phantomstealer | 4c6c075eef30621a8ec9fbcd400292b3de3063e31a8589d189a33b6487cbf3dd

Analysis

max time kernel
149s
max time network
148s
platform
windows11-21h2_x64
resource
win11-20250619-en
resource tags

arch:x64arch:x86image:win11-20250619-enlocale:en-usos:windows11-21h2-x64system
submitted
31/10/2025, 04:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
.RFQ-PO#900BD SQ9039 Order-Materials-pdf.exe
Size 184KB
Sample251031-erblwsfv2a
SHA256 5376b0fea8d666fdcc1f330bd6f34aa5623dcbcad4b0ffed53087456ee849214
MD5 8d8309a795cb4b5c7e66bf202d111037
SHA1 5b3c7143d89938948f1df45f64d08d64b1e5177b
SHA512 8d38e2c0efbde236fb23ed56a9e024e9723ad8dc6f02b553f11bf1e2eb70d6ea32fbcebd8812230a1abeccdccb84fb6c46ca811f7f7d7cc149d342af439140ca
SSDEEP 3072:pEqn/irEsrD3xo2vYsWwY6JOXnVvqAKesWu4OauYfI92YETrc3M7:l/irEgNWoJOXnVvqAKesQOauYfa2YETt
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

collection discovery phantomstealer persistence

Malware Config

Extracted

Credentials

Protocol
smtp
Host
mail.sourc3trade.com
Port
587
Username
[email protected]
Password
yr!{f[L6r}9W!m/z

Extracted

Family

phantomstealer

Version

v3.5.0

Credentials

Protocol
smtp
Host
mail.sourc3trade.com
Port
587
Username
[email protected]
Password
yr!{f[L6r}9W!m/z
Email to
[email protected]

Mutex

12YHANZ1JWN7VAAFXR6S

Attributes

anti_analysis
0
cb_enables_ssl
1
debug
0
keylogger
1
start_delay
0
startup
0

Signatures

Phantomstealer family
phantomstealer

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1418876453-2228697459-2788511057-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AddInProcess32.exe
Key opened	\REGISTRY\USER\S-1-5-21-1418876453-2228697459-2788511057-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AddInProcess32.exe
Key opened	\REGISTRY\USER\S-1-5-21-1418876453-2228697459-2788511057-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AddInProcess32.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1418876453-2228697459-2788511057-1000\Software\Microsoft\Windows\CurrentVersion\Run\DefaultDomain = "cmd.exe /C pushd \"C:\\Users\\Admin\\AppData\\Local\\Temp\\Container\" && start \"\" \"C:\\Users\\Admin\\AppData\\Local\\Temp\\Container\\DefaultDomain\""	.RFQ-PO#900BD SQ9039 Order-Materials-pdf.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
88	icanhazip.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5376 set thread context of 5880	5376	.RFQ-PO#900BD SQ9039 Order-Materials-pdf.exe	78

Drops file in Windows directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp\chrome_installer.log	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\metadata	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\settings.dat	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\settings.dat	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\chrome_installer.log	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\metadata	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe

Checks processor information in registry 2 TTPs 30 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	AddInProcess32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	AddInProcess32.exe

Enumerates system info in registry 2 TTPs 12 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134063574164423550"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	chrmstp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1418876453-2228697459-2788511057-1000\{C81257DD-7716-4D01-9048-610DD4B84B8C}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5880	AddInProcess32.exe
5880	AddInProcess32.exe
2548	chrome.exe
2548	chrome.exe
5880	AddInProcess32.exe
5880	AddInProcess32.exe
5880	AddInProcess32.exe
5880	AddInProcess32.exe
5880	AddInProcess32.exe
5880	AddInProcess32.exe
5880	AddInProcess32.exe
5880	AddInProcess32.exe
5880	AddInProcess32.exe
3912	firefox.exe
3912	firefox.exe
3912	firefox.exe
3912	firefox.exe
3912	firefox.exe
3912	firefox.exe
3912	firefox.exe
3912	firefox.exe
3912	firefox.exe
3912	firefox.exe
3912	firefox.exe
3912	firefox.exe
3912	firefox.exe
3912	firefox.exe
3912	firefox.exe
3912	firefox.exe
3912	firefox.exe
3912	firefox.exe
3912	firefox.exe
3912	firefox.exe
5880	AddInProcess32.exe
5880	AddInProcess32.exe
5880	AddInProcess32.exe
5880	AddInProcess32.exe
5880	AddInProcess32.exe
5880	AddInProcess32.exe
5880	AddInProcess32.exe
5880	AddInProcess32.exe
5880	AddInProcess32.exe
5880	AddInProcess32.exe
5880	AddInProcess32.exe
5880	AddInProcess32.exe
5880	AddInProcess32.exe
5880	AddInProcess32.exe
5880	AddInProcess32.exe
5880	AddInProcess32.exe
4764	firefox.exe
4764	firefox.exe
4764	firefox.exe
4764	firefox.exe
4764	firefox.exe
4764	firefox.exe
4764	firefox.exe
4764	firefox.exe
4764	firefox.exe
4764	firefox.exe
4764	firefox.exe
4764	firefox.exe
4764	firefox.exe
4764	firefox.exe
4764	firefox.exe

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeDebugPrivilege	5880	AddInProcess32.exe
Token: SeShutdownPrivilege	2548	chrome.exe
Token: SeCreatePagefilePrivilege	2548	chrome.exe
Token: SeShutdownPrivilege	2548	chrome.exe
Token: SeCreatePagefilePrivilege	2548	chrome.exe
Token: SeShutdownPrivilege	2548	chrome.exe
Token: SeCreatePagefilePrivilege	2548	chrome.exe
Token: SeShutdownPrivilege	2548	chrome.exe
Token: SeCreatePagefilePrivilege	2548	chrome.exe
Token: SeShutdownPrivilege	2548	chrome.exe
Token: SeCreatePagefilePrivilege	2548	chrome.exe
Token: SeShutdownPrivilege	2548	chrome.exe
Token: SeCreatePagefilePrivilege	2548	chrome.exe
Token: SeShutdownPrivilege	2548	chrome.exe
Token: SeCreatePagefilePrivilege	2548	chrome.exe
Token: SeShutdownPrivilege	2548	chrome.exe
Token: SeCreatePagefilePrivilege	2548	chrome.exe
Token: SeShutdownPrivilege	1996	chrome.exe
Token: SeCreatePagefilePrivilege	1996	chrome.exe
Token: SeShutdownPrivilege	1996	chrome.exe
Token: SeCreatePagefilePrivilege	1996	chrome.exe

Suspicious use of FindShellTrayWindow 47 IoCs

pid	Process
2548	chrome.exe
2548	chrome.exe
3948	chrmstp.exe
3912	firefox.exe
3912	firefox.exe
3912	firefox.exe
3912	firefox.exe
3912	firefox.exe
3912	firefox.exe
3912	firefox.exe
3912	firefox.exe
3912	firefox.exe
3912	firefox.exe
3912	firefox.exe
3912	firefox.exe
3912	firefox.exe
3912	firefox.exe
3912	firefox.exe
3912	firefox.exe
3912	firefox.exe
3912	firefox.exe
3912	firefox.exe
3912	firefox.exe
5384	msedge.exe
5284	msedge.exe
4764	firefox.exe
4764	firefox.exe
4764	firefox.exe
4764	firefox.exe
4764	firefox.exe
4764	firefox.exe
4764	firefox.exe
4764	firefox.exe
4764	firefox.exe
4764	firefox.exe
4764	firefox.exe
4764	firefox.exe
4764	firefox.exe
4764	firefox.exe
4764	firefox.exe
4764	firefox.exe
4764	firefox.exe
4764	firefox.exe
4764	firefox.exe
4764	firefox.exe
1996	chrome.exe
1996	chrome.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3912	firefox.exe
4764	firefox.exe
5880	AddInProcess32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5376 wrote to memory of 5880	5376	.RFQ-PO#900BD SQ9039 Order-Materials-pdf.exe	78
PID 5376 wrote to memory of 5880	5376	.RFQ-PO#900BD SQ9039 Order-Materials-pdf.exe	78
PID 5376 wrote to memory of 5880	5376	.RFQ-PO#900BD SQ9039 Order-Materials-pdf.exe	78
PID 5376 wrote to memory of 5880	5376	.RFQ-PO#900BD SQ9039 Order-Materials-pdf.exe	78
PID 5376 wrote to memory of 5880	5376	.RFQ-PO#900BD SQ9039 Order-Materials-pdf.exe	78
PID 5376 wrote to memory of 5880	5376	.RFQ-PO#900BD SQ9039 Order-Materials-pdf.exe	78
PID 5880 wrote to memory of 2548	5880	AddInProcess32.exe	88
PID 5880 wrote to memory of 2548	5880	AddInProcess32.exe	88
PID 2548 wrote to memory of 5092	2548	chrome.exe	89
PID 2548 wrote to memory of 5092	2548	chrome.exe	89
PID 5880 wrote to memory of 2548	5880	AddInProcess32.exe	88
PID 2548 wrote to memory of 3588	2548	chrome.exe	90
PID 2548 wrote to memory of 3588	2548	chrome.exe	90
PID 5880 wrote to memory of 2548	5880	AddInProcess32.exe	88
PID 2548 wrote to memory of 5144	2548	chrome.exe	91
PID 2548 wrote to memory of 5144	2548	chrome.exe	91
PID 2548 wrote to memory of 3572	2548	chrome.exe	92
PID 2548 wrote to memory of 3572	2548	chrome.exe	92
PID 2548 wrote to memory of 1128	2548	chrome.exe	93
PID 2548 wrote to memory of 1128	2548	chrome.exe	93
PID 2548 wrote to memory of 2308	2548	chrome.exe	94
PID 2548 wrote to memory of 2308	2548	chrome.exe	94
PID 5880 wrote to memory of 5092	5880	AddInProcess32.exe	89
PID 5880 wrote to memory of 5092	5880	AddInProcess32.exe	89
PID 2548 wrote to memory of 6092	2548	chrome.exe	95
PID 2548 wrote to memory of 6092	2548	chrome.exe	95
PID 2548 wrote to memory of 3400	2548	chrome.exe	96
PID 2548 wrote to memory of 3400	2548	chrome.exe	96
PID 2548 wrote to memory of 4980	2548	chrome.exe	97
PID 2548 wrote to memory of 4980	2548	chrome.exe	97
PID 2548 wrote to memory of 1068	2548	chrome.exe	98
PID 2548 wrote to memory of 1068	2548	chrome.exe	98
PID 2548 wrote to memory of 2292	2548	chrome.exe	99
PID 2548 wrote to memory of 2292	2548	chrome.exe	99
PID 5880 wrote to memory of 2548	5880	AddInProcess32.exe	88
PID 5880 wrote to memory of 2548	5880	AddInProcess32.exe	88
PID 5880 wrote to memory of 5092	5880	AddInProcess32.exe	89
PID 5880 wrote to memory of 5092	5880	AddInProcess32.exe	89
PID 5880 wrote to memory of 2292	5880	AddInProcess32.exe	99
PID 5880 wrote to memory of 2292	5880	AddInProcess32.exe	99
PID 5880 wrote to memory of 2308	5880	AddInProcess32.exe	94
PID 5880 wrote to memory of 2308	5880	AddInProcess32.exe	94
PID 5880 wrote to memory of 5144	5880	AddInProcess32.exe	91
PID 5880 wrote to memory of 5144	5880	AddInProcess32.exe	91
PID 5880 wrote to memory of 3572	5880	AddInProcess32.exe	92
PID 5880 wrote to memory of 3572	5880	AddInProcess32.exe	92
PID 2548 wrote to memory of 1928	2548	chrome.exe	101
PID 2548 wrote to memory of 1928	2548	chrome.exe	101
PID 2548 wrote to memory of 5256	2548	chrome.exe	102
PID 2548 wrote to memory of 5256	2548	chrome.exe	102
PID 5880 wrote to memory of 1068	5880	AddInProcess32.exe	98
PID 2548 wrote to memory of 3872	2548	chrome.exe	103
PID 2548 wrote to memory of 3872	2548	chrome.exe	103
PID 5880 wrote to memory of 1068	5880	AddInProcess32.exe	98
PID 5880 wrote to memory of 4980	5880	AddInProcess32.exe	97
PID 5880 wrote to memory of 4980	5880	AddInProcess32.exe	97
PID 5880 wrote to memory of 3400	5880	AddInProcess32.exe	96
PID 5880 wrote to memory of 3400	5880	AddInProcess32.exe	96
PID 5880 wrote to memory of 3588	5880	AddInProcess32.exe	90
PID 5880 wrote to memory of 3588	5880	AddInProcess32.exe	90
PID 5880 wrote to memory of 2548	5880	AddInProcess32.exe	88
PID 5880 wrote to memory of 2548	5880	AddInProcess32.exe	88
PID 5880 wrote to memory of 5092	5880	AddInProcess32.exe	89
PID 5880 wrote to memory of 5092	5880	AddInProcess32.exe	89

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1418876453-2228697459-2788511057-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AddInProcess32.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1418876453-2228697459-2788511057-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AddInProcess32.exe

C:\Users\Admin\AppData\Local\Temp\.RFQ-PO#900BD SQ9039 Order-Materials-pdf.exe
"C:\Users\Admin\AppData\Local\Temp\.RFQ-PO#900BD SQ9039 Order-Materials-pdf.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5376
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - outlook_office_path
  - outlook_win_path
  PID:5880
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\qrqmnwxb.ptm"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2548
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\qrqmnwxb.ptm /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\qrqmnwxb.ptm\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\qrqmnwxb.ptm --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0xe0,0x108,0x10c,0xec,0x110,0x7ff97848dcf8,0x7ff97848dd04,0x7ff97848dd10
      4⤵
      PID:5092
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\qrqmnwxb.ptm" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=1900,i,11359594912376252222,8644265378699492793,262144 --variations-seed-version --mojo-platform-channel-handle=1896 /prefetch:2
      4⤵
      PID:3588
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\qrqmnwxb.ptm" --field-trial-handle=1936,i,11359594912376252222,8644265378699492793,262144 --variations-seed-version --mojo-platform-channel-handle=2024 /prefetch:11
      4⤵
      PID:5144
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\qrqmnwxb.ptm" --field-trial-handle=2132,i,11359594912376252222,8644265378699492793,262144 --variations-seed-version --mojo-platform-channel-handle=2144 /prefetch:13
      4⤵
      PID:3572
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\qrqmnwxb.ptm" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3108,i,11359594912376252222,8644265378699492793,262144 --variations-seed-version --mojo-platform-channel-handle=3184 /prefetch:1
      4⤵
      PID:1128
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\qrqmnwxb.ptm" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=2984,i,11359594912376252222,8644265378699492793,262144 --variations-seed-version --mojo-platform-channel-handle=3224 /prefetch:1
      4⤵
      PID:2308
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\qrqmnwxb.ptm" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3572,i,11359594912376252222,8644265378699492793,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:1
      4⤵
      PID:6092
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\qrqmnwxb.ptm" --extension-process --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=3612,i,11359594912376252222,8644265378699492793,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:9
      4⤵
      PID:3400
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\qrqmnwxb.ptm" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=3064,i,11359594912376252222,8644265378699492793,262144 --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:1
      4⤵
      PID:4980
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\qrqmnwxb.ptm" --extension-process --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=3680,i,11359594912376252222,8644265378699492793,262144 --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:9
      4⤵
      PID:1068
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\qrqmnwxb.ptm" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=4372,i,11359594912376252222,8644265378699492793,262144 --variations-seed-version --mojo-platform-channel-handle=4408 /prefetch:1
      4⤵
      PID:2292
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\qrqmnwxb.ptm" --field-trial-handle=4468,i,11359594912376252222,8644265378699492793,262144 --variations-seed-version --mojo-platform-channel-handle=4472 /prefetch:14
      4⤵
      PID:1928
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\qrqmnwxb.ptm" --field-trial-handle=4496,i,11359594912376252222,8644265378699492793,262144 --variations-seed-version --mojo-platform-channel-handle=4492 /prefetch:14
      4⤵
      PID:5256
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\qrqmnwxb.ptm" --field-trial-handle=3788,i,11359594912376252222,8644265378699492793,262144 --variations-seed-version --mojo-platform-channel-handle=4452 /prefetch:14
      4⤵
      PID:3872
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\qrqmnwxb.ptm" --field-trial-handle=4908,i,11359594912376252222,8644265378699492793,262144 --variations-seed-version --mojo-platform-channel-handle=4928 /prefetch:14
      4⤵
      PID:4128
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\qrqmnwxb.ptm" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=5032,i,11359594912376252222,8644265378699492793,262144 --variations-seed-version --mojo-platform-channel-handle=5036 /prefetch:1
      4⤵
      PID:3204
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\qrqmnwxb.ptm" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=5060,i,11359594912376252222,8644265378699492793,262144 --variations-seed-version --mojo-platform-channel-handle=5044 /prefetch:1
      4⤵
      PID:5924
  - - C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
      4⤵
      Drops file in Windows directory
      PID:4676
    - - C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x244,0x248,0x24c,0x220,0x250,0x7ff75b0b1f58,0x7ff75b0b1f64,0x7ff75b0b1f70
        5⤵
        Drops file in Windows directory
        
        PID:3184
    - - C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\initial_preferences" --create-shortcuts=1 --install-level=0
        5⤵
        Drops file in Windows directory
        Modifies registry class
        Suspicious use of FindShellTrayWindow
        
        PID:3948
      - C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x244,0x248,0x24c,0x220,0x250,0x7ff75b0b1f58,0x7ff75b0b1f64,0x7ff75b0b1f70
        6⤵
        Drops file in Windows directory
        
        PID:5296
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\qrqmnwxb.ptm" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=5140,i,11359594912376252222,8644265378699492793,262144 --variations-seed-version --mojo-platform-channel-handle=4928 /prefetch:1
      4⤵
      PID:4752
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\qrqmnwxb.ptm" --field-trial-handle=5196,i,11359594912376252222,8644265378699492793,262144 --variations-seed-version --mojo-platform-channel-handle=5104 /prefetch:14
      4⤵
      PID:6088
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\qrqmnwxb.ptm" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --field-trial-handle=5028,i,11359594912376252222,8644265378699492793,262144 --variations-seed-version --mojo-platform-channel-handle=5256 /prefetch:1
      4⤵
      PID:3596
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\qrqmnwxb.ptm" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --field-trial-handle=4956,i,11359594912376252222,8644265378699492793,262144 --variations-seed-version --mojo-platform-channel-handle=4900 /prefetch:1
      4⤵
      PID:4428
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\qrqmnwxb.ptm" --field-trial-handle=4932,i,11359594912376252222,8644265378699492793,262144 --variations-seed-version --mojo-platform-channel-handle=5108 /prefetch:14
      4⤵
      PID:3220
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\qrqmnwxb.ptm" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --field-trial-handle=5128,i,11359594912376252222,8644265378699492793,262144 --variations-seed-version --mojo-platform-channel-handle=5248 /prefetch:1
      4⤵
      PID:2984
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\qrqmnwxb.ptm" --field-trial-handle=5132,i,11359594912376252222,8644265378699492793,262144 --variations-seed-version --mojo-platform-channel-handle=5020 /prefetch:14
      4⤵
      PID:5164
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\qrqmnwxb.ptm" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --field-trial-handle=5056,i,11359594912376252222,8644265378699492793,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:1
      4⤵
      PID:5796
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\qrqmnwxb.ptm" --field-trial-handle=5012,i,11359594912376252222,8644265378699492793,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:14
      4⤵
      PID:2836
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\qrqmnwxb.ptm" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --field-trial-handle=5024,i,11359594912376252222,8644265378699492793,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:1
      4⤵
      PID:3432
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\qrqmnwxb.ptm" --extension-process --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --field-trial-handle=5368,i,11359594912376252222,8644265378699492793,262144 --variations-seed-version --mojo-platform-channel-handle=5300 /prefetch:9
      4⤵
      PID:3540
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\4mp4dqqa.gmd"
    3⤵
    PID:2472
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir=C:\Users\Admin\AppData\Local\Temp\4mp4dqqa.gmd
      4⤵
      Checks processor information in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:3912
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1984 -prefsLen 27097 -prefMapHandle 1988 -prefMapSize 270279 -ipcHandle 2056 -initialChannelId {5ee3201b-b380-4d5e-9490-8d62588eec61} -parentPid 3912 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3912" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
        5⤵
        
        PID:5260
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2188 -prefsLen 27133 -prefMapHandle 2176 -prefMapSize 270279 -ipcHandle 2312 -initialChannelId {b1f35200-6a73-4bb6-90dd-b8ea5a979091} -parentPid 3912 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3912" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
        5⤵
        
        PID:5732
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\0d5cf33f-5f31-41ef-b539-07334eda6eb8.dmp"
        5⤵
        
        PID:1680
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2896 -prefsLen 27133 -prefMapHandle 2900 -prefMapSize 270279 -ipcHandle 2616 -initialChannelId {65ec1c20-3348-433a-9e0a-6536d44ebdf9} -parentPid 3912 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3912" -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 gpu
        5⤵
        
        PID:1556
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\40906d0d-fcf2-496c-b31f-aba4c78697ba.dmp"
        5⤵
        
        PID:3176
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2616 -prefsLen 27133 -prefMapHandle 2988 -prefMapSize 270279 -ipcHandle 2892 -initialChannelId {8e97c8ae-0d4f-40de-b0a5-a2f89b39f670} -parentPid 3912 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3912" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 gpu
        5⤵
        
        PID:5368
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\3953c973-0de9-4c26-be79-c9cf86dfdb0f.dmp"
        5⤵
        
        PID:4448
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2892 -prefsLen 27198 -prefMapHandle 3444 -prefMapSize 270279 -ipcHandle 3492 -initialChannelId {80078de8-1a8a-457d-baad-dd301d3e2f8a} -parentPid 3912 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3912" -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 gpu
        5⤵
        
        PID:972
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3092 -prefsLen 27274 -prefMapHandle 3168 -prefMapSize 270279 -jsInitHandle 3156 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3132 -initialChannelId {cbcfd787-a8ca-4524-bdd7-5125ecf206a1} -parentPid 3912 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3912" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 tab
        5⤵
        Checks processor information in registry
        
        PID:1460
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\099a0c85-5ce5-40ef-9128-85e83396a7fc.dmp"
        5⤵
        
        PID:4228
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3492 -prefsLen 27274 -prefMapHandle 3596 -prefMapSize 270279 -ipcHandle 3584 -initialChannelId {95507f1f-e1ab-4a13-aadf-75e766486886} -parentPid 3912 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3912" -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 gpu
        5⤵
        
        PID:1628
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\8a7d2c4b-1553-44dc-9ea2-46c60be7ae40.dmp"
        5⤵
        
        PID:5320
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4212 -prefsLen 27274 -prefMapHandle 4216 -prefMapSize 270279 -ipcHandle 4248 -initialChannelId {c9500356-8fee-4751-9b7f-62aae8638cdb} -parentPid 3912 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3912" -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 rdd
        5⤵
        
        PID:4704
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4464 -prefsLen 34773 -prefMapHandle 4592 -prefMapSize 270279 -jsInitHandle 4468 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2836 -initialChannelId {3a1fddd5-b04a-4bc8-ab40-f38c95c4c118} -parentPid 3912 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3912" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
        5⤵
        Checks processor information in registry
        
        PID:2488
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4568 -prefsLen 35010 -prefMapHandle 4480 -prefMapSize 270279 -ipcHandle 5164 -initialChannelId {2cad679e-6b4c-436c-a30b-0a0cc2c445c3} -parentPid 3912 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3912" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 utility
        5⤵
        
        PID:3880
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3028 -prefsLen 32900 -prefMapHandle 5028 -prefMapSize 270279 -jsInitHandle 1980 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4480 -initialChannelId {192cc149-0816-4c97-9a73-220dfa42a2c9} -parentPid 3912 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3912" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
        5⤵
        
        PID:2776
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5148 -prefsLen 32900 -prefMapHandle 5152 -prefMapSize 270279 -jsInitHandle 5156 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5028 -initialChannelId {45156851-6d79-4090-a3c3-e2d72ce53330} -parentPid 3912 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3912" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
        5⤵
        
        PID:3332
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rhhldx0x.5vb"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious use of FindShellTrayWindow
    PID:5384
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\rhhldx0x.5vb /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\rhhldx0x.5vb\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x23c,0x240,0x244,0x238,0x264,0x7ff96859f208,0x7ff96859f214,0x7ff96859f220
      4⤵
      PID:5780
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rhhldx0x.5vb" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --field-trial-handle=2448,i,13445796392434990640,714150656728314924,262144 --variations-seed-version --mojo-platform-channel-handle=2444 /prefetch:2
      4⤵
      PID:5620
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rhhldx0x.5vb" --always-read-main-dll --field-trial-handle=1736,i,13445796392434990640,714150656728314924,262144 --variations-seed-version --mojo-platform-channel-handle=2476 /prefetch:11
      4⤵
      PID:4864
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rhhldx0x.5vb" --always-read-main-dll --field-trial-handle=2112,i,13445796392434990640,714150656728314924,262144 --variations-seed-version --mojo-platform-channel-handle=2508 /prefetch:13
      4⤵
      PID:5152
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rhhldx0x.5vb" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3364,i,13445796392434990640,714150656728314924,262144 --variations-seed-version --mojo-platform-channel-handle=3436 /prefetch:1
      4⤵
      PID:5012
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rhhldx0x.5vb" --instant-process --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3372,i,13445796392434990640,714150656728314924,262144 --variations-seed-version --mojo-platform-channel-handle=3444 /prefetch:1
      4⤵
      PID:4668
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rhhldx0x.5vb" --always-read-main-dll --field-trial-handle=3764,i,13445796392434990640,714150656728314924,262144 --variations-seed-version --mojo-platform-channel-handle=3784 /prefetch:14
      4⤵
      PID:5980
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rhhldx0x.5vb" --always-read-main-dll --field-trial-handle=3756,i,13445796392434990640,714150656728314924,262144 --variations-seed-version --mojo-platform-channel-handle=3776 /prefetch:14
      4⤵
      PID:3060
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rhhldx0x.5vb" --always-read-main-dll --field-trial-handle=3768,i,13445796392434990640,714150656728314924,262144 --variations-seed-version --mojo-platform-channel-handle=3844 /prefetch:14
      4⤵
      PID:4784
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rhhldx0x.5vb" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --field-trial-handle=3800,i,13445796392434990640,714150656728314924,262144 --variations-seed-version --mojo-platform-channel-handle=3852 /prefetch:1
      4⤵
      PID:3068
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rhhldx0x.5vb" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --field-trial-handle=3836,i,13445796392434990640,714150656728314924,262144 --variations-seed-version --mojo-platform-channel-handle=3860 /prefetch:9
      4⤵
      PID:4104
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rhhldx0x.5vb" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --field-trial-handle=3884,i,13445796392434990640,714150656728314924,262144 --variations-seed-version --mojo-platform-channel-handle=3956 /prefetch:1
      4⤵
      PID:4228
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rhhldx0x.5vb" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --field-trial-handle=3932,i,13445796392434990640,714150656728314924,262144 --variations-seed-version --mojo-platform-channel-handle=3968 /prefetch:9
      4⤵
      PID:2404
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rhhldx0x.5vb" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --field-trial-handle=3804,i,13445796392434990640,714150656728314924,262144 --variations-seed-version --mojo-platform-channel-handle=4008 /prefetch:1
      4⤵
      PID:3272
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rhhldx0x.5vb" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --field-trial-handle=3960,i,13445796392434990640,714150656728314924,262144 --variations-seed-version --mojo-platform-channel-handle=4040 /prefetch:9
      4⤵
      PID:5400
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rhhldx0x.5vb" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --field-trial-handle=3980,i,13445796392434990640,714150656728314924,262144 --variations-seed-version --mojo-platform-channel-handle=4068 /prefetch:1
      4⤵
      PID:5608
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rhhldx0x.5vb" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --field-trial-handle=4020,i,13445796392434990640,714150656728314924,262144 --variations-seed-version --mojo-platform-channel-handle=4124 /prefetch:9
      4⤵
      PID:6044
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rhhldx0x.5vb" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --field-trial-handle=4032,i,13445796392434990640,714150656728314924,262144 --variations-seed-version --mojo-platform-channel-handle=4192 /prefetch:1
      4⤵
      PID:972
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rhhldx0x.5vb" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --field-trial-handle=4052,i,13445796392434990640,714150656728314924,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:9
      4⤵
      PID:3500
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rhhldx0x.5vb" --always-read-main-dll --field-trial-handle=4332,i,13445796392434990640,714150656728314924,262144 --variations-seed-version --mojo-platform-channel-handle=4348 /prefetch:14
      4⤵
      PID:1640
    - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=1128
        5⤵
        
        PID:3332
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rhhldx0x.5vb" --always-read-main-dll --field-trial-handle=3928,i,13445796392434990640,714150656728314924,262144 --variations-seed-version --mojo-platform-channel-handle=5284 /prefetch:14
      4⤵
      PID:4516
    - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=596
        5⤵
        
        PID:1336
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rhhldx0x.5vb" --always-read-main-dll --field-trial-handle=5328,i,13445796392434990640,714150656728314924,262144 --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:14
      4⤵
      PID:3972
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rhhldx0x.5vb" --always-read-main-dll --field-trial-handle=5372,i,13445796392434990640,714150656728314924,262144 --variations-seed-version --mojo-platform-channel-handle=3844 /prefetch:14
      4⤵
      PID:3940
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rhhldx0x.5vb" --always-read-main-dll --field-trial-handle=4672,i,13445796392434990640,714150656728314924,262144 --variations-seed-version --mojo-platform-channel-handle=5300 /prefetch:14
      4⤵
      PID:4108
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --no-sandbox --mute-audio --onnx-enabled-for-ee --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rhhldx0x.5vb" --always-read-main-dll --field-trial-handle=3748,i,13445796392434990640,714150656728314924,262144 --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:14
      4⤵
      PID:1964
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5brzkvqu.15q"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious use of FindShellTrayWindow
    PID:5284
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\5brzkvqu.15q /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\5brzkvqu.15q\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x23c,0x240,0x244,0x238,0x260,0x7ff96859f208,0x7ff96859f214,0x7ff96859f220
      4⤵
      PID:2920
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5brzkvqu.15q" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --field-trial-handle=2120,i,6961025088792363357,1572890700455970939,262144 --variations-seed-version --mojo-platform-channel-handle=2116 /prefetch:2
      4⤵
      PID:2876
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5brzkvqu.15q" --always-read-main-dll --field-trial-handle=1812,i,6961025088792363357,1572890700455970939,262144 --variations-seed-version --mojo-platform-channel-handle=2124 /prefetch:11
      4⤵
      PID:4200
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5brzkvqu.15q" --always-read-main-dll --field-trial-handle=2288,i,6961025088792363357,1572890700455970939,262144 --variations-seed-version --mojo-platform-channel-handle=2432 /prefetch:13
      4⤵
      PID:2960
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5brzkvqu.15q" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=2976,i,6961025088792363357,1572890700455970939,262144 --variations-seed-version --mojo-platform-channel-handle=3000 /prefetch:1
      4⤵
      PID:1548
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5brzkvqu.15q" --instant-process --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=2988,i,6961025088792363357,1572890700455970939,262144 --variations-seed-version --mojo-platform-channel-handle=3016 /prefetch:1
      4⤵
      PID:1476
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5brzkvqu.15q" --always-read-main-dll --field-trial-handle=3460,i,6961025088792363357,1572890700455970939,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:14
      4⤵
      PID:4688
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5brzkvqu.15q" --always-read-main-dll --field-trial-handle=3472,i,6961025088792363357,1572890700455970939,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:14
      4⤵
      PID:5112
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5brzkvqu.15q" --always-read-main-dll --field-trial-handle=3476,i,6961025088792363357,1572890700455970939,262144 --variations-seed-version --mojo-platform-channel-handle=2936 /prefetch:14
      4⤵
      PID:2376
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5brzkvqu.15q" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --field-trial-handle=3584,i,6961025088792363357,1572890700455970939,262144 --variations-seed-version --mojo-platform-channel-handle=3740 /prefetch:1
      4⤵
      PID:4860
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5brzkvqu.15q" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --field-trial-handle=3608,i,6961025088792363357,1572890700455970939,262144 --variations-seed-version --mojo-platform-channel-handle=3788 /prefetch:9
      4⤵
      PID:4700
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5brzkvqu.15q" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --field-trial-handle=3636,i,6961025088792363357,1572890700455970939,262144 --variations-seed-version --mojo-platform-channel-handle=3848 /prefetch:1
      4⤵
      PID:3744
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5brzkvqu.15q" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --field-trial-handle=3688,i,6961025088792363357,1572890700455970939,262144 --variations-seed-version --mojo-platform-channel-handle=3856 /prefetch:9
      4⤵
      PID:6080
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5brzkvqu.15q" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --field-trial-handle=3712,i,6961025088792363357,1572890700455970939,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:1
      4⤵
      PID:568
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5brzkvqu.15q" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --field-trial-handle=3728,i,6961025088792363357,1572890700455970939,262144 --variations-seed-version --mojo-platform-channel-handle=3716 /prefetch:9
      4⤵
      PID:4744
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5brzkvqu.15q" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --field-trial-handle=3756,i,6961025088792363357,1572890700455970939,262144 --variations-seed-version --mojo-platform-channel-handle=4388 /prefetch:1
      4⤵
      PID:1884
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5brzkvqu.15q" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --field-trial-handle=3776,i,6961025088792363357,1572890700455970939,262144 --variations-seed-version --mojo-platform-channel-handle=4440 /prefetch:9
      4⤵
      PID:2704
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5brzkvqu.15q" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --field-trial-handle=3836,i,6961025088792363357,1572890700455970939,262144 --variations-seed-version --mojo-platform-channel-handle=4396 /prefetch:1
      4⤵
      PID:3288
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5brzkvqu.15q" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --field-trial-handle=3860,i,6961025088792363357,1572890700455970939,262144 --variations-seed-version --mojo-platform-channel-handle=4408 /prefetch:9
      4⤵
      PID:1492
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5brzkvqu.15q" --always-read-main-dll --field-trial-handle=3936,i,6961025088792363357,1572890700455970939,262144 --variations-seed-version --mojo-platform-channel-handle=4528 /prefetch:14
      4⤵
      PID:1904
    - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=1132
        5⤵
        
        PID:3236
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5brzkvqu.15q" --always-read-main-dll --field-trial-handle=5184,i,6961025088792363357,1572890700455970939,262144 --variations-seed-version --mojo-platform-channel-handle=4992 /prefetch:14
      4⤵
      PID:4952
    - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=592
        5⤵
        
        PID:5160
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5brzkvqu.15q" --always-read-main-dll --field-trial-handle=3916,i,6961025088792363357,1572890700455970939,262144 --variations-seed-version --mojo-platform-channel-handle=5252 /prefetch:14
      4⤵
      PID:6132
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5brzkvqu.15q" --always-read-main-dll --field-trial-handle=5344,i,6961025088792363357,1572890700455970939,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:14
      4⤵
      PID:1996
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5brzkvqu.15q" --always-read-main-dll --field-trial-handle=5144,i,6961025088792363357,1572890700455970939,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:14
      4⤵
      PID:5200
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --no-sandbox --mute-audio --onnx-enabled-for-ee --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5brzkvqu.15q" --always-read-main-dll --field-trial-handle=4288,i,6961025088792363357,1572890700455970939,262144 --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:14
      4⤵
      PID:5656
  - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5brzkvqu.15q" --always-read-main-dll --field-trial-handle=6100,i,6961025088792363357,1572890700455970939,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:14
      4⤵
      PID:4820
  - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5brzkvqu.15q" --always-read-main-dll --field-trial-handle=6100,i,6961025088792363357,1572890700455970939,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:14
      4⤵
      PID:5100
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5brzkvqu.15q" --always-read-main-dll --field-trial-handle=6268,i,6961025088792363357,1572890700455970939,262144 --variations-seed-version --mojo-platform-channel-handle=6248 /prefetch:14
      4⤵
      PID:5408
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5brzkvqu.15q" --always-read-main-dll --field-trial-handle=6300,i,6961025088792363357,1572890700455970939,262144 --variations-seed-version --mojo-platform-channel-handle=6356 /prefetch:14
      4⤵
      PID:1224
  - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\Installer\setup.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
      4⤵
      PID:912
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\bynuucll.qpf"
    3⤵
    PID:5720
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir=C:\Users\Admin\AppData\Local\Temp\bynuucll.qpf
      4⤵
      Checks processor information in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:4764
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1964 -prefsLen 27097 -prefMapHandle 1968 -prefMapSize 270331 -ipcHandle 2052 -initialChannelId {db925e5c-4876-4fca-89c0-0672ec046edb} -parentPid 4764 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4764" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
        5⤵
        
        PID:4512
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2232 -prefsLen 27133 -prefMapHandle 2220 -prefMapSize 270331 -ipcHandle 2196 -initialChannelId {94cb15ab-dae3-42f8-ae97-d1811c1863bd} -parentPid 4764 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4764" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
        5⤵
        
        PID:4020
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\48f9636f-a946-4784-89f0-c56cc30764e6.dmp"
        5⤵
        
        PID:1400
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2052 -prefsLen 27133 -prefMapHandle 2668 -prefMapSize 270331 -ipcHandle 2688 -initialChannelId {97add77f-e3bb-411e-873c-5c1cc5acd510} -parentPid 4764 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4764" -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 gpu
        5⤵
        
        PID:4820
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\9cd0fa7e-ebdc-434a-ac0e-c85ecaa77587.dmp"
        5⤵
        
        PID:4012
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2688 -prefsLen 27133 -prefMapHandle 3184 -prefMapSize 270331 -ipcHandle 3188 -initialChannelId {93456d67-ac90-494e-a47c-5e351181f771} -parentPid 4764 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4764" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 gpu
        5⤵
        
        PID:4548
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\25591b09-5369-40f4-9e7a-217d8e2c7103.dmp"
        5⤵
        
        PID:5524
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3156 -prefsLen 27198 -prefMapHandle 3496 -prefMapSize 270331 -ipcHandle 3452 -initialChannelId {9f777aef-0382-464f-b45a-861e2592af20} -parentPid 4764 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4764" -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 gpu
        5⤵
        
        PID:6112
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3920 -prefsLen 27323 -prefMapHandle 3924 -prefMapSize 270331 -jsInitHandle 3928 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3996 -initialChannelId {34315318-516c-4873-8b97-1f838569d81a} -parentPid 4764 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4764" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 tab
        5⤵
        Checks processor information in registry
        
        PID:2300
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\bdf20e7e-d0fb-4ea4-96d3-013fd05cee8a.dmp"
        5⤵
        
        PID:1036
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3452 -prefsLen 27323 -prefMapHandle 3788 -prefMapSize 270331 -ipcHandle 3796 -initialChannelId {f37df137-ddee-4160-bdc3-35f2f2a25a13} -parentPid 4764 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4764" -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 gpu
        5⤵
        
        PID:5372
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\2c8d263b-f0cd-4c8a-887c-83e0f7cc79e5.dmp"
        5⤵
        
        PID:1564
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4532 -prefsLen 27323 -prefMapHandle 4536 -prefMapSize 270331 -ipcHandle 3936 -initialChannelId {e8e3c291-59b6-4c6e-b7ce-e1e5da7e8c68} -parentPid 4764 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4764" -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 rdd
        5⤵
        
        PID:5196
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 1596 -prefsLen 34876 -prefMapHandle 1684 -prefMapSize 270331 -jsInitHandle 3028 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4568 -initialChannelId {3f95dead-132b-4729-9aae-81ad476637be} -parentPid 4764 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4764" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
        5⤵
        Checks processor information in registry
        
        PID:1628
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5040 -prefsLen 35010 -prefMapHandle 5044 -prefMapSize 270331 -ipcHandle 5020 -initialChannelId {32cf1ee0-8269-44ff-83af-c47e0af957ca} -parentPid 4764 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4764" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 utility
        5⤵
        Checks processor information in registry
        
        PID:3736
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5092 -prefsLen 32952 -prefMapHandle 4692 -prefMapSize 270331 -jsInitHandle 4704 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5176 -initialChannelId {e5916585-1f3c-4a15-ac5b-571d2441cfa3} -parentPid 4764 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4764" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
        5⤵
        Checks processor information in registry
        
        PID:2140
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5196 -prefsLen 32952 -prefMapHandle 5200 -prefMapSize 270331 -jsInitHandle 5204 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5212 -initialChannelId {2143071c-c36e-4101-86cd-39784898a42e} -parentPid 4764 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4764" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
        5⤵
        Checks processor information in registry
        
        PID:4152
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4704 -prefsLen 32952 -prefMapHandle 4692 -prefMapSize 270331 -jsInitHandle 5092 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5328 -initialChannelId {3e203ca5-2949-4322-91f3-a5109522d75a} -parentPid 4764 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4764" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab
        5⤵
        Checks processor information in registry
        
        PID:5748
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\qha4rxu5.nu5"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    PID:1996
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\qha4rxu5.nu5 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\qha4rxu5.nu5\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\qha4rxu5.nu5 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ff97848dcf8,0x7ff97848dd04,0x7ff97848dd10
      4⤵
      PID:1812
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\qha4rxu5.nu5" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=2504,i,9135524808820218029,5143895172828667708,262144 --variations-seed-version --mojo-platform-channel-handle=2484 /prefetch:2
      4⤵
      PID:4032
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\qha4rxu5.nu5" --field-trial-handle=1872,i,9135524808820218029,5143895172828667708,262144 --variations-seed-version --mojo-platform-channel-handle=2616 /prefetch:11
      4⤵
      PID:6008
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\qha4rxu5.nu5" --field-trial-handle=2236,i,9135524808820218029,5143895172828667708,262144 --variations-seed-version --mojo-platform-channel-handle=2656 /prefetch:13
      4⤵
      PID:4684
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\qha4rxu5.nu5" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3076,i,9135524808820218029,5143895172828667708,262144 --variations-seed-version --mojo-platform-channel-handle=3148 /prefetch:1
      4⤵
      PID:768
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\qha4rxu5.nu5" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3084,i,9135524808820218029,5143895172828667708,262144 --variations-seed-version --mojo-platform-channel-handle=3152 /prefetch:1
      4⤵
      PID:1180
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\qha4rxu5.nu5" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3280,i,9135524808820218029,5143895172828667708,262144 --variations-seed-version --mojo-platform-channel-handle=3356 /prefetch:1
      4⤵
      PID:1580
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\qha4rxu5.nu5" --extension-process --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=3296,i,9135524808820218029,5143895172828667708,262144 --variations-seed-version --mojo-platform-channel-handle=3276 /prefetch:9
      4⤵
      PID:1976
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\qha4rxu5.nu5" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=3332,i,9135524808820218029,5143895172828667708,262144 --variations-seed-version --mojo-platform-channel-handle=3376 /prefetch:1
      4⤵
      PID:5380
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\qha4rxu5.nu5" --extension-process --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=3364,i,9135524808820218029,5143895172828667708,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:9
      4⤵
      PID:4848
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\qha4rxu5.nu5" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=4312,i,9135524808820218029,5143895172828667708,262144 --variations-seed-version --mojo-platform-channel-handle=2260 /prefetch:1
      4⤵
      PID:5112
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\qha4rxu5.nu5" --field-trial-handle=4316,i,9135524808820218029,5143895172828667708,262144 --variations-seed-version --mojo-platform-channel-handle=4392 /prefetch:14
      4⤵
      PID:5964
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\qha4rxu5.nu5" --field-trial-handle=4324,i,9135524808820218029,5143895172828667708,262144 --variations-seed-version --mojo-platform-channel-handle=4356 /prefetch:14
      4⤵
      PID:3092
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\qha4rxu5.nu5" --field-trial-handle=4452,i,9135524808820218029,5143895172828667708,262144 --variations-seed-version --mojo-platform-channel-handle=4448 /prefetch:14
      4⤵
      PID:1164

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1160

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:1884

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:4152

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

activity-stream.contile.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\vozqjwij.default-release\activity-stream.contile.json
Size 5KB
SHA256 f9b6946ef0afa5ed4f42adb96c82f93e7a2308fe575d10400fde546c86eb12b7
MD5 26ca9b26bf5f526ef4b37a3ecf48a5bf
SHA1 3c4aa8643d570448dc38e1cb38732c582dff17b0
SHA512 2322c97d0561ea71fa780b0bdb0edf48cd9595acdd61f365158808de5ef80104051768f15a3095c94e89ff5a3c18124f02e34a2a7f8ea2a4d651a0c031629391
SSDEEP 96:Ke+w9tvrXQ8BnVcAd80oz+ZnjcmCsezEol:Ke+ctvrQ8Bnnd80uanjcmYz7l
MD5 SHA1 SHA512 SSDEEP

Submit Download

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\vozqjwij.default-release\activity-stream.discovery_stream.json
Size 23KB
SHA256 f4e0e42fa72602af2d16d8e0e667b1cfe3d71c96c2b4627cae444584ebc6992c
MD5 063e57096af023cdcd67f156abe57fdd
SHA1 7eeb14ca41918b278a353a79f79edbefa8f699d3
SHA512 793b43f33896d3a1d1319a796086fc8a9cabef3fc24078f52f62fe36b29683ea7a3f183893f3027a623d1a1a866505c3928c444d2f06dbd272505cbbbb9e0d5b
SSDEEP 384:BjiXu8Pe5qYdtMLlRzRQhTvuyRgsHdn+HfOsCRvAeIkya3:xie8vYaSy01+2jLyE
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\5brzkvqu.15q\Crashpad\settings.dat
Size 280B
SHA256 0a85117a9f0780af165f838caa60c4859ef2feeed53f4b3bf6dcaf79774c05a4
MD5 ec97e83ed742019012aef8761c47694c
SHA1 ad351eab1d51d8f90fd263bf9b72bd3e1a336783
SHA512 9e72c9fb77fe9914ee527abbeb96a3726c4a273b926250553a402f7cd0971c21196ef409a4aee5f7f3cfc0e119657b006f3f356ff8cb4fb2c6cc9c512341d4c3
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\5brzkvqu.15q\Crashpad\settings.dat
Size 280B
SHA256 2cb7987a344566ea5c82a71ae82718b7c48545bfad3822aac83952c0e4340201
MD5 f350d944944a5103828d60160224ecf8
SHA1 62758456b62d4bc9f2edd90902409b38bc211c1b
SHA512 42b160d9da6fa66290fead5c19028e9a0ec2c016442af1066cd8df693a208ae60d5728e9f57f12d854078a93a6a581c1b86093bb27a582da855fd6aedc96b31c
MD5 SHA1 SHA512

Submit Download

f_000002

Path C:\Users\Admin\AppData\Local\Temp\5brzkvqu.15q\Default\Cache\Cache_Data\f_000002
Size 99KB
SHA256 cad25cfcc108f11e81cf1a339916e956b5ccd3ab3da38a3bd7a3a7a01adcd3f4
MD5 86e9c0ad8befdb46f1ecda1d3f2c70ad
SHA1 cf9520c235db04ac02e98a7f7c9f3d5d631d4199
SHA512 30a1265891f03df0c46d4f310d97ffa312b84d485a214d895a1c5e260474260d6637592b20d9cf4efa507c131694f63253577fdb352e8e0c46505e02183e0ab4
SSDEEP 1536:GAqrSnLU5BxYE4bP9zel9rbvjJvNCLtY25wJ0qPKldrT6LTMyT2ItH3RHTZ:GAqrSLSvYEwsVbrTfUPdqL4S2iTZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000004

Path C:\Users\Admin\AppData\Local\Temp\5brzkvqu.15q\Default\Cache\Cache_Data\f_000004
Size 383KB
SHA256 dc3af441eb066cbda7e42f12fb2b4a3df6f7d56b64b94ad8d099de55e4738c46
MD5 294155765131d445bb3d8e94bebe8d75
SHA1 b6e1cddb101abbddba067e18c9830f8215acb459
SHA512 f86e15e69866fbb47971334f45e19fd4c1ed72ddaff109696cc190fbeaed60904731be665cb98371bf8e291e9ddf7f9772ed24ffdddd21e3564d624c7d2b1bb7
SSDEEP 6144:D9KxWHBWzAY0a9Fufaaqy1h6wVY41jhnSJ5x8T398XPQUI0YLg8FHe8y8KwrTZkd:D4xWhhbE091h6FoSnx8T98YmYBFHIbwg
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000005

Path C:\Users\Admin\AppData\Local\Temp\5brzkvqu.15q\Default\Cache\Cache_Data\f_000005
Size 63KB
SHA256 a9c9c90931e351cba32704d61f1d329d7a9df76145a8d0dc71e194f293abf425
MD5 ceddc0ede5679a07157e742c028d8cc1
SHA1 48af4601ef9feaf67aa08de7e7e6d7f646db4041
SHA512 8c81f96035fe679bd86a4cc490d10e2754817be3fd08fe2a11a0a4bea82e3d102ed4d2a69e20ec347314658b51f931b17e9f3a1ea82c4e28256cc4165431ff66
SSDEEP 1536:RRLKoT08wUGIDL9uWiYp8araK2xQbypF449xYPMk2xmct/p5CWbL:RRLzT0E56c82RlypFT9WPMkYmctxsi
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00000a

Path C:\Users\Admin\AppData\Local\Temp\5brzkvqu.15q\Default\Cache\Cache_Data\f_00000a
Size 28KB
SHA256 b421c05a340e40d4d4bd1831521268b6f0afd0461ec3991cfa8d5314bf3207b4
MD5 57f9a7c7e2be49102533a2ceb7a05e51
SHA1 850ab0a80577b7f7effe196cba037899e71594c5
SHA512 66406d54a1d1a44f30e19a9bff1242b50fdcfbf66c33e4c23daaa756c06f50a2e39c991e7a8dfd9a81184cc37c2062d0406070be132e28a22307896e63b55447
SSDEEP 768:dT+CJ4QL+F8S4bApn9Ua0ndjCaixJ/fVW2/AGYnS:TJ45F8SgjXnNCa4fVWVnS
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00000c

Path C:\Users\Admin\AppData\Local\Temp\5brzkvqu.15q\Default\Cache\Cache_Data\f_00000c
Size 72KB
SHA256 d532c0033bd892149ba6d22122425ce16e0b9916be3b96edb5d1215892741705
MD5 e8397f14ee34e3d2661d6a762db8ce28
SHA1 c897cf196851f971ac0a728866c1bd1eba41590c
SHA512 b2a8530593aedc867af7daab3fbe40c2649549f977120bdbd073839efe8b5546c5eee83d5788262d0373c5674d90505d02046758b5f6ad0819e5dac71b2ba65b
SSDEEP 1536:Xllt4fEDp707LH1E9kb+zw4oGp6LHXDjMrupuAHnVY3jUUX1AqaPdJp3MdF3TsBf:1PdpcLVE9kcw4oGp6zXCun1Y4UXiJide
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00000d

Path C:\Users\Admin\AppData\Local\Temp\5brzkvqu.15q\Default\Cache\Cache_Data\f_00000d
Size 17KB
SHA256 5e41837a6aba4a285df072ad0290e7f9e1dc4682799f71e33222a3a0d6e5a082
MD5 9e6475d889c8916a680317ec48b212c1
SHA1 daea8c5b6cf03d05fb8ee7fcc18320eefd2ee0ca
SHA512 7c4f34e50b5bf4bc95d59a2ae648a673e4a7dbb9669f73d6512dd12521335297886168c5c00f60cca5f85a655265c49355c3ad113e62124577f75f45abaf534c
SSDEEP 384:DlDTvwo0JYeOCqDG+G8fPv4yDs3HsxaYprRr2y0BYi1n:BXwoy9OCHifts3HsYKroBpn
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00000f

Path C:\Users\Admin\AppData\Local\Temp\5brzkvqu.15q\Default\Cache\Cache_Data\f_00000f
Size 68KB
SHA256 fe2fbf50c33ae9e12935df44eb094e541236f27fbbd97ec1bdaec2bf03e69054
MD5 7f3bae3ddb127530a3b1ec2c8501a056
SHA1 3d2a9ec8ebda8961af05bd4f2fbe0aea180fa762
SHA512 e8a5c7cbb1081d5e229b231b3e50a2d0211082981a44628cb6e01dee18087b73240633f649fc1a0103f24613178973997d7a74961bd4ea7dbea49296c48b0e10
SSDEEP 1536:NupBZ1xSO3cQmUY/lbFBw70hbBD9AfA1pwdpPq3Yf3AZ:NunZ18O3NOlJpd+kpwdpi1
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000015

Path C:\Users\Admin\AppData\Local\Temp\5brzkvqu.15q\Default\Cache\Cache_Data\f_000015
Size 70KB
SHA256 30b4527ac16dda6093c174e8e842c7208d6c1cc26693f6f1a849d52b17b41d37
MD5 362644b225a27e4a658d69e9b17a8d19
SHA1 99e0fd685d570022b40800612b5dd13b801044a8
SHA512 cf1122d85319b28c69ccdf3f12b7362ffde1cafe952edb0e4a40370d1fb80dc6f8ab70e50ae8f07166c29e254d5a138ad8fb346d796752efbd14642afe5905dc
SSDEEP 1536:SPD6v1B+LiVECo6I6hUr2ZEwVjnZefbudrSb3fFQ9RMVFO:SPD6v1B+kvfYWnP5Sb3fFQT
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000022

Path C:\Users\Admin\AppData\Local\Temp\5brzkvqu.15q\Default\Cache\Cache_Data\f_000022
Size 33KB
SHA256 89ab09e7b2d516d5292607553dec92832148ab1a3c37529b7ae4a108477cc387
MD5 baebf31c834043f30f329f8105626445
SHA1 743c63a89cb813094b68af4b8bd2886624c1a08e
SHA512 c98727173145a6b93cb3c1790d9067503966ff617ca50201c68e60051269223cf728b65b439456bf197921324c3f133c057690e8ceaf3f899561def9dc41cf74
SSDEEP 768:AdkIw38+GJp0WyTh17LiGi3m6W2MNc+0lgntGsWEOn:AdzoApU2Gu7INc+0l0t0
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000030

Path C:\Users\Admin\AppData\Local\Temp\5brzkvqu.15q\Default\Cache\Cache_Data\f_000030
Size 16KB
SHA256 23cebdde3aa3c9b38e0647ae2bd6daedae2f62adee6521dbf726731d00bf14b5
MD5 fdbdb95b5ac5c4edecb625ceaccf87b5
SHA1 8da620668bc6b3ee6c2eac8c258d80afa06ead0c
SHA512 08c9c96ffa14e4be65c50bed0683a5d817ea190a493cca1119dbec30807a9e5846baa86c96dd97603620ee67c3acee2cda678cb246fdbd033aed1805aef1d2f1
SSDEEP 384:BhBYbM/UQhdWQz2xB4uINwHHKwq2Lx+J7Yj83GyEskVvyWpg5Fe:DqQUwWQz2xBrnnbNLUBYI2yEVVKWpn
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000033

Path C:\Users\Admin\AppData\Local\Temp\5brzkvqu.15q\Default\Cache\Cache_Data\f_000033
Size 37KB
SHA256 6df0197d5710db66a7ef315a0576051377f58955d73c1f4b23db7ad183df8d3a
MD5 69581708d86ec10c6489065b51ee5483
SHA1 91fe71d2a355d958d826f336a880c844a72c13cf
SHA512 7931780512d21f926e193d29f39656e9d4b626487d81d58b6977054ae78d941860ecc56eb1c6ce042431471b871a0c8b0efe09b2fe40eaf5214d45ae16c585f5
SSDEEP 768:tx2YIheOWrWX5LytLNWQho0hd7NV79tIQNY:tkY/8ytxWfqd7NV79mQNY
MD5 SHA1 SHA512 SSDEEP

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Temp\5brzkvqu.15q\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 192B
SHA256 0657d107bdce972e7d49d10499a8f5424bdc943453305a757fd4b99812cd4d61
MD5 41a986a7da6deacbc14d02be42c1bac7
SHA1 21f3cfa7830f6417eb16cd4ae099c9fd1fa2ba81
SHA512 f1d1064f59b71b645bf4e0a3d8798327ce68deebb3d82b439f5308d2cc22bfb5c050b6b9a2b2d17305d0b8317fe4ccb7f90b46cebd96abf514eb8593e9c2ec90
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Temp\5brzkvqu.15q\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 255B
SHA256 620f442eb55af4e9f4f1c90737cc9c82d231908a68e3b7acf3737eabe3216dd1
MD5 0aeb52092f3cd705a1dc62669226e7d0
SHA1 4986544533cf34b492d397979d32ca0482f599b7
SHA512 b169efaa3521b00e5c5a3f816a7d7c081bf1af3b982824e01d1a24c8a02f468c0c4e3fee5673128349ede21b73a3a4bda8ef4cb894dccd91abae2e62efaf5516
MD5 SHA1 SHA512

Submit Download

index.txt~RFe5804cd.TMP

Path C:\Users\Admin\AppData\Local\Temp\5brzkvqu.15q\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt~RFe5804cd.TMP
Size 119B
SHA256 3b725018f703c6d5f815660febf9ab2376657a5b0585fccc8ecc468d3a2ab12b
MD5 858e15fcc956cf146c6424efc5be93fd
SHA1 313bdb1a1c625520a91e7f85596b7a80191e4a07
SHA512 ca8d2e739f15dc036664f589ffb68cd1dc9153764bb2f36af88a064a02688c9065d1d45cdf93270d73e5d3b2ae9f02d62e53082428bfac3747aeb68a7348b3b6
MD5 SHA1 SHA512

Submit Download

Trust Tokens

Path C:\Users\Admin\AppData\Local\Temp\5brzkvqu.15q\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens
Size 36KB
SHA256 19e1e0d60dc0a70455014fec98b5e4b73e93a80651600368745ab0d4a49c9529
MD5 4203aba60fd9de5b4232fc624db3f817
SHA1 1f07dfc552d6b509c83c36cb05986007ce29e250
SHA512 6240f8ef505e093f0ea99306adfa90969b3de094cde08b61076bd2c737763c0815108f532ec17e766fe15f9b1bcb9d82096f799ef04d50c3ce2305d8247bfeb1
SSDEEP 24:TL33lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:TL31DtX5nDOvyKDhU1cSB
MD5 SHA1 SHA512 SSDEEP

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Temp\5brzkvqu.15q\Default\Sync Data\Logs\sync_diagnostic.log
Size 2KB
SHA256 edfc3b061e23ac5eca144686e8fc6a41462c51415c5075286703dbe12c17fb11
MD5 d03bcef84dd1a5d91d40a29dd340bfd6
SHA1 4d1eb100d0801ed93f37ed7ebc9ef9a22e39e333
SHA512 99e571181b697f574e98cdac920886c6f6591292c8a6172f243cb700a4083c13ebd6cd5f0955be7e7c17397ce16d33cbeac85ff6b02136e593b5ab114d2a8048
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\5brzkvqu.15q\Local State
Size 4KB
SHA256 2cb113ec29216e99efde24bf3c4c10f4a2c55681b41d23e9126c35bceb65b186
MD5 25b5d20cb202ab8276a7baa94fe29849
SHA1 b86caba5fe530c3d4909f3d2b4f1867a7292733a
SHA512 a7da15135e94556ac4c7a7a7a9482733f1580a78b769a42c85a3e500060ac56094491ffd1950d288fb621158a23927641db6788a087e8f9777ac77c2e5fe3657
SSDEEP 96:cqGNkCufleHLIe58Frh/cInURoDotov/HD6B4cvLWMmJQXCUWBAa:HGNbOeqooDUwLqSMS9UM
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\5brzkvqu.15q\Local State
Size 3KB
SHA256 36d35ed5ed862d0be61f57c577fc915cd0ac37ef6a6e1201341a1ad8b8e31e9d
MD5 c45759cfdd41a9db12b6c088acec1207
SHA1 acfef81167864300a80211f578400aab491acfa2
SHA512 7c2234a9594fadb0e07c1c592add575a3b6785771165c8d66875d59a08ff2ee07c58da9b5d784e85e0bba7ab152943333b8aa191c88e3c5f4ae9e065a9579625
MD5 SHA1 SHA512

Submit Download

Local State~RFe57f84a.TMP

Path C:\Users\Admin\AppData\Local\Temp\5brzkvqu.15q\Local State~RFe57f84a.TMP
Size 1KB
SHA256 36e9260bb715ec57e4bd47c1d75549a85cf41cd69e972ab7e7fbbf7bbcd1d4ac
MD5 d699b1335c8e10abfb2c093b21fc4095
SHA1 06a56ac0803c5d1ec7b2b162d5eb691dbbe12d39
SHA512 baadb133f016f236f99e3227764138f0e46ec6c5ee040b7384e2524c7f6406e1204ef79e0ae9bcc77b5c7dc1dd2688bdca1a8ea177779a1329ef778579ced251
MD5 SHA1 SHA512

Submit Download

wctF136.tmp

Path C:\Users\Admin\AppData\Local\Temp\Container\wctF136.tmp
Size 63KB
SHA256 543796a1b343b4ebc0285d89cb8eb70667ac7b513da37495e38003704e9d88d7
MD5 e516a60bc980095e8d156b1a99ab5eee
SHA1 238e243ffc12d4e012fd020c9822703109b987f6
SHA512 9b51e99ba20e9da56d1acc24a1cf9f9c9dbdeb742bec034e0ff2bc179a60f4aff249f40344f9ddd43229dcdefa1041940f65afb336d46c175ffeff725c638d58
SSDEEP 384:poaSLGTSy3S0XuMU9mCzHS7vpvpJGV6Hu/i49Pji7iJI5TZCP56vS1xDR+dBUFvT:WryF7U9mCzHS7vu/xV2iP56vcDR+P0T
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\qrqmnwxb.ptm\Crashpad\settings.dat
Size 40B
SHA256 40f88a08214208bd6f09b2f709b483ea5dcbb6101f1e10f396082f957f07080a
MD5 1be0aa30389034ccc9a28a1b51417b8a
SHA1 4d208afa9f8b6f81926f66b80865533c15d0275f
SHA512 73c04c14551d38f0fac350c16c1a7c743bc82d596a534d8fcb5781c2c5c7977873debd0faafb0a8b431b047576e43cdf36ae391176e3520d269c951263a5052a
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Temp\qrqmnwxb.ptm\Default\BrowsingTopicsState
Size 414B
SHA256 dcb06c8bec88ffe9864646ed72870d9bc6f4424eab20953f10e04a244b09421b
MD5 41ca42dbfcadfeb0767176ef3dc70d6c
SHA1 c38a083722f205e01685fcac7ad1ea7f3abfd902
SHA512 84a8b8bf8f356a2dd9dea0ada6ba86b9288fe663c81e45b655c9c20825def1219936af5f9f503fa60d44dbd3a38d2eaaa2f19b5bc7fc34e4de353aff82a5cb09
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\qrqmnwxb.ptm\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 f4f3856502f5785f3a29b0cbe7884486469838f594f46ea0cd4fae464e612703
MD5 f3699ad952704d64addaa69fec70a6c9
SHA1 1fe366af61173472562740790f4b32dc1fa2deb6
SHA512 63507db2a346f349f496a0f30cd9ab8614869cb123ca59c2720b381bb3f461040c6ac6387b3c7524b4665518cb9aa0d0004673763724f5c3c9041c8faf41e1ba
SSDEEP 12:d7XlewSaABMlZUu55xtgyEiUGPE2R8GhE:d73yBQZUu558yE3GPE2R8GhE
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\qrqmnwxb.ptm\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 3aed44cb4933c041aa3474c196005c5511ee2e23b5ccaf10170d0de9c08afb31
MD5 570d7d6970fa0da4454d1de7b9536338
SHA1 c941bb88c6bad54e419a450e140f13661200bf65
SHA512 bc956f7ca0d78e15f875417ff1067eae4ca20ada7ba8fd97d0d4a06d7f097b327fc91ccf0fa66f19daa61fe141256cad0b9674df0db4454bf7c5d15eddb08596
SSDEEP 48:oxYVoMCXg/MiX39RGxoyCqS8aBCymbaI9W0:f6/g/DfPDqSCy0aV0
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\qrqmnwxb.ptm\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 9809ca6fcec6a6699a6ce82913198870e36798e30cb5d3504bf66b4dfb1fa5f7
MD5 661767d436e120b0551d71bd721247b5
SHA1 d1706e9b5123e6d72c1c4e8f13003d3b8390706d
SHA512 2a3a4bc034fda8335e1431245732e791e18db8988e32087b797c4aa7cd669002918f124d3fd60e8d3ad1d8c1d2b8bbee7e30a1dbef5098c9e776c345cca2aaa2
SSDEEP 24:WTqkGCDOj2NIRqBXQ8XloJc0C/PuhPgg1eA3uRxbagzu3XOJmlOji2:NkGaGZRqRdoJVCehPgBADHHEmlYV
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\qrqmnwxb.ptm\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 b51d1676355940b4bb691abc196dbc5a5676fb806f3b8a5ae6943e9ddb2deff0
MD5 c5e77a0038df2e8348a94195d62e4aac
SHA1 3e19f4f8f81fa50fcf229939872b65f221b1a77c
SHA512 c4500337d8c272607f81c500fce00205b0beae9e9e38043112b6f9031692f62b29e17adda518e51bbaf2be6b5367050a0134f8026d8ddfdf7072e2f546b09ef8
SSDEEP 768:VVUfDPLSgcRUv+Rv4BUfDPLSgcRUv+Kv4GUfDPLSgcRUv+hv4Ppizx31Ls+echyv:VV3JXPzxNUc4P6T
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000001

Path C:\Users\Admin\AppData\Local\Temp\qrqmnwxb.ptm\Default\Cache\Cache_Data\f_000001
Size 35KB
SHA256 4db4d9d84125eef7c732d2fb3b1996deb7541a83cb74f46782655fc8abc87179
MD5 48a4bd8cfade87fb1f576b5e826d24b1
SHA1 e7f20ad8f2e720444759572289edf21be124bd59
SHA512 fce9368cedc92c65677821680c2ccdc8ae2579e02b035e8c7424391366166ccf85a6798de98e3e81b4e93f2e338e8ba8d5a0bfbdd7dec378a832458c2a9b716f
SSDEEP 768:mhcCE6JD34N0wgVyzKiTF4lh4fWK92hJSui8t/HY+Nq/l:McMJ8gXFluf/9T7y6N
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000002

Path C:\Users\Admin\AppData\Local\Temp\qrqmnwxb.ptm\Default\Cache\Cache_Data\f_000002
Size 68KB
SHA256 b0f592feb5003c94afb3480a2bdd50bd75b94138cb8ef900e263814391dd13a6
MD5 a532bb44c3f6bbd0ac7683e6865987f2
SHA1 7a30af4811ace68d5c3a8a96ba7194e7d9198fda
SHA512 17d2d19c9f748ce63b234442cbb26714cc42df64a9bbf1077cd10606df4373deba77a61ea2cc9adecb7d10f61dca524d21b656d6366382501ff1fb902cb77b73
SSDEEP 1536:IigmpgVcOkQZyClVrA2HkjRgD3YCORtiPjCiIV7gzQAGFglpfyiHrOv:Ii6FzyClh5kaxOriPAKNGFSy2A
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000003

Path C:\Users\Admin\AppData\Local\Temp\qrqmnwxb.ptm\Default\Cache\Cache_Data\f_000003
Size 38KB
SHA256 f9ad4fa1adfc18c4dd4b6e8b0aec3991749370ace523aa00e094d9eadaba6dcf
MD5 1fd363e44327c5e74ba59a663f190419
SHA1 5766c2a04931b7834cef2efb92fb501f58ae0e42
SHA512 e23cce63fc528598da30f17f330755d2b837c6aff46130f335ac0eb00547aad0039d76f9a5bf74aa1d6877c3b067a6abac44b50fa8496959a4d2f81535e1ffaa
SSDEEP 768:WKlVzaWjdNYbC92iImwXG7o2QHaKWiF8B5ccJ25h9Z6g8ysY3kEhTn9Jl:WQz7SC92IPo2s8B5c7Z6g89Kp9Jl
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\qrqmnwxb.ptm\Default\Cache\Cache_Data\index
Size 256KB
SHA256 d2a08784d777838954da0213021ca7a4bb3d58c6bcb4785cb60343fd9874828d
MD5 0f17bfad31955b16857d65fc58a96ba3
SHA1 dfc28382549e8953fa94e866b2d78af2814288b9
SHA512 74276eaf612867e722809c01eb27d004099ad8e890cafbe569bd62fb42df2ecc3bb08fba008d807819adce817273899e8763297510ad2f90694fff8193fec9d3
SSDEEP 3:LsLllNlNllklkXlblwn1Sllx/911pll//d/Ql+/lME/dlXlmNtl:LsRt3lPBSIZl/VqE0N
MD5 SHA1 SHA512 SSDEEP

Submit Download

7018b8cf1c3b00c7_0

Path C:\Users\Admin\AppData\Local\Temp\qrqmnwxb.ptm\Default\Code Cache\js\7018b8cf1c3b00c7_0
Size 306B
SHA256 904aba312893c0a6d6eeb9637323da2f25cbf03c95e7c1fab3b28f9be2571bef
MD5 ba23335ccd3b9a40ae3aba3fb479f1fb
SHA1 34dc2e39d1cb81e2439188b4bc001e0c78fefd9e
SHA512 2871732dd248046151f7a12c7802192f8ecf55494a32997730859f6c2b4d1ff1e39f910e3568f9d44bedfc45352c3335555c41b75910ff107bf22a389e5af641
MD5 SHA1 SHA512

Submit Download

ba678a2fbd8c358c_0

Path C:\Users\Admin\AppData\Local\Temp\qrqmnwxb.ptm\Default\Code Cache\js\ba678a2fbd8c358c_0
Size 298B
SHA256 c52057d62f9ce86babaac82ae5fbaad51533f1fc2c0e64275647652f5a62e107
MD5 5fa11b42fac071d5e0d98b91887ccd6b
SHA1 be6c20deb27dfa9824a8dc96d59cd5357a6dcf26
SHA512 cef4819346500e179282de9c2a72ff3654904045b0b08b837246cdf635c171885b09bb4546fea56e6a8fcbdf7c2e6c4df01f1a597ec101d3f8f835241e5a3f0f
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\qrqmnwxb.ptm\Default\Code Cache\wasm\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\qrqmnwxb.ptm\Default\Code Cache\wasm\index-dir\the-real-index
Size 48B
SHA256 dd98c4d3a2fbe2e7c207788514962b3234e5b639d57bb93a299ad5f8c108fe71
MD5 09673d5337249237903428853f4e63e6
SHA1 54df99ca72be8cff07b475e1f675b48ac265f68e
SHA512 aa422e244e1a19bfda4a704be98bd9e1cf7f7d51799814c9a6f597a646994aa86a91001157c0b2988091b3cbc88d472c4b3366019b097e669eb213932d9da4ae
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\qrqmnwxb.ptm\Default\DawnWebGPUCache\index
Size 256KB
SHA256 74444b200a220d1a7128c2c0a90e2cfff0fc5ef7be4af058ab76bd349aa6b27d
MD5 2328435323692813d23eaecff2f1e5bd
SHA1 0386b6366d187042f90b22e2e9ca26182e293568
SHA512 179fb79b28e8c0c62ea4e4c3071faf31545044f5c19430e13bdc940f3abfea05753887830a136f9b1bd02911195a9a0d5376c1ad6493f4f71829c7060271b9a5
SSDEEP 3:LstlNllklkXlU:LsX3lPU
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\qrqmnwxb.ptm\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

128.png

Path C:\Users\Admin\AppData\Local\Temp\qrqmnwxb.ptm\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.97.1_0\128.png
Size 4KB
SHA256 75da533888189d13fc340d40637b9fc07a3f732e3fcf33ec300f4c7268790a62
MD5 35696aba596d5b8619a558dd05b4ad40
SHA1 7ecc1dad332847b08c889cb35dda9d4bae85dea8
SHA512 c32f20865f736b772844aaa44572369e7ae85b9f2f17f87d61694acc54487309a32bc4830ed8d9cee8b593babecf728c1ea33c2b9588649be0e4f1e6ed7ee753
SSDEEP 96:BCspUuBfy1PI2JIwOKpGzJhvw3ymK198EfeCW74mWQz3Z+1nl03Vjkq:BCsfly5TeFKpGFy3ymK1+oK4zQ1+Q6q
MD5 SHA1 SHA512 SSDEEP

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\qrqmnwxb.ptm\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.97.1_0\_locales\af\messages.json
Size 908B
SHA256 b40bde5b612cfff936370b32fb0c58cc205fc89937729504c6c0b527b60e2cba
MD5 12403ebcce3ae8287a9e823c0256d205
SHA1 c82d43c501fae24bfe05db8b8f95ed1c9ac54037
SHA512 153401ecdb13086d2f65f9b9f20acb3cefe5e2aeff1c31ba021be35bf08ab0634812c33d1d34da270e5693a8048fc5e2085e30974f6a703f75ea1622a0ca0ffd
MD5 SHA1 SHA512

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Temp\qrqmnwxb.ptm\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.97.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Temp\qrqmnwxb.ptm\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.97.1_0\manifest.json
Size 2KB
SHA256 ef67877af40d32f48d45e0fc44245f191e795b64ead8f4b87664ab80d0ca36a7
MD5 580173b7de156e29884d4f57a66ec07b
SHA1 9f08b09fb87b9db088c0de9c1af37fcee1dc94d8
SHA512 fc1d083171f4b25de0d4daa432ddde852bc160aa9fcdd7668438faabf14dfc75f2854a4936aea9990b3e487017f2f2d41a188e915a1063055b67456c859a9e1b
MD5 SHA1 SHA512

Submit Download

offscreendocument.html

Path C:\Users\Admin\AppData\Local\Temp\qrqmnwxb.ptm\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.97.1_0\offscreendocument.html
Size 97B
SHA256 b9fa2d52a4ffabb438b56184131b893b04655b01f336066415d4fe839efe64e7
MD5 b747b5922a0bc74bbf0a9bc59df7685f
SHA1 7bf124b0be8ee2cfcd2506c1c6ffc74d1650108c
SHA512 7567761be4054fcb31885e16d119cd4e419a423ffb83c3b3ed80bfbf64e78a73c2e97aae4e24ab25486cd1e43877842db0836db58fbfbcef495bc53f9b2a20ec
MD5 SHA1 SHA512

Submit Download

offscreendocument_main.js

Path C:\Users\Admin\AppData\Local\Temp\qrqmnwxb.ptm\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.97.1_0\offscreendocument_main.js
Size 135KB
SHA256 7a64c384eaee7579f0c07dea3d49bc404cedf21fb060e736949f523e8af656db
MD5 ea3a1f7fb8dd2996fb5e066c10c7154f
SHA1 cf3c11aeba964e303f9005d65737dd0d6e2033bf
SHA512 eceb8cca0c4803a1144aec47b875cd8d4b723c22a1d1d323521826db37cb8536384b0905b25fc7337e0a94abec45c6c70d1d0a74c3a71e546a11fc402fcf1f5a
SSDEEP 1536:E3oQjxDHEhMS4L8MrOUZfSj3rZxOEzt2txtKjKtvLH33XnmSzfQhXPJ/s/I8eNhC:b44Mr+brZxOEgKjE7ZfQBNsI8e3yu6LL
MD5 SHA1 SHA512 SSDEEP

Submit Download

page_embed_script.js

Path C:\Users\Admin\AppData\Local\Temp\qrqmnwxb.ptm\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.97.1_0\page_embed_script.js
Size 338B
SHA256 399909cf76c833fc5fbaff5114650a614c031b4fae4eea53f3d71dc9f28bd94a
MD5 cfe7aafddfebc707c0c442c52e6bd945
SHA1 3ff1a1e907dff4b50d9348bdaa26eb7c2cf4bc60
SHA512 9aa528edcecac167d13f5faee0bf7d5f7c1b609bcba32ec4aec6236a3812a79b0ae38e74232e0361ceeffe67e99c19978fee08918ac01a505e16fef919a8cd73
MD5 SHA1 SHA512

Submit Download

service_worker_bin_prod.js

Path C:\Users\Admin\AppData\Local\Temp\qrqmnwxb.ptm\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.97.1_0\service_worker_bin_prod.js
Size 141KB
SHA256 01101df3341dff41f5e9dc5d4191ae135a700c03d28233f9f2704f6c6d92d799
MD5 7b0d1dc77da0b32f7c273b9c57c5d944
SHA1 a2fb1ee3a525609c1d9b95ad3212d64a717ed432
SHA512 2b8b08bb3a0fa9a7c302ab38fdc0bbb63d834f04cc5171323a1a27da001e3c42185711978a8659d1b5e45cc5b7145c11cf4a7217815e8aa00c3711b2f3f27117
SSDEEP 1536:S6Vj/O/Wl38TfNwJDP5s/qu4nQsea4VQvtwKoXA8Gss2emSuiZPMTER9/M/KQiXn:2TGqsea0KoX3fiZ0IPMKQLGKwQtAig
MD5 SHA1 SHA512 SSDEEP

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\qrqmnwxb.ptm\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\qrqmnwxb.ptm\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

32.png

Path C:\Users\Admin\AppData\Local\Temp\qrqmnwxb.ptm\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\32.png
Size 1KB
SHA256 c0b2a99e82bfa9b629fc903c77bd36fd3b148b25fb67ae196cbda262c593efcf
MD5 b422f26131f7d87105b2ef5bcc8996d1
SHA1 5bebedb12720c3b09dbafe9204bdc8eb0f7971d4
SHA512 1a4b3406afb311ad824a1adfcb33f336de09efab34c66e058936a57d4f73ac33431eacf1fdb11f516f56107a93741aab3b9fa5c85d805466ca58c3e24bcc9c28
MD5 SHA1 SHA512

Submit Download

48.png

Path C:\Users\Admin\AppData\Local\Temp\qrqmnwxb.ptm\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\48.png
Size 2KB
SHA256 a16b7fa466101581d443223247589ff21fdf73f1b09d43ac740fa128d0252931
MD5 33da9ad751e4a3b21bfccca9e6727e8f
SHA1 05d5ceb6a2b80de82a2f70442f68ae803dad22f4
SHA512 5af9ef87eb7c050158b7add761ca06273094a5a2d5dba87991c7ab20fa2dfb7e7f7ebf1fbae21286781144ec1fe3531457deaedfd2a668975dc7184020c6f0a9
MD5 SHA1 SHA512

Submit Download

64.png

Path C:\Users\Admin\AppData\Local\Temp\qrqmnwxb.ptm\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\64.png
Size 3KB
SHA256 4fea2d966296665a3ae1d35c0eae541b0ef7b9b1a9890e9e65314f80db5a3e21
MD5 1efcc119d02c61752598ca121cd0babd
SHA1 6d0736581b02aee66d51fe29e68babca6a59fdb5
SHA512 8d5554a167907f96720a126e901aa25f01e1f58f9469f8366e7f2352ce16da82fa3963845cdd586837c5aeafb3092a2aec6d3e755bec2031d12325b4799d44e1
MD5 SHA1 SHA512

Submit Download

32.png

Path C:\Users\Admin\AppData\Local\Temp\qrqmnwxb.ptm\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\32.png
Size 903B
SHA256 217f48c637316cfba706de86339bbdb5f6d60c0fab701fc71ba2da01ea71bd99
MD5 166a9c3ecab6cfe73664f783d6d49a89
SHA1 0b9e5c909810c2d2b40df3fd4c8feacebad846c9
SHA512 d3da9c250dd728af13e8eb1ee75f420b1857357e7afca9f93090d253fb6cba43bb52b1199725ce3683d7e0411af764333ad2293ada77638847d2526b1b363d3c
MD5 SHA1 SHA512

Submit Download

48.png

Path C:\Users\Admin\AppData\Local\Temp\qrqmnwxb.ptm\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\48.png
Size 1KB
SHA256 2e201cd442e08720a6d4e38516ceea3e892dbc345db1835441e9eec005501c67
MD5 19f9c11e56103a25a50b9c33be84560b
SHA1 266f57c5a015281d4dd266a9b3dec9cb3a754653
SHA512 964e1e6d787450b837f130a4289906ac39277fcd4a98f6314e5aa0450fff81fae275f023c15eb58548ef3ada0b7363e4e6b3d61bb326246f3dc63336d68bb160
MD5 SHA1 SHA512

Submit Download

64.png

Path C:\Users\Admin\AppData\Local\Temp\qrqmnwxb.ptm\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\64.png
Size 1KB
SHA256 a693bf9d32c7ec663b864a2faa9b99d8bb6cb76e332263f5e9a6e3fc2ba60ac5
MD5 1f695a492ddf318b832bb48f5b9442fc
SHA1 81eb257fc22a30c4e75454ea0e4677043367a6f0
SHA512 0ad7e376288ec7a2d9314447f2649bb19bb703bedc9710a758e7a15e39083150aa34e2a2e6c22229b324cef4e41c09289c90b445a413336d6eed497f65d8bcb3
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\qrqmnwxb.ptm\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\qrqmnwxb.ptm\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\qrqmnwxb.ptm\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\qrqmnwxb.ptm\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\rhhldx0x.5vb\Crashpad\settings.dat
Size 280B
SHA256 768050504c08886872603dee5f3b8a03b910d8e2c6aee587ff144dad31f44c2b
MD5 487d3ff5a9d1c732ecdc1132bc06ac6d
SHA1 3cbdc2b461702b200bb0fb64be731fcad020e68d
SHA512 67dbc82970cd595c45ee3db218ee2c0060a71760f8e151ca65c422714febb6a1c5b99f682b7b164855f64f0ab0b25fb875b62d3fcc7fba743902198a8535b2f2
MD5 SHA1 SHA512

Submit Download

84ec134e-2993-4875-8b6e-df296f439bce.tmp

Path C:\Users\Admin\AppData\Local\Temp\rhhldx0x.5vb\Default\84ec134e-2993-4875-8b6e-df296f439bce.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Temp\rhhldx0x.5vb\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 192B
SHA256 07a1e790c74ff515fb26ca285a7d6b7d956f027fb836764f4e86fd4903483677
MD5 d7ca1f88c276f785c2f76ca8f977c1fa
SHA1 8d6e3c66322776388c6ce62667d7758d76985201
SHA512 8b7f7e3cdb847ba983c6a7103c9705b0ed25eac221bbfe7223ba1d6697434180eccf9add55bfceb2697592f3c3027fe8bbc1ec8878af58cd5363af98527992e5
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Temp\rhhldx0x.5vb\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 257B
SHA256 30cfe580165956081585effaf5f16eb5544abc4d2b4f1ec36fb197075a56a355
MD5 6b33303eeeb0b2d9d3b7958c53fd134a
SHA1 d9264e917cdfd1109069f7849f07119779bd2d8f
SHA512 49707924c1d927653663ed8ca3e0b1ef02045d32739c43c8f5a832a51981967fc28f0737501b496cdaec883819772d4993aac4143c45cfd09e9a4d2fb9c5216d
MD5 SHA1 SHA512

Submit Download

index.txt~RFe57f0b9.TMP

Path C:\Users\Admin\AppData\Local\Temp\rhhldx0x.5vb\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt~RFe57f0b9.TMP
Size 119B
SHA256 8b358cd6ad34ee265f1c1efba0cd48f851b1ad6570b6af65a9d886f9a1d76e63
MD5 a72869fda5a9a39830b5d7fcccfd998b
SHA1 0a6f88dc5f126850e2a572d6ae781c2af7ea8974
SHA512 0af9c8408a2ab616ccb159062e352aaac64691fbdff95e6616bc7be73dce817ef871b8c24be44ade4b430876424641084876d33c138f511c5bcffc024baeebcc
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\rhhldx0x.5vb\Local State
Size 3KB
SHA256 7de272a052bae50d3378ebba93f66fd854bee66d51cf2fd8b06b51a3ee72393b
MD5 49fb1db16fdf444edbb5ed5823e5d678
SHA1 90e28f1adab619d3545c29dc95091837f6c17a42
SHA512 2ceb260b792fc427bb19c5270e4bf72c1b394b2242c5ee1f07294b5191d29a24304d0fdf59419be267a07779ca3ad34b949222b64e07519646f9c2f1a8788cd4
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\rhhldx0x.5vb\Local State
Size 4KB
SHA256 e1ed65f65eb4fb308c5676081408c77e1225ef07de9d29e2a5f90b4a25929c6d
MD5 868b80d1aaa2aea04326f103d669c3bb
SHA1 960830821b15b8658d42a56101230e597621dd80
SHA512 bc0760e9c20013b30551fb0c3bcb317880be83b1afefe74ac5ef6338e39f51e5db622ad583af09cab36aa397970ecd5c7f2d43a5438041d1d11e1f7a17f5638e
SSDEEP 96:ZqGNkCuflOT/1Ti58Frh/cInURoDotovJ3PDAB3PTvEaZYWJ4CUPaBRa:gGNbO4/DooDUwdk/tYC5UP3
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State~RFe57e32c.TMP

Path C:\Users\Admin\AppData\Local\Temp\rhhldx0x.5vb\Local State~RFe57e32c.TMP
Size 1KB
SHA256 d43a8d4d6ff39d268e9a11b9d02e2a646456d4a84b05f5b3fb8f5914d3619d5a
MD5 ec8d05e3e2edaccd0caf3aa2c19c1c22
SHA1 923adc82c4b7238f34783c067f791512d013fc37
SHA512 6323e774aa84573b4646039251247a2b7933f132a7da711cf1c966cefdda07b88038b9f1f646811e4d04222e27a77148787f56ff14d1c16b3ad35c09093c4107
MD5 SHA1 SHA512

Submit Download

5b11e251-a60b-41c1-bb81-33b56ed82586.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2548_541477323\5b11e251-a60b-41c1-bb81-33b56ed82586.tmp
Size 154KB
SHA256 a468f5875b4e55ea732e3df283b4f4ea941be738b238122979ca5d8006a3a8fe
MD5 4ad81f6ccc657d1da582c75c5db037cb
SHA1 ab0370e7d32ebed71fe9787d3a4a2fc0c652a28e
SHA512 66461474f8b36d6d470797df9d4a3cc4698bceb7054c97166eed98b74def84f58486fdb909928aaeafee793799a436210b5d7091acce6232b23eb6ba926ad227
SSDEEP 3072:OqeD5sKZ7XcbMSqnDhcfXE0IfnpWpyKIrFn2wNkR7aUPuWm6u:yD5sIXcYSqDGc0kkpIZ2weeX6u
MD5 SHA1 SHA512 SSDEEP

Submit Download

5d6b976f-c0af-4684-a7a5-047184ebc349.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5284_1907310920\5d6b976f-c0af-4684-a7a5-047184ebc349.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5 SHA1 SHA512 SSDEEP

Submit Download

9IWZYQQB82DREOWBUHLK.temp

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\9IWZYQQB82DREOWBUHLK.temp
Size 4KB
SHA256 22923fe04ee62b13f28ba84c909eb58d3e04c06ce5c8ab5543438fda6b717c34
MD5 0ee1d7ce04761cd7badd3928dc38e9d6
SHA1 54c7472359bd3225f5a739620d5ae4591fb29747
SHA512 86733190b68a6129cff7f67c50983665587901bc63924f4751a89e827cb8eefc030e403724dd5446d4ff41f4d0f609b3b382cfd92fd53cc78eb12039ebbf2311
SSDEEP 48:FECudOmjyC/lVOOJ9zUoYgdLXuHTQp7laNCudOmjyC/lVOOJ9zvY1gdLXuHTD27E:GeSmIJUo1u01CeSmIJvKIueE
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vozqjwij.default-release\AlternateServices.bin
Size 6KB
SHA256 c8b10036ff743d552e5cf25ed11f825c3a7983485a6daac1520f84b80772f0e8
MD5 abfccc01f2bd38e794398d87c579b84f
SHA1 6d8161d0af1d5cb31ecf3b973a189e821258407d
SHA512 5d0e85a60aafda4ed86d7365b913db3c90e0f067ccd1538ec9674385501ca87f7e7d0713ab2eaab190d58b16229b7aa99e7e597b30cbcf98a02ca7b6201a90f5
SSDEEP 6:Y8gidpq88gidydgiddAdZyy27Hgidpqs7HgidBgidBfSdZy:Y8gQpB8gQWgQdAd4y2MQphMQSQpSd4
MD5 SHA1 SHA512 SSDEEP

Submit Download

store.json.mozlz4.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vozqjwij.default-release\crashes\store.json.mozlz4.tmp
Size 6KB
SHA256 55f1688934118216ac13747eaed88fb8d30960c4c1ab43dfa713180f7e34ea9d
MD5 28ac1aadad9d06e1715fa2e83bfc5ab4
SHA1 5043cf868458717252e7fe018bdbe9bdadeb7421
SHA512 4ed3fe4690b9a3d7ef74e08ef9a5f42de0efd3ae34949dfd0ca2ca1ab9b2d443ef0df48501d4c8abbe659ab0bb54ae81120cc6ae53bb65535b8c16ea16c243d3
SSDEEP 192:q+8MuewJ9X9sCrRR9PuD7z3I2cd9f7d6PLWUuLSYGnSPDS:JfmL9RVs7zY2cnOluWd
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vozqjwij.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 4002a36c15576e885058b5d0de6ce90b3a2dfcfd70e54a3afab1b59e4e138543
MD5 1fba75633c91cdf84cf7a18c3103ff65
SHA1 8ff31deb4b2cd4c6185d2ab3bf9b79c3892e6a7d
SHA512 8de282bd2c4ae2d1b5ac361dd5ea65769be3aff70458eae37a9c400c42a5b3b2317064fd4e8be492deabdd9936f4075f24fba34dfcac001ba352fa1dde4bdbe1
SSDEEP 192:SMOv5zboNbhxyjqiScO1/66Joz0dzgCl6mSSdz:UboNbhxyjbo/66JozQzgC1bd
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vozqjwij.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 5572c15bf2e21301e76e8d362eb3596d0b174d8542bfcae400d7e0897d5261b4
MD5 3d5baa00ce3267590422479376706745
SHA1 3fe6f91ae5e7fb5146f7c79f25365043a730891d
SHA512 9095611c16a036fca7a03476a6417beea94411351bd3cab1b37a7df49afdd0cd4f4f086595db306c96baebe2894029c09451dd536f2247b4dbf35cf328fd2508
SSDEEP 192:UMOv5zboH8ZhxyjqiScc1/66Joz0dzgCl6mSSdz:ibocZhxyjbG/66JozQzgC1bd
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vozqjwij.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 072ab679fb9e1bc20fe72e24f69a1f2e61a2b95bf1ba9bae35e34034b121b0c5
MD5 4443c221f514577c03a6ebc7543383c8
SHA1 f9a52178bb98135ae4b58de5d03739ac01328b37
SHA512 a686485ada54f9047ec38bf6240b679070f999952b8f2b61f5c1e215167b3dfd4b951e744da3c73da4cb01dcb7a73c864fa0d335ffa74f79c254d2154fdb8e2a
SSDEEP 192:G1/66Joz0dzgCl6mSSdNMOv5zboMbhxyjqiS:g/66JozQzgC1bzboMbhxyj
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vozqjwij.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 ad377d2821761f464f86bd01ce815ae261e5abe402046bba53f270a8dfcb3b74
MD5 592eadf1f1a59e6c2713a55ed007ed2a
SHA1 17277ca1768d5397e818178938c5ded4a13409a5
SHA512 9665fb8ab35fb08ef795858c871bf771255f9051c0fcb99031d9b146e5f8a1d529f67b51ba69a51bcb1df9779050a33c98e8cbdeb6d04ffa6ee8076b7876fc53
SSDEEP 192:QZ1/66Joz0dzgCl6mSSdjMOv5zboHpZhxyjqiSV:QX/66JozQzgC1bxboJZhxyjW
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vozqjwij.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 695ce9ea3987b85d234ee980ee34dd816691b20ef8e1700b43325992faad9c1c
MD5 90d623777d61839c1a3039b5a288fa53
SHA1 df4c48658a5f6f262610f29c47f6daec22bca037
SHA512 1ecb93d76ff1bedbc4667952245a983096395453b4bc22e66e6743008c33d75bb22a1db7c8e6d6b316fa25f62791c9d5bc4152cac0a88c7a9fef5bbdd8bafd72
SSDEEP 192:HR1/66Joz0dzgCl6mSSdjMOv5zboH8ZhxyjqiSV:HP/66JozQzgC1bxbocZhxyjW
MD5 SHA1 SHA512 SSDEEP

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vozqjwij.default-release\datareporting\glean\events\events
Size 1KB
SHA256 5b2d239233634eb097569faa66f74e92537f12ce59b4d2d7f046bcf6a0302180
MD5 05af28450b8e880bae60f4b0a3869348
SHA1 d74220f035b5558d7b8f3bdae8ff095dc84eb3d6
SHA512 d0112e0355d36c0f4ab98015c9d59b044d3211d4d99139b2aa7734f920c8f3cd65ab9ec341dbdb71f67d352acc24f977b790d0fbdab74b4272d21cdf9b4edbb9
MD5 SHA1 SHA512

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vozqjwij.default-release\datareporting\glean\events\events
Size 1KB
SHA256 2c80e920807b1c9861b840df2a4603ab6851b8669c5ca4923cb1076a0e0cf159
MD5 bd5f580a8aed13ccf39d16eff34a68df
SHA1 2f8a27794ee9b01bf879a2e9eef185ec5b7cdc06
SHA512 745144c0c9dfc922f9901a996fa45b4f90acb21d6de22b682c7b5aea8860207111812a880e70bc1e124d7d84ae60dc908a126388a0e1c9d61ac3c67edb6435ce
MD5 SHA1 SHA512

Submit Download

06dad7a2-5f93-41fe-bac5-94b46898a3cc

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vozqjwij.default-release\datareporting\glean\pending_pings\06dad7a2-5f93-41fe-bac5-94b46898a3cc
Size 235B
SHA256 b208f411aa278e6065c629d5e629708d08655f307d89fcccb275367a293606ae
MD5 a10a9e5310bcd961d51a3d567436270c
SHA1 50fd1081dc9b339f0fc94f4fdfd7d65df13f0355
SHA512 73c0fc5dfa4ed67c9507f6c99dfc1b4079b96cb004c9beb734257f28420eacfa3db010a51e3406b9534aa26914058cf246f7c0fcfedbf6205cda8dfaca0d60ee
MD5 SHA1 SHA512

Submit Download

37942014-2d10-4b1c-8953-e5c9973da3db

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vozqjwij.default-release\datareporting\glean\pending_pings\37942014-2d10-4b1c-8953-e5c9973da3db
Size 235B
SHA256 845d61fdac806d4d33adf04707f728fbfdd8b80a85fb139bb2d4341fe740a027
MD5 09887e8b9c8657ee38fdc389b5e49594
SHA1 2888064ce971c874162238ec2b5e7b3b2897e152
SHA512 9f99b97190c52646898e26f58ac6067113e88462329e07a95a5e0244fc66a3893bb6431b00974feeea8f89eb2ff2e22c2681c95ffdb393021792459fe539bda0
MD5 SHA1 SHA512

Submit Download

40c13945-ed7b-4829-af1e-daf0997067e3

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vozqjwij.default-release\datareporting\glean\pending_pings\40c13945-ed7b-4829-af1e-daf0997067e3
Size 3KB
SHA256 47f01660ba5fd301b1e27704588d876db02c21cd10bd32917f9262c450c6fbc7
MD5 84e531dcff11bd1bb1613d3f6770157a
SHA1 67ba024e7d28b5bbbb29202cc6b944061c2f6703
SHA512 b76a0a2723d84f6c3a6cbf5c040c7017bf61e94597a1bb38d17c56eb8d8e52d225d84905b0fe3de04b3ba27b82678d54252d61d7cbd29ea87d91853658a03bd7
MD5 SHA1 SHA512

Submit Download

485a53ae-ec8e-4631-8fa7-da60fb39749b

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vozqjwij.default-release\datareporting\glean\pending_pings\485a53ae-ec8e-4631-8fa7-da60fb39749b
Size 896B
SHA256 f178dd68bce7940d05542fe526798e79c399274768f74318114b55d12b512862
MD5 0b3485cb9ecb640094cd7070370870e4
SHA1 7844fef1179098c7000a3dbe88fa999f2dc7130b
SHA512 e5bf3a38d0b30bc8a2d1a0670dff53e0120723452d487c4fee901256db6094d3e1dfd2f2dcc7871e2f715708db3ea7e49db3cf31f22a319bedb5921d32aacc0f
MD5 SHA1 SHA512

Submit Download

48dae920-760a-4dd6-81a9-c9ce15b46bc2

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vozqjwij.default-release\datareporting\glean\pending_pings\48dae920-760a-4dd6-81a9-c9ce15b46bc2
Size 3KB
SHA256 9493f17f4f6fd95f4b3e65c878983cd48bee03ff2271a421163c0990be429b03
MD5 8ddd56b92728da4aea5d453449a0b588
SHA1 00fb065b30e0954b0a2bf5c9f9d0e083512af901
SHA512 e50dc24befd49a9ce371e19c91165a4e669529548b85e2c43f556464c8b7eddfcbf0e36ac3abd9ef0a47f79acc318e9a654442ce041ff0818bb859bf7d9fba90
MD5 SHA1 SHA512

Submit Download

520ccd3e-8293-4d69-819c-6545784d577a

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vozqjwij.default-release\datareporting\glean\pending_pings\520ccd3e-8293-4d69-819c-6545784d577a
Size 15KB
SHA256 17b6cf9e1f912601c048989485bab521cf185404d953de7909175fc4ae841c37
MD5 7ec3bbd3522bd4630760e38021427d4b
SHA1 a3ac43c5aee57c7afc2bebdf92c99621b73bb2b3
SHA512 52de6a2f072a967328d7bd744c0a7b70f5d913415f5c9594cd0a7f844220ab3fcce07d3c19eab59c495fc0d021e8273453a83f1ca8c6eb34caa56991ebc78f30
SSDEEP 192:Jk/N6T48Bb/TOPV3j17BFGjirhSyk1z6U01RG+hdAycA8igdqLYzU4PsJi3bxIth:Jk/c8QvOd3VHcy6+U01RG+hSycKPQO
MD5 SHA1 SHA512 SSDEEP

Submit Download

537ef484-8092-4127-8179-b11c971ad55f

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vozqjwij.default-release\datareporting\glean\pending_pings\537ef484-8092-4127-8179-b11c971ad55f
Size 883B
SHA256 17d64cbaf3f8b422f0de6565c5245b83131a6c16efe6edea1ad4787fdafd5287
MD5 e8778755c660e08cfc4b2573926025f6
SHA1 afe93c1552b82b06710b66b8a5b3c703ee60435e
SHA512 30a275d5be9befede2ad3cb2d7121beea7680c81f9820e0ec87f938505a3a47b1d1ebbd78352e5884a8dd918b3f97c63d1a77577cac5fd8a8b77db7070fd8054
MD5 SHA1 SHA512

Submit Download

59fb5ee5-e155-4eb6-bd4a-8ee3eb36fdb3

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vozqjwij.default-release\datareporting\glean\pending_pings\59fb5ee5-e155-4eb6-bd4a-8ee3eb36fdb3
Size 2KB
SHA256 94cbf7893e173c11102632cb70d56d917f64c900ac90221995d2e93cb1d970d1
MD5 eb8b037ea64de46a94d139407a93b2a5
SHA1 b6a578464836bec162180b97ac516a581b91500e
SHA512 7a906c720bd0c5b1bca7ec5ac61d1f33191b25dc1c566a0a32c55f2877fc69168efa0c0702ab6d8af0dd9996cb7b4be14dfc8113c8be3eabab2e355046b290de
MD5 SHA1 SHA512

Submit Download

5cd01dd8-1ea5-4f19-bea0-6ce8c860cf3d

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vozqjwij.default-release\datareporting\glean\pending_pings\5cd01dd8-1ea5-4f19-bea0-6ce8c860cf3d
Size 886B
SHA256 99b8da67db1ec610625eb25a931675a837cd7ab3921d4383bb7e59784de9e477
MD5 d45b6ee7dd90feae16438229b42a9e72
SHA1 16957bac1ef59b2628f321f0f50c9985746a25fc
SHA512 ddf13e7d6ffaa78ed2e2b04509578ffe29c85e8e2ed2a26ac7e50d96aff5c3821b2784dcfd9ea3bbe07715c7677748c526addbfc7bd08f60ca8466cdaea6df30
MD5 SHA1 SHA512

Submit Download

65e85654-de5a-4d0b-91ac-1c4c03257ab1

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vozqjwij.default-release\datareporting\glean\pending_pings\65e85654-de5a-4d0b-91ac-1c4c03257ab1
Size 3KB
SHA256 4555b27ab3219f6c698b6eb48c7314542f9b5e80becc9afead98ba64fde9ddb3
MD5 31595625b74268d4348ca626b395f624
SHA1 70588c8b64cf552b92bfd4cca412b4cc9872043a
SHA512 f346dfecb26c12501236d58f4bd972fe264751ec008e8caf22ecaf2e60a75a6c96c2174ed645e5e150a55bf2e94cf443c513589d34f19487b1df2f6bfede2711
MD5 SHA1 SHA512

Submit Download

6ea6dde5-dcbf-42a7-b710-0b223102bd6f

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vozqjwij.default-release\datareporting\glean\pending_pings\6ea6dde5-dcbf-42a7-b710-0b223102bd6f
Size 3KB
SHA256 c8069f08b62db758750ebb5e25d9dcf8ee671d4103c74bfbad9a31c4a196fc65
MD5 9ffbe942f848a9a5cf9d6396dc4bfe2a
SHA1 cc2453fea59d26f3814bbe95e03e58682fe4e061
SHA512 b0d9d59cee275000a067ecd153ab467c674c40512c5c368e55eccc03d35693b9ab10fab739514fa9b626f0517ada09b3231a38e92f43607862fb31cfc03e994d
MD5 SHA1 SHA512

Submit Download

7bb2f656-2cf1-4f44-9a80-d2aef991010e

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vozqjwij.default-release\datareporting\glean\pending_pings\7bb2f656-2cf1-4f44-9a80-d2aef991010e
Size 2KB
SHA256 047f39b68301d08d64e9a1d9270a80ef8715aff8be93f29c3cc7fe0042e97c94
MD5 dd43d9205b613f1ead0f3145e72aaf3d
SHA1 14a7ced8750b8ace9f805f9c55b5f49f88973d20
SHA512 c620c06f3fb98bc1b1e0c489b598688cbaa7c6ece14c7f8b5ea5210f236f7cf5d28f6fca927886430a9cf8b349a67820e8b08650d6ec708ea316f5386b35e21e
MD5 SHA1 SHA512

Submit Download

7ea433d7-d273-41a9-afe3-25da2630e4d9

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vozqjwij.default-release\datareporting\glean\pending_pings\7ea433d7-d273-41a9-afe3-25da2630e4d9
Size 235B
SHA256 d8e602f427b7351da9a2f0ef0457f83fa2d722f372050f77c756101076d14598
MD5 df5578a32e275e08b4b85a7c979208f0
SHA1 2319b58ec6d832d48f7ec189f9d04822c46b029d
SHA512 ffbed4fb6dc0b821e96c09edbfdfc74b5748065d96af218ea0f81baf58ec0d1e026e36453ed7cacf3f82ed28e6fdba6c94b63f8b45a57a20a6bde373054a165a
MD5 SHA1 SHA512

Submit Download

90e1207f-ecbc-48f3-b34f-c3e440177ac6

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vozqjwij.default-release\datareporting\glean\pending_pings\90e1207f-ecbc-48f3-b34f-c3e440177ac6
Size 3KB
SHA256 6813ef72ceb2567925c54a182466d073d107d2f8d66292af1e0d959352359204
MD5 e43b5bc0388592ce3f13eb577dd7adcc
SHA1 cdf1b08d2c2e743632fcfc4610fecfea5cff4c57
SHA512 7df484833ed86baefc767448f713cd3445120f77149c141c1c841054112bc73277fd23c254480f0e16a8b944f04655b7fc31bd16ba296e7fb085338c260dfd49
MD5 SHA1 SHA512

Submit Download

ab893801-c9d5-4287-9e71-8da539d7d72f

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vozqjwij.default-release\datareporting\glean\pending_pings\ab893801-c9d5-4287-9e71-8da539d7d72f
Size 3KB
SHA256 9ab4dfe39e8ed4c2ae4936e9e2b91cc172031a016a652269cea4ba391a0085b5
MD5 0f673fb2a2826f545ba926f2d788dc32
SHA1 ca725c7673a54976188bfe5f251523a0220ab500
SHA512 8ae0c8653fd883646421cefb0c9902736bb42bfff2f58ea55a07d9a0b13d5a4829cccdd9e0c6bc528f66b8247dc1bb550ecd8b5d20198f42fee0e1dde2ae729c
MD5 SHA1 SHA512

Submit Download

b5db1720-f4c1-4b3b-a750-329926cb5df9

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vozqjwij.default-release\datareporting\glean\pending_pings\b5db1720-f4c1-4b3b-a750-329926cb5df9
Size 3KB
SHA256 6b250ec25ec3bf8bc39ad57a49ccd10d9d183a2f9bc95472870e0e1406e725e0
MD5 1b578896c3117878146e88125b7435be
SHA1 2f9e8a0f05387d6d8c820510ecb9197d506aef22
SHA512 e83aff21337af1cbdd094030f32a215dd96a614c76be65dab359a75a1e411dd220798c657f678a1fd342b01763b16be81ac60592f2420f4908c1a277d062be4c
MD5 SHA1 SHA512

Submit Download

c9b33d28-8972-41fd-bb79-3242c82a490a

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vozqjwij.default-release\datareporting\glean\pending_pings\c9b33d28-8972-41fd-bb79-3242c82a490a
Size 871B
SHA256 c3492bf8d3ddd3ec9abe06edc175785fec08b55a2a8c7d523cf4eb36b618988f
MD5 be764bcd2ca79cd7ea1ee3eb61d435f6
SHA1 ef016c82b4c87d64d71f80244baf90538a7d38af
SHA512 4e37dfc333237e2b1e3059f5bcbaf3db0dbff21c4a3e05d05fdff5282a7dbe8dee2e39248a043139083dc5936b9a25e5beec631bc72d972b14e8950f0207be2c
MD5 SHA1 SHA512

Submit Download

e4e2db6e-fd26-4739-b0f6-d7b1d87b7973

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vozqjwij.default-release\datareporting\glean\pending_pings\e4e2db6e-fd26-4739-b0f6-d7b1d87b7973
Size 3KB
SHA256 6031c8b9f472b2f59151eb6033e8a292b5c9f00a28432d2aeb75448838c5d038
MD5 fb7d3b2e82762859c5c668d738b016e3
SHA1 401e0c72c1071dcc069440ed0583eb60a8e28541
SHA512 8e478adb57357c0ab3b747127098e6a9ede8699084f230843d84c2ce351ea810bf7b87bf76b3be7fd4c00a06f643f64b3f90c2b3ef7fd9104d9b1d892cab5d42
MD5 SHA1 SHA512

Submit Download

e87dacb8-9bad-4f4a-a2b4-b718c1c9eccb

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vozqjwij.default-release\datareporting\glean\pending_pings\e87dacb8-9bad-4f4a-a2b4-b718c1c9eccb
Size 235B
SHA256 23497d4f394bbb9bef0b49d8cb7674ad31a63d4fce556f0ec2a478271c76fa5e
MD5 f81f9ee0a74337e9a3893293bb44932b
SHA1 744f27e17aac0194aeee9dc607f7223b60e350f5
SHA512 2f274effa2efd5f33b0cf5c087ea36011b7b327ca3190e817f7b2235901f90f0b6c893a5b9e59e98bc370b7e29717bc4aefc2fc1e9739918105e2de20e6d2f36
MD5 SHA1 SHA512

Submit Download

f264495c-82d1-46d0-b1ef-c7aa5f086443

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vozqjwij.default-release\datareporting\glean\pending_pings\f264495c-82d1-46d0-b1ef-c7aa5f086443
Size 3KB
SHA256 dd0b270e8f96b7291d861ee5e9cd947bebd94625f3ed9cab7e5b03f7c5b4acaa
MD5 634f7a9026e550d6f8a68b5ecf9a7555
SHA1 7c806417f922656cdabcdd476bbe8444bc74499b
SHA512 d4ae91b105b7a026ff1c67778e913526eef79818bbee58f4454c9f0e71d0881a23c456bc1a005687853de9b74be4b550b49582e66655577166b48571079f1b1c
MD5 SHA1 SHA512

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vozqjwij.default-release\prefs-1.js
Size 6KB
SHA256 b06c3c6064590a3919d75ed68a5fa61cefd314e22313c0f3a2ebc0437542e005
MD5 cf6bf49a208984fbd4e655099cae77d8
SHA1 df1102f9c7a352b4d16034a2bd89dc455c15f442
SHA512 30171f30faf973f06cb3468a62f8af982d5855e6b92969293b3eb3d775a9f28e6a29211391a4ca03d15bae06448fb76ceaea97bc45726049ca7660172c1434cd
SSDEEP 96:xHxUTUM8qGq5fAK6nb1zS1SSlfdv9j9tnndRHORBw88H8L4cnXpDd:DSR5fA9bYSSH9ORBw88e
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vozqjwij.default-release\prefs.js
Size 6KB
SHA256 c4a7603ef173587e4dd2f40f037106f7246a5c78bd147e8fcdbabe1df271a101
MD5 a97f4c8a29dc0c6ccc6e7a41e463ced6
SHA1 61a4e2116608d31f85bfb3e037298179423e62f9
SHA512 73c643035440d09803a449ea438666ff8169d6de29caf1d20223c5c391e7b28f6a5fe8d1f3c1d815dc0f4cb8732ea477c40b0b8b7526e99ce369c89797b99c46
SSDEEP 96:xHxUTUM8qGq5fAls1zSzxSSlfdv9jMrHndRHORBw88H8L4cnXUd:DSR5fAlsKxSSY99ORBw88P
MD5 SHA1 SHA512 SSDEEP

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vozqjwij.default-release\sessionCheckpoints.json
Size 90B
SHA256 00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2
MD5 c4ab2ee59ca41b6d6a6ea911f35bdc00
SHA1 5942cd6505fc8a9daba403b082067e1cdefdfbc4
SHA512 71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2
MD5 SHA1 SHA512

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\vozqjwij.default-release\sessionCheckpoints.json
Size 53B
SHA256 792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da
MD5 ea8b62857dfdbd3d0be7d7e4a954ec9a
SHA1 b43bc4b3ea206a02ef8f63d5bfad0c96bf2a3b2a
SHA512 076ee83534f42563046d25086166f82e1a3ec61840c113aec67abe2d8195daa247d827d0c54e7e8f8a1bbf2d082a3763577587e84342ec160ff97905243e6d19
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Windows\SystemTemp\Crashpad\settings.dat
Size 40B
SHA256 835283dba532824e6ea41f01b960c0ee632181df029cbc45fff8e8b6ac3164c7
MD5 8759a41c8c2f5e8f4462ff3c25b5041d
SHA1 a0f33c9de1b20e9851b6aab7f8b621348ed110e9
SHA512 b8e0a7a9e484d71daea86a1aa86c28c457e8734842ea09f7089089a1f63dca9a609ed10f28d8ff2c1fe43d49d0ebc48328eac555b3329bcfab26fa8177900a71
MD5 SHA1 SHA512

Submit Download

chrome_installer.log

Path C:\Windows\SystemTemp\chrome_installer.log
Size 7KB
SHA256 7ae8a1d093aa1f25ec4420af70cc4e666ce6f4fc27514399d92c806b52fb8574
MD5 3786805b03352b926e2f8c8522d53a52
SHA1 ae431aad501f67517bf4012ce0cd44ac7dbbc48f
SHA512 fa4633759217d648a10212f3ad002c637558b626c87bf68eb3f0142ccff4cd8fa7e6005b6f3b47f260b0ae1c2059276b8284071fd18e01e3da6fc24f08d624f4
SSDEEP 96:Yh2w5sZX477gfwK3vK3hX7MJJ6twK2kK2wz6CPK03SBYwK3WK373:Ioo7nAKWJ3aACDB3Nk3
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2548-86-0x000001738A780000-0x000001738A78C000-memory.dmp

Download

memory/5880-195-0x0000000001370000-0x0000000001470000-memory.dmp

Download

memory/5880-295-0x0000000001370000-0x0000000001470000-memory.dmp

Download

memory/5880-296-0x0000000001370000-0x0000000001470000-memory.dmp

Download

memory/5880-297-0x0000000001370000-0x0000000001470000-memory.dmp

Download

memory/5880-298-0x0000000001370000-0x0000000001470000-memory.dmp

Download

memory/5880-302-0x00000000064B0000-0x00000000065B0000-memory.dmp

Download

memory/5880-303-0x0000000001370000-0x0000000001470000-memory.dmp

Download

memory/5880-314-0x00000000064B0000-0x00000000065B0000-memory.dmp

Download

memory/5880-315-0x0000000001370000-0x0000000001470000-memory.dmp

Download

memory/5880-316-0x0000000001370000-0x0000000001470000-memory.dmp

Download

memory/5880-317-0x0000000001370000-0x0000000001470000-memory.dmp

Download

memory/5880-318-0x0000000001370000-0x0000000001470000-memory.dmp

Download

memory/5880-323-0x00000000064B0000-0x00000000065B0000-memory.dmp

Download

memory/5880-325-0x00000000064B0000-0x00000000065B0000-memory.dmp

Download

memory/5880-324-0x0000000001370000-0x0000000001470000-memory.dmp

Download

memory/5880-319-0x00000000064B0000-0x00000000065B0000-memory.dmp

Download

memory/5880-304-0x00000000064B0000-0x00000000065B0000-memory.dmp

Download

memory/5880-312-0x0000000001370000-0x0000000001470000-memory.dmp

Download

memory/5880-313-0x0000000001370000-0x0000000001470000-memory.dmp

Download

memory/5880-311-0x00000000064B0000-0x00000000065B0000-memory.dmp

Download

memory/5880-305-0x0000000001370000-0x0000000001470000-memory.dmp

Download

memory/5880-307-0x0000000001370000-0x0000000001470000-memory.dmp

Download

memory/5880-306-0x0000000001370000-0x0000000001470000-memory.dmp

Download

memory/5880-286-0x0000000001370000-0x0000000001470000-memory.dmp

Download

memory/5880-287-0x0000000001370000-0x0000000001470000-memory.dmp

Download

memory/5880-288-0x0000000001370000-0x0000000001470000-memory.dmp

Download

memory/5880-289-0x0000000001370000-0x0000000001470000-memory.dmp

Download

memory/5880-291-0x00000000064B0000-0x00000000065B0000-memory.dmp

Download

memory/5880-292-0x00000000064B0000-0x00000000065B0000-memory.dmp

Download

memory/5880-285-0x00000000064B0000-0x00000000065B0000-memory.dmp

Download

memory/5880-247-0x0000000001370000-0x0000000001470000-memory.dmp

Download

memory/5880-245-0x0000000001370000-0x0000000001470000-memory.dmp

Download

memory/5880-248-0x0000000001370000-0x0000000001470000-memory.dmp

Download

memory/5880-249-0x0000000001370000-0x0000000001470000-memory.dmp

Download

memory/5880-253-0x00000000064B0000-0x00000000065B0000-memory.dmp

Download

memory/5880-257-0x00000000064B0000-0x00000000065B0000-memory.dmp

Download

memory/5880-258-0x0000000001370000-0x0000000001470000-memory.dmp

Download

memory/5880-270-0x0000000001370000-0x0000000001470000-memory.dmp

Download

memory/5880-271-0x0000000001370000-0x0000000001470000-memory.dmp

Download

memory/5880-272-0x0000000001370000-0x0000000001470000-memory.dmp

Download

memory/5880-277-0x0000000001370000-0x0000000001470000-memory.dmp

Download

memory/5880-278-0x0000000001370000-0x0000000001470000-memory.dmp

Download

memory/5880-279-0x00000000064B0000-0x00000000065B0000-memory.dmp

Download

memory/5880-280-0x00000000064B0000-0x00000000065B0000-memory.dmp

Download

memory/5880-276-0x0000000001370000-0x0000000001470000-memory.dmp

Download

memory/5880-269-0x00000000064B0000-0x00000000065B0000-memory.dmp

Download

memory/5880-267-0x00000000064B0000-0x00000000065B0000-memory.dmp

Download

memory/5880-259-0x0000000001370000-0x0000000001470000-memory.dmp

Download

memory/5880-260-0x0000000001370000-0x0000000001470000-memory.dmp

Download

memory/5880-261-0x0000000001370000-0x0000000001470000-memory.dmp

Download

memory/5880-254-0x00000000064B0000-0x00000000065B0000-memory.dmp

Download

memory/5880-250-0x0000000001370000-0x0000000001470000-memory.dmp

Download

memory/5880-246-0x0000000001370000-0x0000000001470000-memory.dmp

Download

memory/5880-193-0x0000000001370000-0x0000000001470000-memory.dmp

Download

memory/5880-194-0x0000000001370000-0x0000000001470000-memory.dmp

Download

memory/5880-0-0x0000000001100000-0x00000000011BE000-memory.dmp

Download

memory/5880-203-0x00000000064B0000-0x00000000065B0000-memory.dmp

Download

memory/5880-204-0x0000000001370000-0x0000000001470000-memory.dmp

Download

memory/5880-211-0x00000000064B0000-0x00000000065B0000-memory.dmp

Download

memory/5880-214-0x00000000064B0000-0x00000000065B0000-memory.dmp

Download

memory/5880-215-0x0000000001370000-0x0000000001470000-memory.dmp

Download

memory/5880-216-0x0000000001370000-0x0000000001470000-memory.dmp

Download

memory/5880-222-0x00000000064B0000-0x00000000065B0000-memory.dmp

Download

memory/5880-223-0x00000000064B0000-0x00000000065B0000-memory.dmp

Download

memory/5880-224-0x0000000001370000-0x0000000001470000-memory.dmp

Download

memory/5880-226-0x0000000001370000-0x0000000001470000-memory.dmp

Download

memory/5880-229-0x00000000064B0000-0x00000000065B0000-memory.dmp

Download

memory/5880-230-0x00000000064B0000-0x00000000065B0000-memory.dmp

Download

memory/5880-227-0x0000000001370000-0x0000000001470000-memory.dmp

Download

memory/5880-225-0x0000000001370000-0x0000000001470000-memory.dmp

Download

memory/5880-217-0x0000000001370000-0x0000000001470000-memory.dmp

Download

memory/5880-218-0x0000000001370000-0x0000000001470000-memory.dmp

Download

memory/5880-205-0x0000000001370000-0x0000000001470000-memory.dmp

Download

memory/5880-206-0x0000000001370000-0x0000000001470000-memory.dmp

Download

memory/5880-207-0x0000000001370000-0x0000000001470000-memory.dmp

Download

memory/5880-196-0x0000000001370000-0x0000000001470000-memory.dmp

Download

memory/5880-197-0x00000000064B0000-0x00000000065B0000-memory.dmp

Download

memory/5880-77-0x0000000001370000-0x0000000001470000-memory.dmp

Download

memory/5880-143-0x00000000064B0000-0x00000000065B0000-memory.dmp

Download

memory/5880-189-0x00000000064B0000-0x00000000065B0000-memory.dmp

Download

memory/5880-185-0x0000000001370000-0x0000000001470000-memory.dmp

Download

memory/5880-184-0x0000000001370000-0x0000000001470000-memory.dmp

Download

memory/5880-183-0x0000000005720000-0x0000000005730000-memory.dmp

Download

memory/5880-151-0x0000000001370000-0x0000000001470000-memory.dmp

Download

memory/5880-152-0x0000000001370000-0x0000000001470000-memory.dmp

Download

memory/5880-172-0x00000000064B0000-0x00000000065B0000-memory.dmp

Download

memory/5880-76-0x0000000001370000-0x0000000001470000-memory.dmp

Download

memory/5880-54-0x0000000005C70000-0x0000000005C8E000-memory.dmp

Download

memory/5880-53-0x0000000006FA0000-0x00000000074CC000-memory.dmp

Download

memory/5880-52-0x00000000067D0000-0x0000000006820000-memory.dmp

Download

memory/5880-51-0x0000000006750000-0x00000000067C6000-memory.dmp

Download

memory/5880-50-0x00000000068A0000-0x0000000006A62000-memory.dmp

Download

memory/5880-49-0x0000000006620000-0x00000000066D2000-memory.dmp

Download

memory/5880-48-0x0000000006440000-0x00000000064A6000-memory.dmp

Download

memory/5880-47-0x0000000005720000-0x0000000005730000-memory.dmp

Download

memory/5880-39-0x0000000005CE0000-0x0000000006286000-memory.dmp

Download