phantomstealer | dc60b3a787e014b5ed9ef2a3eb0d7b7d93ed800d0524a10d0eb8447d47b43926

Analysis

max time kernel
149s
max time network
134s
platform
windows11-21h2_x64
resource
win11-20250619-en
resource tags

arch:x64arch:x86image:win11-20250619-enlocale:en-usos:windows11-21h2-x64system
submitted
15/10/2025, 11:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e-dekont.pdf.exe
Size 1.2MB
Sample251015-n3acmsbr2z
SHA256 dc60b3a787e014b5ed9ef2a3eb0d7b7d93ed800d0524a10d0eb8447d47b43926
MD5 6f5ae138326ff745f4a8d7d3621e7673
SHA1 459d6d57c8b3c07fd778c267a8ac8927d2b7839e
SHA512 0d79f81af365f9e76fe71873456a65d1181a17a6ec6278d933723f9dba3fb2592ec219b13367b0efbaf6244a30374d82703e5adc6c5eadc1c3baae1bb21fc1f5
SSDEEP 24576:+TnypdJ51YxkIJB4K1hgyc6LQ6sJV6+5yKI9rdJ8o1ZyAw7kJ9oS+v62f:ugdz1xwLBAk9Pjj5wq9oSs7
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

collection discovery execution phantomstealer persistence spyware stealer

Malware Config

Extracted

Family

phantomstealer

Version

v3.5.0

https://api.telegram.org/bot8311646472:AAE3y-mOoDjijqIf0ZE_lCtb8S0nWRARlUw/sendMessage?chat_id=6605246356

Mutex

TMJ1S1R5RO0YF92QPAV7

Attributes

anti_analysis
0
cb_enables_ssl
0
debug
0
keylogger
1
start_delay
0
startup
0

Signatures

Phantomstealer family
phantomstealer

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
6100	powershell.exe
1448	powershell.exe
1868	powershell.exe
4332	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
3500	aCSbxnu.exe
4580	aCSbxnu.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3625340254-1625357543-1797847221-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	e-dekont.pdf.exe
Key opened	\REGISTRY\USER\S-1-5-21-3625340254-1625357543-1797847221-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	e-dekont.pdf.exe
Key opened	\REGISTRY\USER\S-1-5-21-3625340254-1625357543-1797847221-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	e-dekont.pdf.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	icanhazip.com

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 5264 set thread context of 3240	5264	e-dekont.pdf.exe	84
PID 3500 set thread context of 4580	3500	aCSbxnu.exe	161

Drops file in Windows directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\chrome_installer.log	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\metadata	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\metadata	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\settings.dat	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\chrome_installer.log	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\settings.dat	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aCSbxnu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aCSbxnu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e-dekont.pdf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e-dekont.pdf.exe

Checks processor information in registry 2 TTPs 38 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	e-dekont.pdf.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	e-dekont.pdf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Enumerates system info in registry 2 TTPs 12 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134050029168914617"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2348	schtasks.exe
1832	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
6100	powershell.exe
1448	powershell.exe
6100	powershell.exe
1448	powershell.exe
3240	e-dekont.pdf.exe
3240	e-dekont.pdf.exe
3240	e-dekont.pdf.exe
5180	chrome.exe
5180	chrome.exe
3240	e-dekont.pdf.exe
3240	e-dekont.pdf.exe
3240	e-dekont.pdf.exe
3240	e-dekont.pdf.exe
3240	e-dekont.pdf.exe
3240	e-dekont.pdf.exe
3240	e-dekont.pdf.exe
3240	e-dekont.pdf.exe
3348	firefox.exe
3348	firefox.exe
3348	firefox.exe
3348	firefox.exe
3348	firefox.exe
3348	firefox.exe
3348	firefox.exe
3348	firefox.exe
3348	firefox.exe
3348	firefox.exe
3348	firefox.exe
3348	firefox.exe
3348	firefox.exe
3348	firefox.exe
3348	firefox.exe
3348	firefox.exe
3348	firefox.exe
3348	firefox.exe
3348	firefox.exe
3348	firefox.exe
3240	e-dekont.pdf.exe
3240	e-dekont.pdf.exe
3240	e-dekont.pdf.exe
3240	e-dekont.pdf.exe
3240	e-dekont.pdf.exe
3240	e-dekont.pdf.exe
3240	e-dekont.pdf.exe
3240	e-dekont.pdf.exe
4332	powershell.exe
4332	powershell.exe
1868	powershell.exe
1868	powershell.exe
4332	powershell.exe
1868	powershell.exe
3240	e-dekont.pdf.exe
3240	e-dekont.pdf.exe
3240	e-dekont.pdf.exe
3240	e-dekont.pdf.exe
3240	e-dekont.pdf.exe
3240	e-dekont.pdf.exe
3240	e-dekont.pdf.exe
3240	e-dekont.pdf.exe
3240	e-dekont.pdf.exe
3240	e-dekont.pdf.exe
3240	e-dekont.pdf.exe
3240	e-dekont.pdf.exe
6012	firefox.exe

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeDebugPrivilege	6100	powershell.exe
Token: SeDebugPrivilege	1448	powershell.exe
Token: SeDebugPrivilege	3240	e-dekont.pdf.exe
Token: SeShutdownPrivilege	5180	chrome.exe
Token: SeCreatePagefilePrivilege	5180	chrome.exe
Token: SeShutdownPrivilege	5180	chrome.exe
Token: SeCreatePagefilePrivilege	5180	chrome.exe
Token: SeShutdownPrivilege	5180	chrome.exe
Token: SeCreatePagefilePrivilege	5180	chrome.exe
Token: SeDebugPrivilege	4332	powershell.exe
Token: SeDebugPrivilege	1868	powershell.exe
Token: SeDebugPrivilege	4580	aCSbxnu.exe
Token: SeShutdownPrivilege	4092	chrome.exe
Token: SeCreatePagefilePrivilege	4092	chrome.exe
Token: SeShutdownPrivilege	4092	chrome.exe
Token: SeCreatePagefilePrivilege	4092	chrome.exe
Token: SeShutdownPrivilege	4092	chrome.exe
Token: SeCreatePagefilePrivilege	4092	chrome.exe

Suspicious use of FindShellTrayWindow 46 IoCs

pid	Process
5180	chrome.exe
5180	chrome.exe
3348	firefox.exe
3348	firefox.exe
3348	firefox.exe
3348	firefox.exe
3348	firefox.exe
3348	firefox.exe
3348	firefox.exe
3348	firefox.exe
3348	firefox.exe
3348	firefox.exe
3348	firefox.exe
3348	firefox.exe
3348	firefox.exe
3348	firefox.exe
3348	firefox.exe
3348	firefox.exe
3348	firefox.exe
3348	firefox.exe
3348	firefox.exe
3348	firefox.exe
5732	msedge.exe
2060	msedge.exe
6012	firefox.exe
6012	firefox.exe
6012	firefox.exe
6012	firefox.exe
6012	firefox.exe
6012	firefox.exe
6012	firefox.exe
6012	firefox.exe
6012	firefox.exe
6012	firefox.exe
6012	firefox.exe
6012	firefox.exe
6012	firefox.exe
6012	firefox.exe
6012	firefox.exe
6012	firefox.exe
6012	firefox.exe
6012	firefox.exe
6012	firefox.exe
6012	firefox.exe
4092	chrome.exe
4092	chrome.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3348	firefox.exe
6012	firefox.exe
3240	e-dekont.pdf.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5264 wrote to memory of 6100	5264	e-dekont.pdf.exe	78
PID 5264 wrote to memory of 6100	5264	e-dekont.pdf.exe	78
PID 5264 wrote to memory of 6100	5264	e-dekont.pdf.exe	78
PID 5264 wrote to memory of 1448	5264	e-dekont.pdf.exe	80
PID 5264 wrote to memory of 1448	5264	e-dekont.pdf.exe	80
PID 5264 wrote to memory of 1448	5264	e-dekont.pdf.exe	80
PID 5264 wrote to memory of 2348	5264	e-dekont.pdf.exe	82
PID 5264 wrote to memory of 2348	5264	e-dekont.pdf.exe	82
PID 5264 wrote to memory of 2348	5264	e-dekont.pdf.exe	82
PID 5264 wrote to memory of 3240	5264	e-dekont.pdf.exe	84
PID 5264 wrote to memory of 3240	5264	e-dekont.pdf.exe	84
PID 5264 wrote to memory of 3240	5264	e-dekont.pdf.exe	84
PID 5264 wrote to memory of 3240	5264	e-dekont.pdf.exe	84
PID 5264 wrote to memory of 3240	5264	e-dekont.pdf.exe	84
PID 5264 wrote to memory of 3240	5264	e-dekont.pdf.exe	84
PID 5264 wrote to memory of 3240	5264	e-dekont.pdf.exe	84
PID 5264 wrote to memory of 3240	5264	e-dekont.pdf.exe	84
PID 3240 wrote to memory of 5180	3240	e-dekont.pdf.exe	88
PID 3240 wrote to memory of 5180	3240	e-dekont.pdf.exe	88
PID 5180 wrote to memory of 5876	5180	chrome.exe	89
PID 5180 wrote to memory of 5876	5180	chrome.exe	89
PID 3240 wrote to memory of 5876	3240	e-dekont.pdf.exe	89
PID 3240 wrote to memory of 5876	3240	e-dekont.pdf.exe	89
PID 5180 wrote to memory of 2196	5180	chrome.exe	90
PID 5180 wrote to memory of 2196	5180	chrome.exe	90
PID 3240 wrote to memory of 5180	3240	e-dekont.pdf.exe	88
PID 3240 wrote to memory of 5180	3240	e-dekont.pdf.exe	88
PID 5180 wrote to memory of 2424	5180	chrome.exe	91
PID 5180 wrote to memory of 2424	5180	chrome.exe	91
PID 5180 wrote to memory of 3224	5180	chrome.exe	92
PID 5180 wrote to memory of 3224	5180	chrome.exe	92
PID 5180 wrote to memory of 4968	5180	chrome.exe	93
PID 5180 wrote to memory of 4968	5180	chrome.exe	93
PID 5180 wrote to memory of 6140	5180	chrome.exe	94
PID 5180 wrote to memory of 6140	5180	chrome.exe	94
PID 5180 wrote to memory of 3084	5180	chrome.exe	95
PID 5180 wrote to memory of 3084	5180	chrome.exe	95
PID 5180 wrote to memory of 5400	5180	chrome.exe	96
PID 5180 wrote to memory of 5400	5180	chrome.exe	96
PID 5180 wrote to memory of 2356	5180	chrome.exe	97
PID 5180 wrote to memory of 2356	5180	chrome.exe	97
PID 5180 wrote to memory of 5492	5180	chrome.exe	98
PID 5180 wrote to memory of 5492	5180	chrome.exe	98
PID 5180 wrote to memory of 1668	5180	chrome.exe	99
PID 5180 wrote to memory of 1668	5180	chrome.exe	99
PID 3240 wrote to memory of 5876	3240	e-dekont.pdf.exe	89
PID 3240 wrote to memory of 5876	3240	e-dekont.pdf.exe	89
PID 3240 wrote to memory of 5180	3240	e-dekont.pdf.exe	88
PID 3240 wrote to memory of 5180	3240	e-dekont.pdf.exe	88
PID 3240 wrote to memory of 3224	3240	e-dekont.pdf.exe	92
PID 3240 wrote to memory of 3224	3240	e-dekont.pdf.exe	92
PID 3240 wrote to memory of 2424	3240	e-dekont.pdf.exe	91
PID 3240 wrote to memory of 2424	3240	e-dekont.pdf.exe	91
PID 3240 wrote to memory of 2196	3240	e-dekont.pdf.exe	90
PID 3240 wrote to memory of 2196	3240	e-dekont.pdf.exe	90
PID 5180 wrote to memory of 5156	5180	chrome.exe	100
PID 5180 wrote to memory of 5156	5180	chrome.exe	100
PID 3240 wrote to memory of 2356	3240	e-dekont.pdf.exe	97
PID 3240 wrote to memory of 2356	3240	e-dekont.pdf.exe	97
PID 3240 wrote to memory of 5492	3240	e-dekont.pdf.exe	98
PID 3240 wrote to memory of 5492	3240	e-dekont.pdf.exe	98
PID 3240 wrote to memory of 5876	3240	e-dekont.pdf.exe	89
PID 3240 wrote to memory of 5876	3240	e-dekont.pdf.exe	89
PID 3240 wrote to memory of 5180	3240	e-dekont.pdf.exe	88

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3625340254-1625357543-1797847221-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	e-dekont.pdf.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3625340254-1625357543-1797847221-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	e-dekont.pdf.exe

C:\Users\Admin\AppData\Local\Temp\e-dekont.pdf.exe
"C:\Users\Admin\AppData\Local\Temp\e-dekont.pdf.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5264
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\e-dekont.pdf.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:6100
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\aCSbxnu.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1448
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\aCSbxnu" /XML "C:\Users\Admin\AppData\Local\Temp\tmpC999.tmp"
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:2348
- C:\Users\Admin\AppData\Local\Temp\e-dekont.pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\e-dekont.pdf.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - outlook_office_path
  - outlook_win_path
  PID:3240
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\kyfsiefn.svq"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5180
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\kyfsiefn.svq /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\kyfsiefn.svq\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\kyfsiefn.svq --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ff8296fdcf8,0x7ff8296fdd04,0x7ff8296fdd10
      4⤵
      PID:5876
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\kyfsiefn.svq" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=1868,i,6928477923315169369,16888177133977597501,262144 --variations-seed-version --mojo-platform-channel-handle=1860 /prefetch:2
      4⤵
      PID:2196
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\kyfsiefn.svq" --field-trial-handle=1920,i,6928477923315169369,16888177133977597501,262144 --variations-seed-version --mojo-platform-channel-handle=1996 /prefetch:11
      4⤵
      PID:2424
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\kyfsiefn.svq" --field-trial-handle=2112,i,6928477923315169369,16888177133977597501,262144 --variations-seed-version --mojo-platform-channel-handle=2172 /prefetch:13
      4⤵
      PID:3224
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\kyfsiefn.svq" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3056,i,6928477923315169369,16888177133977597501,262144 --variations-seed-version --mojo-platform-channel-handle=3068 /prefetch:1
      4⤵
      PID:4968
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\kyfsiefn.svq" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3076,i,6928477923315169369,16888177133977597501,262144 --variations-seed-version --mojo-platform-channel-handle=3112 /prefetch:1
      4⤵
      PID:6140
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\kyfsiefn.svq" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3480,i,6928477923315169369,16888177133977597501,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
      4⤵
      PID:3084
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\kyfsiefn.svq" --extension-process --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=3520,i,6928477923315169369,16888177133977597501,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:9
      4⤵
      PID:5400
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\kyfsiefn.svq" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=3624,i,6928477923315169369,16888177133977597501,262144 --variations-seed-version --mojo-platform-channel-handle=3704 /prefetch:1
      4⤵
      PID:2356
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\kyfsiefn.svq" --extension-process --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=3640,i,6928477923315169369,16888177133977597501,262144 --variations-seed-version --mojo-platform-channel-handle=3708 /prefetch:9
      4⤵
      PID:5492
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\kyfsiefn.svq" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=4212,i,6928477923315169369,16888177133977597501,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:1
      4⤵
      PID:1668
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\kyfsiefn.svq" --field-trial-handle=4220,i,6928477923315169369,16888177133977597501,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:14
      4⤵
      PID:5156
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\kyfsiefn.svq" --field-trial-handle=4876,i,6928477923315169369,16888177133977597501,262144 --variations-seed-version --mojo-platform-channel-handle=4892 /prefetch:14
      4⤵
      PID:6072
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\kyfsiefn.svq" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=4976,i,6928477923315169369,16888177133977597501,262144 --variations-seed-version --mojo-platform-channel-handle=5036 /prefetch:1
      4⤵
      PID:1548
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\kyfsiefn.svq" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=5004,i,6928477923315169369,16888177133977597501,262144 --variations-seed-version --mojo-platform-channel-handle=4988 /prefetch:1
      4⤵
      PID:1272
  - - C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
      4⤵
      PID:5796
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\uoe2k1sd.dad"
    3⤵
    PID:3020
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir=C:\Users\Admin\AppData\Local\Temp\uoe2k1sd.dad
      4⤵
      Checks processor information in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:3348
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1972 -prefsLen 27097 -prefMapHandle 1976 -prefMapSize 270279 -ipcHandle 1944 -initialChannelId {b425d18e-c18b-4a74-b0b6-e6d672ac2991} -parentPid 3348 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3348" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
        5⤵
        
        PID:4184
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2164 -prefsLen 27133 -prefMapHandle 2152 -prefMapSize 270279 -ipcHandle 2408 -initialChannelId {220b2458-54a0-4abe-9046-f95acb9085b6} -parentPid 3348 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3348" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
        5⤵
        
        PID:1504
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\a9762f34-6f1b-4f55-9f8b-3f5ac51538bb.dmp"
        5⤵
        
        PID:1604
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2216 -prefsLen 27133 -prefMapHandle 2892 -prefMapSize 270279 -ipcHandle 2920 -initialChannelId {fffa2a00-3fe2-4db8-817c-a4a62307084c} -parentPid 3348 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3348" -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 gpu
        5⤵
        
        PID:4436
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\6a1db2f2-ef6e-408c-a80f-17e83e42eeb1.dmp"
        5⤵
        
        PID:4712
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2920 -prefsLen 27133 -prefMapHandle 3168 -prefMapSize 270279 -ipcHandle 3164 -initialChannelId {db68c075-9c4a-41f0-9cc8-595d592e647f} -parentPid 3348 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3348" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 gpu
        5⤵
        
        PID:1696
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\3266796f-9c9f-45fe-97e1-8c44d7b8f1bc.dmp"
        5⤵
        
        PID:1992
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3164 -prefsLen 27198 -prefMapHandle 3320 -prefMapSize 270279 -ipcHandle 3240 -initialChannelId {081edaa7-622a-4d45-9e81-e647d8b23091} -parentPid 3348 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3348" -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 gpu
        5⤵
        
        PID:1764
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3960 -prefsLen 27323 -prefMapHandle 3964 -prefMapSize 270279 -jsInitHandle 3968 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4028 -initialChannelId {6f49fd10-aeb0-462f-ada1-7a63620c4ab8} -parentPid 3348 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3348" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 tab
        5⤵
        Checks processor information in registry
        
        PID:5344
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\30292032-7058-49f6-a3e0-89f43b5a1f2e.dmp"
        5⤵
        
        PID:3468
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3240 -prefsLen 27323 -prefMapHandle 3584 -prefMapSize 270279 -ipcHandle 4192 -initialChannelId {7f9fe3df-71bc-4193-a54e-85f5fb83e773} -parentPid 3348 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3348" -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 gpu
        5⤵
        
        PID:4044
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\b191e976-f3b6-41c8-971f-285fca48a170.dmp"
        5⤵
        
        PID:3228
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4560 -prefsLen 27323 -prefMapHandle 4564 -prefMapSize 270279 -ipcHandle 4472 -initialChannelId {722265e1-9013-4867-a9bc-ef31a0e4cfc3} -parentPid 3348 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3348" -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 rdd
        5⤵
        
        PID:956
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2780 -prefsLen 34822 -prefMapHandle 2784 -prefMapSize 270279 -jsInitHandle 3108 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3564 -initialChannelId {7426a563-c247-49dc-a3ea-cb701483a970} -parentPid 3348 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3348" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
        5⤵
        Checks processor information in registry
        
        PID:5108
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 3520 -prefsLen 35010 -prefMapHandle 3600 -prefMapSize 270279 -ipcHandle 3228 -initialChannelId {fd1924aa-0932-438d-8da6-a35df3df67ad} -parentPid 3348 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3348" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 utility
        5⤵
        Checks processor information in registry
        
        PID:6112
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3272 -prefsLen 32900 -prefMapHandle 3324 -prefMapSize 270279 -jsInitHandle 2916 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2780 -initialChannelId {2d77d331-e5e5-4150-a9ff-27151d8a6bbf} -parentPid 3348 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3348" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
        5⤵
        Checks processor information in registry
        
        PID:3060
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5332 -prefsLen 32900 -prefMapHandle 5336 -prefMapSize 270279 -jsInitHandle 5340 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5348 -initialChannelId {532438f4-2ca4-4e97-90a0-cd2f6d94f631} -parentPid 3348 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3348" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
        5⤵
        Checks processor information in registry
        
        PID:4704
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5708 -prefsLen 32900 -prefMapHandle 5712 -prefMapSize 270279 -jsInitHandle 5716 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2916 -initialChannelId {fe7d025e-2ddb-4e79-9fc2-1ee45ca12774} -parentPid 3348 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3348" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab
        5⤵
        Checks processor information in registry
        
        PID:4880
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\20qcpwxe.ip2"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious use of FindShellTrayWindow
    PID:5732
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\20qcpwxe.ip2 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\20qcpwxe.ip2\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x23c,0x240,0x244,0x238,0x250,0x7ff81734f208,0x7ff81734f214,0x7ff81734f220
      4⤵
      PID:2020
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\20qcpwxe.ip2" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --field-trial-handle=2076,i,2802247864606817471,12845293321359026791,262144 --variations-seed-version --mojo-platform-channel-handle=2064 /prefetch:2
      4⤵
      PID:5668
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\20qcpwxe.ip2" --always-read-main-dll --field-trial-handle=1832,i,2802247864606817471,12845293321359026791,262144 --variations-seed-version --mojo-platform-channel-handle=2080 /prefetch:11
      4⤵
      PID:4152
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\20qcpwxe.ip2" --always-read-main-dll --field-trial-handle=2272,i,2802247864606817471,12845293321359026791,262144 --variations-seed-version --mojo-platform-channel-handle=2424 /prefetch:13
      4⤵
      PID:4068
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\20qcpwxe.ip2" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3068,i,2802247864606817471,12845293321359026791,262144 --variations-seed-version --mojo-platform-channel-handle=3100 /prefetch:1
      4⤵
      PID:4784
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\20qcpwxe.ip2" --instant-process --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3084,i,2802247864606817471,12845293321359026791,262144 --variations-seed-version --mojo-platform-channel-handle=3116 /prefetch:1
      4⤵
      PID:224
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\20qcpwxe.ip2" --always-read-main-dll --field-trial-handle=2892,i,2802247864606817471,12845293321359026791,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:14
      4⤵
      PID:4468
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\20qcpwxe.ip2" --always-read-main-dll --field-trial-handle=3544,i,2802247864606817471,12845293321359026791,262144 --variations-seed-version --mojo-platform-channel-handle=3692 /prefetch:14
      4⤵
      PID:2620
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\20qcpwxe.ip2" --always-read-main-dll --field-trial-handle=3552,i,2802247864606817471,12845293321359026791,262144 --variations-seed-version --mojo-platform-channel-handle=3700 /prefetch:14
      4⤵
      PID:1404
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\20qcpwxe.ip2" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --field-trial-handle=3684,i,2802247864606817471,12845293321359026791,262144 --variations-seed-version --mojo-platform-channel-handle=3732 /prefetch:1
      4⤵
      PID:5608
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\20qcpwxe.ip2" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --field-trial-handle=3664,i,2802247864606817471,12845293321359026791,262144 --variations-seed-version --mojo-platform-channel-handle=3760 /prefetch:9
      4⤵
      PID:756
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\20qcpwxe.ip2" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --field-trial-handle=3748,i,2802247864606817471,12845293321359026791,262144 --variations-seed-version --mojo-platform-channel-handle=3772 /prefetch:1
      4⤵
      PID:400
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\20qcpwxe.ip2" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --field-trial-handle=3800,i,2802247864606817471,12845293321359026791,262144 --variations-seed-version --mojo-platform-channel-handle=3860 /prefetch:9
      4⤵
      PID:1780
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\20qcpwxe.ip2" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --field-trial-handle=3824,i,2802247864606817471,12845293321359026791,262144 --variations-seed-version --mojo-platform-channel-handle=3872 /prefetch:1
      4⤵
      PID:5204
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\20qcpwxe.ip2" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --field-trial-handle=3896,i,2802247864606817471,12845293321359026791,262144 --variations-seed-version --mojo-platform-channel-handle=3928 /prefetch:9
      4⤵
      PID:2128
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\20qcpwxe.ip2" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --field-trial-handle=3904,i,2802247864606817471,12845293321359026791,262144 --variations-seed-version --mojo-platform-channel-handle=3932 /prefetch:1
      4⤵
      PID:5432
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\20qcpwxe.ip2" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --field-trial-handle=3940,i,2802247864606817471,12845293321359026791,262144 --variations-seed-version --mojo-platform-channel-handle=3892 /prefetch:9
      4⤵
      PID:748
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\20qcpwxe.ip2" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --field-trial-handle=4000,i,2802247864606817471,12845293321359026791,262144 --variations-seed-version --mojo-platform-channel-handle=3948 /prefetch:1
      4⤵
      PID:2452
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\20qcpwxe.ip2" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --field-trial-handle=4024,i,2802247864606817471,12845293321359026791,262144 --variations-seed-version --mojo-platform-channel-handle=4084 /prefetch:9
      4⤵
      PID:4084
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\20qcpwxe.ip2" --always-read-main-dll --field-trial-handle=4116,i,2802247864606817471,12845293321359026791,262144 --variations-seed-version --mojo-platform-channel-handle=4092 /prefetch:14
      4⤵
      PID:836
    - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=1116
        5⤵
        
        PID:776
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\20qcpwxe.ip2" --always-read-main-dll --field-trial-handle=5264,i,2802247864606817471,12845293321359026791,262144 --variations-seed-version --mojo-platform-channel-handle=5076 /prefetch:14
      4⤵
      PID:5088
    - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=596
        5⤵
        
        PID:732
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\20qcpwxe.ip2" --always-read-main-dll --field-trial-handle=5276,i,2802247864606817471,12845293321359026791,262144 --variations-seed-version --mojo-platform-channel-handle=5296 /prefetch:14
      4⤵
      PID:944
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\20qcpwxe.ip2" --always-read-main-dll --field-trial-handle=5360,i,2802247864606817471,12845293321359026791,262144 --variations-seed-version --mojo-platform-channel-handle=5368 /prefetch:14
      4⤵
      PID:1688
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\20qcpwxe.ip2" --always-read-main-dll --field-trial-handle=5496,i,2802247864606817471,12845293321359026791,262144 --variations-seed-version --mojo-platform-channel-handle=5516 /prefetch:14
      4⤵
      PID:5656
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --no-sandbox --mute-audio --onnx-enabled-for-ee --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\20qcpwxe.ip2" --always-read-main-dll --field-trial-handle=5488,i,2802247864606817471,12845293321359026791,262144 --variations-seed-version --mojo-platform-channel-handle=5564 /prefetch:14
      4⤵
      PID:3944
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\w1ergef1.gas"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious use of FindShellTrayWindow
    PID:2060
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\w1ergef1.gas /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\w1ergef1.gas\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x23c,0x240,0x244,0x238,0x2f0,0x7ff81734f208,0x7ff81734f214,0x7ff81734f220
      4⤵
      PID:3244
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\w1ergef1.gas" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --field-trial-handle=2796,i,8327046697729214896,552889635593308324,262144 --variations-seed-version --mojo-platform-channel-handle=2792 /prefetch:2
      4⤵
      PID:4244
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\w1ergef1.gas" --always-read-main-dll --field-trial-handle=2024,i,8327046697729214896,552889635593308324,262144 --variations-seed-version --mojo-platform-channel-handle=2860 /prefetch:11
      4⤵
      PID:4832
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\w1ergef1.gas" --always-read-main-dll --field-trial-handle=2332,i,8327046697729214896,552889635593308324,262144 --variations-seed-version --mojo-platform-channel-handle=2908 /prefetch:13
      4⤵
      PID:5116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\w1ergef1.gas" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3320,i,8327046697729214896,552889635593308324,262144 --variations-seed-version --mojo-platform-channel-handle=1868 /prefetch:1
      4⤵
      PID:5408
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\w1ergef1.gas" --instant-process --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3328,i,8327046697729214896,552889635593308324,262144 --variations-seed-version --mojo-platform-channel-handle=3380 /prefetch:1
      4⤵
      PID:3652
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\w1ergef1.gas" --always-read-main-dll --field-trial-handle=3560,i,8327046697729214896,552889635593308324,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:14
      4⤵
      PID:4388
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\w1ergef1.gas" --always-read-main-dll --field-trial-handle=3608,i,8327046697729214896,552889635593308324,262144 --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:14
      4⤵
      PID:5872
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\w1ergef1.gas" --always-read-main-dll --field-trial-handle=3616,i,8327046697729214896,552889635593308324,262144 --variations-seed-version --mojo-platform-channel-handle=3716 /prefetch:14
      4⤵
      PID:556
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\w1ergef1.gas" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --field-trial-handle=3656,i,8327046697729214896,552889635593308324,262144 --variations-seed-version --mojo-platform-channel-handle=3732 /prefetch:1
      4⤵
      PID:5144
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\w1ergef1.gas" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --field-trial-handle=3664,i,8327046697729214896,552889635593308324,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:9
      4⤵
      PID:1196
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\w1ergef1.gas" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --field-trial-handle=3700,i,8327046697729214896,552889635593308324,262144 --variations-seed-version --mojo-platform-channel-handle=3820 /prefetch:1
      4⤵
      PID:436
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\w1ergef1.gas" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --field-trial-handle=3756,i,8327046697729214896,552889635593308324,262144 --variations-seed-version --mojo-platform-channel-handle=3840 /prefetch:9
      4⤵
      PID:3504
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\w1ergef1.gas" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --field-trial-handle=3800,i,8327046697729214896,552889635593308324,262144 --variations-seed-version --mojo-platform-channel-handle=3868 /prefetch:1
      4⤵
      PID:5084
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\w1ergef1.gas" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --field-trial-handle=3788,i,8327046697729214896,552889635593308324,262144 --variations-seed-version --mojo-platform-channel-handle=3932 /prefetch:9
      4⤵
      PID:3928
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\w1ergef1.gas" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --field-trial-handle=3832,i,8327046697729214896,552889635593308324,262144 --variations-seed-version --mojo-platform-channel-handle=3944 /prefetch:1
      4⤵
      PID:4376
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\w1ergef1.gas" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --field-trial-handle=3860,i,8327046697729214896,552889635593308324,262144 --variations-seed-version --mojo-platform-channel-handle=4212 /prefetch:9
      4⤵
      PID:4776
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\w1ergef1.gas" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --field-trial-handle=3892,i,8327046697729214896,552889635593308324,262144 --variations-seed-version --mojo-platform-channel-handle=4864 /prefetch:1
      4⤵
      PID:6436
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\w1ergef1.gas" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --field-trial-handle=3916,i,8327046697729214896,552889635593308324,262144 --variations-seed-version --mojo-platform-channel-handle=4868 /prefetch:9
      4⤵
      PID:6444
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\w1ergef1.gas" --always-read-main-dll --field-trial-handle=4112,i,8327046697729214896,552889635593308324,262144 --variations-seed-version --mojo-platform-channel-handle=4896 /prefetch:14
      4⤵
      PID:6452
    - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=1128
        5⤵
        
        PID:5508
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\w1ergef1.gas" --always-read-main-dll --field-trial-handle=5316,i,8327046697729214896,552889635593308324,262144 --variations-seed-version --mojo-platform-channel-handle=3864 /prefetch:14
      4⤵
      PID:5092
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\w1ergef1.gas" --always-read-main-dll --field-trial-handle=5360,i,8327046697729214896,552889635593308324,262144 --variations-seed-version --mojo-platform-channel-handle=1924 /prefetch:14
      4⤵
      PID:3380
    - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=592
        5⤵
        
        PID:6172
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\w1ergef1.gas" --always-read-main-dll --field-trial-handle=5516,i,8327046697729214896,552889635593308324,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:14
      4⤵
      PID:7052
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\w1ergef1.gas" --always-read-main-dll --field-trial-handle=3760,i,8327046697729214896,552889635593308324,262144 --variations-seed-version --mojo-platform-channel-handle=5688 /prefetch:14
      4⤵
      PID:2952
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --no-sandbox --mute-audio --onnx-enabled-for-ee --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\w1ergef1.gas" --always-read-main-dll --field-trial-handle=3944,i,8327046697729214896,552889635593308324,262144 --variations-seed-version --mojo-platform-channel-handle=5740 /prefetch:14
      4⤵
      PID:3912
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\kh3qaqtu.m3j"
    3⤵
    PID:4024
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir=C:\Users\Admin\AppData\Local\Temp\kh3qaqtu.m3j
      4⤵
      Checks processor information in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:6012
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1940 -prefsLen 27097 -prefMapHandle 1944 -prefMapSize 270331 -ipcHandle 2016 -initialChannelId {80b1965e-3bdf-4837-8731-593a49cb2ff5} -parentPid 6012 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6012" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
        5⤵
        
        PID:6344
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2448 -prefsLen 27133 -prefMapHandle 2452 -prefMapSize 270331 -ipcHandle 2228 -initialChannelId {fd267045-391e-444e-9e14-3ca92587e841} -parentPid 6012 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6012" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
        5⤵
        
        PID:2376
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\7fe70848-f0ec-4738-9c0b-fef9a84a6787.dmp"
        5⤵
        
        PID:7072
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2016 -prefsLen 27133 -prefMapHandle 1936 -prefMapSize 270331 -ipcHandle 2828 -initialChannelId {24626b4f-a3d4-47c3-9992-3799cef2cc6f} -parentPid 6012 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6012" -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 gpu
        5⤵
        
        PID:5872
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\6ffe320b-062d-41b4-bfee-0eb12db79187.dmp"
        5⤵
        
        PID:3360
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3152 -prefsLen 27198 -prefMapHandle 2828 -prefMapSize 270331 -ipcHandle 2904 -initialChannelId {8769195f-4929-4247-994b-4d62f87aba55} -parentPid 6012 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6012" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 gpu
        5⤵
        
        PID:1928
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3780 -prefsLen 27323 -prefMapHandle 3784 -prefMapSize 270331 -jsInitHandle 3788 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3832 -initialChannelId {33da4794-21ea-4cdd-97a1-092e77c25f4d} -parentPid 6012 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6012" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
        5⤵
        Checks processor information in registry
        
        PID:1652
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\276d203c-3163-429a-9564-c88c25b60949.dmp"
        5⤵
        
        PID:2296
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2904 -prefsLen 27323 -prefMapHandle 4012 -prefMapSize 270331 -ipcHandle 3808 -initialChannelId {a74bd453-b395-490f-a3b9-913ca8150d6e} -parentPid 6012 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6012" -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 gpu
        5⤵
        
        PID:4900
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\8ce16381-7fd2-4ef6-bc37-e265e08753c8.dmp"
        5⤵
        
        PID:6044
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3788 -prefsLen 27323 -prefMapHandle 4112 -prefMapSize 270331 -ipcHandle 4088 -initialChannelId {0164f17e-7839-411b-803a-95f17258ba4e} -parentPid 6012 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6012" -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 rdd
        5⤵
        
        PID:6032
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2784 -prefsLen 34876 -prefMapHandle 2288 -prefMapSize 270331 -jsInitHandle 2684 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2748 -initialChannelId {9ec9c7ab-a60d-45f4-9087-875334357a2b} -parentPid 6012 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6012" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
        5⤵
        Checks processor information in registry
        
        PID:892
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4472 -prefsLen 35010 -prefMapHandle 4476 -prefMapSize 270331 -ipcHandle 3052 -initialChannelId {fdadc1ea-6b86-4592-b681-bf27e845b31f} -parentPid 6012 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6012" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 utility
        5⤵
        Checks processor information in registry
        
        PID:5704
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5180 -prefsLen 32900 -prefMapHandle 5184 -prefMapSize 270331 -jsInitHandle 5188 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5196 -initialChannelId {2fb9c93f-b573-4e02-a4e8-9aebc7d4b907} -parentPid 6012 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6012" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
        5⤵
        Checks processor information in registry
        
        PID:4460
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5448 -prefsLen 32952 -prefMapHandle 5444 -prefMapSize 270331 -jsInitHandle 5440 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5464 -initialChannelId {5de2aee5-e6f1-4258-abd8-8bf099ab2c9f} -parentPid 6012 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6012" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
        5⤵
        Checks processor information in registry
        
        PID:1832
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5432 -prefsLen 32952 -prefMapHandle 5468 -prefMapSize 270331 -jsInitHandle 5472 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5480 -initialChannelId {7e041aa5-568c-46c5-9452-7bbed9e82030} -parentPid 6012 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6012" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
        5⤵
        Checks processor information in registry
        
        PID:2972
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\00abtkhz.3me"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    PID:4092
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\00abtkhz.3me /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\00abtkhz.3me\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\00abtkhz.3me --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x108,0x10c,0x110,0xe4,0x114,0x7ff82947dcf8,0x7ff82947dd04,0x7ff82947dd10
      4⤵
      PID:6516
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\00abtkhz.3me" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=2308,i,9858657436687612414,9084880633588232645,262144 --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:2
      4⤵
      PID:3936
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\00abtkhz.3me" --field-trial-handle=1776,i,9858657436687612414,9084880633588232645,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:11
      4⤵
      PID:840
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\00abtkhz.3me" --field-trial-handle=2372,i,9858657436687612414,9084880633588232645,262144 --variations-seed-version --mojo-platform-channel-handle=2344 /prefetch:13
      4⤵
      PID:4396
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\00abtkhz.3me" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3096,i,9858657436687612414,9084880633588232645,262144 --variations-seed-version --mojo-platform-channel-handle=3160 /prefetch:1
      4⤵
      PID:240
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\00abtkhz.3me" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3104,i,9858657436687612414,9084880633588232645,262144 --variations-seed-version --mojo-platform-channel-handle=3164 /prefetch:1
      4⤵
      PID:956
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\00abtkhz.3me" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3540,i,9858657436687612414,9084880633588232645,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:1
      4⤵
      PID:6724
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\00abtkhz.3me" --extension-process --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=3556,i,9858657436687612414,9084880633588232645,262144 --variations-seed-version --mojo-platform-channel-handle=3992 /prefetch:9
      4⤵
      PID:6728
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\00abtkhz.3me" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=3576,i,9858657436687612414,9084880633588232645,262144 --variations-seed-version --mojo-platform-channel-handle=4008 /prefetch:1
      4⤵
      PID:6128
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\00abtkhz.3me" --extension-process --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=3592,i,9858657436687612414,9084880633588232645,262144 --variations-seed-version --mojo-platform-channel-handle=4040 /prefetch:9
      4⤵
      PID:6696
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\00abtkhz.3me" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=4384,i,9858657436687612414,9084880633588232645,262144 --variations-seed-version --mojo-platform-channel-handle=3972 /prefetch:1
      4⤵
      PID:6736
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\00abtkhz.3me" --field-trial-handle=4412,i,9858657436687612414,9084880633588232645,262144 --variations-seed-version --mojo-platform-channel-handle=4404 /prefetch:14
      4⤵
      PID:6644
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\00abtkhz.3me" --field-trial-handle=4904,i,9858657436687612414,9084880633588232645,262144 --variations-seed-version --mojo-platform-channel-handle=4860 /prefetch:14
      4⤵
      PID:3008
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\00abtkhz.3me" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=4920,i,9858657436687612414,9084880633588232645,262144 --variations-seed-version --mojo-platform-channel-handle=4956 /prefetch:1
      4⤵
      PID:5148
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\00abtkhz.3me" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=4948,i,9858657436687612414,9084880633588232645,262144 --variations-seed-version --mojo-platform-channel-handle=5008 /prefetch:1
      4⤵
      PID:3572
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\00abtkhz.3me" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=5000,i,9858657436687612414,9084880633588232645,262144 --variations-seed-version --mojo-platform-channel-handle=5068 /prefetch:1
      4⤵
      PID:6284
  - - C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
      4⤵
      Drops file in Windows directory
      PID:784
    - - C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x244,0x248,0x24c,0x200,0x250,0x7ff788fc1f58,0x7ff788fc1f64,0x7ff788fc1f70
        5⤵
        Drops file in Windows directory
        
        PID:732
    - - C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\initial_preferences" --create-shortcuts=1 --install-level=0
        5⤵
        Drops file in Windows directory
        
        PID:3184
      - C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x244,0x248,0x24c,0x220,0x250,0x7ff788fc1f58,0x7ff788fc1f64,0x7ff788fc1f70
        6⤵
        Drops file in Windows directory
        
        PID:6076

C:\Users\Admin\AppData\Roaming\aCSbxnu.exe
C:\Users\Admin\AppData\Roaming\aCSbxnu.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:3500
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\aCSbxnu.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1868
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\aCSbxnu.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4332
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\aCSbxnu" /XML "C:\Users\Admin\AppData\Local\Temp\tmp1827.tmp"
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:1832
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1404
- C:\Users\Admin\AppData\Roaming\aCSbxnu.exe
  "C:\Users\Admin\AppData\Roaming\aCSbxnu.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:4580

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1456

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

aCSbxnu.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\aCSbxnu.exe.log
Size 1KB
SHA256 4c17576f64dea465c45a50573ee41771f7be9962ab2d07f961af4df5589bdcce
MD5 7e1ed0055c3eaa0bbc4a29ec1ef15a6a
SHA1 765b954c1adbb6a6ecc4fe912fdaa6d0fba0ae7d
SHA512 de7c784c37d18c43820908add88f08ab4864c0ef3f9d158cc2c9d1bab120613cb093dd4bfc5d7ed0c289414956cfe0b213c386f8e6b5753847dec915566297c8
MD5 SHA1 SHA512

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 e39062a62c3c7617feeeff95ea8a0be51104a0d36f46e44eea22556fda74d8d9
MD5 ac4917a885cf6050b1a483e4bc4d2ea5
SHA1 b1c0a9f27bd21c6bbb8e9be70db8777b4a2a640f
SHA512 092c67a3ecae1d187cad72a8ea1ea37cb78a0cf79c2cd7fb88953e5990669a2e871267015762fd46d274badb88ac0c1d73b00f1df7394d89bed48a3a45c2ba3d
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 df2411f82d989cb05ca9af993aba73f7b04cc8a83698fa899491abd83b66bef3
MD5 62190603da42d9584046c1c664e4184a
SHA1 afe4c063873da534686f93b790ddddb6f53faada
SHA512 3f250f8b100fb8ae5519920e57e2fbbe28b8e10165504ee3214ff4446f89f89a76d85df7ab884a902121f683fc67f422a6bdba8d1680f3a8c5d79193d8620bea
SSDEEP 384:iTHhsSS1UjSOL56FRHEMEcHnnNzjs2xtgDNS2L949EoX0iFZX:NSSCW+6RPEINzj7xtgRSe49EoX0E
MD5 SHA1 SHA512 SSDEEP

Submit Download

activity-stream.contile.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0lszmf8w.default-release\activity-stream.contile.json
Size 4KB
SHA256 68a84023946415dfecfef9e5f3251321088cb063c318bf5710386b150c3a2ec5
MD5 c41cae9b1b8cd6b716f6768fb4b41446
SHA1 7ef898a74e61191d97422929f46e2a97c384aef0
SHA512 a0edde30b86af10a6fbcac83c2f2b66e6a9fe73d4673d8d6a9eba3430d1cd9228a3b11881c51c1305c78d61c08bb95f5c355fd2351581f600002be24b1732e9b
SSDEEP 96:KW7SCQt1r3FwOrVasbdckiX8DloU59ooRw8Dfw8XNol:KWet1r1wEJdcH0loSioZVXNol
MD5 SHA1 SHA512 SSDEEP

Submit Download

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0lszmf8w.default-release\activity-stream.discovery_stream.json
Size 23KB
SHA256 1d1b4e888572c650adc32f7323fe84aff12bc463068c947c1754b0c3a6750094
MD5 6ee70685e3894592f5c099ac06a0eb6f
SHA1 95666428562f9dbc8a14e93f037038897cd96ebf
SHA512 79b0c6fbc75f80cedef860e8a22541203b264df9cf8253854d149b27dcb031e637c08d78f82188b243411fc39a808ac2e8e646f44f0ca3924a93405ad19a787e
SSDEEP 384:kyagQlE74G15Tk/ZEeKkeS1klXMtygQvO1108ZAZRJC+iOJrHBIoX0qJ:kylJQqeKkolXMggD15ZAU+VTJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

577120C5183923526312DC856F6825FC1C7D072F

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0lszmf8w.default-release\cache2\entries\577120C5183923526312DC856F6825FC1C7D072F
Size 13KB
SHA256 bfea2fcaf29b10588e9cf15bc7cc6c9e45728941a2c39d5cbe712dce61c1dae4
MD5 1ee4843d24b40fbd05b96ccc821bff4c
SHA1 26aef582d34491082336e0a8c84df3278fdab766
SHA512 3c5e570037bdefa6fa7c1e9e106564c5592c03796070302e1b3f5806fb29a6855cc6cdb052b1a8c9663fa4314faf6fe08e209fdb5d05992b1a81c411ad625775
SSDEEP 384:HV9BpiO024YH7hSznZOML+CbcxDEclrIVy8eHG4:1EZYH7hSz8MLPbcxDEcVIVy8U
MD5 SHA1 SHA512 SSDEEP

Submit Download

32.png

Path C:\Users\Admin\AppData\Local\Temp\00abtkhz.3me\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\32.png
Size 927B
SHA256 af50d64bd3cc7c3d201cb5abf0d76f44737e2a4040741ce178d9765fe440bcc5
MD5 26496798ba29a454042d60c9633c1e72
SHA1 65977f9cc15dd73026c91b479f1bc678050c8c45
SHA512 a4a61f66c712fcd27681073c2f30fda3a98fb6348ac4451d8a8e181e525f4ad8491a09d19c17dfb8f01a53eecbfc3ba25f370afd9df5b2ecb9b613236ecdd3cd
MD5 SHA1 SHA512

Submit Download

48.png

Path C:\Users\Admin\AppData\Local\Temp\00abtkhz.3me\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\48.png
Size 1KB
SHA256 3339af4538fdfa40bb438469e35f6b7668d5c5ac93db0ef4a9e2fbf9ae884446
MD5 815ddced6b03c8a62cb590ea4585fcba
SHA1 9f7e8cce2319b15ec63d89f837a173bd247e6998
SHA512 ec7069b51959572c40dfa02f380b081912053898b4d4f86166b90bd277f9e8271d0fb3f0627e82645052ebe021c2e24698785e5214e82190a2298f32dd879b3d
MD5 SHA1 SHA512

Submit Download

64.png

Path C:\Users\Admin\AppData\Local\Temp\00abtkhz.3me\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\64.png
Size 1KB
SHA256 e895cbcc424d6000a15b21d7cc9dec96deb2403a1469761ba3d9f11528c215b1
MD5 f2222b9d8dea52f5ce7d75378de76037
SHA1 e3b266fca2e5bf8bd82a62791902e879af7ff6fd
SHA512 74b947bc915c89f27954b5d0c8c790316ace581a20f7031aa91af3d95303ff0dd8cb4c87d3746ef2b13f76e0e8bba1b5b4a6916f3230c0514164fb1700640f66
MD5 SHA1 SHA512

Submit Download

192.png

Path C:\Users\Admin\AppData\Local\Temp\00abtkhz.3me\Default\Web Applications\Temp\scoped_dir4092_757935106\Icons\192.png
Size 2KB
SHA256 9cfd1ad226821af533499bd832a5674df52a720b19e054580a2b999e19dd7b1a
MD5 22ba8844019e231a435903176a618bf5
SHA1 0ce576800f66bc2145c8df72b9efbe0c7431aff8
SHA512 2e754fce3268dac2f8f9261f4d4337a7990a990121327c9d491f27fba5c4680968c7589bfa0d04082410f975cda97c46912ba8e1c39f8a6da15cb32c02929cfa
MD5 SHA1 SHA512

Submit Download

256.png

Path C:\Users\Admin\AppData\Local\Temp\00abtkhz.3me\Default\Web Applications\Temp\scoped_dir4092_757935106\Icons\256.png
Size 11KB
SHA256 f64a3d1e393f9a114632d22bc8a01b328895127ff1796e2c3d18b206622fab1c
MD5 024859c892ef6882e8a3e1be4675d23c
SHA1 30ba3b6255e2514b9782ee29f6b8b55ed350a29e
SHA512 58caafadba7cda1db596f5a3c2f94fd3a167cbc21ad98387820ebd808a52eff0e23a5a8292b34a8e284aec4bf2573998ca62f0effb5b647af1bee96ded8bb384
SSDEEP 192:F4aCtq9F5vnIb8/0yNBlV28QNP716enZiP3dGu5yIs9gGDyIMWQo2BkL6O1sSO:Veq9vvPdBrQNL8PNoIsPGYwBO1sP
MD5 SHA1 SHA512 SSDEEP

Submit Download

96.png

Path C:\Users\Admin\AppData\Local\Temp\00abtkhz.3me\Default\Web Applications\Temp\scoped_dir4092_757935106\Icons\96.png
Size 3KB
SHA256 6c5f0e1efa0cf592b01bc20be9c3f348a4285e4604e555216c064b64a05961c0
MD5 7b0532144ec2ce1915a3707ec9084aab
SHA1 81cab7df8538d1f757a3e58318716a9a1ed08d5a
SHA512 aefca0ca127e2b91a5c7206b8103b2afd977258643c12e972a292522152964da1beceaaba0b8f4f40e85e705bb9c9e5826ba49eb2d9b925dc07964096863dcaf
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\20qcpwxe.ip2\Crashpad\settings.dat
Size 280B
SHA256 8ded70ed188d3523854dc56d90dd931b2c1a6a6a38fec39a8b6062898fd04976
MD5 8a0994abf975ff147104f64c23b67b0a
SHA1 2d45085dd39b99c8ce11a67896ff29603c93f850
SHA512 da471af160145330aec7c5f4a611fd97e5ed027d3f0668738c3a24e50e0c2f048c76f073f7800218db0e70bda6dc34ff963513148dda156e06b7eec822432d05
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\20qcpwxe.ip2\Crashpad\settings.dat
Size 280B
SHA256 8d40d4458068887aaa6c8a4d243bd6cf7fb979612048b594c07237ed2f575715
MD5 4b99540415ab668f7f66adb2869cd037
SHA1 1ced0bd97213b12beb88ee62f0c48768337e2ff1
SHA512 7e36ce8802fbd0b6863e32d8ebd954367baa8bd84bb43eb28a7216d065185618e985dbf68ae832442fdc64262d4b051e34222431d65581aae7bafbb260eeef87
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Temp\20qcpwxe.ip2\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

8d0cc8dd-f3a5-4077-98b6-05fc4dfc171c.tmp

Path C:\Users\Admin\AppData\Local\Temp\20qcpwxe.ip2\Default\8d0cc8dd-f3a5-4077-98b6-05fc4dfc171c.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\20qcpwxe.ip2\Default\Code Cache\wasm\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Temp\20qcpwxe.ip2\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 192B
SHA256 1223198d75fdc01d591a3a816f7f0a05464a9159804707894784f95c2c23b48e
MD5 6aca79ece8c7fb47c71bc94af9cd4fba
SHA1 c06a1baf05ea92b2d067e43349daadbabb1db781
SHA512 8dae1044993e8fb9909b78439678011593edf1c8cfa99654d6f74684d3249952272466fe87539f510fed255eaccbfe40a234c4549a59a5512775199ef73715aa
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Temp\20qcpwxe.ip2\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 257B
SHA256 225d56ff146d85840c1f4a0d088d4419bba74d30c0ac956ddaae08c18f1d659b
MD5 de12cdb57092e43d6370782bd27178b7
SHA1 8a98351511c4d952c9f8f2ee9c7f10beb7749f4e
SHA512 aee9fb3ded87a85e978abf0704d509b862ebb8170cafaf5f8d041debe02a5ecb43385138a069c33dcfd0c696a5a6b9bbc51a4d1523b56316216905d9f44b3a1b
MD5 SHA1 SHA512

Submit Download

index.txt~RFe580c8e.TMP

Path C:\Users\Admin\AppData\Local\Temp\20qcpwxe.ip2\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt~RFe580c8e.TMP
Size 119B
SHA256 5c3d79c49da08070766abca1437b6031d8d66738dc3150d3808b0938d69a00a9
MD5 1327cabc09dfcf6cdd430e7a81ec638f
SHA1 fd03b41f0c77162ea04f54856695fff23f2bd4d4
SHA512 cc7d61de4a30559d51ee7e74ad033edc436cdaf601169fadd90d2f2ce6fb3f509effb9969db37a9acccee9ce88f42d23bb1aa76c4c001fde152b141252af798b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\20qcpwxe.ip2\Local State
Size 3KB
SHA256 9bdd239cf1092f0bc2faaf8dd9481cd927701a867e06af1b0fa5a5d979b2fde0
MD5 42355f51d1ca7db6bbd77f405d2b8bc0
SHA1 609e780bf582509522bac88d7c649114ff5ea8aa
SHA512 57ac2501641c27f60dd9210a69b79bcabb3ac1e5a90f3f7de13b60d22d0b33d960398d798274e078bdbfb7b456e58c581154b90798f0f15dc09e9e13f3462615
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\20qcpwxe.ip2\Local State
Size 4KB
SHA256 7db7c9a4c03cdf7538e3ddd1d5145cb2989ee248beaa7d96c3235fd70d9b8224
MD5 c885dc0eced1d9765318acb134094351
SHA1 b539ef48c9508736b350c63efea4c7a4c807695b
SHA512 dbe7141a5928b1211fe4a8532d9392e59f21c2878f72d8bd5720ef11abb785ab56fca8e8df61d31581f48313d2acdeeeea67aec15f9db163f1315f97430b53bd
SSDEEP 96:YqGNkCufavGy+iU58Frh/cInURoDotov/jNDFBbPuvFM7KUzYfgJqowRCUW6B3a:DGNbRvGEXooDUwrV7LWevYfQsYUWp
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State~RFe5800c6.TMP

Path C:\Users\Admin\AppData\Local\Temp\20qcpwxe.ip2\Local State~RFe5800c6.TMP
Size 1KB
SHA256 d9002245b7ab20134dd617d5dcb5e7744d00c481cc1835ce65be4c7365397698
MD5 8a70196d4674c80553adf10f02c3755e
SHA1 07ee05b9bbdc10c378c70f2924757dc1ac2403f4
SHA512 b0f05863e092a893e52df58df5ac0855440e1caf846b0d16b071ea6b294fc571c84a0a086e4f28281e182a692d606e08646bd4d18eafb49c7f007b41414692de
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_bplimz5x.faa.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_bplimz5x.faa.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

cfe296ea-7884-40c1-94bf-33f419820e21.tmp

Path C:\Users\Admin\AppData\Local\Temp\cfe296ea-7884-40c1-94bf-33f419820e21.tmp
Size 161KB
SHA256 23b8196b76670ffac8063a91542118344bda24d7b2fa4a4c0dd146c4ee6b31b9
MD5 d6a332ceaa785f20d7cf0ef7b9fc4790
SHA1 65f275d0b2d7b017fc8727298498dd43833d0940
SHA512 d79eba8bc96fe187f1284e7c3adf9323bd0525f73daba3e6f97013297588119256aa1af82ddccbdff5483b466f22b1846ee2f44afeb84fecd7f2c6951b7aa659
SSDEEP 3072:D0siC87t5FyUgTnPw2Aee5WZ/2gtjccLyD1FLrhHopoqxPVv+J09vXOj:3MTyJrP7xe8/RyDf/mpoGX9vXOj
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\kyfsiefn.svq\Default\Extension Rules\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\kyfsiefn.svq\Default\Extension Scripts\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\kyfsiefn.svq\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

32.png

Path C:\Users\Admin\AppData\Local\Temp\kyfsiefn.svq\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\32.png
Size 1KB
SHA256 3197a2ac164c5bacb65f02fd9a6eb9c0a533fdf3b24f43043bbe9af65ed6608a
MD5 60953b3aca67505c2c7ea1a902e84d51
SHA1 5e6a8e04a96e36306c66409edd4775a606f13f54
SHA512 2e65ec84471c3f703617171aa32f1a0d6c57d73e1d5c074b92d20d580df78e7ac4eef5ce54ab7defd0027bb38e33c44a6602d3e123a2fd310e514af0f5b38086
MD5 SHA1 SHA512

Submit Download

48.png

Path C:\Users\Admin\AppData\Local\Temp\kyfsiefn.svq\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\48.png
Size 2KB
SHA256 9bdfc3aa03d4e41b0d83862ce02f9fe7fdb55a492280d86d551b91a24efd47ca
MD5 1625c1dd7bab831d8ab5308a1a71d525
SHA1 f1c145985a7c8c18891caaba0f46729bcbd1f63b
SHA512 75079bcb02482abd10b121d81fe39607dcac17bb3107ca274c549b570bb473260dfdbdd13df769b1745425ac5433a22fd392a2a1d815897e0c2091b787bada8e
MD5 SHA1 SHA512

Submit Download

64.png

Path C:\Users\Admin\AppData\Local\Temp\kyfsiefn.svq\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\64.png
Size 2KB
SHA256 57d5cd9fa59f944ffc78ec2a12633a79e2f923124fc50676ffbecaef5021b4a9
MD5 e6671b804d6013a6706ea598e2d854c5
SHA1 40e4f401fe4afbf7bda49a02fe94f5308868460e
SHA512 7b11a47497ae5810ec4c7038ebf8358f03d79126886feb6daffd92d116fd606f530ecced9c3d635c0f57b9f9eb80ed9e8fa4eb98b029f9fd798d9b89ccd279a8
MD5 SHA1 SHA512

Submit Download

128.png

Path C:\Users\Admin\AppData\Local\Temp\kyfsiefn.svq\Default\Web Applications\Temp\scoped_dir5180_695230773\Icons\128.png
Size 5KB
SHA256 99b19cf47ea4e47b933229e92b87a474fbd5af7936bdf885c2240d0e6f4bdaaa
MD5 6a371e7bbf132a71f031772845249b9c
SHA1 36f499f3a2e2bf885019d914a0cc6e8b3e035a79
SHA512 b1fdcd5af84fa476808b8e89794d9df9f8e48b3e7c1a2239deae10832834d01bf311803ac95b3774d781be791b47389310ca866e1a6b497925ca6e2f004555a6
SSDEEP 96:n0NgAMSinf795k4ITgiEAyaD39SOOcqS+e60qq/zsB:n0Ngpf795k4CwG9ST3S0wzsB
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\kyfsiefn.svq\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\kyfsiefn.svq\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\kyfsiefn.svq\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\kyfsiefn.svq\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpC999.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmpC999.tmp
Size 1KB
SHA256 54e6bcae7b5cd0f3c07813c8cea3428c78f5083afb48f18930a33eea15c97e79
MD5 18757942729ab9c046c178358477f26a
SHA1 5e810cc069d02eba078cad8c1840696ec1707f60
SHA512 70909726ef0e9287a4d63e32b81eb4c9fcf102baabd7fa122b12d4fe0ee355dd415b0ededaf7a22bbb4b52b4170beae1552a8848cc21e90ff16a283c52e43a6a
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\w1ergef1.gas\Crashpad\settings.dat
Size 280B
SHA256 e1c3ab22a81aabf4d9d80bd26cd242cf43035977606ff79332350e8e313e3b4c
MD5 57e1f6966c1c0961980b30521c477036
SHA1 1d680f1b3e09682e0cefbb923ca78a8e34cf756e
SHA512 d2754b4a454c00d2086f6432413cd445f97d277ab73115d011b1fb3e7132115137a35330d8e63d97062c4a7c9b980cb22e16487a8db22cd6f6a5ea714e577ceb
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\w1ergef1.gas\Crashpad\settings.dat
Size 280B
SHA256 119ece8a5fa3dfdf497cc6da369635cffc880aba08a6ee256d429c31779e473e
MD5 803046e42ce3d413be60e0ebb90a138b
SHA1 09ffbc30ab2179b744efbc88b938ee96cc71a6ae
SHA512 afa263a0467cf3b1eca88c3c4be37ee7fea35b7bf00acc9abe744a88bf21084279f5740b1dd5003ec8f4d765ebfe43cfc4b3c1718031dea813c0fac86c3eb2b3
MD5 SHA1 SHA512

Submit Download

f_000001

Path C:\Users\Admin\AppData\Local\Temp\w1ergef1.gas\Default\Cache\Cache_Data\f_000001
Size 35KB
SHA256 c1636607fbe121e7a6fe6336b2bccb0daf1db997ba1ef57989da3f55c0809c18
MD5 69d0325fe27b505632ee4429c49c83d1
SHA1 41bccaaea7f5e47e810c5cf82074c9233bd7a3ab
SHA512 1e5b2a0620d966344db0ba1cc4f4b191b61971598cd4d567c945987dd8940727c0fd10a080c2d4f8a58b86045ec19f406517bee4af6ee42a55e378acd022a2cb
SSDEEP 768:nwuGrOHLqpEBa70t3IlGjjMOkbcR3WjbdFUnPioMcHkO:wfriLxBacPjM8GjbdFFoMcH7
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000002

Path C:\Users\Admin\AppData\Local\Temp\w1ergef1.gas\Default\Cache\Cache_Data\f_000002
Size 100KB
SHA256 5682c98effece00491be8227ae75e3cfae09fb3147db1a23827bcc45dd6fe392
MD5 b9458d8a9a334ad0342ee4d74f8187db
SHA1 d7333a8d13e1383b4537a99526bd0b46f1fc3b28
SHA512 bad64ece9db02369d73f81ed8a2ca6c8929b414a2f1ca9a878eedcfce12866050bfcd313026d730fb978388162d0feb516c316d07cf8a85bc59aa93c97cfbdee
SSDEEP 3072:sL2Z0/CW2loqicfuJxk7JMCUADxbZulTJa:w2Z0/CWEoq/fQxyJMfQxNulg
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000003

Path C:\Users\Admin\AppData\Local\Temp\w1ergef1.gas\Default\Cache\Cache_Data\f_000003
Size 61KB
SHA256 b11aefba956845d1d52e9cb0d9ce736b96836537ffc8c9b06b92f808ae2a5b86
MD5 598eca57fa8fa7475f2f9f4169228482
SHA1 65f218cdb6e7339013fbd91a82df2ec891e5b679
SHA512 03ec14527716e3703a9497d7da9f7013628d59ca9dbd62a295da33c3869fa490ee644cd858df27443ba74b58a496dfac0b8aad54ff29c36f7d77fcebd3d0cb5d
SSDEEP 1536:66V2TYBOrMZkomQ8NqWA6dGdt7yNSZJwW6qoU5alBd/6AK8l75xhGU:TDKomlMv9bXw3l2d8l75/GU
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000004

Path C:\Users\Admin\AppData\Local\Temp\w1ergef1.gas\Default\Cache\Cache_Data\f_000004
Size 381KB
SHA256 dffa3dd93f5f45ada009b556aaf03199812113a548a37212f8d717514d782007
MD5 d588b5144d1aa3c28b8184be7f16550d
SHA1 f236ec4732efc9c090bc46cf9360e23fb4ef1574
SHA512 a58efed242f3ebbcfd2681766f58f84aea6575f42c9dd100dc9312ec60285f41ae6588aaf0a9900c2f18ca07b0808d4fc161b91b04c1052e0719e9e509989aad
SSDEEP 6144:Ip9EySisT0dxABYeXti2HZCnzUnMOnjFYtimDrkJT+RSgO:IIySWoyeXt0nIMOjit3oTeS
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00000a

Path C:\Users\Admin\AppData\Local\Temp\w1ergef1.gas\Default\Cache\Cache_Data\f_00000a
Size 26KB
SHA256 039ad570ac612dbed3a4501a84b872d7454814734b5fbbbf3df758f2f69b895f
MD5 e924cc41c587c8861a1c9915fc32c3d6
SHA1 e3def882c7aaac31f5f2e08d260a60281eb9bf0e
SHA512 1a6c602ed4fe828e7611ad45212025d8074982d749b917dba1e64d26bbc2a1d708fe35da3b3a75f907b25bbc8fbaef62eaf550d577fa1de5c343f58cc15e16be
SSDEEP 768:MJ8Ytwxv6eua8RgV4hfhEOhiLoAKaz3AyaE4zE:68Ytavc1RggEOhiLlvcy/EE
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00000b

Path C:\Users\Admin\AppData\Local\Temp\w1ergef1.gas\Default\Cache\Cache_Data\f_00000b
Size 72KB
SHA256 df26d4260b4599fadc2ff23f1312e570465dd49ac05abb8689155d35d49fc456
MD5 8b1ca4bf35f011fd684ad190454fb6bc
SHA1 f54002abd2f851401979dbfa9979f9f3ba73131f
SHA512 f1ced1555eeae062280c19f2b1bb6a8007c6c3c12abbc0ef9d4fb1b1e3349483d8fed823465706b4324287bcf0ce8cbe4e15a7deaf18eb7dd3b024a1b5b92d5a
SSDEEP 1536:8IHNVVmhx4A1LNpruQ57Mn87k2KQl7ocoCg+Cpz7U/Dq3QE367NNesb:jtVMfjHrpMn4tjlU5G/e3QE3o
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00000c

Path C:\Users\Admin\AppData\Local\Temp\w1ergef1.gas\Default\Cache\Cache_Data\f_00000c
Size 17KB
SHA256 e61ec47cc6f130e9aca2dba03b27f64cc189d282ca4cd878e436f7cabb3afab7
MD5 c9e6a407920504b268c6b1ea5e2b1a16
SHA1 64c5a72a4e30207cd0a4d4ef1ec09d473d72125c
SHA512 307312e7fff5fba5da1c93c394165612839732811271a7e4ba8675267db85a4962026a46c813d2fec99163084a92a119b5b79785026ddff17fc10feee5749fcd
SSDEEP 384:WUtx5C7ZY9+bgOShlXeIhoNHp3bffOO70S7U7jue5Y:WUYK9+boeIy6So7jue5Y
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00000d

Path C:\Users\Admin\AppData\Local\Temp\w1ergef1.gas\Default\Cache\Cache_Data\f_00000d
Size 67KB
SHA256 b94b7dd0f3d96ea2de4c933315a9331bf85c8b9e651f43eb9ef2b4c18b042c30
MD5 0b992a35170a707ef8da8169e37e9ce5
SHA1 4a2c942a121156ef06417bbb517bb90ac62ffc98
SHA512 6f806dec40ff8e04aed5ca913f23320bd513d1a5ae312d9a9145a9c3c31ff6a07ff8afa5424c92170115f0f5615b667d70d8fe6d37bae43a72d5f7b06f215287
SSDEEP 1536:4nmD0CmBIJyRL5+aJWL2p2BBQ6fPyvoCcVM8csRP:4nmD0Cng5+aIyEf38oJa89
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000015

Path C:\Users\Admin\AppData\Local\Temp\w1ergef1.gas\Default\Cache\Cache_Data\f_000015
Size 70KB
SHA256 275252d80fbf58b2ad29d8a82bb3b94b03ddf3ae387e6c409d4729cd1a56d46e
MD5 4978f115f8eccf7c094dd7131457939f
SHA1 d82f50e690d830f18221130a634880b051df367b
SHA512 df0d6b99192e4870a9c8c02121d8d7d93bd492f8df353653e8b3e46ddf418bc8bb128d3aa7b9cc684e9a66df8f40617337a843c457abfccb9abe57992ccfedd9
SSDEEP 1536:pbkSBQaF7bJ3kbO34V7iq3mhWnj0JU70rf1qQthAQQbVHlDYRSDBSLI/YLFh:BkSN7MO34V7xWhKj5iAQuVFDY8DsIQ5h
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00001a

Path C:\Users\Admin\AppData\Local\Temp\w1ergef1.gas\Default\Cache\Cache_Data\f_00001a
Size 18KB
SHA256 20a1c875972d030d114689f91ecc4ef65497364fba0d54deabf1a32535f84db4
MD5 748d04a3372fa4603c0656efe2a6264d
SHA1 3ea51f70d305b92207c398b4888302b3c0258502
SHA512 753a53e582af32ae60a49d38268130cdbb39c9c2d79462f6c47454e409e45acbc83eb98265fdd26a75eda0f73cc211d9801c42f71c7b2257f43bc030870ecd28
SSDEEP 384:4MLtci0wPQUET6xe1rdj2JQuALqwczogzkFLVQsdLqWjDGhQaedrUZx/:vtc5wPQUETUnAmwhzFLqWyQdUZx/
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00001b

Path C:\Users\Admin\AppData\Local\Temp\w1ergef1.gas\Default\Cache\Cache_Data\f_00001b
Size 16KB
SHA256 b0cee203e0904b59bb708ae871ad36d5386a5d51d0909a5b5a46461327ccf645
MD5 1712d21c6b50e0eb31f8addb32ebd649
SHA1 a68a944906b99d557642101e285889c5ae445605
SHA512 5b094bcb32ae792ba2e01d31c7ceddd29d4fc925040302fc75fc529c48ae4efc2bb609ae8de0725ca5e4a83d356fa06f01fcb9e10a131ed77b71a7c51c21f127
SSDEEP 384:lSDugOEpmVtK/0Eg0+6TYtQqL+EZ2vjp4rP26Zh08:lC/pi7E3EtQql2vjp4re6ZC8
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00001f

Path C:\Users\Admin\AppData\Local\Temp\w1ergef1.gas\Default\Cache\Cache_Data\f_00001f
Size 16KB
SHA256 ac52cb0af3807893ec8a4f68ea05a76abc7c99d56b7eff3e38a9df4ac4d8fc17
MD5 51a669021c986f20a5cda9e94e60b0d7
SHA1 516ff1565b6bd77e2d4570e8ed45716a09b110d6
SHA512 51e4ce93622502c6f6953e757d09aaa9352cf10b98f709e637f2e55a21d08838593462352fef61f0f2326319901a6f329eb5b0a4280e9b2a0ad2fc0ef341b292
SSDEEP 384:CwO1qrS9nRaoNDvFwhtRvezIVrRZEZMNkllDOwBg11r:CwO1q+lsYGPy0RmZM2DOtr
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000027

Path C:\Users\Admin\AppData\Local\Temp\w1ergef1.gas\Default\Cache\Cache_Data\f_000027
Size 33KB
SHA256 5d652a96b64041d53001a86c7bf62289b14f4386c41a5118b394c1226460623a
MD5 44fdf10980d499d339c187ae63125aa9
SHA1 e9ab806d56bc2f1cb81f3381728a894ac02e673a
SHA512 1c8c28d5a7be83483df04b937ced3cf77c23083e28b8c147c678aa0390203a0bba33692aef1437acf46f1eb6b68b1d6dfd36f80b8c1f58c55b623a37795bb57d
SSDEEP 768:nWs6az0EcxeIQ9bQ/a6DDwE7LIqdjWmQU/sbdkKF1OiBVjhtg+zb/IpH+t7cE:Ws6azi5QRGb7LbkNF1PjhtPzUpK7cE
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000039

Path C:\Users\Admin\AppData\Local\Temp\w1ergef1.gas\Default\Cache\Cache_Data\f_000039
Size 17KB
SHA256 a2888c6998e63866e89e566fd135f8c54b4b17fc10faf7b95ee3ee6722e206ef
MD5 93ff2fcb501ecdb434093459bd71016c
SHA1 abe2aa5303ce7bb762008440466e6d70d8dc411c
SHA512 8db873706bbd9d76971606102d887138f2d971739d7adb1f41c1869177ee4972f26d15786931a2928f8a61c023b097857b13ba27edae137e406400c15d4d6784
SSDEEP 384:BM7MN9++Dapvi39nihYxBvOim4547+ngfjpFTV:BM7w9daJA9iWw42KngfrTV
MD5 SHA1 SHA512 SSDEEP

Submit Download

ExtensionActivityComp

Path C:\Users\Admin\AppData\Local\Temp\w1ergef1.gas\Default\ExtensionActivityComp
Size 4KB
SHA256 8c471cab38a1696289186d01b06ff6af2a888852dc18d6fb8d2a0e54898104ed
MD5 d25d5e1dc1d93430e64ee17e48ce442e
SHA1 d5c7ca9a57e6cc68927a249fe8e601d52680ac7a
SHA512 f4cff7510b4ad81090e0b1842652f8eb7995f7aefd0ce651151bc24ca3a4305d34ecae41cf193d9b846e8f6359ccf545e5d05e63e6e766fa9761ccebce620f6c
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Temp\w1ergef1.gas\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 192B
SHA256 55c70a4eb2cdf8751e2e24b40eed3f6246e0ad51a126b6ef979841e1f0e24140
MD5 bd3ecc08b76a3128b8093bf8eec19a2a
SHA1 42297415a73b29efefaffbf116fb9df5af50ad32
SHA512 8f04e5c91931945132e3225d6c7669424a913fc79635b80f156dd043d32209a6f9164b381104b6068d59c162820c95972bdabf773e632b91ff4960d47fa9357a
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Temp\w1ergef1.gas\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 255B
SHA256 1592a337715e66f649680ef90bd8c3661b3b910022ceba58da64bcd88963d789
MD5 0133d6c6ae2797b8d11c22a836825d8d
SHA1 a4e4354cac43aa8d2d4936b5490ebcd7a5885ccc
SHA512 32712f30d0dba3228400823e433908ce9348e24da3ed4d2f96be21be1f8b3f1be08924bd19cb9904cc940fb95481ce0bf2f6debbadaaa1d4f4032b9acef8d3c7
MD5 SHA1 SHA512

Submit Download

index.txt~RFe583081.TMP

Path C:\Users\Admin\AppData\Local\Temp\w1ergef1.gas\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt~RFe583081.TMP
Size 119B
SHA256 cb148e595268a95c8a21c63bc8837720d7d090eaa537f60eb9c82b1b673629ab
MD5 d19c0ecc44bd85eb4c2d28dacd4b54a8
SHA1 34c08b7eb912f821ae37d601e4947bd26e3c99a4
SHA512 459620332c3e26bd4e4f9fe5892ed4160db4653155cb01557068c7fdcf319d50138628fb03f7cd56656021f328d135c79ce7b0f32750d621a8a6502255a43b28
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\w1ergef1.gas\Local State
Size 3KB
SHA256 84d11ecc0ce5398e1599d9278408735da3dccdc5549ff0f0d239c6f1c3575ac5
MD5 0d6f4a72c618d4f74d0be7693fae4006
SHA1 c9d3cba520a07c4f4745aced6c6842f137e962b5
SHA512 e0249c97dc311206cb5adc9a259401c27afc8d8ba01bbff5bf1e6470e99e0d55bb270bf09b3e506dbb4766d616098c2c2790f8c481856a3802b1225c2b757e46
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\w1ergef1.gas\Local State
Size 4KB
SHA256 8c495e4d39fff213d46f61be8ec4a71e9579651127d9d4bb9fc9322ae9724120
MD5 4d6b4c1546076fcbb46b68cf9567ca88
SHA1 80cb05d31abefb9b35b84bf049f0209ea7a46e4b
SHA512 87ed9a5e4fa8c55492b20baf0eea4d42e8d43d9fc46ca1d04f0096736e31a2244cab552439b3c71cc20b2ad1f0d5ddce10811e7452e8aa54d8a8d1adea968874
SSDEEP 96:DqGNkCufavfAwV8C+58Frh/cInURoDotovdjmDbByMvFO8UuZ59CJqICUQBIDa:GGNbRvo+ooDUwdAlvzUu59OEUpG
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State~RFe5823bf.TMP

Path C:\Users\Admin\AppData\Local\Temp\w1ergef1.gas\Local State~RFe5823bf.TMP
Size 1KB
SHA256 f5d965b9c877e5d970504060d919f00af8a8c96902499c5efdd235ab87a627eb
MD5 978f2c1d2748c12fb0926fbb3362706f
SHA1 f60674ab3e208b9de9eb9c1e7910d9b0f1d105a2
SHA512 fe3c81202f56c9b536a66b2ab7a0ee9951475aee3410d4a5315a77e3266630f368813b4766c56f49dc87ca581c7ff146d86c14d17af4a4396374473438bad74c
MD5 SHA1 SHA512

Submit Download

6AOEB59FZXGWV9FUK7CK.temp

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6AOEB59FZXGWV9FUK7CK.temp
Size 4KB
SHA256 464d9ac74ca88658768ecc351a5140139df27cb994321782ecb360287c57a3cc
MD5 fae54051d0efe9ff8ea55c5875c861d7
SHA1 6e9e35fccc91491f837a6a3aa44ad90477783f37
SHA512 c585b2c19228086b1d11cf3f4521ae7f2b83caa12554bf08ed7346437c4f6ebbda60ff192610f25e227d3d89e9b046be164c68bd8f04f0377fbc9b2ca6e10078
SSDEEP 48:BH/hRkdOoSLTYORol+YJ9zUoYidLXuH+pjW/hRkdOoSLTYORol+YJ9zvY3gdLXuy:8JUojueRJvYIuy
MD5 SHA1 SHA512 SSDEEP

Submit Download

ccba5a5986c77e43.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Size 4KB
SHA256 a17b51571d6a506c53c25b494f0cedb81cb7494003e2d6e6ff9454d75d293876
MD5 50e2239989665e0cdc34927941277a95
SHA1 7c38be8383f4f28d2f0eeb032db15064f2642ab9
SHA512 7348d4ad510fa722ee1d8f55752e87420e821d5475ce9415dfe33db2d71f42516ddab3cec40cb889de1dab6497d0ccdb06ab54a358826a5037ac80df95636532
SSDEEP 48:VN/hRkdOoSLTYORol+YJ9zUoYtgdLXuH+pHE/hRkdOoSLTYORol+YJ9zvYPgdLXr:VMJUorueRlJvwIuy
MD5 SHA1 SHA512 SSDEEP

Submit Download

30292032-7058-49f6-a3e0-89f43b5a1f2e.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\30292032-7058-49f6-a3e0-89f43b5a1f2e.dmp
Size 65KB
SHA256 2488797ea193c9287e7896505ebd4f75a54a8b49a0e2daff1c14bbf4de3cf27e
MD5 071d5d56305793ed4d7db6480be68336
SHA1 4f340d1da622d765b8a74cd80a1a6bf45e40250e
SHA512 ffb7de3fd311568fe36c4be54a0ec4683af08f7fbcaa2230d545ae26b1621dad35e50ad077324cd516c83b1840c97b19a6c311034b45cb003e810ead20054c9f
SSDEEP 384:hCSZ0LuR2/Pr3YqOlgZbXESmK06bfB/SQA5TVeO7HopXxFo5+:h2O2/bgCXQK06bfJSQA5h7IphFo5
MD5 SHA1 SHA512 SSDEEP

Submit Download

30292032-7058-49f6-a3e0-89f43b5a1f2e.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\30292032-7058-49f6-a3e0-89f43b5a1f2e.extra
Size 10KB
SHA256 8608728b8fd3f860a81d04950a9e118979512514f8ce037133e950eda3f6258f
MD5 7910c6069f1842644b800dc4abb62b56
SHA1 8dd859bc26abd80332837a0feb07f61df6f8e294
SHA512 c2ae0f01a2fc06f5bbe6f8c235065d9fc0874ccb2699b84dcfea2b60374c9460ab72ed813ae256b3e95bbc55c96ade773c6359136eb9334659ae8f4501701aa9
SSDEEP 96:STWCeeT23pY6pw6lF29dt40Rh7CsevBb1d05DjMLlIrLlhTLlaXv7aputILfcBC7:S5emWlYb/7uvZ8dL5xsP5wlPHkfoD
MD5 SHA1 SHA512 SSDEEP

Submit Download

30292032-7058-49f6-a3e0-89f43b5a1f2e.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\30292032-7058-49f6-a3e0-89f43b5a1f2e.extra
Size 10KB
SHA256 ba3d9e186677744edbc4f0a8e5106ac3892ae147624c6b08bc2d2192e79bd677
MD5 ce703157ccf0771c06ae7b8977e59a0a
SHA1 d3c864d00ae830ca03a1f4e3b5421f310adf7ab7
SHA512 8598f8595a3d378db852987254082a6f68ea2a69f90444ae584f7c0026d8e08dc36eb98bfaa8183de7935f63f92b771966c7c4875b3c02e1bb73d54747be3c76
SSDEEP 192:S5eFLcFQiR4M4DnQYapdVxzPXWBHv4T/fKNtalHHkfoPbL2Mnwv:i8cFQiUDI1/WBHv4TmatkAP24M
MD5 SHA1 SHA512 SSDEEP

Submit Download

3266796f-9c9f-45fe-97e1-8c44d7b8f1bc.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\3266796f-9c9f-45fe-97e1-8c44d7b8f1bc.dmp
Size 64KB
SHA256 020582f021dffa98ae2d48c52f818e4e3fc73cc44f618cfd61c789805181844f
MD5 d053f91049ad7df2fbff4d17547f651f
SHA1 4309f444f3cb60b7dce2323137238f917b33f69c
SHA512 8ca2916352901dcabf707138e9a9452bb991516e5cdd544990122a8193bce5eae26b5806b2b7c155ef17ca2eab7bee197e7bc64abdb63d8471e076d5b2759582
SSDEEP 384:HFjVaDZb3PaYGprMUYwxGHajmBKlmnefCpXxFo5+:HtVg3NG6yjmBTnQCphFo5
MD5 SHA1 SHA512 SSDEEP

Submit Download

3266796f-9c9f-45fe-97e1-8c44d7b8f1bc.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\3266796f-9c9f-45fe-97e1-8c44d7b8f1bc.extra
Size 10KB
SHA256 287281a08e7122341d57f10601c34456a0171d337591f9bfc09d15385bccdc9d
MD5 898ad1c968f5382a9abc35c2a9dabbb3
SHA1 2e60c2d44ebd4153c3a003508994a0eb95f42406
SHA512 9b45ea7cc8eb797a9df55fcd98e795c8515ccd04183005df4e9fa1344adacaecd031ff8960ea5960d937e2021112d9ceca109cd02e8baef4a0cd86e09aa50f35
SSDEEP 96:STWCeCT23pY6pw6lF29dt40Rh7CsevBb1d05DjMLlIrLlhTLlaXv7agutILfcBCk:S5eSWlYb/7uvZ8dLmxsP5wl+0fo1
MD5 SHA1 SHA512 SSDEEP

Submit Download

3266796f-9c9f-45fe-97e1-8c44d7b8f1bc.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\3266796f-9c9f-45fe-97e1-8c44d7b8f1bc.extra
Size 10KB
SHA256 921edbcb2bef15d8cf9ec5f4b116accbaa30155e12ccc899f5bd36c35cfa475c
MD5 2abaa9cbbc7f69a487fcc096993da7cf
SHA1 da087b484fb1c3c3b0cbbdef73849c3e0b8eaf2a
SHA512 7ca14e28cc10cbbc02fda6de21f06102b2ce50ddb345627b6e9d73d234b2ae100c2d8c1150625eae0d04d5a4c0d5b3a1b643448a42e4e02c1b4f2ddaa7f92e53
SSDEEP 192:S5eBLcFQiR4M4DnQYapdVxzPXWBH84T/fKNtalm0foZbL2Mnwv:iEcFQiUDI1/WBH84TmaxAZ24M
MD5 SHA1 SHA512 SSDEEP

Submit Download

6a1db2f2-ef6e-408c-a80f-17e83e42eeb1.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\6a1db2f2-ef6e-408c-a80f-17e83e42eeb1.dmp
Size 64KB
SHA256 d97c2821e83fbd81677b649215f33879c997365ff45447990dbf78e2df296d2c
MD5 8d3089d40896e20d14c6eadbca454c14
SHA1 7405523470c648e56e914f5078302114a4de2fc4
SHA512 128c9a0ccfd43681c281cab5aaa27871a8cf75090eef738085076f4efc7bb291135e02a5b98a1f7d6743d6a896a2e4b2a55871b1a64ba1440223cffd4f2fa360
SSDEEP 384:9Cxvznpqy0onpkzyEvjG3y4wLZPiFhN5BRpXxFo5+:9urXSb8yZZ6FhrphFo5
MD5 SHA1 SHA512 SSDEEP

Submit Download

6a1db2f2-ef6e-408c-a80f-17e83e42eeb1.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\6a1db2f2-ef6e-408c-a80f-17e83e42eeb1.extra
Size 10KB
SHA256 8493eed8b464d718b0502e11b1f7d9ad976d346ddf62653eb8f91bc5ac32c4ac
MD5 61a716d99fa2ce7a924eda3fa2f83f7d
SHA1 9a53fdcb04dc9934645af885602e37fd284973c5
SHA512 c3c473445ff7048bda172aed88363dc97f3e7f990bfa7f9becc553d90c96274a6f77d7e27e5d1332840103e670894bc5681c1859b0ae379137f6239bd51e6fe4
SSDEEP 96:STWCepT23pY6pw6lF29dt40Rh7CTvBb1d05DjMLlIrLlhTLlaXv7aXutILfcBCqh:S5eZWlYb/7WvZ8dL3xsP5wlKcfo9
MD5 SHA1 SHA512 SSDEEP

Submit Download

6a1db2f2-ef6e-408c-a80f-17e83e42eeb1.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\6a1db2f2-ef6e-408c-a80f-17e83e42eeb1.extra
Size 10KB
SHA256 fa602126adb7bfdf9779f298891a2334e45eb0e009e80a98279ec92346edc4f6
MD5 ee36986ace4335aba8055ee8d00ef399
SHA1 18326e11dfedb1e4a05bfc3a53f99c0d72642dd8
SHA512 48c81121937d238c9d1bdea423ff3ad2b3dc1828a003f2765b590f4fc5d66fb5029d1e29d0da2e200118c95c2328d549afa86412c3ad1712ed9191b7c942a6de
SSDEEP 192:S5ewLcFQiR4M4DnQYaVdVxzPXWBHL4T/fKNtalCcfoRbL2Mnwv:iBcFQiUDW1/WBHL4TmatAR24M
MD5 SHA1 SHA512 SSDEEP

Submit Download

a9762f34-6f1b-4f55-9f8b-3f5ac51538bb.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\a9762f34-6f1b-4f55-9f8b-3f5ac51538bb.dmp
Size 67KB
SHA256 ed512141e35249dfa33bc9ba5393fedafcd5878243ca5e0c6796f8df8bae9a56
MD5 39041d681a75f2d2c5cc3f5586bc37f3
SHA1 795dc642bff4ffbb82b00ed6c560d0cf1bec6cd6
SHA512 a211e3c638ad8deaeea042330271126e7e6b2b008fb2f1d3aef23eb2bc0d38ddf19068eed81f7975f428f4efd919b1b0f227ef8976070eb4b728573620e442d6
SSDEEP 768:2rMznn6/wH7X4+NznnlZiJPFLVmqznphFo5:Scnn6/wH7XTnnlZC5Tps5
MD5 SHA1 SHA512 SSDEEP

Submit Download

a9762f34-6f1b-4f55-9f8b-3f5ac51538bb.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\a9762f34-6f1b-4f55-9f8b-3f5ac51538bb.extra
Size 1KB
SHA256 68fbd168f4b21a4081e5982e12479fdcc2a427753a774cae7bfb7202408ff789
MD5 ef5dff5349b3c7484b8d7349050bd6f5
SHA1 ada182fdc7720e553c21280534e519866a98fd88
SHA512 af9bd3b4a6b7eefe49f69676dd5b2e087e6463300724798f4e8d9c43abc0f523582c4fc43845ecf454536d07d31564f8464bda7ae905ee26cdbc57c291cba51e
MD5 SHA1 SHA512

Submit Download

a9762f34-6f1b-4f55-9f8b-3f5ac51538bb.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\a9762f34-6f1b-4f55-9f8b-3f5ac51538bb.extra
Size 3KB
SHA256 d8192091d51fa5fb9e676940d04a90dcef5759af72d49b45551b164d6bfaa9bc
MD5 0e31a9b0aeb792396695b3e36e364417
SHA1 3844bca449509ebeae07f1815e2ccbdff7462a09
SHA512 ffb0b0b6f56ae9834c0dcb5f9606f1effe8057f2c7fd5b10aeb0ef24540ee169321af8003aef9deddb2915f21bf327d38a0f0477b176ceb155d03460c147c0ff
MD5 SHA1 SHA512

Submit Download

b191e976-f3b6-41c8-971f-285fca48a170.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\b191e976-f3b6-41c8-971f-285fca48a170.dmp
Size 66KB
SHA256 766070dca881fce8a260c9a27320eee2403c0bdef954b81246dd7dffe4952424
MD5 27e575953f1c9f344bb8698a62e0682b
SHA1 b2a57e88a43951bcc10f32a3e24477f679fa8de0
SHA512 2ea10d8ec663581ec67c43eee03beb3fbc7bf41ac4e4728bbe05fb04627842d6c6807fccc7cda3e205d3566b01250d1d67744dc5b4e7894341a9acbcc951eb7a
SSDEEP 384:fKcuchyq2PWPPjs2H0rcMoocJ8DeN//L3LUj8YnDY1oJpXxFo5+:fC8fqytuoGe1br1oJphFo5
MD5 SHA1 SHA512 SSDEEP

Submit Download

b191e976-f3b6-41c8-971f-285fca48a170.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\b191e976-f3b6-41c8-971f-285fca48a170.extra
Size 10KB
SHA256 1208f794f82e0b0782a0ec760e7e80ebf92b5c9007c7a5bb71279c2fe64ed75f
MD5 f4440c56bc59c01c49570b88e39b4c20
SHA1 fdbb26bb3869198e1baf944a68e7b1dc67e31140
SHA512 590e84d1350da3ca733913d72b7e831ee772f7dfd0514b63342eef67248b509897dfe77fd7b8b53b9653357a8de1acb6068afcbda996f42c8e66b74ce154ab60
SSDEEP 96:STWCeYlYT23pY6pw6lF29dt40Rh7CsevBb1d05DjMLlIrLlhTLlaXv7aeutILfcR:S5eYlkWlYb/7uvZ8dLUxsP5wlHRfoJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

b191e976-f3b6-41c8-971f-285fca48a170.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\b191e976-f3b6-41c8-971f-285fca48a170.extra
Size 10KB
SHA256 138d894230e254d4079fbb7c59c262b7726da6a25120dd76207b6c6c66658a47
MD5 5252dd7afd10169ab781cc3f558da0a8
SHA1 3fcb8aa7471d5e395066d1b8b7398405658ab49a
SHA512 8883254c12ef0e236e2662ab73f726f8fb8616e6b8006c3222236663c81a8cd17a5e734484e528aec533d5d310553d0fa96ef51ebe752c0ef30a105b4f06ab47
SSDEEP 192:S5eYlzLcFQiR4M4DnQYapdVxzPXWBHA4T/fKNtalPRfoFbL2Mnwv:iBZcFQiUDI1/WBHA4TmaXAF24M
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0lszmf8w.default-release\AlternateServices.bin
Size 6KB
SHA256 d5210bf03eca9d6c1e30300da2f73966b5f823851d9388701552481a7b782152
MD5 e148a1bbb8cf6c3e3bffb49b1bdbd6f9
SHA1 b18d202cd7e2d8abe57a00e8a855a73df0ab6617
SHA512 0e4bf651807e05f25bf641d8b58ba90347e612e0f82e5a85b35d36710ee5d706e0a05bec8802a49b29f38de0d3facdcdff659d9d7205fcd4da4b7b3bb77f2bda
SSDEEP 6:2H28gidpq88gidydgids4Eyjj67Hgidpqs7HgidBgidM3E:2W8gQpB8gQWgQs4EHMQphMQSQM3E
MD5 SHA1 SHA512 SSDEEP

Submit Download

compatibility.ini

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0lszmf8w.default-release\compatibility.ini
Size 198B
SHA256 252b7fff962848c61092e82a3d87adca163849767713a93ab533bb397f1f53bb
MD5 ce9ef13caa8a74c25157b184aa038475
SHA1 db03a9935d8bb3ce6b120aca98feade536805160
SHA512 0f6f5053e78167ef5cc5fa70ed3a87dd116df0671a590299277a197341bed983e3d77e37ad2c33cd4afe880fab9ed1c7f7502210040617a01f97a81c1e1d4f29
MD5 SHA1 SHA512

Submit Download

store.json.mozlz4.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0lszmf8w.default-release\crashes\store.json.mozlz4.tmp
Size 6KB
SHA256 077113f50d2e0f87934a650bce36cb6e7f28b706066c2830e002f1c769cd0b2b
MD5 70172e4eec067b5cde81cd75675d7268
SHA1 3d68f2cf6e619e90757eefec7192667fd4796948
SHA512 ab1726d666ede402bc4cd0b50797ec524bfd71b02fdffb1ff112407320281e0ff49d3a2879bff63ae90d6d6121b81658cae095a76d037d71d070e4ee5f860fa2
SSDEEP 192:2bNf56b/113acEDlpl6uD8dDHuISqqT8ZsKZOfSRs:Mxwb/HqGuD8ZPHhOqRs
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0lszmf8w.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 650bea16e9bfc3b0c22ca07226135e20ccc10ed4ee07da182a22a04b794c597b
MD5 aa461d683b82df0690cb339c40450344
SHA1 b4d1b3323eba98c5285ab2788a6720a86af37967
SHA512 fee83f3c240706f30749a1a1fdfd5839fe5631a4b1648aead81a36729baaa295fe4459b5d8d3a8e45c0b63a9419ee663c704004bf1d8648bd7326fff76dd4196
SSDEEP 96:ldi2SsQyq/dFl66Joz0dzgClKtmSSd/UKK2uKSfSdF95/7bkW6QXjrcEQKTvfyUM:Rq1/66Joz0dzgCl6mSSdxMROv5zboobk
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0lszmf8w.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 3084143780753ffeb7b4610338b7fe9e23923cf8994ac88ae8b55de61ff6673c
MD5 89e1117ae87d50e6b96b500e0f33f87d
SHA1 6dac1ecd745faee9207951ec1a7b8fae8e6246d5
SHA512 7218f5b79e809edef69058796eca98cce9d4c4cd1c0f0acf184105a0e003da56783be2b7bea7d97ed9a74ac1fe0465a161eec76b262c27409602fbaaec6963fa
SSDEEP 192:9MROv5zboHmZQiHyjFxCcxsq1/66Joz0dzgCl6mSSdz:PboGZvHyj75sU/66JozQzgC1bd
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0lszmf8w.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 1fd0faeee3c8ec85adae21eb006c8e171814e0d0d6a54b7b75c251fac6d32986
MD5 a53762ae3549c1ee3e24cd346402bd4f
SHA1 285fc995362730a238853a33d773de6549894d27
SHA512 dca487e5ed01f66aa5bb019834b3e9e5a7a071250c79714b81e584c651df2fdc9d69891ac6a0ad14b8a40163dc3b2b589e4629fc51b5addfad7b0f97d2d0b651
SSDEEP 192:0dq1/66Joz0dzgCl6mSSdMMROv5zboobQiHyjFxCOG:0dU/66JozQzgC1bqboobvHyj70
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0lszmf8w.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 0c646d79836d22e8f130dec09ef9fbe71298d3b571a61ee9157b3c7bab01900b
MD5 cdd612f0ad79915d3479f47af26cf31d
SHA1 3f548772e7f7332ef5934f2f7457ef79e33f4403
SHA512 7ad10f1f7bb4954f39dba3d3af782e5e4f1157fdd7dbf966bd619a35ee36f875d77f6bf21730ea8ffe3002a3d2d6a4d74230632f900d5e4f4c7a45a8354a5532
SSDEEP 192:6MROv5zboHoZQiHyjFxCOx2q1/66Joz0dzgCl6mSSd:WboIZvHyj7/2U/66JozQzgC1b
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0lszmf8w.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 7a4ea4cc8c64c60f45320e94a2d523e9493e868dfcf15759427ef31528f57b9d
MD5 7eac6369fe7f98a5b35a26c6f16a0db0
SHA1 25ce597b44e652671ae9316e8b6b316f73bee6d7
SHA512 27c1ea0ab177ed5402ec26390c10de348e025cefccf408a36ff2a9fd5a70d1a63b03fea76e2ad160dfd97a2f548b840e8393e20007dbe32c3ccaa66406f16af4
SSDEEP 192:05Iq1/66Joz0dzgCl6mSSdHMROv5zbodZQiHyjFxCON:0yU/66JozQzgC1bDbodZvHyj7/
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0lszmf8w.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 2b0c017cc5e11520037d1b8434cd5bb0373e6e5cc5b6cd0ca787c442956a47be
MD5 0ec1d430b33468075cb58ebc01e3323e
SHA1 7f6c7bef8203b5116e9e0329b61bd965b02cffd6
SHA512 8288368c7394490f3ee4ac644c20928ae35522a24c71344dfd10a8337bce02f0331299fd56434cdac0720b4eebaab5e39001bc0af07a91d8f2d9611ba868f4de
SSDEEP 192:6MROv5zboHmZQiHyjFxCcxbq1/66Joz0dzgCl6mSSd:WboGZvHyj75bU/66JozQzgC1b
MD5 SHA1 SHA512 SSDEEP

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0lszmf8w.default-release\datareporting\glean\events\events
Size 1KB
SHA256 91a09d1146197713717d9cffe4a4d296b67f9e760390a511bc3ed3946af6e6b8
MD5 6cd3b65b98c918f1cd777f0653c36b0a
SHA1 586cf12d1205bfca7f6e1ffc017ab9747b8541c0
SHA512 77a1c7ae8f48fd2e1d1aca4a7d74f81a626cd1649dedfb97236d23e73d37c0509f7291e3c1db2f483caa29b58ea58578110d0190bbe01efa55da1a1dd3b0b8f7
MD5 SHA1 SHA512

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0lszmf8w.default-release\datareporting\glean\events\events
Size 1KB
SHA256 0447139f914ee5a750e0222d61b9616087f75a5ee9e692d3de5aabc3f912ddba
MD5 54eca7d6efadefc42cf4d78df754c3c5
SHA1 3d283387fcdefecc5145480b9785f1f7f6c066ed
SHA512 f773cf08f7f73195e2c92d628947f93870d90e187f633d6d55002b59e13e17270b1e4417f923d9870df11467541850a55771bdc294f3470bdf6de5adbed201cc
MD5 SHA1 SHA512

Submit Download

299bbb25-0acb-4e7c-a085-33905de28737

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0lszmf8w.default-release\datareporting\glean\pending_pings\299bbb25-0acb-4e7c-a085-33905de28737
Size 3KB
SHA256 9e03f9d1b4c9da9c04777792b77f4af7ac71c4d6bd2dff71df32feef7c7a2007
MD5 b7d57baad9de41c4af37461e2f5c1203
SHA1 3a7d25da181ef7112b738bd78bf477c99624e03b
SHA512 e8f149ba1148b66ddab937951bb9c0f1969e550795dacebcfba4f6d53c8e7ded520ec62ea3d15ba899a3a46288753f71c06552c78e5b092166fcea5882a4feeb
MD5 SHA1 SHA512

Submit Download

343f1a0b-32c8-4620-93f5-9345ba333274

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0lszmf8w.default-release\datareporting\glean\pending_pings\343f1a0b-32c8-4620-93f5-9345ba333274
Size 886B
SHA256 b68e7222cdb545d22f0b0b30903462f99c170aa5c1fc4bb68dcf9a04ea8b1d2a
MD5 ef1aa36d78551430bc0e6be7b0521066
SHA1 d8cf416be3f52e6253b8360c96cde51140432148
SHA512 d86d1a45d9ae861c9b2dbdfa8435d4af860ae1b5fa8da6df327f09d5fc52a5b8e5ef20360a0acb8a80e3c64a3f6dbc05cc4f53988831268efbe25690732cd1fd
MD5 SHA1 SHA512

Submit Download

44be0da9-83d7-416b-a118-0a970007b72a

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0lszmf8w.default-release\datareporting\glean\pending_pings\44be0da9-83d7-416b-a118-0a970007b72a
Size 235B
SHA256 59f53d19d6a110ea748e25dec0007b118cf0efcb499d564f42176c2e60e679bc
MD5 cbf1ac9eb453bbc4021420f8f0ceef41
SHA1 b41b7a7b8e475ff89b28249098b1f7bb48f13b7b
SHA512 f92b96c9621c559a74309c5979fb8fc2f45e928f1a950af166df9bd800c8641c66a3a76bf876d50284b204b939354c044b0d05fcded10c27c8c763e1ad185441
MD5 SHA1 SHA512

Submit Download

52a2c922-df39-4162-8a6a-0ab62bacffcd

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0lszmf8w.default-release\datareporting\glean\pending_pings\52a2c922-df39-4162-8a6a-0ab62bacffcd
Size 3KB
SHA256 b957dc4e71a2f6127a76019d1ad3fe9b9fb2a4ff4376fe02cfb342966d9618ec
MD5 612c0f745a0a30dc2e9e0938e82281b9
SHA1 424d14e35bd87fa648f35e38fd41529979ddad4f
SHA512 19721f62132b1e9009e9891d1c6b8353bdba5308fbc03c782a7d96b72b1f04807043c652e1a99c2e863ec83dab19db18f437b28ec197b3b47dc09fc397e426b1
MD5 SHA1 SHA512

Submit Download

610c73b2-39af-45aa-97ed-568818b7f8b5

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0lszmf8w.default-release\datareporting\glean\pending_pings\610c73b2-39af-45aa-97ed-568818b7f8b5
Size 3KB
SHA256 66c8e4777886f1167a98b8fe7a9a6e2c659847548d9869a79f2f88dcb5932f41
MD5 48ff860b4b0b6a96a2b5821e8e0ac0c2
SHA1 ca2d7b4e75c180c1053459b00b5a47cc53fc7814
SHA512 005d9df1d81c4e4fa8ffb590798e6992c251c2884ab37a14051152f70be6bdc3b3834a5380745be69e5e0edb95a83deb03dc4125276af0f564a061286553b30f
MD5 SHA1 SHA512

Submit Download

62a18707-7c77-4c11-b0e4-8256d7b5ecfc

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0lszmf8w.default-release\datareporting\glean\pending_pings\62a18707-7c77-4c11-b0e4-8256d7b5ecfc
Size 871B
SHA256 51fbbc3afa2146581f9859aac6ed410d26659ddec0bbe631ec26b9c63c5db246
MD5 a411b04903205a9c83338e0da0d1d383
SHA1 5637102de2b1988bcaa391840175eeadf728a823
SHA512 541bff32a9603f4e5a1e3872fa2d208af709ecbc543be5c4f021ef0ddca04ea1beab7575998050511cec2f446129d9d27b67ab50626aa80656a0716aa427c494
MD5 SHA1 SHA512

Submit Download

63502305-0cd7-44a0-b0db-ba877e678ea1

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0lszmf8w.default-release\datareporting\glean\pending_pings\63502305-0cd7-44a0-b0db-ba877e678ea1
Size 883B
SHA256 90d9f8bb5cffb1a3473f8b68f9598d4e611502502d119cc714fd7916f85885ab
MD5 6c910ddf39384dce8f8e0186188387e7
SHA1 23b3f50da425206c606812f48d998da7a449c1e8
SHA512 5fde4eae6034c5148d5940007f6dba8b2161f614ad20e7d10f32f928da04f5d924c343f6b72748b92073301af57ba1043d6adff2b4984d70e91b1a211e67459c
MD5 SHA1 SHA512

Submit Download

6a0060a1-aac7-4306-a308-b428a9f2caf2

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0lszmf8w.default-release\datareporting\glean\pending_pings\6a0060a1-aac7-4306-a308-b428a9f2caf2
Size 3KB
SHA256 79327445a66c031983671282d9f2c94264d557987db8b2f9c4a45c974977de1d
MD5 27577c5da455e5e557b60041d61365b8
SHA1 72fe57a80e37443b2fdc034cfa0d616d50404c41
SHA512 ae8e9479081335fbfcb84cb94b8b01679e2987bdd9ac0d23f9fa5f8141b8f4bbd573224314c0db362d3bc341c3307955d993e868cf533ba442ea1be1e7344555
MD5 SHA1 SHA512

Submit Download

73c54141-3a33-4b00-a38e-16c5e83641d0

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0lszmf8w.default-release\datareporting\glean\pending_pings\73c54141-3a33-4b00-a38e-16c5e83641d0
Size 3KB
SHA256 094c1f349e309b00f266f5e1e69c70b74b8eac11253b7cc8c34f729d2a92338b
MD5 3fea5f4ba52098b5503b7650a7af5dab
SHA1 8ffb44aa7fbdf5fd529c3fcc23054a3d0a324c0e
SHA512 6cb415b63c77e5a0bebc5b257f5a756da54175572ecab649811d9be7b65be90c03eccf89b28419da46f4bfc26ed48e529560b234e168e006586298f2898c36e7
MD5 SHA1 SHA512

Submit Download

8a2a009b-8264-4cf5-bb46-56def7d8ca94

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0lszmf8w.default-release\datareporting\glean\pending_pings\8a2a009b-8264-4cf5-bb46-56def7d8ca94
Size 2KB
SHA256 95e1cb732d69852b4b76925637bf76031c96b3120d7117e6947d900b466ca26c
MD5 844729be80f90cb7caf9c92cc992e0a4
SHA1 9f0caa29f3e8d1d12a2640f47bbb785c48602694
SHA512 08e5be3fa622f7793fb02eb0c83d24a6ba615f0c4053b029da9844e52de3e34d75867f679265c949176dac68f0fcf546357d48652286eb12e5f248bffdef1369
MD5 SHA1 SHA512

Submit Download

ae71fd6a-c1cd-4a1c-846a-3bf534712fd6

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0lszmf8w.default-release\datareporting\glean\pending_pings\ae71fd6a-c1cd-4a1c-846a-3bf534712fd6
Size 235B
SHA256 c9b03e8ae7226111615bd9b5f34c9c5afc83b886b4976bd1836060abf30800f1
MD5 b040eac19e136d4a69d0bac02b18aa5c
SHA1 d49f325000ff70db053085e29a976e4e0577d8f0
SHA512 0d020e03e688be0d658d47a3db74334677d88342fa86195264b3fe33ab88060980311253ade6fa22615b8e097a2c72c6c2d0fe2571721bfe5662ac01dc618232
MD5 SHA1 SHA512

Submit Download

ba35ded1-bb7f-4ddd-a884-21a5db417e14

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0lszmf8w.default-release\datareporting\glean\pending_pings\ba35ded1-bb7f-4ddd-a884-21a5db417e14
Size 16KB
SHA256 4acf1ce5a1dc88408ac1e3a9a83075717b339cdb17eb492e98aece6550aa574b
MD5 f96868a3f3e4b3b3c59fdb3a379387d0
SHA1 c50e7926c7d8948c342b40d0073f688016e49233
SHA512 cd42f5ea28cdf55f5a87a220c60b7895ede916ec8f14329eb9f5840a9471c7cf59bfcdb7facac79bee01cdd7eac0864b8f0ea132e68082d1d08fb8678a41f65e
SSDEEP 192:zGeCKRSLBuzSb+zE005iL5084/AO+qqcWpvmgbG7afIHgkB1iBffr8hDjnSLYeBK:5CKRSL8mb+zE0UiLOkq57af1N2Jj0ux
MD5 SHA1 SHA512 SSDEEP

Submit Download

c35497fe-da06-4833-b0fa-347dfe7eeea4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0lszmf8w.default-release\datareporting\glean\pending_pings\c35497fe-da06-4833-b0fa-347dfe7eeea4
Size 3KB
SHA256 69667da65b7c178308bf772e13c972b1eaadfa87d8c60136e10bfc7c0f036cf7
MD5 c36813d60bf780864f06fc465d610fb6
SHA1 e9935078b054a6b8f8ed48ce3fcfc61cc7541bcb
SHA512 52c0db99941d4676b4087c8c6f953a95c45e3caf07e4b9a1feb74d05cb09e9ffb11e0a13f4f0848437d1eefcecf052fae99f4065bfd07ab4a660db704b7b3468
MD5 SHA1 SHA512

Submit Download

cd02a07f-86e9-4bce-a37f-dea81cb0c5aa

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0lszmf8w.default-release\datareporting\glean\pending_pings\cd02a07f-86e9-4bce-a37f-dea81cb0c5aa
Size 3KB
SHA256 601b775a7375e80bc6a27c74871e719e004cde2e23196e3d5ff2c2d16daaa881
MD5 dd6645eb0c871eb152a0362c840856da
SHA1 e8f74064215d0314b8f7deb5af9a5c41479e2a56
SHA512 fc2cd2d5eb96227c03fa90d63ee35a4ee83a90b5ba1768ee032d9d72478b8e73cabc5627ceb5578d012dcac65e4407062fa776525385eb099d7e70657c60d086
MD5 SHA1 SHA512

Submit Download

e15aa6e9-427d-4ad7-bf43-b0a05356cce2

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0lszmf8w.default-release\datareporting\glean\pending_pings\e15aa6e9-427d-4ad7-bf43-b0a05356cce2
Size 3KB
SHA256 af0f2dd1a7c0fae2808912bf9d8385628763eaf0fc07f9df493ea5d10b8bb526
MD5 01d37a81cb322969b805f7a2fb7a34a6
SHA1 8b2b1f531ac8c7cf7a0b56e4532fd9679a491508
SHA512 81b2f811f45db2f3b3f64f68b58509262c4bf4b6dcb75039dafd151b79e572e313527604b972f7c6d82f18fac94e9b52a42fecb512da5c5fe79fe69f5106f665
MD5 SHA1 SHA512

Submit Download

e377f2d4-43c0-405d-881c-cb8b528a9c49

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0lszmf8w.default-release\datareporting\glean\pending_pings\e377f2d4-43c0-405d-881c-cb8b528a9c49
Size 2KB
SHA256 d52628c76bec1caf218e9848abf686bf73b25f37836726db68c4fe5ec67a9e02
MD5 93ac8224313732839cb69463f72a4fdc
SHA1 b32e9baf20329346992d4da124e35cf9782abcb4
SHA512 4a8503562dea9f352c282e410aaf227d640a2781204ed1b11b5e739a52dd6257d3390769675628c35cd288654484e2de0473d56c681b5f2c396f04858242a2a2
MD5 SHA1 SHA512

Submit Download

e4f6a935-7b2c-4c77-93bd-1a3c4e6cb612

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0lszmf8w.default-release\datareporting\glean\pending_pings\e4f6a935-7b2c-4c77-93bd-1a3c4e6cb612
Size 235B
SHA256 936c50ff90d70b6114ba99e0d9de2424532c4e124e586371ec036422d1264910
MD5 d24b0d7aae170134c3be9634b3c4102b
SHA1 b32c49a0bbc441b284694cb66688b6a1744e392d
SHA512 df944540b7584f8d7e3fe35318ab9ad405888c0152db1a8869b9a07a37f24a980f9ff6bda618772975e1e42d53f56308bcaf7593d22fb0f2d8562238982d625d
MD5 SHA1 SHA512

Submit Download

e6116e2f-2d86-471d-a9ad-b7d8a727c689

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0lszmf8w.default-release\datareporting\glean\pending_pings\e6116e2f-2d86-471d-a9ad-b7d8a727c689
Size 3KB
SHA256 cee8fe989397e898f38ecf604549895df7643fa20c82a01dbb55ee95a9c15d69
MD5 810eb0c588150fde70300dce9ef3251d
SHA1 7c65cb2c5f6254b0fd1e5090e37d79710c0deeb6
SHA512 9c0f7e454f2815aeea07ad2967de3e7001b4bd886022490a2f669f5cbf49b1f069d174192b9cfd3b1c3af52d73241e81ff3401dcb38399862bf112eb233f06f3
MD5 SHA1 SHA512

Submit Download

f1c10e4d-7098-4ba7-adb1-49e303787fa2

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0lszmf8w.default-release\datareporting\glean\pending_pings\f1c10e4d-7098-4ba7-adb1-49e303787fa2
Size 896B
SHA256 27523bc7b1a552d5810f70d3ebc5292b90b1075baaab9a05658ad63e2ae0d7fd
MD5 42393a92bf6a4a6ce58b57a7ab8518cc
SHA1 12b13abde9165f820fbe37096c1a5ed5a24f7e1d
SHA512 493ea07a662251a96a41c2c8ee42e59b3b536d0a5cbbe11ed673e16c5b3265a77d69e7f989fe9b92b58e3913d6b432422bfa89cefb3249f97846be8b4ef31a50
MD5 SHA1 SHA512

Submit Download

fbcd5aba-dd90-475f-86b1-d2b11cb9532b

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0lszmf8w.default-release\datareporting\glean\pending_pings\fbcd5aba-dd90-475f-86b1-d2b11cb9532b
Size 235B
SHA256 6a383c5be3586cfdccffc1b8943014b38074931e35a1d2ae78bad3c3f3b25755
MD5 ff84ba319bbfc91af5306b4b2d9c033c
SHA1 2e3c10bd9db500f14bd0b2d464c57c99117b3ae1
SHA512 e9dfcf241bb9a293c78c2d55fe238b4b3c26f984518e91ccb0f61a52da2e936f69baad53034703b7e6fa21f9ddbf2f79147a423855fb03b820cbe713e87279dc
MD5 SHA1 SHA512

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0lszmf8w.default-release\prefs-1.js
Size 6KB
SHA256 3746bb89f808b91d69021dc624ec720324a22f76e4f7f7723c4ed7f29a0feb21
MD5 c7ed862411cc4455be1a7e21ab9243de
SHA1 7f3680a1058b5129732630ee2baed8c09466c610
SHA512 36976304d68e8c76cc8e077d4b11b0a05a184e1dac9cca5d219e769cacd5f5c575768d78b03fdcedb7e01499b2c7f24ee4857d7fe404e90c8256997b69961db7
SSDEEP 96:xHeWUTUjqGqtfFKEynH1zSD6ySSlVdv9j+nAeRHB/OmScxcBw88H8L4cn80Vf1/X:0W+RtfFvyHC6ySSve9B/D8Bw88V0P
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0lszmf8w.default-release\prefs.js
Size 6KB
SHA256 b555f957eddb08ae1220c9c54deebaf8435883edee7b81fc40013724ea96c648
MD5 9502a9bd1ee847d380281dc9f73e1ccb
SHA1 e707ef4202f30833ad92b8cbfca5a0e09225c925
SHA512 24e3f4af0b588a4ef6205b93242406552a42494950bfdd535139417571388a954138c88cd7ee638b78e502f05ff4707eaa328ffda7e03cd1921b9bfc9458aa26
SSDEEP 96:xHeWUTUjqGqtfFyU1zSIUSSlVdv9j6nAeRHB/OmScxcBw88H8L4cn80VI/nmE:0W+RtfFyUxUSSje9B/D8Bw88V0I
MD5 SHA1 SHA512 SSDEEP

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0lszmf8w.default-release\sessionCheckpoints.json
Size 90B
SHA256 00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2
MD5 c4ab2ee59ca41b6d6a6ea911f35bdc00
SHA1 5942cd6505fc8a9daba403b082067e1cdefdfbc4
SHA512 71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2
MD5 SHA1 SHA512

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0lszmf8w.default-release\sessionCheckpoints.json
Size 53B
SHA256 792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da
MD5 ea8b62857dfdbd3d0be7d7e4a954ec9a
SHA1 b43bc4b3ea206a02ef8f63d5bfad0c96bf2a3b2a
SHA512 076ee83534f42563046d25086166f82e1a3ec61840c113aec67abe2d8195daa247d827d0c54e7e8f8a1bbf2d082a3763577587e84342ec160ff97905243e6d19
MD5 SHA1 SHA512

Submit Download

aCSbxnu.exe

Path C:\Users\Admin\AppData\Roaming\aCSbxnu.exe
Size 1.2MB
SHA256 dc60b3a787e014b5ed9ef2a3eb0d7b7d93ed800d0524a10d0eb8447d47b43926
MD5 6f5ae138326ff745f4a8d7d3621e7673
SHA1 459d6d57c8b3c07fd778c267a8ac8927d2b7839e
SHA512 0d79f81af365f9e76fe71873456a65d1181a17a6ec6278d933723f9dba3fb2592ec219b13367b0efbaf6244a30374d82703e5adc6c5eadc1c3baae1bb21fc1f5
SSDEEP 24576:+TnypdJ51YxkIJB4K1hgyc6LQ6sJV6+5yKI9rdJ8o1ZyAw7kJ9oS+v62f:ugdz1xwLBAk9Pjj5wq9oSs7
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1448-16-0x0000000002820000-0x0000000002830000-memory.dmp

Download

memory/1448-18-0x0000000002820000-0x0000000002830000-memory.dmp

Download

memory/1448-67-0x00000000074A0000-0x00000000074B5000-memory.dmp

Download

memory/1448-53-0x0000000071170000-0x00000000711BC000-memory.dmp

Download

memory/1448-61-0x0000000007890000-0x0000000007F0A000-memory.dmp

Download

memory/1448-62-0x0000000007250000-0x000000000726A000-memory.dmp

Download

memory/1448-65-0x0000000007460000-0x0000000007471000-memory.dmp

Download

memory/1448-66-0x0000000007490000-0x000000000749E000-memory.dmp

Download

memory/1448-68-0x00000000075A0000-0x00000000075BA000-memory.dmp

Download

memory/1868-1738-0x0000000006CC0000-0x0000000006D64000-memory.dmp

Download

memory/1868-1766-0x0000000007020000-0x0000000007031000-memory.dmp

Download

memory/1868-1730-0x0000000071130000-0x000000007117C000-memory.dmp

Download

memory/2060-1797-0x000001075EC00000-0x000001075ED32000-memory.dmp

Download

memory/3240-75-0x0000000006930000-0x0000000006980000-memory.dmp

Download

memory/3240-73-0x0000000006A00000-0x0000000006BC2000-memory.dmp

Download

memory/3240-76-0x0000000007100000-0x000000000762C000-memory.dmp

Download

memory/3240-77-0x0000000006D30000-0x0000000006D4E000-memory.dmp

Download

memory/3240-3503-0x0000000007690000-0x00000000079E7000-memory.dmp

Download

memory/3240-74-0x00000000068B0000-0x0000000006926000-memory.dmp

Download

memory/3240-72-0x0000000006780000-0x0000000006832000-memory.dmp

Download

memory/3240-30-0x0000000000400000-0x00000000004BE000-memory.dmp

Download

memory/3500-43-0x0000000005570000-0x0000000005584000-memory.dmp

Download

memory/4068-937-0x0000026C1D8D0000-0x0000026C1DA02000-memory.dmp

Download

memory/4092-3148-0x00000174AEDA0000-0x00000174AEED2000-memory.dmp

Download

memory/4332-1723-0x0000000071130000-0x000000007117C000-memory.dmp

Download

memory/4332-1697-0x0000000006320000-0x0000000006677000-memory.dmp

Download

memory/4332-1787-0x0000000007D20000-0x0000000007D35000-memory.dmp

Download

memory/4332-1716-0x00000000067C0000-0x000000000680C000-memory.dmp

Download

memory/5264-7-0x0000000006640000-0x0000000006742000-memory.dmp

Download

memory/5264-4-0x0000000004F90000-0x0000000004F9A000-memory.dmp

Download

memory/5264-8-0x0000000008D80000-0x0000000008E1C000-memory.dmp

Download

memory/5264-3-0x0000000005190000-0x00000000051A0000-memory.dmp

Download

memory/5264-5-0x00000000054B0000-0x00000000054C4000-memory.dmp

Download

memory/5264-6-0x0000000005190000-0x00000000051A0000-memory.dmp

Download

memory/5264-2-0x0000000004FE0000-0x0000000005072000-memory.dmp

Download

memory/5264-1-0x00000000054F0000-0x0000000005A96000-memory.dmp

Download

memory/5264-0-0x00000000004E0000-0x0000000000612000-memory.dmp

Download

memory/5876-84-0x000001619A7C0000-0x000001619A8F2000-memory.dmp

Download

memory/6100-17-0x0000000004ED0000-0x00000000054FA000-memory.dmp

Download

memory/6100-39-0x0000000005AE0000-0x0000000005AFE000-memory.dmp

Download

memory/6100-13-0x00000000022D0000-0x0000000002306000-memory.dmp

Download

memory/6100-14-0x0000000004890000-0x00000000048A0000-memory.dmp

Download

memory/6100-20-0x0000000004D30000-0x0000000004D52000-memory.dmp

Download

memory/6100-15-0x0000000004890000-0x00000000048A0000-memory.dmp

Download

memory/6100-22-0x00000000055B0000-0x0000000005616000-memory.dmp

Download

memory/6100-31-0x0000000005620000-0x0000000005977000-memory.dmp

Download

memory/6100-21-0x0000000004E50000-0x0000000004EB6000-memory.dmp

Download

memory/6100-69-0x0000000007170000-0x0000000007178000-memory.dmp

Download

memory/6100-64-0x00000000070C0000-0x0000000007156000-memory.dmp

Download

memory/6100-41-0x0000000005EF0000-0x0000000005F3C000-memory.dmp

Download

memory/6100-45-0x0000000071170000-0x00000000711BC000-memory.dmp

Download

memory/6100-52-0x0000000006CC0000-0x0000000006CDE000-memory.dmp

Download

memory/6100-60-0x0000000006CF0000-0x0000000006D94000-memory.dmp

Download

memory/6100-44-0x00000000060A0000-0x00000000060D4000-memory.dmp

Download

memory/6100-63-0x0000000006EB0000-0x0000000006EBA000-memory.dmp

Download

memory/6516-3200-0x00000234B2650000-0x00000234B2782000-memory.dmp

Download