phantomstealer | 4c6c075eef30621a8ec9fbcd400292b3de3063e31a8589d189a33b6487cbf3dd

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20251016-en
resource tags

arch:x64arch:x86image:win10v2004-20251016-enlocale:en-usos:windows10-2004-x64system
submitted
31/10/2025, 04:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
.RFQ-PO#900BD SQ9039 Order-Materials-pdf.exe
Size 184KB
Sample251031-erblwsfv2a
SHA256 5376b0fea8d666fdcc1f330bd6f34aa5623dcbcad4b0ffed53087456ee849214
MD5 8d8309a795cb4b5c7e66bf202d111037
SHA1 5b3c7143d89938948f1df45f64d08d64b1e5177b
SHA512 8d38e2c0efbde236fb23ed56a9e024e9723ad8dc6f02b553f11bf1e2eb70d6ea32fbcebd8812230a1abeccdccb84fb6c46ca811f7f7d7cc149d342af439140ca
SSDEEP 3072:pEqn/irEsrD3xo2vYsWwY6JOXnVvqAKesWu4OauYfI92YETrc3M7:l/irEgNWoJOXnVvqAKesQOauYfa2YETt
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

collection discovery phantomstealer persistence

Malware Config

Extracted

Credentials

Protocol
smtp
Host
mail.sourc3trade.com
Port
587
Username
[email protected]
Password
yr!{f[L6r}9W!m/z

Extracted

Family

phantomstealer

Version

v3.5.0

Credentials

Protocol
smtp
Host
mail.sourc3trade.com
Port
587
Username
[email protected]
Password
yr!{f[L6r}9W!m/z
Email to
[email protected]

Mutex

12YHANZ1JWN7VAAFXR6S

Attributes

anti_analysis
0
cb_enables_ssl
1
debug
0
keylogger
1
start_delay
0
startup
0

Signatures

Phantomstealer family
phantomstealer

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1919182765-2457925700-1517026611-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AddInProcess32.exe
Key opened	\REGISTRY\USER\S-1-5-21-1919182765-2457925700-1517026611-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AddInProcess32.exe
Key opened	\REGISTRY\USER\S-1-5-21-1919182765-2457925700-1517026611-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AddInProcess32.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1919182765-2457925700-1517026611-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\DefaultDomain = "cmd.exe /C pushd \"C:\\Users\\Admin\\AppData\\Local\\Temp\\Container\" && start \"\" \"C:\\Users\\Admin\\AppData\\Local\\Temp\\Container\\DefaultDomain\""	.RFQ-PO#900BD SQ9039 Order-Materials-pdf.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
355	icanhazip.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4192 set thread context of 4152	4192	.RFQ-PO#900BD SQ9039 Order-Materials-pdf.exe	84

Drops file in Program Files directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Crashpad\metadata	chrmstp.exe
File opened for modification	C:\Program Files\Crashpad\settings.dat	chrmstp.exe
File opened for modification	C:\Program Files\Crashpad\metadata	chrmstp.exe
File opened for modification	C:\Program Files\chrome_installer.log	chrmstp.exe
File opened for modification	C:\Program Files\Crashpad\metadata	chrmstp.exe
File opened for modification	C:\Program Files\chrome_installer.log	chrmstp.exe
File opened for modification	C:\Program Files\chrome_installer.log	chrmstp.exe
File opened for modification	C:\Program Files\chrome_installer.log	chrmstp.exe
File opened for modification	C:\Program Files\Crashpad\settings.dat	chrmstp.exe
File opened for modification	C:\Program Files\Crashpad\settings.dat	chrmstp.exe
File opened for modification	C:\Program Files\Crashpad\metadata	chrmstp.exe
File opened for modification	C:\Program Files\Crashpad\settings.dat	chrmstp.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe

Checks processor information in registry 2 TTPs 46 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	AddInProcess32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	AddInProcess32.exe

Enumerates system info in registry 2 TTPs 12 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134063574219094551"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1919182765-2457925700-1517026611-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	chrmstp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	chrmstp.exe
Key created	\REGISTRY\USER\S-1-5-21-1919182765-2457925700-1517026611-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4152	AddInProcess32.exe
4152	AddInProcess32.exe
4152	AddInProcess32.exe
4152	AddInProcess32.exe
5772	chrome.exe
5772	chrome.exe
4152	AddInProcess32.exe
4152	AddInProcess32.exe
4152	AddInProcess32.exe
4152	AddInProcess32.exe
4152	AddInProcess32.exe
4152	AddInProcess32.exe
4152	AddInProcess32.exe
4152	AddInProcess32.exe
3360	firefox.exe
3360	firefox.exe
3360	firefox.exe
3360	firefox.exe
3360	firefox.exe
3360	firefox.exe
3360	firefox.exe
3360	firefox.exe
3360	firefox.exe
3360	firefox.exe
3360	firefox.exe
3360	firefox.exe
3360	firefox.exe
3360	firefox.exe
3360	firefox.exe
3360	firefox.exe
3360	firefox.exe
3360	firefox.exe
3360	firefox.exe
3360	firefox.exe
4152	AddInProcess32.exe
4152	AddInProcess32.exe
4152	AddInProcess32.exe
4152	AddInProcess32.exe
4152	AddInProcess32.exe
4152	AddInProcess32.exe
4152	AddInProcess32.exe
4152	AddInProcess32.exe
4152	AddInProcess32.exe
4152	AddInProcess32.exe
4152	AddInProcess32.exe
4152	AddInProcess32.exe
4152	AddInProcess32.exe
4152	AddInProcess32.exe
4152	AddInProcess32.exe
4152	AddInProcess32.exe
4152	AddInProcess32.exe
4152	AddInProcess32.exe
4152	AddInProcess32.exe
4152	AddInProcess32.exe
4152	AddInProcess32.exe
452	firefox.exe
452	firefox.exe
452	firefox.exe
452	firefox.exe
452	firefox.exe
452	firefox.exe
452	firefox.exe
452	firefox.exe
452	firefox.exe

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeDebugPrivilege	4152	AddInProcess32.exe
Token: SeShutdownPrivilege	5772	chrome.exe
Token: SeCreatePagefilePrivilege	5772	chrome.exe
Token: SeShutdownPrivilege	5772	chrome.exe
Token: SeCreatePagefilePrivilege	5772	chrome.exe
Token: SeShutdownPrivilege	5772	chrome.exe
Token: SeCreatePagefilePrivilege	5772	chrome.exe
Token: SeShutdownPrivilege	5772	chrome.exe
Token: SeCreatePagefilePrivilege	5772	chrome.exe
Token: SeShutdownPrivilege	5772	chrome.exe
Token: SeCreatePagefilePrivilege	5772	chrome.exe
Token: SeShutdownPrivilege	7988	chrome.exe
Token: SeCreatePagefilePrivilege	7988	chrome.exe
Token: SeShutdownPrivilege	7988	chrome.exe
Token: SeCreatePagefilePrivilege	7988	chrome.exe
Token: SeShutdownPrivilege	7988	chrome.exe
Token: SeCreatePagefilePrivilege	7988	chrome.exe

Suspicious use of FindShellTrayWindow 47 IoCs

pid	Process
5772	chrome.exe
5772	chrome.exe
1436	chrmstp.exe
3360	firefox.exe
3360	firefox.exe
3360	firefox.exe
3360	firefox.exe
3360	firefox.exe
3360	firefox.exe
3360	firefox.exe
3360	firefox.exe
3360	firefox.exe
3360	firefox.exe
3360	firefox.exe
3360	firefox.exe
3360	firefox.exe
3360	firefox.exe
3360	firefox.exe
3360	firefox.exe
3360	firefox.exe
3360	firefox.exe
3360	firefox.exe
3360	firefox.exe
3068	msedge.exe
5616	msedge.exe
452	firefox.exe
452	firefox.exe
452	firefox.exe
452	firefox.exe
452	firefox.exe
452	firefox.exe
452	firefox.exe
452	firefox.exe
452	firefox.exe
452	firefox.exe
452	firefox.exe
452	firefox.exe
452	firefox.exe
452	firefox.exe
452	firefox.exe
452	firefox.exe
452	firefox.exe
452	firefox.exe
452	firefox.exe
452	firefox.exe
7988	chrome.exe
7988	chrome.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3360	firefox.exe
452	firefox.exe
4152	AddInProcess32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4192 wrote to memory of 4152	4192	.RFQ-PO#900BD SQ9039 Order-Materials-pdf.exe	84
PID 4192 wrote to memory of 4152	4192	.RFQ-PO#900BD SQ9039 Order-Materials-pdf.exe	84
PID 4192 wrote to memory of 4152	4192	.RFQ-PO#900BD SQ9039 Order-Materials-pdf.exe	84
PID 4192 wrote to memory of 4152	4192	.RFQ-PO#900BD SQ9039 Order-Materials-pdf.exe	84
PID 4192 wrote to memory of 4152	4192	.RFQ-PO#900BD SQ9039 Order-Materials-pdf.exe	84
PID 4192 wrote to memory of 4152	4192	.RFQ-PO#900BD SQ9039 Order-Materials-pdf.exe	84
PID 4152 wrote to memory of 5772	4152	AddInProcess32.exe	102
PID 4152 wrote to memory of 5772	4152	AddInProcess32.exe	102
PID 5772 wrote to memory of 2548	5772	chrome.exe	103
PID 5772 wrote to memory of 2548	5772	chrome.exe	103
PID 4152 wrote to memory of 2548	4152	AddInProcess32.exe	103
PID 4152 wrote to memory of 2548	4152	AddInProcess32.exe	103
PID 4152 wrote to memory of 5772	4152	AddInProcess32.exe	102
PID 4152 wrote to memory of 5772	4152	AddInProcess32.exe	102
PID 5772 wrote to memory of 6124	5772	chrome.exe	104
PID 5772 wrote to memory of 6124	5772	chrome.exe	104
PID 5772 wrote to memory of 5256	5772	chrome.exe	105
PID 5772 wrote to memory of 5256	5772	chrome.exe	105
PID 5772 wrote to memory of 2264	5772	chrome.exe	106
PID 5772 wrote to memory of 2264	5772	chrome.exe	106
PID 4152 wrote to memory of 2548	4152	AddInProcess32.exe	103
PID 4152 wrote to memory of 2548	4152	AddInProcess32.exe	103
PID 4152 wrote to memory of 5772	4152	AddInProcess32.exe	102
PID 4152 wrote to memory of 5772	4152	AddInProcess32.exe	102
PID 4152 wrote to memory of 6124	4152	AddInProcess32.exe	104
PID 4152 wrote to memory of 6124	4152	AddInProcess32.exe	104
PID 5772 wrote to memory of 3224	5772	chrome.exe	107
PID 5772 wrote to memory of 3224	5772	chrome.exe	107
PID 5772 wrote to memory of 2124	5772	chrome.exe	108
PID 5772 wrote to memory of 2124	5772	chrome.exe	108
PID 5772 wrote to memory of 5104	5772	chrome.exe	110
PID 5772 wrote to memory of 5104	5772	chrome.exe	110
PID 5772 wrote to memory of 4784	5772	chrome.exe	111
PID 5772 wrote to memory of 4784	5772	chrome.exe	111
PID 5772 wrote to memory of 648	5772	chrome.exe	112
PID 5772 wrote to memory of 648	5772	chrome.exe	112
PID 5772 wrote to memory of 3956	5772	chrome.exe	113
PID 5772 wrote to memory of 3956	5772	chrome.exe	113
PID 5772 wrote to memory of 4480	5772	chrome.exe	114
PID 5772 wrote to memory of 4480	5772	chrome.exe	114
PID 4152 wrote to memory of 2548	4152	AddInProcess32.exe	103
PID 4152 wrote to memory of 2548	4152	AddInProcess32.exe	103
PID 4152 wrote to memory of 2124	4152	AddInProcess32.exe	108
PID 4152 wrote to memory of 2124	4152	AddInProcess32.exe	108
PID 4152 wrote to memory of 2264	4152	AddInProcess32.exe	106
PID 4152 wrote to memory of 2264	4152	AddInProcess32.exe	106
PID 4152 wrote to memory of 5772	4152	AddInProcess32.exe	102
PID 4152 wrote to memory of 5772	4152	AddInProcess32.exe	102
PID 4152 wrote to memory of 3956	4152	AddInProcess32.exe	113
PID 5772 wrote to memory of 2320	5772	chrome.exe	122
PID 5772 wrote to memory of 2320	5772	chrome.exe	122
PID 4152 wrote to memory of 3956	4152	AddInProcess32.exe	113
PID 4152 wrote to memory of 4784	4152	AddInProcess32.exe	111
PID 4152 wrote to memory of 4784	4152	AddInProcess32.exe	111
PID 4152 wrote to memory of 648	4152	AddInProcess32.exe	112
PID 4152 wrote to memory of 648	4152	AddInProcess32.exe	112
PID 4152 wrote to memory of 5256	4152	AddInProcess32.exe	105
PID 4152 wrote to memory of 5256	4152	AddInProcess32.exe	105
PID 4152 wrote to memory of 6124	4152	AddInProcess32.exe	104
PID 4152 wrote to memory of 6124	4152	AddInProcess32.exe	104
PID 4152 wrote to memory of 2548	4152	AddInProcess32.exe	103
PID 4152 wrote to memory of 2548	4152	AddInProcess32.exe	103
PID 4152 wrote to memory of 2124	4152	AddInProcess32.exe	108
PID 4152 wrote to memory of 2124	4152	AddInProcess32.exe	108

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1919182765-2457925700-1517026611-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AddInProcess32.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1919182765-2457925700-1517026611-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AddInProcess32.exe

C:\Users\Admin\AppData\Local\Temp\.RFQ-PO#900BD SQ9039 Order-Materials-pdf.exe
"C:\Users\Admin\AppData\Local\Temp\.RFQ-PO#900BD SQ9039 Order-Materials-pdf.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4192
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - outlook_office_path
  - outlook_win_path
  PID:4152
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\pbdenyde.syy"
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5772
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\pbdenyde.syy /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\pbdenyde.syy\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\pbdenyde.syy --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fff1d5cdcf8,0x7fff1d5cdd04,0x7fff1d5cdd10
      4⤵
      PID:2548
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\pbdenyde.syy" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=2256,i,13902299062011746693,3893656653249717287,262144 --variations-seed-version --mojo-platform-channel-handle=2252 /prefetch:2
      4⤵
      PID:6124
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\pbdenyde.syy" --field-trial-handle=1408,i,13902299062011746693,3893656653249717287,262144 --variations-seed-version --mojo-platform-channel-handle=2260 /prefetch:3
      4⤵
      PID:5256
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\pbdenyde.syy" --field-trial-handle=2368,i,13902299062011746693,3893656653249717287,262144 --variations-seed-version --mojo-platform-channel-handle=2608 /prefetch:8
      4⤵
      PID:2264
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\pbdenyde.syy" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3092,i,13902299062011746693,3893656653249717287,262144 --variations-seed-version --mojo-platform-channel-handle=3136 /prefetch:1
      4⤵
      PID:3224
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\pbdenyde.syy" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3100,i,13902299062011746693,3893656653249717287,262144 --variations-seed-version --mojo-platform-channel-handle=3128 /prefetch:1
      4⤵
      PID:2124
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\pbdenyde.syy" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3492,i,13902299062011746693,3893656653249717287,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
      4⤵
      PID:5104
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\pbdenyde.syy" --extension-process --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=3536,i,13902299062011746693,3893656653249717287,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:2
      4⤵
      PID:4784
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\pbdenyde.syy" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=3552,i,13902299062011746693,3893656653249717287,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:1
      4⤵
      PID:648
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\pbdenyde.syy" --extension-process --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=3592,i,13902299062011746693,3893656653249717287,262144 --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:2
      4⤵
      PID:3956
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\pbdenyde.syy" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=4296,i,13902299062011746693,3893656653249717287,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:1
      4⤵
      PID:4480
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\pbdenyde.syy" --field-trial-handle=4340,i,13902299062011746693,3893656653249717287,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:8
      4⤵
      PID:2320
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\pbdenyde.syy" --field-trial-handle=5828,i,13902299062011746693,3893656653249717287,262144 --variations-seed-version --mojo-platform-channel-handle=5588 /prefetch:8
      4⤵
      PID:2320
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\pbdenyde.syy" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=5932,i,13902299062011746693,3893656653249717287,262144 --variations-seed-version --mojo-platform-channel-handle=5952 /prefetch:1
      4⤵
      PID:2228
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\pbdenyde.syy" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=5980,i,13902299062011746693,3893656653249717287,262144 --variations-seed-version --mojo-platform-channel-handle=5956 /prefetch:1
      4⤵
      PID:3656
  - - C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
      4⤵
      Drops file in Program Files directory
      PID:624
    - - C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x268,0x26c,0x270,0x258,0x274,0x7ff719ed1f58,0x7ff719ed1f64,0x7ff719ed1f70
        5⤵
        Drops file in Program Files directory
        
        PID:5756
    - - C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\initial_preferences" --create-shortcuts=1 --install-level=0
        5⤵
        Drops file in Program Files directory
        Modifies registry class
        Suspicious use of FindShellTrayWindow
        
        PID:1436
      - C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x268,0x26c,0x270,0x244,0x274,0x7ff719ed1f58,0x7ff719ed1f64,0x7ff719ed1f70
        6⤵
        Drops file in Program Files directory
        
        PID:5720
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\pbdenyde.syy" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=5832,i,13902299062011746693,3893656653249717287,262144 --variations-seed-version --mojo-platform-channel-handle=5936 /prefetch:1
      4⤵
      PID:1416
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\pbdenyde.syy" --field-trial-handle=6084,i,13902299062011746693,3893656653249717287,262144 --variations-seed-version --mojo-platform-channel-handle=6200 /prefetch:8
      4⤵
      PID:5604
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ku5bwvg5.2px"
    3⤵
    PID:2828
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir=C:\Users\Admin\AppData\Local\Temp\ku5bwvg5.2px
      4⤵
      Checks processor information in registry
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:3360
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2000 -prefsLen 27099 -prefMapHandle 2004 -prefMapSize 270279 -ipcHandle 2092 -initialChannelId {1fd67f7c-f81a-4249-bc6c-56ad442499ca} -parentPid 3360 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3360" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
        5⤵
        
        PID:6092
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2216 -prefsLen 27135 -prefMapHandle 2204 -prefMapSize 270279 -ipcHandle 2180 -initialChannelId {279c28ec-11c6-4d2a-bc89-d0887bb542af} -parentPid 3360 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3360" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
        5⤵
        
        PID:2236
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\f5c40094-fa4b-45a2-9ec1-4a086cf93db3.dmp"
        5⤵
        
        PID:4940
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2264 -prefsLen 27135 -prefMapHandle 2920 -prefMapSize 270279 -ipcHandle 2892 -initialChannelId {b33cf544-3c26-454f-8879-f87f89bc9951} -parentPid 3360 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3360" -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 gpu
        5⤵
        
        PID:5648
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\fa9dc9ee-4c3b-41ae-8283-0e1ebb786d3d.dmp"
        5⤵
        
        PID:4004
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2892 -prefsLen 27135 -prefMapHandle 3012 -prefMapSize 270279 -ipcHandle 3000 -initialChannelId {630fc570-76f6-4f6d-af5d-55364506588b} -parentPid 3360 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3360" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 gpu
        5⤵
        
        PID:4436
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\a3fc9eda-f015-4a53-a80f-a40daeb7d4f1.dmp"
        5⤵
        
        PID:2036
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3372 -prefsLen 27200 -prefMapHandle 3744 -prefMapSize 270279 -ipcHandle 3560 -initialChannelId {de82a101-7ab0-4a00-8ab9-88d1a05b2199} -parentPid 3360 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3360" -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 gpu
        5⤵
        
        PID:5412
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3996 -prefsLen 27276 -prefMapHandle 4000 -prefMapSize 270279 -jsInitHandle 4004 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4012 -initialChannelId {e3547c8d-6817-45c9-9804-8c1a7014be0e} -parentPid 3360 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3360" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 tab
        5⤵
        Checks processor information in registry
        
        PID:4640
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\67195af8-87cd-4929-b6c2-418d03d15cbf.dmp"
        5⤵
        
        PID:4768
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3560 -prefsLen 27276 -prefMapHandle 4136 -prefMapSize 270279 -ipcHandle 4148 -initialChannelId {1f8a5030-bf72-468a-a7b0-feff41a0d7e0} -parentPid 3360 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3360" -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 gpu
        5⤵
        
        PID:1816
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\97cfe805-dfcb-4c09-9b98-a84c2e624a60.dmp"
        5⤵
        
        PID:4668
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4324 -prefsLen 27276 -prefMapHandle 4328 -prefMapSize 270279 -ipcHandle 4336 -initialChannelId {b4d6b769-926d-4b45-9a3c-76dada945473} -parentPid 3360 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3360" -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 rdd
        5⤵
        
        PID:4160
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3252 -prefsLen 34775 -prefMapHandle 2916 -prefMapSize 270279 -jsInitHandle 2888 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2736 -initialChannelId {6a4120df-41ef-4a71-aa8f-0176a8009dd3} -parentPid 3360 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3360" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
        5⤵
        Checks processor information in registry
        
        PID:4556
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5020 -prefsLen 35012 -prefMapHandle 5016 -prefMapSize 270279 -ipcHandle 4924 -initialChannelId {3cee9b3f-c9b3-4dd1-aaee-dc6230cf7766} -parentPid 3360 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3360" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 utility
        5⤵
        Checks processor information in registry
        
        PID:6912
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5240 -prefsLen 32952 -prefMapHandle 5244 -prefMapSize 270279 -jsInitHandle 5248 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5008 -initialChannelId {0fc805f3-c5d0-4760-bb5a-8cc48d1ae4e4} -parentPid 3360 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3360" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
        5⤵
        Checks processor information in registry
        
        PID:6968
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5480 -prefsLen 32952 -prefMapHandle 5484 -prefMapSize 270279 -jsInitHandle 5488 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5244 -initialChannelId {097e7daf-4a94-499e-8079-c2dd75517237} -parentPid 3360 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3360" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
        5⤵
        Checks processor information in registry
        
        PID:6984
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5668 -prefsLen 32952 -prefMapHandle 5672 -prefMapSize 270279 -jsInitHandle 5676 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5276 -initialChannelId {a9aa392a-f59c-4cd4-9077-68b9ce7aeb32} -parentPid 3360 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3360" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab
        5⤵
        Checks processor information in registry
        
        PID:7000
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vngqbdp3.fbu"
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious use of FindShellTrayWindow
    PID:3068
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\vngqbdp3.fbu /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\vngqbdp3.fbu\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x238,0x23c,0x240,0x234,0x24c,0x7fff1c36f208,0x7fff1c36f214,0x7fff1c36f220
      4⤵
      PID:3156
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vngqbdp3.fbu" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --field-trial-handle=1972,i,3569910423660714827,2944936919167708335,262144 --variations-seed-version --mojo-platform-channel-handle=1968 /prefetch:2
      4⤵
      PID:5424
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vngqbdp3.fbu" --always-read-main-dll --field-trial-handle=1876,i,3569910423660714827,2944936919167708335,262144 --variations-seed-version --mojo-platform-channel-handle=1976 /prefetch:3
      4⤵
      PID:2128
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vngqbdp3.fbu" --always-read-main-dll --field-trial-handle=1908,i,3569910423660714827,2944936919167708335,262144 --variations-seed-version --mojo-platform-channel-handle=2668 /prefetch:8
      4⤵
      PID:4196
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vngqbdp3.fbu" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3396,i,3569910423660714827,2944936919167708335,262144 --variations-seed-version --mojo-platform-channel-handle=3428 /prefetch:1
      4⤵
      PID:6564
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vngqbdp3.fbu" --instant-process --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3420,i,3569910423660714827,2944936919167708335,262144 --variations-seed-version --mojo-platform-channel-handle=3444 /prefetch:1
      4⤵
      PID:2340
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vngqbdp3.fbu" --always-read-main-dll --field-trial-handle=3824,i,3569910423660714827,2944936919167708335,262144 --variations-seed-version --mojo-platform-channel-handle=3840 /prefetch:8
      4⤵
      PID:6732
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vngqbdp3.fbu" --always-read-main-dll --field-trial-handle=3820,i,3569910423660714827,2944936919167708335,262144 --variations-seed-version --mojo-platform-channel-handle=3952 /prefetch:8
      4⤵
      PID:3628
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vngqbdp3.fbu" --always-read-main-dll --field-trial-handle=3828,i,3569910423660714827,2944936919167708335,262144 --variations-seed-version --mojo-platform-channel-handle=3940 /prefetch:8
      4⤵
      PID:2432
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vngqbdp3.fbu" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --field-trial-handle=3968,i,3569910423660714827,2944936919167708335,262144 --variations-seed-version --mojo-platform-channel-handle=3984 /prefetch:1
      4⤵
      PID:6776
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vngqbdp3.fbu" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --field-trial-handle=3988,i,3569910423660714827,2944936919167708335,262144 --variations-seed-version --mojo-platform-channel-handle=4028 /prefetch:2
      4⤵
      PID:6788
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vngqbdp3.fbu" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --field-trial-handle=3860,i,3569910423660714827,2944936919167708335,262144 --variations-seed-version --mojo-platform-channel-handle=4032 /prefetch:1
      4⤵
      PID:6616
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vngqbdp3.fbu" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --field-trial-handle=4072,i,3569910423660714827,2944936919167708335,262144 --variations-seed-version --mojo-platform-channel-handle=4084 /prefetch:2
      4⤵
      PID:6804
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vngqbdp3.fbu" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --field-trial-handle=4140,i,3569910423660714827,2944936919167708335,262144 --variations-seed-version --mojo-platform-channel-handle=4132 /prefetch:1
      4⤵
      PID:6812
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vngqbdp3.fbu" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --field-trial-handle=4144,i,3569910423660714827,2944936919167708335,262144 --variations-seed-version --mojo-platform-channel-handle=4152 /prefetch:2
      4⤵
      PID:6820
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vngqbdp3.fbu" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --field-trial-handle=4168,i,3569910423660714827,2944936919167708335,262144 --variations-seed-version --mojo-platform-channel-handle=4188 /prefetch:1
      4⤵
      PID:6832
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vngqbdp3.fbu" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --field-trial-handle=4220,i,3569910423660714827,2944936919167708335,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:2
      4⤵
      PID:6840
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vngqbdp3.fbu" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --field-trial-handle=4244,i,3569910423660714827,2944936919167708335,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:1
      4⤵
      PID:6848
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vngqbdp3.fbu" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --field-trial-handle=4292,i,3569910423660714827,2944936919167708335,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:2
      4⤵
      PID:6856
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vngqbdp3.fbu" --always-read-main-dll --field-trial-handle=5380,i,3569910423660714827,2944936919167708335,262144 --variations-seed-version --mojo-platform-channel-handle=4156 /prefetch:8
      4⤵
      PID:6800
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vngqbdp3.fbu" --always-read-main-dll --field-trial-handle=5412,i,3569910423660714827,2944936919167708335,262144 --variations-seed-version --mojo-platform-channel-handle=3952 /prefetch:8
      4⤵
      PID:1664
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vngqbdp3.fbu" --always-read-main-dll --field-trial-handle=5500,i,3569910423660714827,2944936919167708335,262144 --variations-seed-version --mojo-platform-channel-handle=4132 /prefetch:8
      4⤵
      PID:6496
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --no-sandbox --mute-audio --onnx-enabled-for-ee --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vngqbdp3.fbu" --always-read-main-dll --field-trial-handle=5492,i,3569910423660714827,2944936919167708335,262144 --variations-seed-version --mojo-platform-channel-handle=3956 /prefetch:8
      4⤵
      PID:7152
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hnerojsc.htw"
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious use of FindShellTrayWindow
    PID:5616
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\hnerojsc.htw /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\hnerojsc.htw\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7fff1c36f208,0x7fff1c36f214,0x7fff1c36f220
      4⤵
      PID:212
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hnerojsc.htw" --subproc-heap-profiling --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --field-trial-handle=2216,i,16946646876445216495,5108709232973285999,262144 --variations-seed-version --mojo-platform-channel-handle=2212 /prefetch:2
      4⤵
      PID:4256
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hnerojsc.htw" --subproc-heap-profiling --always-read-main-dll --field-trial-handle=1776,i,16946646876445216495,5108709232973285999,262144 --variations-seed-version --mojo-platform-channel-handle=2220 /prefetch:3
      4⤵
      PID:3904
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hnerojsc.htw" --subproc-heap-profiling --always-read-main-dll --field-trial-handle=2332,i,16946646876445216495,5108709232973285999,262144 --variations-seed-version --mojo-platform-channel-handle=2360 /prefetch:8
      4⤵
      PID:6564
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hnerojsc.htw" --subproc-heap-profiling --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3284,i,16946646876445216495,5108709232973285999,262144 --variations-seed-version --mojo-platform-channel-handle=3320 /prefetch:1
      4⤵
      PID:6408
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hnerojsc.htw" --instant-process --subproc-heap-profiling --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3300,i,16946646876445216495,5108709232973285999,262144 --variations-seed-version --mojo-platform-channel-handle=3280 /prefetch:1
      4⤵
      PID:4236
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hnerojsc.htw" --subproc-heap-profiling --always-read-main-dll --field-trial-handle=3676,i,16946646876445216495,5108709232973285999,262144 --variations-seed-version --mojo-platform-channel-handle=3828 /prefetch:8
      4⤵
      PID:1356
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hnerojsc.htw" --subproc-heap-profiling --always-read-main-dll --field-trial-handle=3692,i,16946646876445216495,5108709232973285999,262144 --variations-seed-version --mojo-platform-channel-handle=3832 /prefetch:8
      4⤵
      PID:5264
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hnerojsc.htw" --subproc-heap-profiling --always-read-main-dll --field-trial-handle=3720,i,16946646876445216495,5108709232973285999,262144 --variations-seed-version --mojo-platform-channel-handle=3256 /prefetch:8
      4⤵
      PID:6860
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hnerojsc.htw" --subproc-heap-profiling --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --field-trial-handle=3732,i,16946646876445216495,5108709232973285999,262144 --variations-seed-version --mojo-platform-channel-handle=3900 /prefetch:1
      4⤵
      PID:5652
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hnerojsc.htw" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --field-trial-handle=3840,i,16946646876445216495,5108709232973285999,262144 --variations-seed-version --mojo-platform-channel-handle=3988 /prefetch:2
      4⤵
      PID:3236
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hnerojsc.htw" --subproc-heap-profiling --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --field-trial-handle=3884,i,16946646876445216495,5108709232973285999,262144 --variations-seed-version --mojo-platform-channel-handle=3968 /prefetch:1
      4⤵
      PID:4300
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hnerojsc.htw" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --field-trial-handle=3920,i,16946646876445216495,5108709232973285999,262144 --variations-seed-version --mojo-platform-channel-handle=4048 /prefetch:2
      4⤵
      PID:5800
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hnerojsc.htw" --subproc-heap-profiling --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --field-trial-handle=4000,i,16946646876445216495,5108709232973285999,262144 --variations-seed-version --mojo-platform-channel-handle=3880 /prefetch:1
      4⤵
      PID:3664
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hnerojsc.htw" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --field-trial-handle=4036,i,16946646876445216495,5108709232973285999,262144 --variations-seed-version --mojo-platform-channel-handle=4088 /prefetch:2
      4⤵
      PID:6920
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hnerojsc.htw" --subproc-heap-profiling --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --field-trial-handle=4032,i,16946646876445216495,5108709232973285999,262144 --variations-seed-version --mojo-platform-channel-handle=4100 /prefetch:1
      4⤵
      PID:7008
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hnerojsc.htw" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --field-trial-handle=4080,i,16946646876445216495,5108709232973285999,262144 --variations-seed-version --mojo-platform-channel-handle=4148 /prefetch:2
      4⤵
      PID:3380
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hnerojsc.htw" --subproc-heap-profiling --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --field-trial-handle=4128,i,16946646876445216495,5108709232973285999,262144 --variations-seed-version --mojo-platform-channel-handle=3752 /prefetch:1
      4⤵
      PID:4160
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hnerojsc.htw" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --field-trial-handle=4160,i,16946646876445216495,5108709232973285999,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:2
      4⤵
      PID:5584
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hnerojsc.htw" --subproc-heap-profiling --always-read-main-dll --field-trial-handle=3320,i,16946646876445216495,5108709232973285999,262144 --variations-seed-version --mojo-platform-channel-handle=5264 /prefetch:8
      4⤵
      PID:2980
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hnerojsc.htw" --subproc-heap-profiling --always-read-main-dll --field-trial-handle=3724,i,16946646876445216495,5108709232973285999,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:8
      4⤵
      PID:5512
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hnerojsc.htw" --subproc-heap-profiling --always-read-main-dll --field-trial-handle=5416,i,16946646876445216495,5108709232973285999,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:8
      4⤵
      PID:6712
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --no-sandbox --mute-audio --onnx-enabled-for-ee --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hnerojsc.htw" --subproc-heap-profiling --always-read-main-dll --field-trial-handle=5424,i,16946646876445216495,5108709232973285999,262144 --variations-seed-version --mojo-platform-channel-handle=5532 /prefetch:8
      4⤵
      PID:2176
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\xas1ubn2.2jg"
    3⤵
    PID:2772
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir=C:\Users\Admin\AppData\Local\Temp\xas1ubn2.2jg
      4⤵
      Checks processor information in registry
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:452
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1992 -prefsLen 27099 -prefMapHandle 1996 -prefMapSize 270331 -ipcHandle 2076 -initialChannelId {2a319965-4c1f-4aca-bba3-2334b389c11d} -parentPid 452 -crashReporter "\\.\pipe\gecko-crash-server-pipe.452" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
        5⤵
        
        PID:8168
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2352 -prefsLen 27135 -prefMapHandle 2092 -prefMapSize 270331 -ipcHandle 2356 -initialChannelId {9d49836f-ca3a-4ee7-a623-4341a01869d8} -parentPid 452 -crashReporter "\\.\pipe\gecko-crash-server-pipe.452" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
        5⤵
        
        PID:8088
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\3e82b2c2-05be-4699-9cb7-14e8cb63d47b.dmp"
        5⤵
        
        PID:6100
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2248 -prefsLen 27135 -prefMapHandle 2896 -prefMapSize 270331 -ipcHandle 2900 -initialChannelId {10a562bb-3df7-471f-8519-37d422c3794c} -parentPid 452 -crashReporter "\\.\pipe\gecko-crash-server-pipe.452" -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 gpu
        5⤵
        
        PID:6548
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\1227c911-5c35-445d-81ea-28994adb4e43.dmp"
        5⤵
        
        PID:6332
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2896 -prefsLen 27135 -prefMapHandle 3016 -prefMapSize 270331 -ipcHandle 3044 -initialChannelId {2b5d66e8-05a4-430d-a3e8-639e072c3a86} -parentPid 452 -crashReporter "\\.\pipe\gecko-crash-server-pipe.452" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 gpu
        5⤵
        
        PID:6344
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\a2855af3-4cb5-4e87-b238-8d079b7256a3.dmp"
        5⤵
        
        PID:2556
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3156 -prefsLen 27200 -prefMapHandle 3152 -prefMapSize 270331 -ipcHandle 3392 -initialChannelId {d56da7c4-63d3-4974-866a-f01aef23530b} -parentPid 452 -crashReporter "\\.\pipe\gecko-crash-server-pipe.452" -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 gpu
        5⤵
        
        PID:4420
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3608 -prefsLen 27325 -prefMapHandle 3612 -prefMapSize 270331 -jsInitHandle 3616 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3624 -initialChannelId {2229f0cf-2f28-4747-9615-1530bec2d82b} -parentPid 452 -crashReporter "\\.\pipe\gecko-crash-server-pipe.452" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 tab
        5⤵
        Checks processor information in registry
        
        PID:6372
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\07136f42-7b02-4e93-9899-f8687d32f1cd.dmp"
        5⤵
        
        PID:3028
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3388 -prefsLen 27325 -prefMapHandle 3780 -prefMapSize 270331 -ipcHandle 3784 -initialChannelId {afc97dbe-8b9c-4c0d-ae21-10f1bb31f1a1} -parentPid 452 -crashReporter "\\.\pipe\gecko-crash-server-pipe.452" -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 gpu
        5⤵
        
        PID:4560
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\a4ab8a48-d517-49bc-af6d-a05ebfdcbb7c.dmp"
        5⤵
        
        PID:4576
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4120 -prefsLen 27325 -prefMapHandle 4124 -prefMapSize 270331 -ipcHandle 4132 -initialChannelId {a2745334-df03-41df-b213-75a8842375f5} -parentPid 452 -crashReporter "\\.\pipe\gecko-crash-server-pipe.452" -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 rdd
        5⤵
        
        PID:8100
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4484 -prefsLen 34878 -prefMapHandle 4488 -prefMapSize 270331 -jsInitHandle 4492 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3336 -initialChannelId {641a43e9-da7a-4c28-9894-1e2fe623cfe3} -parentPid 452 -crashReporter "\\.\pipe\gecko-crash-server-pipe.452" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
        5⤵
        Checks processor information in registry
        
        PID:7400
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5024 -prefsLen 34878 -prefMapHandle 5028 -prefMapSize 270331 -ipcHandle 5004 -initialChannelId {a2ead9ba-3f00-4e5f-a07a-29e86315d815} -parentPid 452 -crashReporter "\\.\pipe\gecko-crash-server-pipe.452" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 utility
        5⤵
        Checks processor information in registry
        
        PID:4620
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5072 -prefsLen 32766 -prefMapHandle 5076 -prefMapSize 270331 -jsInitHandle 5088 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5096 -initialChannelId {4e23c9ac-f8c2-493f-9d5a-277b5a4920ab} -parentPid 452 -crashReporter "\\.\pipe\gecko-crash-server-pipe.452" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
        5⤵
        Checks processor information in registry
        
        PID:5348
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5116 -prefsLen 32766 -prefMapHandle 5124 -prefMapSize 270331 -jsInitHandle 5128 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5140 -initialChannelId {152e4170-9921-4198-b561-9876d313452c} -parentPid 452 -crashReporter "\\.\pipe\gecko-crash-server-pipe.452" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
        5⤵
        Checks processor information in registry
        
        PID:7652
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5572 -prefsLen 32766 -prefMapHandle 5576 -prefMapSize 270331 -jsInitHandle 5580 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5588 -initialChannelId {b197955e-7822-49f9-b3cd-edcb6de71941} -parentPid 452 -crashReporter "\\.\pipe\gecko-crash-server-pipe.452" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab
        5⤵
        Checks processor information in registry
        
        PID:6744
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\h2oxlrcz.bei"
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    PID:7988
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\h2oxlrcz.bei /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\h2oxlrcz.bei\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\h2oxlrcz.bei --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fff1d5cdcf8,0x7fff1d5cdd04,0x7fff1d5cdd10
      4⤵
      PID:7972
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\h2oxlrcz.bei" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=2076,i,18373283928810066922,17674115689006468345,262144 --variations-seed-version --mojo-platform-channel-handle=2072 /prefetch:2
      4⤵
      PID:5248
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\h2oxlrcz.bei" --field-trial-handle=1920,i,18373283928810066922,17674115689006468345,262144 --variations-seed-version --mojo-platform-channel-handle=2080 /prefetch:3
      4⤵
      PID:5888
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\h2oxlrcz.bei" --field-trial-handle=2132,i,18373283928810066922,17674115689006468345,262144 --variations-seed-version --mojo-platform-channel-handle=2128 /prefetch:8
      4⤵
      PID:5404
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\h2oxlrcz.bei" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3080,i,18373283928810066922,17674115689006468345,262144 --variations-seed-version --mojo-platform-channel-handle=3100 /prefetch:1
      4⤵
      PID:3444
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\h2oxlrcz.bei" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3112,i,18373283928810066922,17674115689006468345,262144 --variations-seed-version --mojo-platform-channel-handle=3132 /prefetch:1
      4⤵
      PID:8080
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\h2oxlrcz.bei" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3316,i,18373283928810066922,17674115689006468345,262144 --variations-seed-version --mojo-platform-channel-handle=3344 /prefetch:1
      4⤵
      PID:7100
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\h2oxlrcz.bei" --extension-process --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=3332,i,18373283928810066922,17674115689006468345,262144 --variations-seed-version --mojo-platform-channel-handle=3360 /prefetch:2
      4⤵
      PID:6584
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\h2oxlrcz.bei" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=3372,i,18373283928810066922,17674115689006468345,262144 --variations-seed-version --mojo-platform-channel-handle=3400 /prefetch:1
      4⤵
      PID:3552
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\h2oxlrcz.bei" --extension-process --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=3364,i,18373283928810066922,17674115689006468345,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:2
      4⤵
      PID:7144
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\h2oxlrcz.bei" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=4024,i,18373283928810066922,17674115689006468345,262144 --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:1
      4⤵
      PID:7228
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\h2oxlrcz.bei" --field-trial-handle=4404,i,18373283928810066922,17674115689006468345,262144 --variations-seed-version --mojo-platform-channel-handle=4036 /prefetch:8
      4⤵
      PID:7232
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\h2oxlrcz.bei" --field-trial-handle=4840,i,18373283928810066922,17674115689006468345,262144 --variations-seed-version --mojo-platform-channel-handle=4876 /prefetch:8
      4⤵
      PID:6572
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\h2oxlrcz.bei" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=4960,i,18373283928810066922,17674115689006468345,262144 --variations-seed-version --mojo-platform-channel-handle=5032 /prefetch:1
      4⤵
      PID:7576
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\h2oxlrcz.bei" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=4988,i,18373283928810066922,17674115689006468345,262144 --variations-seed-version --mojo-platform-channel-handle=4972 /prefetch:1
      4⤵
      PID:7620
  - - C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
      4⤵
      Drops file in Program Files directory
      PID:8100
    - - C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x268,0x26c,0x270,0x244,0x274,0x7ff719ed1f58,0x7ff719ed1f64,0x7ff719ed1f70
        5⤵
        Drops file in Program Files directory
        
        PID:3256
    - - C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\initial_preferences" --create-shortcuts=1 --install-level=0
        5⤵
        Drops file in Program Files directory
        Modifies registry class
        
        PID:3876
      - C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x268,0x26c,0x270,0x244,0x274,0x7ff719ed1f58,0x7ff719ed1f64,0x7ff719ed1f70
        6⤵
        Drops file in Program Files directory
        
        PID:6544

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4584

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Program Files\Crashpad\settings.dat
Size 40B
SHA256 8f026b1beecc3eb512b306caf97f8cfec8e4292f241359137649dec037fd1a0c
MD5 6e2c56bba5e58c620e0655173aee6de8
SHA1 125711f292173cf11d572cbe08251b7511318aa0
SHA512 e9b6e6978c8bfc131e43dcf56599acb7f0f0ed6e956e30c976ae829b14665889c5710041a1a6fc50ae4fc20a7178d15883dd69381227c665954e355d14b54900
MD5 SHA1 SHA512

Submit Download

chrome_installer.log

Path C:\Program Files\chrome_installer.log
Size 7KB
SHA256 5a171c89b528e7cee30825432dc849f9f1e69a2ffa69269a18c671715e0838e2
MD5 2a4a9c68199988e0871cbefd414e7352
SHA1 50c59317ba6884949c8bc3f812c22a13e02a95d7
SHA512 b6828cb0be3bb751dd59d0697952bf7ce72546405d277fe7f90804ac5a65e1fb60d154de379dc9c38d1e1868ec8830453f10e81ef40fce41342761875a18f430
SSDEEP 96:e/3hsphEm0Dn0J5mtt5A5ANdwK3guK3aRcZmHh4B4E0swK23K2KuqRIMJ4S1owKu:adxW38W70b1eIMCS1nvqMT
MD5 SHA1 SHA512 SSDEEP

Submit Download

activity-stream.contile.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3wiiokog.default-release\activity-stream.contile.json
Size 5KB
SHA256 f9b6946ef0afa5ed4f42adb96c82f93e7a2308fe575d10400fde546c86eb12b7
MD5 26ca9b26bf5f526ef4b37a3ecf48a5bf
SHA1 3c4aa8643d570448dc38e1cb38732c582dff17b0
SHA512 2322c97d0561ea71fa780b0bdb0edf48cd9595acdd61f365158808de5ef80104051768f15a3095c94e89ff5a3c18124f02e34a2a7f8ea2a4d651a0c031629391
SSDEEP 96:Ke+w9tvrXQ8BnVcAd80oz+ZnjcmCsezEol:Ke+ctvrQ8Bnnd80uanjcmYz7l
MD5 SHA1 SHA512 SSDEEP

Submit Download

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3wiiokog.default-release\activity-stream.discovery_stream.json
Size 23KB
SHA256 e6050344ae5c9c782b47b5bfdb09b784dd6e4f10071f51d53841adc5a1eef0a2
MD5 8761bcc095c061b16e6d2cf5bc904055
SHA1 ffb2ff8fb11fdfa399f3585be6e72f9f5cd6aff0
SHA512 3b3bdb36d7afe809eb009db7e7f5617983c7e095982ac4c0c642d7bed9f3456c125eb57721092594d25245e092e04fe5f52c77af933a5aa440af8064d5fef288
SSDEEP 384:XyaNLlRGURH2vA54yRgQUhQ+Ynu8zfBHdnztWik2ReAMIG:Xy0XW4gBYu8l1EiEb
MD5 SHA1 SHA512 SSDEEP

Submit Download

577120C5183923526312DC856F6825FC1C7D072F

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3wiiokog.default-release\cache2\entries\577120C5183923526312DC856F6825FC1C7D072F
Size 13KB
SHA256 83a4a57ba44e227703334e65fd7e5fdcff5021c3cb3338d5bd37973b2a36afee
MD5 c72b10af1eb2d4f684368f9ae25d1b0f
SHA1 32429e3b96bc9fdd84254bf545aa5b1e2f35eba2
SHA512 6044279967ab98cda437c299efcb960632461491980c4ebb3146886c57f146c29a7565a1e47b904c1a0b92a24722c47e32f57aaac627362ca30887aa21b99f01
SSDEEP 384:HV9BpiO024Yj7hSznZOML+CbcxDEclrIVy8em/+y/+aF:1EZYj7hSz8MLPbcxDEcVIVy8zjpF
MD5 SHA1 SHA512 SSDEEP

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3wiiokog.default-release\startupCache\webext.sc.lz4
Size 104KB
SHA256 7f71b581a7a3b48b964a52aff22af899e315c80c20206a3ab5ad051033fea7b1
MD5 14ba8bc5bb2e7d38901a6a57b849ffbd
SHA1 535f8e3ae4b6f617583c8eb1ab708616e3387896
SHA512 2ea93169afb871e4569da893cd669d5f1ef4c3a7d87d4dfa452af9f743febd4be7ed1f7420b88b278ec21a5df59ca4e7896c9ceb2d9828e73ae42d3cfb1360c4
SSDEEP 1536:jTrliW0/nDisI67U6AmhsbQAkLWEFSErOXCdKw1IF7Rg1+2lLipZciFRRYl6mChD:j3lII67UGt1VFSlXCz1IXB2CFzRGM
MD5 SHA1 SHA512 SSDEEP

Submit Download

10c81a78-a502-42af-b6d0-36ea0a1ee906.tmp

Path C:\Users\Admin\AppData\Local\Temp\10c81a78-a502-42af-b6d0-36ea0a1ee906.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

de8713e0-a1a5-4db3-b6e8-094711e0ea54.tmp

Path C:\Users\Admin\AppData\Local\Temp\de8713e0-a1a5-4db3-b6e8-094711e0ea54.tmp
Size 242KB
SHA256 81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82
MD5 541f52e24fe1ef9f8e12377a6ccae0c0
SHA1 189898bb2dcae7d5a6057bc2d98b8b450afaebb6
SHA512 d779d78a15c5efca51ebd6b96a7ccb6d718741bdf7d9a37f53b2eb4b98aa1a78bc4cfa57d6e763aab97276c8f9088940ac0476690d4d46023ff4bf52f3326c88
SSDEEP 3072:r+nmRykNgoldZ8GjJCiUXZSk+QSVh85PxEalRVHmcld9R6yYfEp4ABUGDcaKklrv:k3oF4Z4h45P99Fld9RBQYBVcaxlnfL
MD5 SHA1 SHA512 SSDEEP

Submit Download

e3c52672-4df9-413e-abd7-5023d03d82c6.tmp

Path C:\Users\Admin\AppData\Local\Temp\e3c52672-4df9-413e-abd7-5023d03d82c6.tmp
Size 154KB
SHA256 a468f5875b4e55ea732e3df283b4f4ea941be738b238122979ca5d8006a3a8fe
MD5 4ad81f6ccc657d1da582c75c5db037cb
SHA1 ab0370e7d32ebed71fe9787d3a4a2fc0c652a28e
SHA512 66461474f8b36d6d470797df9d4a3cc4698bceb7054c97166eed98b74def84f58486fdb909928aaeafee793799a436210b5d7091acce6232b23eb6ba926ad227
SSDEEP 3072:OqeD5sKZ7XcbMSqnDhcfXE0IfnpWpyKIrFn2wNkR7aUPuWm6u:yD5sIXcYSqDGc0kkpIZ2weeX6u
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Action Predictor

Path C:\Users\Admin\AppData\Local\Temp\h2oxlrcz.bei\Default\Network Action Predictor
Size 4KB
SHA256 8c471cab38a1696289186d01b06ff6af2a888852dc18d6fb8d2a0e54898104ed
MD5 d25d5e1dc1d93430e64ee17e48ce442e
SHA1 d5c7ca9a57e6cc68927a249fe8e601d52680ac7a
SHA512 f4cff7510b4ad81090e0b1842652f8eb7995f7aefd0ce651151bc24ca3a4305d34ecae41cf193d9b846e8f6359ccf545e5d05e63e6e766fa9761ccebce620f6c
MD5 SHA1 SHA512

Submit Download

192.png

Path C:\Users\Admin\AppData\Local\Temp\h2oxlrcz.bei\Default\Web Applications\Temp\scoped_dir7988_1611044558\Icons\192.png
Size 2KB
SHA256 9cfd1ad226821af533499bd832a5674df52a720b19e054580a2b999e19dd7b1a
MD5 22ba8844019e231a435903176a618bf5
SHA1 0ce576800f66bc2145c8df72b9efbe0c7431aff8
SHA512 2e754fce3268dac2f8f9261f4d4337a7990a990121327c9d491f27fba5c4680968c7589bfa0d04082410f975cda97c46912ba8e1c39f8a6da15cb32c02929cfa
MD5 SHA1 SHA512

Submit Download

256.png

Path C:\Users\Admin\AppData\Local\Temp\h2oxlrcz.bei\Default\Web Applications\Temp\scoped_dir7988_1611044558\Icons\256.png
Size 11KB
SHA256 f64a3d1e393f9a114632d22bc8a01b328895127ff1796e2c3d18b206622fab1c
MD5 024859c892ef6882e8a3e1be4675d23c
SHA1 30ba3b6255e2514b9782ee29f6b8b55ed350a29e
SHA512 58caafadba7cda1db596f5a3c2f94fd3a167cbc21ad98387820ebd808a52eff0e23a5a8292b34a8e284aec4bf2573998ca62f0effb5b647af1bee96ded8bb384
SSDEEP 192:F4aCtq9F5vnIb8/0yNBlV28QNP716enZiP3dGu5yIs9gGDyIMWQo2BkL6O1sSO:Veq9vvPdBrQNL8PNoIsPGYwBO1sP
MD5 SHA1 SHA512 SSDEEP

Submit Download

96.png

Path C:\Users\Admin\AppData\Local\Temp\h2oxlrcz.bei\Default\Web Applications\Temp\scoped_dir7988_1611044558\Icons\96.png
Size 3KB
SHA256 6c5f0e1efa0cf592b01bc20be9c3f348a4285e4604e555216c064b64a05961c0
MD5 7b0532144ec2ce1915a3707ec9084aab
SHA1 81cab7df8538d1f757a3e58318716a9a1ed08d5a
SHA512 aefca0ca127e2b91a5c7206b8103b2afd977258643c12e972a292522152964da1beceaaba0b8f4f40e85e705bb9c9e5826ba49eb2d9b925dc07964096863dcaf
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\hnerojsc.htw\Crashpad\settings.dat
Size 280B
SHA256 e32b03b3bbce9273322afb55a31a1f0fa477ca271adbecd152a6651b32ef7d6a
MD5 d2cde3e9fbe5e1958506ed3a3d5a13e2
SHA1 8de8e7d46491682af13e42c9e3878e715fb6440b
SHA512 b13a4def51c14eab83f6962034b53d5b22df862d2a2a6c4cddb4f76f71822ca2b0cec300f1acd2ab0a6f1f62da04e67877ebbf982298f6932eeca205873ddfd8
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\hnerojsc.htw\Crashpad\settings.dat
Size 280B
SHA256 253111df1f6c3e2900b0e32eedc8773300df4121db7e44ad6b3ee11483c0f847
MD5 dd2e7f990b7dbd9b05a1660a5984b80b
SHA1 9bb2c3a5ce8e376b96cf05f901e3445bed6496e2
SHA512 a91960f32b25635b4497052faeaf2050c5c97d400dbbb9891b9a36d76940ba9f8e21a3ff2047f8cc0fa6ec08d13bc469d85ef082bc9770a595030fe5257e92ed
MD5 SHA1 SHA512

Submit Download

f_000001

Path C:\Users\Admin\AppData\Local\Temp\hnerojsc.htw\Default\Cache\Cache_Data\f_000001
Size 34KB
SHA256 8c97e1a3437f857eb8a346a360274ea339a09eda1b965ee1445d870c09b066ca
MD5 4227139d34ecd3be139bf6c7d75fce5b
SHA1 0e984113aa96daf31d002392523ad0dfc9cc3870
SHA512 bdb38f430aa623a17b26044288841a07c82691ee858325b158423839fad99a75b192fe0df269898cd76e22a7e54250611f852ccb763ce82db2f7d1c4eb6fcb52
SSDEEP 768:iFPCuSWxAknP3gQlE3brX+48360GKKAC4FZ8ELh/SAE9gnmlV:iFPCuSonPJErr18ZGKK1oLQH95
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000002

Path C:\Users\Admin\AppData\Local\Temp\hnerojsc.htw\Default\Cache\Cache_Data\f_000002
Size 99KB
SHA256 cad25cfcc108f11e81cf1a339916e956b5ccd3ab3da38a3bd7a3a7a01adcd3f4
MD5 86e9c0ad8befdb46f1ecda1d3f2c70ad
SHA1 cf9520c235db04ac02e98a7f7c9f3d5d631d4199
SHA512 30a1265891f03df0c46d4f310d97ffa312b84d485a214d895a1c5e260474260d6637592b20d9cf4efa507c131694f63253577fdb352e8e0c46505e02183e0ab4
SSDEEP 1536:GAqrSnLU5BxYE4bP9zel9rbvjJvNCLtY25wJ0qPKldrT6LTMyT2ItH3RHTZ:GAqrSLSvYEwsVbrTfUPdqL4S2iTZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000003

Path C:\Users\Admin\AppData\Local\Temp\hnerojsc.htw\Default\Cache\Cache_Data\f_000003
Size 63KB
SHA256 a9c9c90931e351cba32704d61f1d329d7a9df76145a8d0dc71e194f293abf425
MD5 ceddc0ede5679a07157e742c028d8cc1
SHA1 48af4601ef9feaf67aa08de7e7e6d7f646db4041
SHA512 8c81f96035fe679bd86a4cc490d10e2754817be3fd08fe2a11a0a4bea82e3d102ed4d2a69e20ec347314658b51f931b17e9f3a1ea82c4e28256cc4165431ff66
SSDEEP 1536:RRLKoT08wUGIDL9uWiYp8araK2xQbypF449xYPMk2xmct/p5CWbL:RRLzT0E56c82RlypFT9WPMkYmctxsi
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000004

Path C:\Users\Admin\AppData\Local\Temp\hnerojsc.htw\Default\Cache\Cache_Data\f_000004
Size 383KB
SHA256 dc3af441eb066cbda7e42f12fb2b4a3df6f7d56b64b94ad8d099de55e4738c46
MD5 294155765131d445bb3d8e94bebe8d75
SHA1 b6e1cddb101abbddba067e18c9830f8215acb459
SHA512 f86e15e69866fbb47971334f45e19fd4c1ed72ddaff109696cc190fbeaed60904731be665cb98371bf8e291e9ddf7f9772ed24ffdddd21e3564d624c7d2b1bb7
SSDEEP 6144:D9KxWHBWzAY0a9Fufaaqy1h6wVY41jhnSJ5x8T398XPQUI0YLg8FHe8y8KwrTZkd:D4xWhhbE091h6FoSnx8T98YmYBFHIbwg
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00000a

Path C:\Users\Admin\AppData\Local\Temp\hnerojsc.htw\Default\Cache\Cache_Data\f_00000a
Size 16KB
SHA256 283e231a1dedf20c3f98eb1452ec52d042179d31a6ee482e54b51066074faf42
MD5 46b49aad1412c12943384f8afb51204f
SHA1 e6a38f254f0681007745ededdde176ec64670723
SHA512 8b521405691a78c9f03740f2484f6f07ae881cb1ea5d18336fa44771ec025d1dab438c1a849c30a3b7fbabd9dc391fe4aff499a09de1af6391611d1752ee8d45
SSDEEP 384:iEEbbexRg+TpS0d0qXYsoXB+SBuqkXL214/R7MI7fm:WexRbw0/XYf+SBQ/xMD
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00000b

Path C:\Users\Admin\AppData\Local\Temp\hnerojsc.htw\Default\Cache\Cache_Data\f_00000b
Size 28KB
SHA256 b421c05a340e40d4d4bd1831521268b6f0afd0461ec3991cfa8d5314bf3207b4
MD5 57f9a7c7e2be49102533a2ceb7a05e51
SHA1 850ab0a80577b7f7effe196cba037899e71594c5
SHA512 66406d54a1d1a44f30e19a9bff1242b50fdcfbf66c33e4c23daaa756c06f50a2e39c991e7a8dfd9a81184cc37c2062d0406070be132e28a22307896e63b55447
SSDEEP 768:dT+CJ4QL+F8S4bApn9Ua0ndjCaixJ/fVW2/AGYnS:TJ45F8SgjXnNCa4fVWVnS
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00000c

Path C:\Users\Admin\AppData\Local\Temp\hnerojsc.htw\Default\Cache\Cache_Data\f_00000c
Size 72KB
SHA256 d532c0033bd892149ba6d22122425ce16e0b9916be3b96edb5d1215892741705
MD5 e8397f14ee34e3d2661d6a762db8ce28
SHA1 c897cf196851f971ac0a728866c1bd1eba41590c
SHA512 b2a8530593aedc867af7daab3fbe40c2649549f977120bdbd073839efe8b5546c5eee83d5788262d0373c5674d90505d02046758b5f6ad0819e5dac71b2ba65b
SSDEEP 1536:Xllt4fEDp707LH1E9kb+zw4oGp6LHXDjMrupuAHnVY3jUUX1AqaPdJp3MdF3TsBf:1PdpcLVE9kcw4oGp6zXCun1Y4UXiJide
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00000d

Path C:\Users\Admin\AppData\Local\Temp\hnerojsc.htw\Default\Cache\Cache_Data\f_00000d
Size 17KB
SHA256 5e41837a6aba4a285df072ad0290e7f9e1dc4682799f71e33222a3a0d6e5a082
MD5 9e6475d889c8916a680317ec48b212c1
SHA1 daea8c5b6cf03d05fb8ee7fcc18320eefd2ee0ca
SHA512 7c4f34e50b5bf4bc95d59a2ae648a673e4a7dbb9669f73d6512dd12521335297886168c5c00f60cca5f85a655265c49355c3ad113e62124577f75f45abaf534c
SSDEEP 384:DlDTvwo0JYeOCqDG+G8fPv4yDs3HsxaYprRr2y0BYi1n:BXwoy9OCHifts3HsYKroBpn
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00000e

Path C:\Users\Admin\AppData\Local\Temp\hnerojsc.htw\Default\Cache\Cache_Data\f_00000e
Size 70KB
SHA256 30b4527ac16dda6093c174e8e842c7208d6c1cc26693f6f1a849d52b17b41d37
MD5 362644b225a27e4a658d69e9b17a8d19
SHA1 99e0fd685d570022b40800612b5dd13b801044a8
SHA512 cf1122d85319b28c69ccdf3f12b7362ffde1cafe952edb0e4a40370d1fb80dc6f8ab70e50ae8f07166c29e254d5a138ad8fb346d796752efbd14642afe5905dc
SSDEEP 1536:SPD6v1B+LiVECo6I6hUr2ZEwVjnZefbudrSb3fFQ9RMVFO:SPD6v1B+kvfYWnP5Sb3fFQT
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000012

Path C:\Users\Admin\AppData\Local\Temp\hnerojsc.htw\Default\Cache\Cache_Data\f_000012
Size 68KB
SHA256 fe2fbf50c33ae9e12935df44eb094e541236f27fbbd97ec1bdaec2bf03e69054
MD5 7f3bae3ddb127530a3b1ec2c8501a056
SHA1 3d2a9ec8ebda8961af05bd4f2fbe0aea180fa762
SHA512 e8a5c7cbb1081d5e229b231b3e50a2d0211082981a44628cb6e01dee18087b73240633f649fc1a0103f24613178973997d7a74961bd4ea7dbea49296c48b0e10
SSDEEP 1536:NupBZ1xSO3cQmUY/lbFBw70hbBD9AfA1pwdpPq3Yf3AZ:NunZ18O3NOlJpd+kpwdpi1
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00001a

Path C:\Users\Admin\AppData\Local\Temp\hnerojsc.htw\Default\Cache\Cache_Data\f_00001a
Size 18KB
SHA256 cb78510332b46564f4369bf31ff85c1ab0016bbcef3110b9b9388b88f1cf4795
MD5 9e32121253edde20161adf93523eb060
SHA1 4b9267459ba3c68bd08e6492a270ccaefe2c2dbf
SHA512 7b5c22ac424e32122637c434f4a087b87ba43ac341c008a4df3d0f57f443e38c68f75ae6087e16cf3d7c651a8a35b80faaa8a28b866b1c0def48e3b6c451fae8
SSDEEP 384:USS65/+IiYmwVYkgDdUlzU7SjcKalWW4sIkb6d2e/Oc+C2kZu:lS64ZimDWz/jcK3WRIkMnmo2Su
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000029

Path C:\Users\Admin\AppData\Local\Temp\hnerojsc.htw\Default\Cache\Cache_Data\f_000029
Size 16KB
SHA256 23cebdde3aa3c9b38e0647ae2bd6daedae2f62adee6521dbf726731d00bf14b5
MD5 fdbdb95b5ac5c4edecb625ceaccf87b5
SHA1 8da620668bc6b3ee6c2eac8c258d80afa06ead0c
SHA512 08c9c96ffa14e4be65c50bed0683a5d817ea190a493cca1119dbec30807a9e5846baa86c96dd97603620ee67c3acee2cda678cb246fdbd033aed1805aef1d2f1
SSDEEP 384:BhBYbM/UQhdWQz2xB4uINwHHKwq2Lx+J7Yj83GyEskVvyWpg5Fe:DqQUwWQz2xBrnnbNLUBYI2yEVVKWpn
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00002d

Path C:\Users\Admin\AppData\Local\Temp\hnerojsc.htw\Default\Cache\Cache_Data\f_00002d
Size 33KB
SHA256 89ab09e7b2d516d5292607553dec92832148ab1a3c37529b7ae4a108477cc387
MD5 baebf31c834043f30f329f8105626445
SHA1 743c63a89cb813094b68af4b8bd2886624c1a08e
SHA512 c98727173145a6b93cb3c1790d9067503966ff617ca50201c68e60051269223cf728b65b439456bf197921324c3f133c057690e8ceaf3f899561def9dc41cf74
SSDEEP 768:AdkIw38+GJp0WyTh17LiGi3m6W2MNc+0lgntGsWEOn:AdzoApU2Gu7INc+0l0t0
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000038

Path C:\Users\Admin\AppData\Local\Temp\hnerojsc.htw\Default\Cache\Cache_Data\f_000038
Size 17KB
SHA256 1c252d3f3dc6616ebbfc5cd29e8537f2abdbfa6b34a624c9a20038ffe1c3cf53
MD5 0408f0b32584dacda0d3bc0a5233d8db
SHA1 798be1217f22d352ebaef5402d4245cea48ab48a
SHA512 9e344569a968561d6c9cf7ccf8caccf9140cb995a69c7bfe9f23a939393d13633749a13417f6e73347a62e65107df03bb63c0cead6c7574f153f707c94e603ba
SSDEEP 384:11lSwURGstPKEYa5FnpxYdxoAscuJjEK/M0AK4:8HRGst3DPpxYdxotJjEJ0AK4
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000039

Path C:\Users\Admin\AppData\Local\Temp\hnerojsc.htw\Default\Cache\Cache_Data\f_000039
Size 37KB
SHA256 6df0197d5710db66a7ef315a0576051377f58955d73c1f4b23db7ad183df8d3a
MD5 69581708d86ec10c6489065b51ee5483
SHA1 91fe71d2a355d958d826f336a880c844a72c13cf
SHA512 7931780512d21f926e193d29f39656e9d4b626487d81d58b6977054ae78d941860ecc56eb1c6ce042431471b871a0c8b0efe09b2fe40eaf5214d45ae16c585f5
SSDEEP 768:tx2YIheOWrWX5LytLNWQho0hd7NV79tIQNY:tkY/8ytxWfqd7NV79mQNY
MD5 SHA1 SHA512 SSDEEP

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Temp\hnerojsc.htw\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 192B
SHA256 3675a54ed1d77a5c0c96b22b8b4cb457627932d88660b3b800492e110b1e3b7d
MD5 fe8ceea4aeb292d1569e68f0d4916a76
SHA1 62526b80436c87e7ef0c70bd0e3d6ce84f21f6d2
SHA512 79e6f7918208e9b5f8db8a12d01d46de1a561234d3a4127cdfce2a34423d3dda6161afe4bfe39e75d356d5fc066ffcfcb2b0c1bebda2c9c8a8e8c39ac34b3f17
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Temp\hnerojsc.htw\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 257B
SHA256 4167dc61328fb0f6bc1e6f1022307968f3743eb2a5e1c779255be158160a5a45
MD5 8bf03ad0ef9642887203a72e321fb2b2
SHA1 01f43aa5754dbe4a75f3a3f22784d369a820e026
SHA512 02f6d5ec571697f86bc47741e719c11e51b4eceea5f7f92a5c8ceb1aa3248d2eaf01ee797a60ec4964bb3efc91b7bda633cc48c2851d96d1ce787440bfa55ff0
MD5 SHA1 SHA512

Submit Download

index.txt~RFe5835a1.TMP

Path C:\Users\Admin\AppData\Local\Temp\hnerojsc.htw\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt~RFe5835a1.TMP
Size 119B
SHA256 ffd83ee59ff91e164489eaf44aa1817e4d8633ae227d27b77bfd7b71d193563d
MD5 28cdb7289a09a428bedf8c54828cdeb9
SHA1 7b1abbce37d5a7a68a6aeda8c1e0bc64b427a5e2
SHA512 b758d8c892711b76e6bdc1becfb4f01c646e8766b695c14d3f663b31971550ba6be75015381d05b3d61ce2f00f20fe58ef942368c71807873632f063771cd080
MD5 SHA1 SHA512

Submit Download

Trust Tokens

Path C:\Users\Admin\AppData\Local\Temp\hnerojsc.htw\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens
Size 36KB
SHA256 19e1e0d60dc0a70455014fec98b5e4b73e93a80651600368745ab0d4a49c9529
MD5 4203aba60fd9de5b4232fc624db3f817
SHA1 1f07dfc552d6b509c83c36cb05986007ce29e250
SHA512 6240f8ef505e093f0ea99306adfa90969b3de094cde08b61076bd2c737763c0815108f532ec17e766fe15f9b1bcb9d82096f799ef04d50c3ce2305d8247bfeb1
SSDEEP 24:TL33lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:TL31DtX5nDOvyKDhU1cSB
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\hnerojsc.htw\Local State
Size 1KB
SHA256 9c7a034cb4809e58827d51d8ff6624c690ced23b8318201756ddf5fce33da9e2
MD5 09e6b2d58f5fd3141930d5660986d569
SHA1 f2af73d3087514dc9c89316b054a5dcaee18eae4
SHA512 c98f095888cd717424f0059eb12d3cbbac2ecc6adb6783272225c7dda3d4f3f011908a99cb7223b8420f480184f69239c0628fe53ce200d87817ea8579f020dc
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\hnerojsc.htw\Local State
Size 3KB
SHA256 b52c1a9ecf50ab9a4e51151b360d9ffeca229405c3692ac9c8eb39e389f802af
MD5 a557052d6433c1c8d282197678fd9ac7
SHA1 94e82669d2793ff3b6f03d132c107965257f20db
SHA512 88aa5aad16de1ed62af3582f37e2ae99fa0eccbabb54de66bb742d4ad58712e30050041723c793238553136bbdc3303f9f9a6c8ce0bdde3f0abaceea55977cbe
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\hnerojsc.htw\Local State
Size 4KB
SHA256 765c3b022e983d581091c7268c539a7a61704df12be3b4cc598c66dd7847bbf6
MD5 32d2cf12227017914e7ab7817de07ec9
SHA1 f0a10ebf16844ba45b08004476a5fe5a406f5e62
SHA512 8892c6df3cf753d1613d8e935bf7d8ea717ac35408b9393eac14b32e3565b3000d7aa106faf79e38c33c78cac26c55192c626d4f994038916ca24a2340b15ba0
SSDEEP 96:AqGNkCufg1R658Frh/cInURoDotov4WfDyBdPKv8vhyUJZpANBpa:rGNbTRooDUwfbS9nhyEZz
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\pbdenyde.syy\Default\Extension Rules\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\pbdenyde.syy\Default\Extension Scripts\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\pbdenyde.syy\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

32.png

Path C:\Users\Admin\AppData\Local\Temp\pbdenyde.syy\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\32.png
Size 1KB
SHA256 3197a2ac164c5bacb65f02fd9a6eb9c0a533fdf3b24f43043bbe9af65ed6608a
MD5 60953b3aca67505c2c7ea1a902e84d51
SHA1 5e6a8e04a96e36306c66409edd4775a606f13f54
SHA512 2e65ec84471c3f703617171aa32f1a0d6c57d73e1d5c074b92d20d580df78e7ac4eef5ce54ab7defd0027bb38e33c44a6602d3e123a2fd310e514af0f5b38086
MD5 SHA1 SHA512

Submit Download

48.png

Path C:\Users\Admin\AppData\Local\Temp\pbdenyde.syy\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\48.png
Size 2KB
SHA256 9bdfc3aa03d4e41b0d83862ce02f9fe7fdb55a492280d86d551b91a24efd47ca
MD5 1625c1dd7bab831d8ab5308a1a71d525
SHA1 f1c145985a7c8c18891caaba0f46729bcbd1f63b
SHA512 75079bcb02482abd10b121d81fe39607dcac17bb3107ca274c549b570bb473260dfdbdd13df769b1745425ac5433a22fd392a2a1d815897e0c2091b787bada8e
MD5 SHA1 SHA512

Submit Download

64.png

Path C:\Users\Admin\AppData\Local\Temp\pbdenyde.syy\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\64.png
Size 2KB
SHA256 57d5cd9fa59f944ffc78ec2a12633a79e2f923124fc50676ffbecaef5021b4a9
MD5 e6671b804d6013a6706ea598e2d854c5
SHA1 40e4f401fe4afbf7bda49a02fe94f5308868460e
SHA512 7b11a47497ae5810ec4c7038ebf8358f03d79126886feb6daffd92d116fd606f530ecced9c3d635c0f57b9f9eb80ed9e8fa4eb98b029f9fd798d9b89ccd279a8
MD5 SHA1 SHA512

Submit Download

128.png

Path C:\Users\Admin\AppData\Local\Temp\pbdenyde.syy\Default\Web Applications\Temp\scoped_dir5772_1241424030\Icons\128.png
Size 5KB
SHA256 99b19cf47ea4e47b933229e92b87a474fbd5af7936bdf885c2240d0e6f4bdaaa
MD5 6a371e7bbf132a71f031772845249b9c
SHA1 36f499f3a2e2bf885019d914a0cc6e8b3e035a79
SHA512 b1fdcd5af84fa476808b8e89794d9df9f8e48b3e7c1a2239deae10832834d01bf311803ac95b3774d781be791b47389310ca866e1a6b497925ca6e2f004555a6
SSDEEP 96:n0NgAMSinf795k4ITgiEAyaD39SOOcqS+e60qq/zsB:n0Ngpf795k4CwG9ST3S0wzsB
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\pbdenyde.syy\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\pbdenyde.syy\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\pbdenyde.syy\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\pbdenyde.syy\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\vngqbdp3.fbu\Crashpad\settings.dat
Size 280B
SHA256 4b2bd3aa00b2d459f68af2f4aa070ac95ac4f4ca732b3bb16e9eefd7366cb100
MD5 076c47efc23f7e86df5039bf3cace0ed
SHA1 07f8c720dccb46d5b38ff8a7fd43449bcd34886a
SHA512 90c8fb201080a18a5289fbe7c3309a8dc9001f6f6f3bc9d5ad14014a1c17d55ef7ee01262f0e1f932caaac2b1ef4835f0a138ac516b2c0d86efb433095488c4b
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\vngqbdp3.fbu\Crashpad\settings.dat
Size 280B
SHA256 6ede9a4129072520b9566caf6e890223d6b78cb6079e7109e532ad414f5ea469
MD5 9a6c7fdd70be39d3c4ed3ce460127b56
SHA1 c1bcd0634985a823e0e26c6274cebfe7c4bf8983
SHA512 85d9b447481aed6a8a862f5315fadd33601f8303208059a9628f0965b1c5c1593378b1b302480daf8e09a82a3b492eab29d2ff69f499fde89ea7644519b9c272
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Temp\vngqbdp3.fbu\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\vngqbdp3.fbu\Default\Code Cache\js\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Temp\vngqbdp3.fbu\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 192B
SHA256 cc5535623f66523d9907f9c59333ae513057a60aaf64ec65550cc4604c963c6d
MD5 7b09851aac394ccce9876ba20f1f554c
SHA1 e0862bf8f20872f0c06915919591ed00881b917e
SHA512 0953e612b06a3e1444f439578ec4c284db11b9d801ca2ea05a75dd17274795c5291e8aa0f253d0a2745c0cf2b6115824d2c684f7f8cfa34c1158ade445256ade
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Temp\vngqbdp3.fbu\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 257B
SHA256 bf528e40ff4b8fb7d250d07fcb871955803df403dcdd946c773b37f972917dbc
MD5 dc3c89d30aea26c3ede662f776610962
SHA1 0e909913233d06e14e5637b778b513825797901f
SHA512 46b2a558bbb929861eeb4c05ac240751ccfd87840909b7b79f036ffb35b717d7aec3f0069c4bf5e0b6f21f27f609fb7715cd29624587d77e18eb415ef01aa237
MD5 SHA1 SHA512

Submit Download

index.txt~RFe5814fa.TMP

Path C:\Users\Admin\AppData\Local\Temp\vngqbdp3.fbu\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt~RFe5814fa.TMP
Size 119B
SHA256 1e80880e637fe3a95646e73f939de53a1addbe5e4cadee963969f60985805124
MD5 0f970f983c80092c4a9a0cfce664eea9
SHA1 5247bfea7a8a6c9a7450baf49cd31d701a4c0f61
SHA512 b8c67d104c823318500f5077abc80af78e204a4a3aedf2fc94e428adfd29302efbc66c314e8d23d33c5124948c6c6a26557c04668b2ecec0c9dd4f8fb3a87354
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\vngqbdp3.fbu\Local State
Size 3KB
SHA256 f896d68673b259cecb61f0cc49d9d6d32e5f9a1fb2d54ae5a059b845a1d9be67
MD5 c61be923e8bbb80e5d7e93b73742857e
SHA1 cbc7705c645f44ae886400a309e4b1b79a23dbe1
SHA512 94b19a56a6272c10d114a0c0ecb4d734a559ad94c2037720d1e6f8a267cff5d11a742af2eecd198b23842177a2beb93a0f17fa2e0334289020b5dc92e8290d7b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\vngqbdp3.fbu\Local State
Size 4KB
SHA256 d1ffbecec5e3e68f1d149452b736dc6f4e77dcda6709e87f921b364043d26365
MD5 56d9c190516769933790445f39c70395
SHA1 e1ba645ec350d2c76c57c97165fe3c748f6cb72f
SHA512 2a0ec87e17ded91d454a3060329685317947be6cf7adf0e0ea3dae3bfa023189b54dbc87e3afa98372b3c4b28c7c120c7e00bf2a432aa6562ada0efee483177a
SSDEEP 96:YqGNkCufgpuG/58Frh/cInURoDotov1iDgyB3P2jvlU7AhDZOgJZ35w4SB/a:DGNbTpUooDUwigS/2wYNOQZh
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State~RFe5805b8.TMP

Path C:\Users\Admin\AppData\Local\Temp\vngqbdp3.fbu\Local State~RFe5805b8.TMP
Size 1KB
SHA256 b25b24fe38eb5c14ca79d71a9990dce37d5df54103b310288023b93ae42c6a17
MD5 7b86e310be8c57544f65ce47d53299e5
SHA1 6b287b188515db77741432c75e2c8200421e7a31
SHA512 526cb4dba197aa65e11c68b0c20db79762c964965b3efb0b6b1ce4d92df491c66ad6d1d46bf9ac9d18d28b2ed69bff188e3d8c1a3f9f0f0037033e96318015c1
MD5 SHA1 SHA512

Submit Download

Google Chrome (2).lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome (2).lnk
Size 2KB
SHA256 3a66aed3ce972b8fb60ffffc2835eb976f17692ff0cef85ec722355020210b12
MD5 53276954473a35fc9457d04c4a531aaa
SHA1 346a536ae719593e66c9aaf79b8c8050b9484d21
SHA512 66d0a10b7ed8e28228c5e424ee565b6866e3125892458f24f416e526ceca2603b93212dec7cb389a672ecf43f4deec746999bdf6acd7ef1e006eb172569d7f53
MD5 SHA1 SHA512

Submit Download

UV0N737QOIMRBWAFHHHT.temp

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\UV0N737QOIMRBWAFHHHT.temp
Size 4KB
SHA256 44cf5b7a92d075c5aae39a8e7e0967580d26cde5e4f8d3428f6e6d89e57f9d98
MD5 04036bce5516e292b6ec5f415af01d88
SHA1 79807fee0f5517fc37a3bfda9feb9ccc1abad613
SHA512 acd94864e4358c446f1371caf9a09899b3486ae831d7c9cf729db98edc81e521f2ad14c7692df9f1c159325eda2aaee55fc6ab2c02874628136b40d53cf38223
SSDEEP 48:TKRJdODd5QgJvlJ9zUoY0dLXuHEpnlKRJdODd5QgJvlJ9zvYkYgdLXuHf2n+:+qyeJUoBukZsqyeJv+Iu4+
MD5 SHA1 SHA512 SSDEEP

Submit Download

67195af8-87cd-4929-b6c2-418d03d15cbf.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\67195af8-87cd-4929-b6c2-418d03d15cbf.dmp
Size 58KB
SHA256 87d05e491d30a8e24abb3db6cfcc4916c57cf369452a0cd15441d6af8715b53c
MD5 46a3da780c95de7f508319ceeb40a150
SHA1 33c3c890b2a6a18f5d13a723144db02f43676ac1
SHA512 2ffc270911df88ac8da7e80ec3ceee010413c8fcff9ba67d7f954583a1161a02356c7900e31cc4dd7edaa5ef34f80d96fc937c2cbe2ba04e7d525ae5acef349b
SSDEEP 384:BvVPGPP9bU9bvW9bbUCy6cutIFD/fc8AthMo5Dd63m9RDTPfSI:B9PUrVyXYIDpAhd6Wa
MD5 SHA1 SHA512 SSDEEP

Submit Download

67195af8-87cd-4929-b6c2-418d03d15cbf.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\67195af8-87cd-4929-b6c2-418d03d15cbf.extra
Size 10KB
SHA256 b2d1810ebf4df6f81ef28431e467fa310cebec82f976688d94a3979d31cf89a2
MD5 575010862d75ab006ddcbf7aaf197634
SHA1 ce97f3c7487ad15aaea0cdf27feb33478a919d19
SHA512 335f1780eca21436783b0f1d3068543292ea09d7aa6b2d8c5757a52e64631456d296909ff2232213ed5b0a3e0a380ea3b60e3d85fb0a163ffea2191813b78afb
SSDEEP 96:S7WCsTVwY6pw6FF29dW640Rh7CsevBb1d0pjMLlIrLlhTLlaXv7awcBvtILI5qwS:ShAcYL/7uvZ8FLjxsPpwlgOfoi4
MD5 SHA1 SHA512 SSDEEP

Submit Download

67195af8-87cd-4929-b6c2-418d03d15cbf.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\67195af8-87cd-4929-b6c2-418d03d15cbf.extra
Size 10KB
SHA256 4202432f3678c8da46287f495fa0a404159d1c4315fb053094728529359436c3
MD5 bba8ceb9e1a032b4e8f6723935de8f6a
SHA1 e784978a3b8ce28db21795eaa5a0eec2fee4acc5
SHA512 44e0fef2a2aa8058c483b0890ec59b60f19d764a574b2417bc28d387b1cd8c2035e7aa297c5cf21f179870d1f9e6c5958ca4718ffd6448e369113d8dcc15833f
SSDEEP 192:ShJcFaiR4MmnQYapdVxzPPWBH64TofKNdalYOfoiIbLkWGN:eJcFaiSI13WBH64T3aZA/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

97cfe805-dfcb-4c09-9b98-a84c2e624a60.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\97cfe805-dfcb-4c09-9b98-a84c2e624a60.dmp
Size 65KB
SHA256 805f8b591e43cf69e6f5dc473367c8d6125dda25381accd3bd65f7566aa3591f
MD5 fea580a3d62c25d26f5a3b30d3ae9cbd
SHA1 ec8187a750fd4e64cb09f5f32c0c06d9b35b0be3
SHA512 a4bdfb5b94e2d2ed6ac12318fdf750f61cdb4226cd107548e915a5660851ffa92df435db52c2624347d24d7b7b681f6624dc5a3a4c14c695090188c3ab554f57
SSDEEP 384:CBkU9s81bubXbFUN6AmCRyu43O0ZDhQ53O+GbTTPfSI:Ots8I0Vyd35ZDuBGbna
MD5 SHA1 SHA512 SSDEEP

Submit Download

97cfe805-dfcb-4c09-9b98-a84c2e624a60.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\97cfe805-dfcb-4c09-9b98-a84c2e624a60.extra
Size 10KB
SHA256 1d39e64f5c8b9a1a9e1178b92f3415780ba28f1aac26feae053b44bb72af9d6e
MD5 a36b29698e6b7e289ce0cfdd379b8679
SHA1 f1d606a2d93daa2849179f186c69e56326af4f68
SHA512 3317a48ac466e56890c9c073cfc795c71061f6d8bc58c6a0475c8035301f04bf5c21e046b222d2f6ad8dda86497b8a55cbe8e347c56c432382c0aef3a420bc17
SSDEEP 192:ShdlpcFaiR4MmnQYapdVxzPPWBH14TofKNdalCxfoYbLkWGN:ed/cFaiSI13WBH14T3awAYy
MD5 SHA1 SHA512 SSDEEP

Submit Download

97cfe805-dfcb-4c09-9b98-a84c2e624a60.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\97cfe805-dfcb-4c09-9b98-a84c2e624a60.extra
Size 10KB
SHA256 73a4189839cf7f571ff78a6fe81e2dc9da65eaf8aa04778e7bff9909fd38c514
MD5 703f26b7f738e31f4d94709b85b11407
SHA1 9c03fef4aecab467c27c59fce123cc06a9b77215
SHA512 0df56ff97833d65e9b8a0f6b51d0502cef7ef5910dd23c295613f66658f8ad7f62ee3e2474b44b2b4c27234292e0f0c1238bb664f3abeb7a07d9b6c2364aa258
SSDEEP 96:S7WCdlMTVwY6pw6FF29dW640Rh7CsevBb1d0pjMLlIrLlhTLlaXv7abcBvtILI5I:ShdlgcYL/7uvZ8FLIxsPpwlaxfoo
MD5 SHA1 SHA512 SSDEEP

Submit Download

a3fc9eda-f015-4a53-a80f-a40daeb7d4f1.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\a3fc9eda-f015-4a53-a80f-a40daeb7d4f1.dmp
Size 65KB
SHA256 a3ba6db9fc64901efebc5c322164efb424abf4492e53a0f32af5c8b5591ab1e5
MD5 e283dc6be59ab3437e00e200449e1385
SHA1 1a801d92616390b88870ac56fe916850c3d7f0cd
SHA512 ab4417e937b1d725ad8d3630f501cba4c96df49a85725ea3fb9541dd2a9245b86298902bdb58e31a6e92121419505debde0d7538c6bcef9c525cc43f61d836b0
SSDEEP 384:+wr/59syX1btV/zbYbwUx25FW6hcFmVgVWCF7vDEUS3a8u374w4worB3rTPfSI:+SHsQLE6zSEaDB741worNa
MD5 SHA1 SHA512 SSDEEP

Submit Download

a3fc9eda-f015-4a53-a80f-a40daeb7d4f1.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\a3fc9eda-f015-4a53-a80f-a40daeb7d4f1.extra
Size 10KB
SHA256 d32d3e527b92966f92421ba2f117ee5b56cb44b599a618babe5416af05ca019d
MD5 def4d2e47c6cdeeed85e9d9d6f4ec903
SHA1 58207db8e757544a497c0160df66531b674a2514
SHA512 98f49185f92fc378da3f758a9523afac4c76e821a0fcc67a816e956e3405d105baff33590cb1b5fa08a478774c4bc581eb340fafca74760ac9e6a6db46122e7b
SSDEEP 96:S7WCsTVwY6pw6FF29dW640Rh7CsevBb1d0pjMLlIrLlhTLlaXv7a9cBvtILI5qwM:ShAcYL/7uvZ8FL+xsPpwl22fof
MD5 SHA1 SHA512 SSDEEP

Submit Download

a3fc9eda-f015-4a53-a80f-a40daeb7d4f1.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\a3fc9eda-f015-4a53-a80f-a40daeb7d4f1.extra
Size 10KB
SHA256 5a8fe5a01021a27af65fc75b0dce7509c5daf90737e69f3f1222184c98929538
MD5 fb5e54a379a5a60fbeea0a95e72c799b
SHA1 26b297148bb797e6fdcc47186903ea684a044241
SHA512 410ee514ca068fdabec9be4cae7ed7d81740842a2b31ea748510f16a77ffccd07ea4079bf7984786c871db091a4094358f5fbcc9a6de17a36c8c2efc5cc6409e
SSDEEP 192:ShJcFaiR4MmnQYapdVxzPPWBHj4TofKNdalO2foTbLkWGN:eJcFaiSI13WBHj4T3anATy
MD5 SHA1 SHA512 SSDEEP

Submit Download

f5c40094-fa4b-45a2-9ec1-4a086cf93db3.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\f5c40094-fa4b-45a2-9ec1-4a086cf93db3.dmp
Size 65KB
SHA256 61085ae0ba8e72f7adeed5ccad1807408cfe5cf659b963fded86053d5d3457de
MD5 6d41ed514a80d7d11e520c3d76c91db6
SHA1 7b8255b4776451841624ac315d0457041831285f
SHA512 db84cb5f7b38b7da8a15bbe90f23057d9d3f56de5be87aa869c6686b581c267554237cb18377e4bc2053e254e27cb3894a53af9687a72dde9bffd40154647a43
SSDEEP 384:FHb9sEF++Ucqae1EzkzwlkU8Xuv/D8E2aNMQa6qTPfSI:FJsH+VozKkUusDJ2aqLa
MD5 SHA1 SHA512 SSDEEP

Submit Download

f5c40094-fa4b-45a2-9ec1-4a086cf93db3.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\f5c40094-fa4b-45a2-9ec1-4a086cf93db3.extra
Size 1KB
SHA256 83269e7c6e65e934ab3c2d37bebc51cbee848b744a5582ef7c96bb0a8997d0c8
MD5 c64aeea581db010b38761aa2e1fb14b1
SHA1 8dd3623c8b8aa2ac38cade4312ffc07bfc447377
SHA512 5c07ba45d1f678456c55b9950e7886cdd80eabb56c27033972cf837579d189508708d952a747ded81b0c5aa7332954f766e0b4ee6a42926684655c1ebf0141cd
MD5 SHA1 SHA512

Submit Download

f5c40094-fa4b-45a2-9ec1-4a086cf93db3.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\f5c40094-fa4b-45a2-9ec1-4a086cf93db3.extra
Size 3KB
SHA256 6820b0ccdbd775a91911f335ea1ba7270c5dc89bb1a33ed8a6dcc851a96724a7
MD5 57fa521298bf564f6072cfbee7c42466
SHA1 92425a9256a2787583cbb8924336d04ed95686c9
SHA512 0a254295dc167b6979172b255d20995fd420eb1e5d1d011ac8f11de489b60a88a52978fdd933c4e6d92a0dfc86264794e8f07e94033316c9edaf08843be95aa8
MD5 SHA1 SHA512

Submit Download

fa9dc9ee-4c3b-41ae-8283-0e1ebb786d3d.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\fa9dc9ee-4c3b-41ae-8283-0e1ebb786d3d.dmp
Size 60KB
SHA256 fff4074a6f39e357b7e35c334bc7d6bd287ee6fbaf3080a41393b3edda0d6911
MD5 cf73508712c3d8a6a674174263fb640e
SHA1 59af870bb743b8f2e0dfd3f41bc185c8fbc58ce8
SHA512 f3ccb1d190061c705aab79e572724d0a50996a4c77052ea7ea8041abf5cbc586e5e40559e2533cb9655357b8843743732e136b35adce20136e2f57ca48e8e827
SSDEEP 384:c3FsP3pdZbzZb3ZbmUuB3rFyq6xI3PcCN3F31EFH0jaTPfSI:c1sP3pORhh6ULNVFEFHja
MD5 SHA1 SHA512 SSDEEP

Submit Download

fa9dc9ee-4c3b-41ae-8283-0e1ebb786d3d.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\fa9dc9ee-4c3b-41ae-8283-0e1ebb786d3d.extra
Size 10KB
SHA256 c8dcc4ea734b7c780ab3b11f34067b8ed3db1c1e0c7e74a33f963d757f02652d
MD5 7cb02f0ea821d51b3e277e0c09767f5d
SHA1 1de9ab8f3da1df4eb0841601c1c0d819a30108c5
SHA512 ec0d97d2cf5067d3e237d9d6633b7e9d5d5f8426e5a15c37d256f5a354624d4aeaf2e812458365dd4293e239563c6c42c8ae97c7a7bfb415f67b82cba3cbfc04
SSDEEP 96:S7WCXTVwY6pw6FF29dW640Rh7CTvBb1d0pjMLlIrLlhTLlaXv7adcBvtILI5qwvv:ShjcYL/7WvZ8FLexsPpwlzNfoc
MD5 SHA1 SHA512 SSDEEP

Submit Download

fa9dc9ee-4c3b-41ae-8283-0e1ebb786d3d.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\fa9dc9ee-4c3b-41ae-8283-0e1ebb786d3d.extra
Size 10KB
SHA256 3f8bcc839fefbc9db9c66a278c3d1349d9da49ca6a2a0f24d129f71bc77aa2cb
MD5 e395eb555e888407b6badbd42a8c5d17
SHA1 b76748ff3b4444c4b4985c60fd7224ebdd8c44c7
SHA512 556592e08a7fae5aea9e3835ca407e845e5c7f9b84a738f649ecdc523bcf4f68da88b796d248fba0f17218ccc7a8f074ed92fbbfb7f71897bba59e98180b7ce7
SSDEEP 192:ShocFaiR4MmnQYaVdVxzPPWBH74TofKNdal7NfoUbLkWGN:eocFaiSW13WBH74T3afAUy
MD5 SHA1 SHA512 SSDEEP

Submit Download

compatibility.ini

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3wiiokog.default-release\compatibility.ini
Size 198B
SHA256 252b7fff962848c61092e82a3d87adca163849767713a93ab533bb397f1f53bb
MD5 ce9ef13caa8a74c25157b184aa038475
SHA1 db03a9935d8bb3ce6b120aca98feade536805160
SHA512 0f6f5053e78167ef5cc5fa70ed3a87dd116df0671a590299277a197341bed983e3d77e37ad2c33cd4afe880fab9ed1c7f7502210040617a01f97a81c1e1d4f29
MD5 SHA1 SHA512

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3wiiokog.default-release\datareporting\glean\db\data.safe.tmp
Size 28KB
SHA256 17aacd04f327b15ab9564599a38e701d9b060d1d295767b44cec263df45cfc43
MD5 fff45b2ad0a91207df66ca1ddab24e64
SHA1 25b0df984dc8c99e8dacf12440ad040eac2b6ec1
SHA512 2970500b2eda76e1e79c1c9ba0979063b9b02be70e969fd1461bc38db277078ec9ca91c6c38d1e22f15d8a8b14aabfc8dfe831a7753b88f23156f8f12ebada77
SSDEEP 384:T8ZCkFp7g/GGcmhumc1PKDjRkpbnbh3g7B8bosbChyjPD/66JozGzgC1bd:T8ZhsGGcmhuHhKDjRkpbnbNg7B0GEeEv
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3wiiokog.default-release\datareporting\glean\db\data.safe.tmp
Size 28KB
SHA256 122ceb6af3c2d93a0b7943e8378fc573cd67ae1cb427f0fea92e86f243a04861
MD5 c173ab63f56702edaf14321d230f62d8
SHA1 0bb056b5cffc5962bc058b092aa2c684d722a5fa
SHA512 75bf8cb1f08561db39869224b6bdd8554d5632cf8dcafefd42e02b65604c61677b0a9b15c18e43bd8c768c2c4832511f7bc78885bc884583294c5c05d9dcf660
SSDEEP 384:abosbChyjK8ZCkFp7g/GGcmhumc1PKDjRkpbnbh3g7BmV/66JozGzgC1bd:OGz8ZhsGGcmhuHhKDjRkpbnbNg7BmIEv
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3wiiokog.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 4b63a6e6f278e7f3eb53f08184f6b11b4f20f1987bd4c915527d868bb55be9b0
MD5 c6b3c19e543f3ccfa2906abe0ed6c314
SHA1 111e952fe5f8463b023c86f9a71e48095568d853
SHA512 5972d132cdab71077488a9bb3e14535f3204de4e896df07f64e1f6fef02644c33c736f35aa379b1a9354440db6d0e650056edfca7d38cbc9881ad9e489ba44ad
SSDEEP 192:UBL1/66JozGzgCl6mSSdxOv5zboPFZChyjYA4:UBJ/66JozGzgC1bYbo9ZChyja
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3wiiokog.default-release\datareporting\glean\db\data.safe.tmp
Size 28KB
SHA256 6c6195aba496126413abc6c1675908d8b7977eb6dc5c04ed44ec54922ea6716f
MD5 751d2417e381a0ad7c844a3ed08fc4e9
SHA1 439c171e726a701d3c0c934c1c916a20e931f5bf
SHA512 493f2f16deeacf88afc9f4680edc361d1022f402706e5d6f6d6de83c20b35c550f4da6211a34fb81be1544089cd2abf916ab9cd9b2cfd717d07644e874ca539b
SSDEEP 384:gboRZChyjK8ZCkFp7g/GGcmhumc1PKDjRkpbnbh3g7BmV/66JozGzgC1bd:IDz8ZhsGGcmhuHhKDjRkpbnbNg7BmIEv
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3wiiokog.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 47cfa7de6158299004198c1b31e87e00e5c9d246cabe06015d0a6655b207662d
MD5 e56a3194f35c45c0b72c9cb6e0c2dc33
SHA1 96d318ef9ad0893769dd649ed9b30bbbc5ff9d07
SHA512 22ff011fa6ed66423b4d5d9056be2248e8a005700136a766981b6368e054cd7522883ab571bfb2fa952e356865f91d1e2a603f10114f1f25d1b1c156e0f15bac
SSDEEP 192:FOv5zbowbChyjYAmc1/66JozGzgCl6mSSdz:abowbChyj8G/66JozGzgC1bd
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3wiiokog.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 d99b8808964842e5a4a3a018a9fd93189e725148fe0f6ba5352066cca244148c
MD5 4377235e6bed3e4e7d186f73370b0859
SHA1 f5ba8ecd7d1e676b28767ece3b0faf2c3ffc1de8
SHA512 30aa266c0eda14640406d2da6ff0855ee12e3456112efa8a0fea36810b6691f0dcd15793c86c734b81c78670c9be1eea288fb0d1bbf24c8e993129d0be03e5c0
SSDEEP 192:WOv5zboPFbChyjYAmBL1/66JozGzgCl6mSSd:tbo9bChyj8BJ/66JozGzgC1b
MD5 SHA1 SHA512 SSDEEP

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3wiiokog.default-release\datareporting\glean\events\events
Size 1KB
SHA256 3fccb5ff132427e5959dc70b0867c29bf30b8a543beb0a178b0b614b80e2779f
MD5 c055f7b57dd0b8ba29e5bc633ea09dac
SHA1 08fc5337f86ea35359cd4bf33bd80e7da078292e
SHA512 89e19c3a4ae3769e45a9c195aba0eaab75e36d06d5d1d7d55aebaf59f8fd152dc15151464e6e3f71fdc33363b95e73eff315512c891032e7760f1523b3836b78
MD5 SHA1 SHA512

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3wiiokog.default-release\datareporting\glean\events\events
Size 1KB
SHA256 e034c43a92e8648d2067db3317320ff789dc1522b107d1996a7d8446a33dee3f
MD5 f73c45a101b862389335917b5670e1ac
SHA1 3a262df28ffa6b3b749db4beabfd10bc6c9714cd
SHA512 d8b9fb4ee62ac146feb7b74ac525c8927ddfcacae46ed8ea9d3f34099f7ac5b02af5f17fd38fa8f7ea8c4b5960a73ef1a35944d3bf0927971c2445281aa51408
MD5 SHA1 SHA512

Submit Download

00966348-21b8-40f3-9f6d-fe14c89c5c58

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3wiiokog.default-release\datareporting\glean\pending_pings\00966348-21b8-40f3-9f6d-fe14c89c5c58
Size 3KB
SHA256 211e96c84d0e3de7b4f88eb8433ccb10d86977e88266f1e060ced235bb47004c
MD5 377d102058657fb92274107c59a4c3f3
SHA1 d0f52c4f2327012dc9f95dd2e02b4bf75be7c4e8
SHA512 032c996cf12eb2a32e6fe96bb3a905b59f159b06150f5772ed200620228d4ae06fd0d5817fa313124d81f7ecff58cbd696330a886c06be9756b5b40ff3d61546
MD5 SHA1 SHA512

Submit Download

08757198-8068-407d-8b67-4d950d12b8c1

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3wiiokog.default-release\datareporting\glean\pending_pings\08757198-8068-407d-8b67-4d950d12b8c1
Size 896B
SHA256 28a19bb2174fb1b4bad4c3f6e84b626dacb216907c1b6815b2f54714c5486231
MD5 f1ca0c9c5ac4ca698ff6a62f9c964119
SHA1 a99cbc6343d473c46342e282d09ae252578a159d
SHA512 ca7d554e8710c5faecaf89a621c707aedcdf8fae71ea3c4b104a077539ca86623e17df05218489401621a7ee8b2caf9adc2c7bfbd7fc35b80e6cbf4f4fe53a1a
MD5 SHA1 SHA512

Submit Download

0b1dff68-0c1c-4888-9c84-c5a9c5eae85e

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3wiiokog.default-release\datareporting\glean\pending_pings\0b1dff68-0c1c-4888-9c84-c5a9c5eae85e
Size 914B
SHA256 7ca515e45d51570907dc0cdd2f056501e0835ef39c0d48841ee26a06b0e46a7a
MD5 563a4af677675b9144c8a630a7b06223
SHA1 1389bf97ff9c9f1d5ebf38befb47872410290dea
SHA512 24d9fca635e039bf0cb7089929746713795c7eb5008691a256eb5dd5dcc27b31cf6eba22e105a82defe50c183fba3ea740e65c598e092d623b43346b9ed896b7
MD5 SHA1 SHA512

Submit Download

15f2e4ee-c4d7-4937-b769-a679f0861a61

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3wiiokog.default-release\datareporting\glean\pending_pings\15f2e4ee-c4d7-4937-b769-a679f0861a61
Size 883B
SHA256 f8f5ccd896e9815de4bbd1ff6196d3a2f08880e839703f94c099870b4c6fe85c
MD5 3f2384b262cff4eaf2ccb6961bf8c43c
SHA1 e2d47df82856d2b10f03be960abe85021b9e271c
SHA512 68a49eaaafef5bebe67da86b2eec15e7eab8c3dc1348376c6504368efd7da0fc7687ca286c390f4e16175a96a5d5f8e442ef3e0027daef1678b62f0f83a8a774
MD5 SHA1 SHA512

Submit Download

1c03e8f5-7a55-4700-8c91-37d2184348ea

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3wiiokog.default-release\datareporting\glean\pending_pings\1c03e8f5-7a55-4700-8c91-37d2184348ea
Size 3KB
SHA256 b61658616788dda2925fb79ed95bd4f77ca791214ea7b51481ef4bafc69fc01d
MD5 148590909ef0402b980f60d50bca9ca2
SHA1 6778df4bfeda5ad1d230c1e620a1c4973b7b6560
SHA512 17d4a24c83053418a88bb4ac831fc8d2fee8db191eeb6051f016e1cf0c23ec4c300eb7b63e3d4f1059ef6e4897718424534c1871194c37722d882c5ebd18af6d
MD5 SHA1 SHA512

Submit Download

1d47d72b-2bb8-4b68-a72d-a892161c7849

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3wiiokog.default-release\datareporting\glean\pending_pings\1d47d72b-2bb8-4b68-a72d-a892161c7849
Size 3KB
SHA256 58766a47dc8837b566c735c7d8d505e7751ee8d85b42c5bbf265dc9b298923c9
MD5 e4835cb4ef5bfb5362927a653eca2698
SHA1 9fbbe4e3b1c8697dbe562ba554573abbca45f961
SHA512 74fa19023e4275d933ed6a617a0174ca428284cafdda0664b616db8b1e61d7cde6d0a1ceff9d637a6f0e1d10fa5690d0309f256575ec52396e0d51d2eb4180ae
MD5 SHA1 SHA512

Submit Download

231c2d72-55c1-45d8-8ddd-750eff96f83e

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3wiiokog.default-release\datareporting\glean\pending_pings\231c2d72-55c1-45d8-8ddd-750eff96f83e
Size 3KB
SHA256 db652cfffa972ca6ceae46e62f52b33d8e6f44e5c35cfa8b697afbac1600ec5e
MD5 f64b10cdab9f2ee124944848e4e87915
SHA1 5054912dd2a43f300be1c7114fc90d5c1f43886b
SHA512 1cfbe449bc38991bdbb43fd83d7e5baca08e7f2941faab4d03b2de9981c4d9f38cdeaf12154a41d8af95a58bc4c6942ffbc8b188b6607d7daf9e03d159a15a6d
MD5 SHA1 SHA512

Submit Download

23875810-cfb3-486a-9508-0638f5dee763

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3wiiokog.default-release\datareporting\glean\pending_pings\23875810-cfb3-486a-9508-0638f5dee763
Size 896B
SHA256 fac9aec8658054caa9d971827aa342350bf3f05d64981f2febf52cc3505a6113
MD5 b2502e24762a7729176475d1a557be6f
SHA1 a69671f511eab2b547a4e4c1fc1e0977e35cbca0
SHA512 13e2c5f48f02d49c392111fb620e48037d5b4d9dca85936cac820d67ab5fee9668e6a5133904c2654256e90e8e21e50b00be7f9e691dee1fc36224b31b6ca0c8
MD5 SHA1 SHA512

Submit Download

2815a6bc-07a9-4a89-aa2b-7b27e9f42827

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3wiiokog.default-release\datareporting\glean\pending_pings\2815a6bc-07a9-4a89-aa2b-7b27e9f42827
Size 2KB
SHA256 a77a562be17e433e0a85459234594c28d7cf6e085bc81ef990224f70e5a835b4
MD5 31c51c517d2eaa5ae611a51f6d394985
SHA1 a8679bfec33fcd029185e384e80ba5acb352067b
SHA512 07885d2144774cd9561a854d20b7b28e77ee49458013aed205ab35f08a62e56fb1ad584cecf6929f38bb10ec1699c8684874e036b178c136da464196afca6031
MD5 SHA1 SHA512

Submit Download

408e8c89-17b1-4c7d-9ad3-c419aa36e171

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3wiiokog.default-release\datareporting\glean\pending_pings\408e8c89-17b1-4c7d-9ad3-c419aa36e171
Size 3KB
SHA256 78def31802d769f146d600c0f231efb5ce8ae6788cc5e21b0897878747e77bfe
MD5 438583fb54227962f6f61dd89d82ea7a
SHA1 1f251f69f292b46223e43bcd02769d05414d6911
SHA512 7ae0d00b8bd5267934a6cb2d54ffc68cdcefa46da8daa17d7753f5ad5286ad8670b13d1da85ddb69f2bead5ed67ca9ff00e66c996cbd997bbe105a469bd09ae8
MD5 SHA1 SHA512

Submit Download

485f9518-6a13-475f-a529-a83beb118acd

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3wiiokog.default-release\datareporting\glean\pending_pings\485f9518-6a13-475f-a529-a83beb118acd
Size 235B
SHA256 2535a25ade616b2179a57ce3f675f3f673f9900410d6181b6b7af09b55f0af15
MD5 16eb9ac25eaed2cc91f4ae4565f7a47f
SHA1 26cb4705a71d38dec30fbfff706f48e70017da94
SHA512 c18a939f27d3c54d5263c110b50574e13f47425467455d99243b7b187900b939eaaabc160c7809adaa04680473aa297aae60b8961ab1806c7a50f518dd2e9149
MD5 SHA1 SHA512

Submit Download

4e915998-214f-4c02-8a3a-5a9a2794085d

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3wiiokog.default-release\datareporting\glean\pending_pings\4e915998-214f-4c02-8a3a-5a9a2794085d
Size 3KB
SHA256 1bcd11ec9b4b552e626d9d575b00088a1ed46d6b14cb06e67e8bce67bb6f6107
MD5 e292160b3a9bf36d8a399bf1b8399522
SHA1 e1596c7e78e7c438174e3537a6e1517b175c19b5
SHA512 983b759ded16704a89aae2cea0411c1472de3a81ea02a05b8ac48c0d4022a37f88e4c727b2bd755323d7009f38dc8b9089a734adc5445df49b548303ec7c8eb2
MD5 SHA1 SHA512

Submit Download

6530e33f-56f1-4e17-b494-90404995bc90

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3wiiokog.default-release\datareporting\glean\pending_pings\6530e33f-56f1-4e17-b494-90404995bc90
Size 235B
SHA256 17b9350023062c71ab62d61cf3ddc0ab33b6c8ecf7fb86bb69470ad69e5df711
MD5 65f55568f26339ecf282ba4f6ba45100
SHA1 4b08305d4920264d421b988e23f019f13a0ef136
SHA512 4e194b51e441e7475866ee0d6b9b86981cd9f2a398746a8054ea1e30a1a75ab36dab54d7e3a8380d73aaed0f7813e93afccc0096eef302d60fab2243236bfc05
MD5 SHA1 SHA512

Submit Download

6e995f5c-6e50-40e7-a6fc-8cde6603ceb2

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3wiiokog.default-release\datareporting\glean\pending_pings\6e995f5c-6e50-40e7-a6fc-8cde6603ceb2
Size 16KB
SHA256 8227545c74e040c74af1f94d6ecd1f5bc8c8e77863b287810b9b12245fb9e57b
MD5 f008826ffe106b8361ba6812be720cce
SHA1 e2eb188933c948932f2bf26f802e32ccb43d2565
SHA512 f61c76598b5be813d81d0511dadaf6bc1fe471c9a02849af5a021bb2ea5920e4e3337d816133600227a2463dabde173b7f6ce8ae92ff7838d5cabd3b57c9754a
SSDEEP 192:Ur1zy842bd+242TEw6B+1keZpAbj22V6OGDo3ip1czi96IcLTqD173XcaGDR7m2f:2ndq2TEzapya2VPGs3ip1co6I6vIsX
MD5 SHA1 SHA512 SSDEEP

Submit Download

74bbf23d-491f-42a3-80d0-dcea3d8852ef

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3wiiokog.default-release\datareporting\glean\pending_pings\74bbf23d-491f-42a3-80d0-dcea3d8852ef
Size 3KB
SHA256 025c0d7992977dc2ac079fae9251da51a262581263ee2782a256c17b8baad037
MD5 e733ea1cf66b28894ee99dd9e1c247fe
SHA1 9cec97dbd0e94735d8e2100f68f4592ee87c4395
SHA512 2a8cf6a73c0b0a479ede252c489c969dc2f9fa1aa60cb79dcab5bb6f8a2956e5274353a65571da146ccd9d23deb91b1b50801c6afcce6d3c24284399d6318e78
MD5 SHA1 SHA512

Submit Download

ab4d435f-8c01-4637-8444-e4be1c9e2070

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3wiiokog.default-release\datareporting\glean\pending_pings\ab4d435f-8c01-4637-8444-e4be1c9e2070
Size 3KB
SHA256 ff3489a92a1aa96c908bc6c951b18419abd048caa837609fc99418ab2559b5ee
MD5 447b4a4bf113ca1df79836ed9ba8e80a
SHA1 82ca0cae98298a9acf5b87a10c9934454dc6b155
SHA512 f1f282c3dc61e15e3020f4760a6f3e85b3013f02bab80739c9634178d887830c0de6616f8678546861bcd965677aa48b58058cd3f6d818f4d614ebf8572b9211
MD5 SHA1 SHA512

Submit Download

b70c392d-40a2-43b2-9c49-3a5054044959

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3wiiokog.default-release\datareporting\glean\pending_pings\b70c392d-40a2-43b2-9c49-3a5054044959
Size 235B
SHA256 c3ab10dc7b8535033a2669c447e3bfbe1facb55a978f632135ba522a867b25e1
MD5 57cb0efc75693a2d6418de09a54c5afa
SHA1 db65b217dcb8ca02f208904d4aedad51debf7be0
SHA512 da824977adbcb5ea23d58cbf9215d6ad5696e1ea80ff16d99408fb261d73b6451fb491c28ac3c45c8a07532758beb446c0f1ea2f298da59e45e894afcfcb3906
MD5 SHA1 SHA512

Submit Download

c1311b79-4f8a-41c8-bcc6-667a5cb3e1bb

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3wiiokog.default-release\datareporting\glean\pending_pings\c1311b79-4f8a-41c8-bcc6-667a5cb3e1bb
Size 2KB
SHA256 940fbc69628cfeb97352ad2999cfa5debf2f73878d6893a36a50d70eb09d62f1
MD5 a1674211d0e7b266cb9596f9d2e06c00
SHA1 31e623546932ef7b043da21194edd81c08c9e807
SHA512 65e62f7429e782da3923c98591efc0919dd202266f711fae7171326dfe9fe5b7b5c32735289569af171b1b81866e13536c1fd773d9b16e1c0b2da551113800cf
MD5 SHA1 SHA512

Submit Download

c4d41536-ae38-4fd2-b0b4-26dbb1afc39d

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3wiiokog.default-release\datareporting\glean\pending_pings\c4d41536-ae38-4fd2-b0b4-26dbb1afc39d
Size 3KB
SHA256 295b3d549b2e78adc9c9cc81cc6086a3364b18e0dec628906c83a5b986cb2eab
MD5 8cdf9e8154fce9821338e3a5051928e6
SHA1 42f5d39eee1d62150ee56d7ede2c06594cc2bcec
SHA512 151f6a08ccc32eb1bce7627257e3eda8e142db29b7d65c2e73a551dea14871568cd20496605b9f57897f0f4391a2aacabcf9b1fa113107c7ace6e3292103543d
MD5 SHA1 SHA512

Submit Download

c7f0e83d-4310-4e70-9164-d1f9571a6ee4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3wiiokog.default-release\datareporting\glean\pending_pings\c7f0e83d-4310-4e70-9164-d1f9571a6ee4
Size 3KB
SHA256 01043192b313d9b5768cd544b0091a3fbece21220abccf4e33912c2c125f742f
MD5 890ba09dff669a44a5b9dd4092cb33f1
SHA1 d3a6a0d5935bc32a5db41af8ea9239408cd9fc34
SHA512 39d23cabc9203fa6472ed01feb89483ef0e78c84ca811aa76cc8c54d25e742b90c252ba3f0cfb679815ac24d5bfde97c77c0d604f4d4bdeac02a2706b4e52c8d
MD5 SHA1 SHA512

Submit Download

ce813313-ca19-4e36-9be1-f8c7de555536

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3wiiokog.default-release\datareporting\glean\pending_pings\ce813313-ca19-4e36-9be1-f8c7de555536
Size 235B
SHA256 08f4ad3b7ed481d7d273690efafb017a23be4ba7d55eaa5d75400755875ae38e
MD5 d281a4c19b4350da9a966420d3e47c79
SHA1 030de5a78c7a40940c05977a5194459761afdb72
SHA512 cfacbee3a38ae3060ac0f63762f883e4fb831300779b065f5d7c25584d86df635329562058e41571a9aa1d3874c54a73128056bb354dd686459bf947ac505ade
MD5 SHA1 SHA512

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3wiiokog.default-release\prefs-1.js
Size 6KB
SHA256 8a0b8579b98abbce3c98f7ffc6f07058c333f7f35f85424dfd00c19b63cb0442
MD5 e25ca753873169945035e47662ab637a
SHA1 a3032b1e79f9481a68aa2e53754dfc46a362eaff
SHA512 12de9f862a3badbe3ce7f3b0225af39d82239f8186c02040a0090b4b95a68fc753e44a759dd1823a52d595cdcccec16080ada41ce5ebffdddec1561a2375b2b3
SSDEEP 96:xH/UTULqGqEqfdKGn/1zSvsSSlDsdv9janbHFnPyBw88n8L4cnrV10R:ZWREqfdZ/QsSStJlKBw886w
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3wiiokog.default-release\prefs-1.js
Size 6KB
SHA256 be39c24fb6bd3d89d39f1b5155ea1a2adb8251381b88ac05a2edb22616e5a8b9
MD5 b249e8abd9bacd329ed5cab3b9404f2d
SHA1 a7ded049b4c664e16e9ca58b44a620ee065c44c5
SHA512 63f9477d7a4b4586526c1cc590da9c0ab0a0ea330c11609bac9170861a27102ad4d24b416e9503a14f3d9a4c93ea763617c708322c7623e50fcfd64d21b53267
SSDEEP 96:xH/UTULqGqEqfdKGn/1zSm+SSlDsdv9janbHFnPyBw88n8L4cnrVDR:ZWREqfdZ/9+SStJlKBw886b
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3wiiokog.default-release\prefs.js
Size 6KB
SHA256 e04ce7e1ab211810195ecc19a71c65a5c96b43717a99e657baa0ccba1dada7f5
MD5 abf050027eb5378a5cb344a579977e26
SHA1 f5785465037e1395da98f516434d7acc4ab41e7d
SHA512 6efa80d853aa6bbb64229659d8557c6f6888ac60b8af1463c412d16c94ab994a1b8befcc0d73f00d1c17bbbec06dd7ee234e480dc134b43a751ef70df654ff42
SSDEEP 96:xH/UTULqGqEqfdKen01zSuqDSSlDsdv9jJnbHFnPyBw88n8L4cnrVDR:ZWREqfd10nqDSSt2lKBw886b
MD5 SHA1 SHA512 SSDEEP

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3wiiokog.default-release\sessionCheckpoints.json
Size 90B
SHA256 00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2
MD5 c4ab2ee59ca41b6d6a6ea911f35bdc00
SHA1 5942cd6505fc8a9daba403b082067e1cdefdfbc4
SHA512 71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2
MD5 SHA1 SHA512

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3wiiokog.default-release\sessionCheckpoints.json
Size 53B
SHA256 792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da
MD5 ea8b62857dfdbd3d0be7d7e4a954ec9a
SHA1 b43bc4b3ea206a02ef8f63d5bfad0c96bf2a3b2a
SHA512 076ee83534f42563046d25086166f82e1a3ec61840c113aec67abe2d8195daa247d827d0c54e7e8f8a1bbf2d082a3763577587e84342ec160ff97905243e6d19
MD5 SHA1 SHA512

Submit Download

memory/2548-73-0x0000027066B60000-0x0000027066B6C000-memory.dmp

Download

memory/4152-256-0x0000000000B10000-0x0000000000C10000-memory.dmp

Download

memory/4152-311-0x0000000000B10000-0x0000000000C10000-memory.dmp

Download

memory/4152-312-0x0000000000B10000-0x0000000000C10000-memory.dmp

Download

memory/4152-314-0x0000000000B10000-0x0000000000C10000-memory.dmp

Download

memory/4152-319-0x0000000000B10000-0x0000000000C10000-memory.dmp

Download

memory/4152-320-0x0000000000B10000-0x0000000000C10000-memory.dmp

Download

memory/4152-326-0x0000000000B10000-0x0000000000C10000-memory.dmp

Download

memory/4152-327-0x0000000000B10000-0x0000000000C10000-memory.dmp

Download

memory/4152-334-0x0000000000B10000-0x0000000000C10000-memory.dmp

Download

memory/4152-329-0x0000000000B10000-0x0000000000C10000-memory.dmp

Download

memory/4152-330-0x0000000000B10000-0x0000000000C10000-memory.dmp

Download

memory/4152-328-0x0000000000B10000-0x0000000000C10000-memory.dmp

Download

memory/4152-321-0x0000000000B10000-0x0000000000C10000-memory.dmp

Download

memory/4152-322-0x0000000000B10000-0x0000000000C10000-memory.dmp

Download

memory/4152-315-0x0000000000B10000-0x0000000000C10000-memory.dmp

Download

memory/4152-313-0x0000000000B10000-0x0000000000C10000-memory.dmp

Download

memory/4152-118-0x0000000000B10000-0x0000000000C10000-memory.dmp

Download

memory/4152-119-0x0000000000B10000-0x0000000000C10000-memory.dmp

Download

memory/4152-125-0x0000000000B10000-0x0000000000C10000-memory.dmp

Download

memory/4152-123-0x0000000000B10000-0x0000000000C10000-memory.dmp

Download

memory/4152-124-0x0000000000B10000-0x0000000000C10000-memory.dmp

Download

memory/4152-147-0x0000000000B10000-0x0000000000C10000-memory.dmp

Download

memory/4152-130-0x0000000000B10000-0x0000000000C10000-memory.dmp

Download

memory/4152-214-0x0000000000B10000-0x0000000000C10000-memory.dmp

Download

memory/4152-215-0x0000000000B10000-0x0000000000C10000-memory.dmp

Download

memory/4152-216-0x0000000000B10000-0x0000000000C10000-memory.dmp

Download

memory/4152-217-0x0000000000B10000-0x0000000000C10000-memory.dmp

Download

memory/4152-222-0x0000000000B10000-0x0000000000C10000-memory.dmp

Download

memory/4152-223-0x0000000000B10000-0x0000000000C10000-memory.dmp

Download

memory/4152-224-0x0000000000B10000-0x0000000000C10000-memory.dmp

Download

memory/4152-225-0x0000000000B10000-0x0000000000C10000-memory.dmp

Download

memory/4152-226-0x0000000000B10000-0x0000000000C10000-memory.dmp

Download

memory/4152-231-0x0000000000B10000-0x0000000000C10000-memory.dmp

Download

memory/4152-232-0x0000000000B10000-0x0000000000C10000-memory.dmp

Download

memory/4152-233-0x0000000000B10000-0x0000000000C10000-memory.dmp

Download

memory/4152-234-0x0000000000B10000-0x0000000000C10000-memory.dmp

Download

memory/4152-235-0x0000000000B10000-0x0000000000C10000-memory.dmp

Download

memory/4152-236-0x0000000000B10000-0x0000000000C10000-memory.dmp

Download

memory/4152-240-0x0000000000B10000-0x0000000000C10000-memory.dmp

Download

memory/4152-300-0x0000000000B10000-0x0000000000C10000-memory.dmp

Download

memory/4152-301-0x0000000000B10000-0x0000000000C10000-memory.dmp

Download

memory/4152-302-0x0000000000B10000-0x0000000000C10000-memory.dmp

Download

memory/4152-305-0x0000000000B10000-0x0000000000C10000-memory.dmp

Download

memory/4152-306-0x0000000000B10000-0x0000000000C10000-memory.dmp

Download

memory/4152-307-0x0000000000B10000-0x0000000000C10000-memory.dmp

Download

memory/4152-241-0x0000000000B10000-0x0000000000C10000-memory.dmp

Download

memory/4152-242-0x0000000000B10000-0x0000000000C10000-memory.dmp

Download

memory/4152-243-0x0000000000B10000-0x0000000000C10000-memory.dmp

Download

memory/4152-244-0x0000000000B10000-0x0000000000C10000-memory.dmp

Download

memory/4152-249-0x0000000000B10000-0x0000000000C10000-memory.dmp

Download

memory/4152-251-0x0000000000B10000-0x0000000000C10000-memory.dmp

Download

memory/4152-252-0x0000000000B10000-0x0000000000C10000-memory.dmp

Download

memory/4152-0-0x0000000000700000-0x00000000007BE000-memory.dmp

Download

memory/4152-257-0x0000000000B10000-0x0000000000C10000-memory.dmp

Download

memory/4152-258-0x0000000000B10000-0x0000000000C10000-memory.dmp

Download

memory/4152-259-0x0000000000B10000-0x0000000000C10000-memory.dmp

Download

memory/4152-264-0x0000000000B10000-0x0000000000C10000-memory.dmp

Download

memory/4152-265-0x0000000000B10000-0x0000000000C10000-memory.dmp

Download

memory/4152-266-0x0000000000B10000-0x0000000000C10000-memory.dmp

Download

memory/4152-267-0x0000000000B10000-0x0000000000C10000-memory.dmp

Download

memory/4152-272-0x0000000000B10000-0x0000000000C10000-memory.dmp

Download

memory/4152-273-0x0000000000B10000-0x0000000000C10000-memory.dmp

Download

memory/4152-274-0x0000000000B10000-0x0000000000C10000-memory.dmp

Download

memory/4152-275-0x0000000000B10000-0x0000000000C10000-memory.dmp

Download

memory/4152-276-0x0000000000B10000-0x0000000000C10000-memory.dmp

Download

memory/4152-281-0x0000000000B10000-0x0000000000C10000-memory.dmp

Download

memory/4152-282-0x0000000000B10000-0x0000000000C10000-memory.dmp

Download

memory/4152-283-0x0000000000B10000-0x0000000000C10000-memory.dmp

Download

memory/4152-284-0x0000000000B10000-0x0000000000C10000-memory.dmp

Download

memory/4152-285-0x0000000000B10000-0x0000000000C10000-memory.dmp

Download

memory/4152-286-0x0000000000B10000-0x0000000000C10000-memory.dmp

Download

memory/4152-268-0x0000000000B10000-0x0000000000C10000-memory.dmp

Download

memory/4152-260-0x0000000000B10000-0x0000000000C10000-memory.dmp

Download

memory/4152-250-0x0000000000B10000-0x0000000000C10000-memory.dmp

Download

memory/4152-245-0x0000000000B10000-0x0000000000C10000-memory.dmp

Download

memory/4152-227-0x0000000000B10000-0x0000000000C10000-memory.dmp

Download

memory/4152-218-0x0000000000B10000-0x0000000000C10000-memory.dmp

Download

memory/4152-167-0x0000000000B10000-0x0000000000C10000-memory.dmp

Download

memory/4152-148-0x0000000000B10000-0x0000000000C10000-memory.dmp

Download

memory/4152-149-0x0000000000B10000-0x0000000000C10000-memory.dmp

Download

memory/4152-146-0x0000000000B10000-0x0000000000C10000-memory.dmp

Download

memory/4152-78-0x0000000000B10000-0x0000000000C10000-memory.dmp

Download

memory/4152-82-0x0000000000B10000-0x0000000000C10000-memory.dmp

Download

memory/4152-79-0x0000000000B10000-0x0000000000C10000-memory.dmp

Download

memory/4152-80-0x0000000000B10000-0x0000000000C10000-memory.dmp

Download

memory/4152-72-0x0000000000B10000-0x0000000000C10000-memory.dmp

Download

memory/4152-71-0x0000000000B10000-0x0000000000C10000-memory.dmp

Download

memory/4152-65-0x00000000052C0000-0x00000000052DE000-memory.dmp

Download

memory/4152-64-0x0000000006570000-0x0000000006A9C000-memory.dmp

Download

memory/4152-63-0x0000000005DA0000-0x0000000005DF0000-memory.dmp

Download

memory/4152-62-0x0000000005D20000-0x0000000005D96000-memory.dmp

Download

memory/4152-61-0x0000000005E70000-0x0000000006032000-memory.dmp

Download

memory/4152-60-0x0000000005BE0000-0x0000000005C92000-memory.dmp

Download

memory/4152-13-0x00000000053C0000-0x0000000005426000-memory.dmp

Download

memory/4152-11-0x0000000004E70000-0x0000000004E80000-memory.dmp

Download

memory/4152-10-0x0000000005430000-0x00000000059D4000-memory.dmp

Download