LciwFZnlMf6r60dMIGyxBlDetAqxSvSc:RZ7n74iwFZlC6+6MIGybq
TLSH
T199F49D1AF7A502FCD07BC175CA524952EB72B8565330A78F03E14AA61F376A05F3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prhh39gh.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-4EK0B93F8Z.tmp\prhh39gh.tmp
Size 4.3MB
SHA256 8a71d9a7963fbb1904e8d43ec3aaec927c1a94ed78376baf8fdd8fa46f7533ef
MD5 33453f6a4881d9959e8f964a185e1e04
SHA1 5adb5722c611dbeceba40d753c766211bc461787
SHA512 2572420402140eec620b219d7db73e05f4ef210ffe9cc0608edd399c42ec9d1a990330bcace4653156f0f389a4d72acb77d2f6817744672d46a96bf71283a789
SSDEEP 49152:6eGyzK5YtS9+SmpPvOwUNSdi1NsF+QxvCs7F5uhJBP4ji2333DneQ:6eGwK5YHCNmi16F+QxvCeFLm2333zB
TLSH
T148267E13B688753ED4A71A3B483BA684983B7E213A11CC4B7BF42D4C9E3D740AD26757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_isdecmp.dll

Path C:\Users\Admin\AppData\Local\Temp\is-EMK5FPQWTW.tmp\_isetup\_isdecmp.dll
Size 31KB
SHA256 046dddc55633d3867ecf0c05d4ec7176ded1df0456a2aedcd1f50fb26e94c132
MD5 3d2871f010ab3c038c6df5df11245f86
SHA1 da9c39f9d86896edf50f58e12bb436e2133fa32b
SHA512 5d8f4f1ba245dabfce9dfc48897415cbb0b70e28191206dd2530be409b539d75df56cf3cb40f649e3e66ab5087596f1e3ea17f5467ea6e905de262253973bb35
SSDEEP 384:jxec1Jqzr9DeV6PDW3TMzZH3MKbizJ3KhKRPtAsLiAML/pwKNs6VozmOblvldeiZ:jiUV6PqQzZH4zN23AMA6QEAmbLn
TLSH
T177E26C46B9C02B5FD6C385B054CADF5E69B1E72223B4A9E790A068356F49FF32C1502F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prhh39gh.exe

Path C:\Users\Admin\AppData\Local\Temp\prhh39gh.exe
Size 13.1MB
SHA256 42d3f82fdc329abbfea289482b70b0a93adee02963306d6680cc047140dd794a
MD5 988c557adf7da2bb023305f07c5cceac
SHA1 8e32ccb260cb531aa8de8c9f585bc765841d566a
SHA512 a73835bd2ef2131a22da20d0121681a65e5dcdaa39afdb564041e61e5e4af50d0fad69a1f7fffa177b7d85249eb2338d9465383ce1c00d0443318215422796e1
SSDEEP 98304:voJJqPg6ziVAQhCydt9JuQcpF4JorePYPAMo7Bmpbn5RjQC73I1jw6NeHAFMSj:6eg6zoAQXdVyyPgfo70pbngCLI1c6w
TLSH
T155D60233A189602AE06D563745B79285853B6E687C218D1DA7F03D5CFB3F3603927B8B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qcau1rcy.exe

Path C:\Users\Admin\AppData\Local\Temp\qcau1rcy.exe
Size 350KB
SHA256 f808b3e2570a2446b1483274e9aaf0d235580dbeacb2f129d5b52adc745a91a2
MD5 535ec55dd03c574541c9f6a5266fefad
SHA1 e2b318b2e438414f775ed35251e9e72fc2e0d7ee
SHA512 ab0cbe5ef8266218290d06b4c1583223d5b6186e180add0dee5e9d80211da36265bf13a5a0d76e638a50a202fb48c21138e81ed99e9327e4c932b73c4b74cef1
SSDEEP 6144:XVzk6qoefnPoDjo4ZYOVKS2bwJz8RmQf0WIiEnm2j7ZvINkn0srBQVkhHdZ:Xu3gDjoOktsORmQf07iSvN0hs/Z
TLSH
T12D74F147FEF035E9E12A523D84644A16E736F4BD06348E1F036C426A2F2A6D15E3AF31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir108_1326039584\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4596_1142670346\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

128.png

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4596_842832332\CRX_INSTALL\128.png
Size 4KB
SHA256 ff702ca753a7e3b75f9d9850cc9343e28e8d60f8005a2c955c8ac2105532b2c9
MD5 d056cec3b05d6a863ddfa7ee4c1c9f0c
SHA1 dcd15b46dea9d234f13d7f04c739a2c516c973f1
SHA512 751274949b04c7cdc5e8f5f20fd062bfe130f1415eee524d9d83bcf1a448fbfb4b82dff8bbf7495250a852779c3d11ac87e33275508a4064f9d52417f4ca230f
SSDEEP 96:YpjISYK9mvKBG4+43tmidWQX3DJQoWQpzYKL:Yp7nG4j3tRWQX314QpzzL
TLSH
T1EDA16DDEF15935355323E89B282AC458C69F5302D282D6AF940DD4C572C3DBE68B2DC7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4596_842832332\CRX_INSTALL\_locales\en\messages.json
Size 711B
SHA256 2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
MD5 558659936250e03cc14b60ebf648aa09
SHA1 32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825
SHA512 1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727
TLSH
T1460197136240AF18470BF05BB9023442A0B44AC62384E0B775EC982C6656DAFB20B3B0
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4596_842832332\CRX_INSTALL\_locales\en\messages.json
Size 851B
SHA256 6895648577286002f1dc9c3366f558484eb7020d52bbf64a296406e61d09599c
MD5 07ffbe5f24ca348723ff8c6c488abfb8
SHA1 6dc2851e39b2ee38f88cf5c35a90171dbea5b690
SHA512 7ed2c8db851a84f614d5daf1d5fe633bd70301fd7ff8a6723430f05f642ceb3b1ad0a40de65b224661c782ffcec69d996ebe3e5bb6b2f478181e9a07d8cd41f6
TLSH
T175012506E2516A2B03B2A12775613641F57045EA1200DCBB7A7CD41C9FB6DAB918BBD8
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4596_842832332\CRX_INSTALL\_locales\en_US\messages.json
Size 1KB
SHA256 4f70eca8e28541855a11ec7a4e6b3bc6dd16c672ff9b596ecfb7715bb3b5898c
MD5 64eaeb92cb15bf128429c2354ef22977
SHA1 45ec549acaa1fda7c664d3906835ced6295ee752
SHA512 f63ee02159812146eee84c4eb2034edfc2858a287119cc34a8b38c309c1b98953e14ca1ca6304d6b32b715754b15ba1b3aa4b46976631b5944d50581b2f49def
TLSH
T153213806EA14BB37825F6036BC657585A3300ADB2600FC3D7EDC941C1B059AA91BB3D4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4596_842832332\CRX_INSTALL\manifest.json
Size 1KB
SHA256 157696227de4fbbb1b201e16ceb091d502dbb5dbaa4ff9eb66fafc1a786085d9
MD5 e40ad42b3c23ed2276b1099a0c89b3f4
SHA1 8b3316f2f53fadb1cbaa894e75316719b31db175
SHA512 701a53a3c704bae6b5a11a4ed13027007072f074b97a2f0893e8ee8156292b4f956de2aaa500106b7645a67981b91f099146bfdfba293447e233b55933513a0c
TLSH
T1804169F7BC00AD634BA49998AA1E714EFB29B24D55CFD4DB8298107302CCDAE1D601E5
MD5 SHA1 SHA512 TLSH

Submit Download

ccba5a5986c77e43.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Size 3KB
SHA256 b3bd2d01430056960445cadaace0b4471c329cc4be205096ea5c3d5b9acc250b
MD5 1aeb78e824b2b8e5f4f52701c6b3b21e
SHA1 1c82288c90ea379dd7b9fa0772dafb68ce0e35b9
SHA512 922420a77a7e117a0ecd89779c486730a175a275af684ffd42003224fd52086ac1c958b90751b214222500e722fcfe065fbf9d37f0273ecd01fa8f9a1cee420f
TLSH
T12B81C2009FE70D5AF2FAE9B155F27B116F37FA06CA148A4E009551091D73A0496BEFB3
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1452-64-0x0000000003DB0000-0x0000000003DD5000-memory.dmp

Download

memory/1452-90-0x0000000003EA0000-0x0000000003EA1000-memory.dmp

Download

memory/1452-65-0x0000000003DB0000-0x0000000003DD5000-memory.dmp

Download

memory/1452-71-0x0000000004050000-0x0000000004095000-memory.dmp

Download

memory/1452-70-0x0000000003DE0000-0x0000000003E20000-memory.dmp

Download

memory/1452-77-0x0000000003DB0000-0x0000000003DD5000-memory.dmp

Download

memory/1452-83-0x0000000003DB0000-0x0000000003DD5000-memory.dmp

Download

memory/1452-81-0x0000000003DB0000-0x0000000003DD5000-memory.dmp

Download

memory/1452-109-0x0000000003DB0000-0x0000000003DD5000-memory.dmp

Download

memory/1452-107-0x0000000003DB0000-0x0000000003DD5000-memory.dmp

Download

memory/1452-80-0x0000000003DB0000-0x0000000003DD5000-memory.dmp

Download

memory/1452-43-0x0000000001090000-0x0000000001097000-memory.dmp

Download

memory/1452-79-0x0000000003DB0000-0x0000000003DD5000-memory.dmp

Download

memory/1452-1686-0x00000000040F0000-0x0000000004135000-memory.dmp

Download

memory/1452-78-0x0000000003DB0000-0x0000000003DD5000-memory.dmp

Download

memory/1452-96-0x00000000066A0000-0x00000000066E5000-memory.dmp

Download

memory/1452-76-0x00000000010C0000-0x00000000010C1000-memory.dmp

Download

memory/1452-74-0x0000000001070000-0x0000000001071000-memory.dmp

Download

memory/1452-75-0x00000000010B0000-0x00000000010B1000-memory.dmp

Download

memory/1452-234-0x00000000040A0000-0x00000000040E5000-memory.dmp

Download

memory/1896-16-0x0000000000565000-0x0000000000567000-memory.dmp

Download

memory/1896-17-0x0000000000400000-0x00000000005B4000-memory.dmp

Download

memory/1896-103-0x0000000000400000-0x00000000005B4000-memory.dmp

Download

memory/1896-105-0x0000000000400000-0x00000000005B4000-memory.dmp

Download

memory/2068-88-0x00007FF663530000-0x00007FF66354E000-memory.dmp

Download

memory/2068-91-0x00007FF663530000-0x00007FF66354E000-memory.dmp

Download

memory/2236-23-0x0000000000DD0000-0x0000000000ED6000-memory.dmp

Download

memory/2236-111-0x0000000000DD0000-0x0000000000ED6000-memory.dmp

Download

memory/3216-112-0x0000000000890000-0x0000000000CF0000-memory.dmp

Download

memory/3216-401-0x0000000000890000-0x0000000000CF0000-memory.dmp

Download

memory/3216-998-0x0000000000890000-0x0000000000CF0000-memory.dmp

Download

memory/3216-116-0x0000000000890000-0x0000000000CF0000-memory.dmp

Download

memory/4268-110-0x0000000000050000-0x00000000000CC000-memory.dmp

Download

memory/4268-120-0x0000000000050000-0x00000000000CC000-memory.dmp

Download

memory/4268-1513-0x0000000000050000-0x00000000000CC000-memory.dmp

Download

memory/4268-1700-0x0000000000050000-0x00000000000CC000-memory.dmp

Download

memory/4268-347-0x0000000000050000-0x00000000000CC000-memory.dmp

Download

memory/4268-1693-0x0000000000050000-0x00000000000CC000-memory.dmp

Download

memory/4268-1683-0x0000000000050000-0x00000000000CC000-memory.dmp

Download

memory/4388-50-0x00000165BDC20000-0x00000165BDC27000-memory.dmp

Download

memory/4388-39-0x00000165BDC00000-0x00000165BDC03000-memory.dmp

Download

memory/4444-48-0x00000269DA560000-0x00000269DA567000-memory.dmp

Download

memory/5132-68-0x00007FF6EEA40000-0x00007FF6EEA5E000-memory.dmp

Download

memory/5132-63-0x00007FF6EEA40000-0x00007FF6EEA5E000-memory.dmp

Download

memory/5144-52-0x000001670FFC0000-0x000001670FFC7000-memory.dmp

Download

memory/5904-100-0x00007FF6EEA40000-0x00007FF6EEA5E000-memory.dmp

Download