phantomstealer | 4c6c075eef30621a8ec9fbcd400292b3de3063e31a8589d189a33b6487cbf3dd

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20251016-en
resource tags

arch:x64arch:x86image:win10v2004-20251016-enlocale:en-usos:windows10-2004-x64system
submitted
31/10/2025, 04:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MSVCP140.dll
Size 5.7MB
Sample251031-erblwsfv2a
SHA256 363022bd7bf8deb61785a3ec95d107893370f329ae2460effc5a1addd100995d
MD5 64837a9c4b7165f305ea9b6d1554a68e
SHA1 2cb5e9901bc76ecbd303c765e035f228e3e0b291
SHA512 f92bd14c9798c27138f9a07eceb8099101d209dd5e281cbdf7b45809cb8d324c1f0206195950cebee86c4542c545a29bb4f0418670fdf10abc1fb0a6f763086c
SSDEEP 49152:BlClpF9AqFx3mqO0+rjJEipVb/sC6aF/Sad0H7/UAeVCux70BEsHIMY3LkYP2GuS:rqOrpV7Fld0bSaKMkP8BR3WKc
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

collection discovery phantomstealer persistence

Malware Config

Extracted

Credentials

Protocol
smtp
Host
mail.sourc3trade.com
Port
587
Username
[email protected]
Password
yr!{f[L6r}9W!m/z

Extracted

Family

phantomstealer

Version

v3.5.0

Credentials

Protocol
smtp
Host
mail.sourc3trade.com
Port
587
Username
[email protected]
Password
yr!{f[L6r}9W!m/z
Email to
[email protected]

Mutex

12YHANZ1JWN7VAAFXR6S

Attributes

anti_analysis
0
cb_enables_ssl
1
debug
0
keylogger
1
start_delay
0
startup
0

Signatures

Phantomstealer family
phantomstealer

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-756542885-431777018-975678197-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AddInProcess32.exe
Key opened	\REGISTRY\USER\S-1-5-21-756542885-431777018-975678197-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AddInProcess32.exe
Key opened	\REGISTRY\USER\S-1-5-21-756542885-431777018-975678197-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AddInProcess32.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-756542885-431777018-975678197-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\DefaultDomain = "cmd.exe /C pushd \"C:\\Windows\\system32\\Container\" && start \"\" \"C:\\Windows\\system32\\Container\\DefaultDomain\""	rundll32.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
354	icanhazip.com

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\system32\Container\Windows.Graphics.Printing.dll	rundll32.exe
File created	C:\Windows\system32\Container\wpx.dll	rundll32.exe
File created	C:\Windows\system32\Container\autopilot.dll	rundll32.exe
File created	C:\Windows\system32\Container\PrintIsolationProxy.dll	rundll32.exe
File created	C:\Windows\system32\Container\SystemPropertiesHardware.exe	rundll32.exe
File created	C:\Windows\system32\Container\vss_ps.dll	rundll32.exe
File created	C:\Windows\system32\Container\Windows.Internal.Graphics.Display.DisplayColorManagement.dll	rundll32.exe
File created	C:\Windows\system32\Container\eudcedit.exe	rundll32.exe
File created	C:\Windows\system32\Container\sysmon.ocx	rundll32.exe
File created	C:\Windows\system32\Container\Windows.Media.Protection.PlayReady.dll	rundll32.exe
File created	C:\Windows\system32\Container\Windows.Mirage.Internal.Capture.Pipeline.ProxyStub.dll	rundll32.exe
File created	C:\Windows\system32\Container\cellulardatacapabilityhandler.dll	rundll32.exe
File created	C:\Windows\system32\Container\msdtcVSp1res.dll	rundll32.exe
File created	C:\Windows\system32\Container\udhisapi.dll	rundll32.exe
File created	C:\Windows\system32\Container\user32.dll	rundll32.exe
File created	C:\Windows\system32\Container\XblAuthManager.dll	rundll32.exe
File created	C:\Windows\system32\Container\CloudDomainJoinAUG.dll	rundll32.exe
File created	C:\Windows\system32\Container\comres.dll	rundll32.exe
File created	C:\Windows\system32\Container\C_20905.NLS	rundll32.exe
File created	C:\Windows\system32\Container\csrsrv.dll	rundll32.exe
File created	C:\Windows\system32\Container\MSNP.ax	rundll32.exe
File created	C:\Windows\system32\Container\dispex.dll	rundll32.exe
File created	C:\Windows\system32\Container\dmvdsitf.dll	rundll32.exe
File created	C:\Windows\system32\Container\EnterpriseDesktopAppMgmtCSP.dll	rundll32.exe
File created	C:\Windows\system32\Container\Microsoft.Uev.PrinterCustomActions.dll	rundll32.exe
File created	C:\Windows\system32\Container\networkexplorer.dll	rundll32.exe
File created	C:\Windows\system32\Container\AppVEntSubsystems64.dll	rundll32.exe
File created	C:\Windows\system32\Container\MSAMRNBSource.dll	rundll32.exe
File created	C:\Windows\system32\Container\SensApi.dll	rundll32.exe
File created	C:\Windows\system32\Container\ShellCommonCommonProxyStub.dll	rundll32.exe
File created	C:\Windows\system32\Container\cngprovider.dll	rundll32.exe
File created	C:\Windows\system32\Container\C_437.NLS	rundll32.exe
File created	C:\Windows\system32\Container\find.exe	rundll32.exe
File created	C:\Windows\system32\Container\kbdlisub.dll	rundll32.exe
File created	C:\Windows\system32\Container\mfc120esn.dll	rundll32.exe
File created	C:\Windows\system32\Container\C_10029.NLS	rundll32.exe
File created	C:\Windows\system32\Container\DeviceUpdateCenterCsp.dll	rundll32.exe
File created	C:\Windows\system32\Container\MbaeApi.dll	rundll32.exe
File created	C:\Windows\system32\Container\schedcli.dll	rundll32.exe
File created	C:\Windows\system32\Container\vbscript.dll	rundll32.exe
File created	C:\Windows\system32\Container\Windows.UI.Core.TextInput.dll	rundll32.exe
File created	C:\Windows\system32\Container\AudioSrvPolicyManager.dll	rundll32.exe
File created	C:\Windows\system32\Container\ServicingUAPI.dll	rundll32.exe
File created	C:\Windows\system32\Container\TaskApis.dll	rundll32.exe
File created	C:\Windows\system32\Container\WwaExt.dll	rundll32.exe
File created	C:\Windows\system32\Container\autoplay.dll	rundll32.exe
File created	C:\Windows\system32\Container\SimCfg.dll	rundll32.exe
File created	C:\Windows\system32\Container\srchadmin.dll	rundll32.exe
File created	C:\Windows\system32\Container\kbdarmph.dll	rundll32.exe
File created	C:\Windows\system32\Container\LockController.dll	rundll32.exe
File created	C:\Windows\system32\Container\NgcProCsp.dll	rundll32.exe
File created	C:\Windows\system32\Container\rtmmvrortc.dll	rundll32.exe
File created	C:\Windows\system32\Container\libcrypto.dll	rundll32.exe
File created	C:\Windows\system32\Container\djoin.exe	rundll32.exe
File created	C:\Windows\system32\Container\xcopy.exe	rundll32.exe
File created	C:\Windows\system32\Container\Win32_DeviceGuard.dll	rundll32.exe
File created	C:\Windows\system32\Container\tzsync.exe	rundll32.exe
File created	C:\Windows\system32\Container\Windows.Management.SecureAssessment.Diagnostics.dll	rundll32.exe
File created	C:\Windows\system32\Container\MosStorage.dll	rundll32.exe
File created	C:\Windows\system32\Container\MouseSystemToastIcon.contrast-white.png	rundll32.exe
File created	C:\Windows\system32\Container\NL7Lexicons0011.dll	rundll32.exe
File created	C:\Windows\system32\Container\WindowsIoTCsp.dll	rundll32.exe
File created	C:\Windows\system32\Container\CscMig.dll	rundll32.exe
File created	C:\Windows\system32\Container\fhmanagew.exe	rundll32.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2464 set thread context of 4248	2464	rundll32.exe	84

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\chrome_installer.log	chrmstp.exe
File opened for modification	C:\Program Files\Crashpad\metadata	chrmstp.exe
File opened for modification	C:\Program Files\Crashpad\settings.dat	chrmstp.exe
File opened for modification	C:\Program Files\chrome_installer.log	chrmstp.exe
File opened for modification	C:\Program Files\Crashpad\metadata	chrmstp.exe
File opened for modification	C:\Program Files\Crashpad\settings.dat	chrmstp.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe

Checks processor information in registry 2 TTPs 44 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	AddInProcess32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	AddInProcess32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Enumerates system info in registry 2 TTPs 12 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134063574255258526"	chrome.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-756542885-431777018-975678197-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-756542885-431777018-975678197-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	chrmstp.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4248	AddInProcess32.exe
4248	AddInProcess32.exe
4248	AddInProcess32.exe
988	chrome.exe
988	chrome.exe
4248	AddInProcess32.exe
4248	AddInProcess32.exe
4248	AddInProcess32.exe
4248	AddInProcess32.exe
4248	AddInProcess32.exe
4248	AddInProcess32.exe
4248	AddInProcess32.exe
4248	AddInProcess32.exe
4248	AddInProcess32.exe
4248	AddInProcess32.exe
4408	firefox.exe
4408	firefox.exe
4408	firefox.exe
4408	firefox.exe
4408	firefox.exe
4408	firefox.exe
4408	firefox.exe
4408	firefox.exe
4408	firefox.exe
4408	firefox.exe
4408	firefox.exe
4408	firefox.exe
4408	firefox.exe
4408	firefox.exe
4408	firefox.exe
4408	firefox.exe
4408	firefox.exe
4408	firefox.exe
4408	firefox.exe
4408	firefox.exe
4248	AddInProcess32.exe
4248	AddInProcess32.exe
4248	AddInProcess32.exe
4248	AddInProcess32.exe
4248	AddInProcess32.exe
4248	AddInProcess32.exe
4248	AddInProcess32.exe
4248	AddInProcess32.exe
4248	AddInProcess32.exe
4248	AddInProcess32.exe
4248	AddInProcess32.exe
4248	AddInProcess32.exe
4248	AddInProcess32.exe
4248	AddInProcess32.exe
4248	AddInProcess32.exe
4248	AddInProcess32.exe
4248	AddInProcess32.exe
4248	AddInProcess32.exe
4248	AddInProcess32.exe
1716	firefox.exe
1716	firefox.exe
1716	firefox.exe
1716	firefox.exe
1716	firefox.exe
1716	firefox.exe
1716	firefox.exe
1716	firefox.exe
1716	firefox.exe
1716	firefox.exe

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: SeDebugPrivilege	4248	AddInProcess32.exe
Token: SeShutdownPrivilege	988	chrome.exe
Token: SeCreatePagefilePrivilege	988	chrome.exe
Token: SeShutdownPrivilege	988	chrome.exe
Token: SeCreatePagefilePrivilege	988	chrome.exe
Token: SeShutdownPrivilege	988	chrome.exe
Token: SeCreatePagefilePrivilege	988	chrome.exe
Token: SeShutdownPrivilege	988	chrome.exe
Token: SeCreatePagefilePrivilege	988	chrome.exe
Token: SeShutdownPrivilege	988	chrome.exe
Token: SeCreatePagefilePrivilege	988	chrome.exe
Token: SeShutdownPrivilege	2100	chrome.exe
Token: SeCreatePagefilePrivilege	2100	chrome.exe
Token: SeShutdownPrivilege	2100	chrome.exe
Token: SeCreatePagefilePrivilege	2100	chrome.exe

Suspicious use of FindShellTrayWindow 47 IoCs

pid	Process
988	chrome.exe
988	chrome.exe
5468	chrmstp.exe
4408	firefox.exe
4408	firefox.exe
4408	firefox.exe
4408	firefox.exe
4408	firefox.exe
4408	firefox.exe
4408	firefox.exe
4408	firefox.exe
4408	firefox.exe
4408	firefox.exe
4408	firefox.exe
4408	firefox.exe
4408	firefox.exe
4408	firefox.exe
4408	firefox.exe
4408	firefox.exe
4408	firefox.exe
4408	firefox.exe
4408	firefox.exe
4408	firefox.exe
7132	msedge.exe
6340	msedge.exe
1716	firefox.exe
1716	firefox.exe
1716	firefox.exe
1716	firefox.exe
1716	firefox.exe
1716	firefox.exe
1716	firefox.exe
1716	firefox.exe
1716	firefox.exe
1716	firefox.exe
1716	firefox.exe
1716	firefox.exe
1716	firefox.exe
1716	firefox.exe
1716	firefox.exe
1716	firefox.exe
1716	firefox.exe
1716	firefox.exe
1716	firefox.exe
1716	firefox.exe
2100	chrome.exe
2100	chrome.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4408	firefox.exe
1716	firefox.exe
4248	AddInProcess32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2464 wrote to memory of 4248	2464	rundll32.exe	84
PID 2464 wrote to memory of 4248	2464	rundll32.exe	84
PID 2464 wrote to memory of 4248	2464	rundll32.exe	84
PID 2464 wrote to memory of 4248	2464	rundll32.exe	84
PID 2464 wrote to memory of 4248	2464	rundll32.exe	84
PID 2464 wrote to memory of 4248	2464	rundll32.exe	84
PID 4248 wrote to memory of 988	4248	AddInProcess32.exe	94
PID 4248 wrote to memory of 988	4248	AddInProcess32.exe	94
PID 988 wrote to memory of 676	988	chrome.exe	95
PID 988 wrote to memory of 676	988	chrome.exe	95
PID 988 wrote to memory of 5824	988	chrome.exe	96
PID 988 wrote to memory of 5824	988	chrome.exe	96
PID 988 wrote to memory of 2028	988	chrome.exe	97
PID 988 wrote to memory of 2028	988	chrome.exe	97
PID 4248 wrote to memory of 5824	4248	AddInProcess32.exe	96
PID 988 wrote to memory of 5948	988	chrome.exe	98
PID 988 wrote to memory of 5948	988	chrome.exe	98
PID 4248 wrote to memory of 5824	4248	AddInProcess32.exe	96
PID 988 wrote to memory of 4060	988	chrome.exe	99
PID 988 wrote to memory of 4060	988	chrome.exe	99
PID 988 wrote to memory of 3792	988	chrome.exe	100
PID 988 wrote to memory of 3792	988	chrome.exe	100
PID 4248 wrote to memory of 676	4248	AddInProcess32.exe	95
PID 4248 wrote to memory of 676	4248	AddInProcess32.exe	95
PID 988 wrote to memory of 5384	988	chrome.exe	101
PID 988 wrote to memory of 5384	988	chrome.exe	101
PID 988 wrote to memory of 1152	988	chrome.exe	102
PID 988 wrote to memory of 1152	988	chrome.exe	102
PID 988 wrote to memory of 4988	988	chrome.exe	103
PID 988 wrote to memory of 4988	988	chrome.exe	103
PID 988 wrote to memory of 5860	988	chrome.exe	104
PID 988 wrote to memory of 5860	988	chrome.exe	104
PID 4248 wrote to memory of 2028	4248	AddInProcess32.exe	97
PID 4248 wrote to memory of 2028	4248	AddInProcess32.exe	97
PID 988 wrote to memory of 3160	988	chrome.exe	105
PID 988 wrote to memory of 3160	988	chrome.exe	105
PID 4248 wrote to memory of 988	4248	AddInProcess32.exe	94
PID 4248 wrote to memory of 988	4248	AddInProcess32.exe	94
PID 988 wrote to memory of 3772	988	chrome.exe	106
PID 988 wrote to memory of 3772	988	chrome.exe	106
PID 988 wrote to memory of 1196	988	chrome.exe	107
PID 988 wrote to memory of 1196	988	chrome.exe	107
PID 4248 wrote to memory of 5824	4248	AddInProcess32.exe	96
PID 4248 wrote to memory of 5824	4248	AddInProcess32.exe	96
PID 4248 wrote to memory of 676	4248	AddInProcess32.exe	95
PID 4248 wrote to memory of 676	4248	AddInProcess32.exe	95
PID 4248 wrote to memory of 5860	4248	AddInProcess32.exe	104
PID 4248 wrote to memory of 5860	4248	AddInProcess32.exe	104
PID 988 wrote to memory of 4816	988	chrome.exe	108
PID 988 wrote to memory of 4816	988	chrome.exe	108
PID 4248 wrote to memory of 1152	4248	AddInProcess32.exe	102
PID 4248 wrote to memory of 1152	4248	AddInProcess32.exe	102
PID 4248 wrote to memory of 4988	4248	AddInProcess32.exe	103
PID 4248 wrote to memory of 4988	4248	AddInProcess32.exe	103
PID 4248 wrote to memory of 2028	4248	AddInProcess32.exe	97
PID 4248 wrote to memory of 2028	4248	AddInProcess32.exe	97
PID 4248 wrote to memory of 3792	4248	AddInProcess32.exe	100
PID 4248 wrote to memory of 3792	4248	AddInProcess32.exe	100
PID 4248 wrote to memory of 5948	4248	AddInProcess32.exe	98
PID 4248 wrote to memory of 5948	4248	AddInProcess32.exe	98
PID 4248 wrote to memory of 3772	4248	AddInProcess32.exe	106
PID 4248 wrote to memory of 3772	4248	AddInProcess32.exe	106
PID 4248 wrote to memory of 988	4248	AddInProcess32.exe	94
PID 4248 wrote to memory of 988	4248	AddInProcess32.exe	94

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-756542885-431777018-975678197-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AddInProcess32.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-756542885-431777018-975678197-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AddInProcess32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\MSVCP140.dll,#1
1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2464
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - outlook_office_path
  - outlook_win_path
  PID:4248
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\xz4io3p5.z4r"
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:988
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\xz4io3p5.z4r /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\xz4io3p5.z4r\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\xz4io3p5.z4r --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7fff2192dcf8,0x7fff2192dd04,0x7fff2192dd10
      4⤵
      PID:676
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\xz4io3p5.z4r" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=2060,i,1087341479435337274,18374622831624836100,262144 --variations-seed-version --mojo-platform-channel-handle=2056 /prefetch:2
      4⤵
      PID:5824
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\xz4io3p5.z4r" --field-trial-handle=1940,i,1087341479435337274,18374622831624836100,262144 --variations-seed-version --mojo-platform-channel-handle=2072 /prefetch:3
      4⤵
      PID:2028
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\xz4io3p5.z4r" --field-trial-handle=2156,i,1087341479435337274,18374622831624836100,262144 --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:8
      4⤵
      PID:5948
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\xz4io3p5.z4r" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=2808,i,1087341479435337274,18374622831624836100,262144 --variations-seed-version --mojo-platform-channel-handle=2824 /prefetch:1
      4⤵
      PID:4060
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\xz4io3p5.z4r" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=2832,i,1087341479435337274,18374622831624836100,262144 --variations-seed-version --mojo-platform-channel-handle=2892 /prefetch:1
      4⤵
      PID:3792
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\xz4io3p5.z4r" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=2968,i,1087341479435337274,18374622831624836100,262144 --variations-seed-version --mojo-platform-channel-handle=3216 /prefetch:1
      4⤵
      PID:5384
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\xz4io3p5.z4r" --extension-process --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=3028,i,1087341479435337274,18374622831624836100,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:2
      4⤵
      PID:1152
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\xz4io3p5.z4r" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=3092,i,1087341479435337274,18374622831624836100,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:1
      4⤵
      PID:4988
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\xz4io3p5.z4r" --extension-process --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=3108,i,1087341479435337274,18374622831624836100,262144 --variations-seed-version --mojo-platform-channel-handle=3724 /prefetch:2
      4⤵
      PID:5860
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\xz4io3p5.z4r" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=3916,i,1087341479435337274,18374622831624836100,262144 --variations-seed-version --mojo-platform-channel-handle=3952 /prefetch:1
      4⤵
      PID:3160
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\xz4io3p5.z4r" --field-trial-handle=4372,i,1087341479435337274,18374622831624836100,262144 --variations-seed-version --mojo-platform-channel-handle=3784 /prefetch:8
      4⤵
      PID:3772
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\xz4io3p5.z4r" --field-trial-handle=4420,i,1087341479435337274,18374622831624836100,262144 --variations-seed-version --mojo-platform-channel-handle=4360 /prefetch:8
      4⤵
      PID:1196
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\xz4io3p5.z4r" --field-trial-handle=4460,i,1087341479435337274,18374622831624836100,262144 --variations-seed-version --mojo-platform-channel-handle=4472 /prefetch:8
      4⤵
      PID:4816
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\xz4io3p5.z4r" --field-trial-handle=4896,i,1087341479435337274,18374622831624836100,262144 --variations-seed-version --mojo-platform-channel-handle=4892 /prefetch:8
      4⤵
      PID:5512
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\xz4io3p5.z4r" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=4948,i,1087341479435337274,18374622831624836100,262144 --variations-seed-version --mojo-platform-channel-handle=5024 /prefetch:1
      4⤵
      PID:1588
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\xz4io3p5.z4r" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=5036,i,1087341479435337274,18374622831624836100,262144 --variations-seed-version --mojo-platform-channel-handle=5016 /prefetch:1
      4⤵
      PID:2756
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\xz4io3p5.z4r" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=5048,i,1087341479435337274,18374622831624836100,262144 --variations-seed-version --mojo-platform-channel-handle=5112 /prefetch:1
      4⤵
      PID:2108
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\xz4io3p5.z4r" --field-trial-handle=5136,i,1087341479435337274,18374622831624836100,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:8
      4⤵
      PID:3004
  - - C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
      4⤵
      Drops file in Program Files directory
      PID:5924
    - - C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x268,0x26c,0x270,0x244,0x274,0x7ff68be01f58,0x7ff68be01f64,0x7ff68be01f70
        5⤵
        Drops file in Program Files directory
        
        PID:5296
    - - C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\initial_preferences" --create-shortcuts=1 --install-level=0
        5⤵
        Drops file in Program Files directory
        Modifies registry class
        Suspicious use of FindShellTrayWindow
        
        PID:5468
      - C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x268,0x26c,0x270,0x244,0x274,0x7ff68be01f58,0x7ff68be01f64,0x7ff68be01f70
        6⤵
        Drops file in Program Files directory
        
        PID:868
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\jz3g5lks.vnb"
    3⤵
    PID:2804
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir=C:\Users\Admin\AppData\Local\Temp\jz3g5lks.vnb
      4⤵
      Checks processor information in registry
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:4408
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2020 -prefsLen 27099 -prefMapHandle 2024 -prefMapSize 270279 -ipcHandle 2100 -initialChannelId {4ffaabf3-7d98-4252-8b20-102c1417a846} -parentPid 4408 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4408" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
        5⤵
        
        PID:1016
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2500 -prefsLen 27135 -prefMapHandle 2504 -prefMapSize 270279 -ipcHandle 2252 -initialChannelId {280430ea-6216-4e48-abef-1eaa4eebd484} -parentPid 4408 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4408" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
        5⤵
        
        PID:3776
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\5d55f058-e47e-4f68-9dd7-8064ae107d02.dmp"
        5⤵
        
        PID:432
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2876 -prefsLen 27135 -prefMapHandle 2812 -prefMapSize 270279 -ipcHandle 2872 -initialChannelId {b2a222fc-fb76-4963-85b1-98f2729a7687} -parentPid 4408 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4408" -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 gpu
        5⤵
        
        PID:4184
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\e259667c-699e-4959-9ddd-4c3afa01e879.dmp"
        5⤵
        
        PID:5180
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2872 -prefsLen 27135 -prefMapHandle 3184 -prefMapSize 270279 -ipcHandle 3180 -initialChannelId {e7feff6d-0918-429b-bf0e-099dd404e750} -parentPid 4408 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4408" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 gpu
        5⤵
        
        PID:3692
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\f8f99955-e08a-4d47-8fc5-8f9eb3ed16e0.dmp"
        5⤵
        
        PID:1884
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2872 -prefsLen 27200 -prefMapHandle 3268 -prefMapSize 270279 -ipcHandle 3732 -initialChannelId {40100a6c-1f04-46a2-a9bf-6e477338ab62} -parentPid 4408 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4408" -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 gpu
        5⤵
        
        PID:2232
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3848 -prefsLen 27325 -prefMapHandle 3860 -prefMapSize 270279 -jsInitHandle 3660 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3972 -initialChannelId {843e20f5-65e2-44f3-8c5f-0101239346a4} -parentPid 4408 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4408" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 tab
        5⤵
        Checks processor information in registry
        
        PID:1420
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\aed436b5-c018-4f50-bd89-5d68df67ca14.dmp"
        5⤵
        
        PID:5716
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3732 -prefsLen 27325 -prefMapHandle 4032 -prefMapSize 270279 -ipcHandle 4060 -initialChannelId {d32b97a0-b925-4109-ba58-623af891eb05} -parentPid 4408 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4408" -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 gpu
        5⤵
        
        PID:6000
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\d0885b3f-454d-4829-a92a-de53b9fe5a73.dmp"
        5⤵
        
        PID:5240
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4284 -prefsLen 27325 -prefMapHandle 4288 -prefMapSize 270279 -ipcHandle 4308 -initialChannelId {c887150a-9d97-4463-8674-2ef507974a2d} -parentPid 4408 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4408" -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 rdd
        5⤵
        
        PID:5628
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3108 -prefsLen 34824 -prefMapHandle 2972 -prefMapSize 270279 -jsInitHandle 3044 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4720 -initialChannelId {c5135b05-d14b-48c0-a21b-a3443c8a220b} -parentPid 4408 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4408" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
        5⤵
        Checks processor information in registry
        
        PID:2812
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 3088 -prefsLen 35012 -prefMapHandle 4956 -prefMapSize 270279 -ipcHandle 5104 -initialChannelId {cb17477b-2171-4a8f-b715-a6c006f95602} -parentPid 4408 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4408" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 utility
        5⤵
        Checks processor information in registry
        
        PID:7120
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5064 -prefsLen 32900 -prefMapHandle 4052 -prefMapSize 270279 -jsInitHandle 4888 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5112 -initialChannelId {3c471fae-b8cc-4d8d-a4d3-5931a09397d5} -parentPid 4408 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4408" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
        5⤵
        Checks processor information in registry
        
        PID:7136
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5088 -prefsLen 32900 -prefMapHandle 5092 -prefMapSize 270279 -jsInitHandle 5096 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5124 -initialChannelId {8e20598c-6819-4ea4-8095-efe78422bb53} -parentPid 4408 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4408" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
        5⤵
        Checks processor information in registry
        
        PID:7160
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5612 -prefsLen 32952 -prefMapHandle 5616 -prefMapSize 270279 -jsInitHandle 5620 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5628 -initialChannelId {ea02ceff-d842-46a3-a772-ca5f233ba43e} -parentPid 4408 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4408" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab
        5⤵
        Checks processor information in registry
        
        PID:5492
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\l1htkhcg.m01"
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious use of FindShellTrayWindow
    PID:7132
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\l1htkhcg.m01 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\l1htkhcg.m01\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x238,0x23c,0x240,0x234,0x24c,0x7fff240df208,0x7fff240df214,0x7fff240df220
      4⤵
      PID:3720
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\l1htkhcg.m01" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --field-trial-handle=2200,i,9987967866533280089,14523935321125415570,262144 --variations-seed-version --mojo-platform-channel-handle=2196 /prefetch:2
      4⤵
      PID:2160
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\l1htkhcg.m01" --always-read-main-dll --field-trial-handle=1856,i,9987967866533280089,14523935321125415570,262144 --variations-seed-version --mojo-platform-channel-handle=2180 /prefetch:3
      4⤵
      PID:2080
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\l1htkhcg.m01" --always-read-main-dll --field-trial-handle=2588,i,9987967866533280089,14523935321125415570,262144 --variations-seed-version --mojo-platform-channel-handle=2740 /prefetch:8
      4⤵
      PID:1580
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\l1htkhcg.m01" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3352,i,9987967866533280089,14523935321125415570,262144 --variations-seed-version --mojo-platform-channel-handle=3348 /prefetch:1
      4⤵
      PID:6224
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\l1htkhcg.m01" --instant-process --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3332,i,9987967866533280089,14523935321125415570,262144 --variations-seed-version --mojo-platform-channel-handle=3368 /prefetch:1
      4⤵
      PID:6288
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\l1htkhcg.m01" --always-read-main-dll --field-trial-handle=3764,i,9987967866533280089,14523935321125415570,262144 --variations-seed-version --mojo-platform-channel-handle=3876 /prefetch:8
      4⤵
      PID:3460
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\l1htkhcg.m01" --always-read-main-dll --field-trial-handle=3768,i,9987967866533280089,14523935321125415570,262144 --variations-seed-version --mojo-platform-channel-handle=4928 /prefetch:8
      4⤵
      PID:6744
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\l1htkhcg.m01" --always-read-main-dll --field-trial-handle=3776,i,9987967866533280089,14523935321125415570,262144 --variations-seed-version --mojo-platform-channel-handle=4996 /prefetch:8
      4⤵
      PID:4716
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\l1htkhcg.m01" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --field-trial-handle=3880,i,9987967866533280089,14523935321125415570,262144 --variations-seed-version --mojo-platform-channel-handle=5036 /prefetch:1
      4⤵
      PID:6992
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\l1htkhcg.m01" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --field-trial-handle=3860,i,9987967866533280089,14523935321125415570,262144 --variations-seed-version --mojo-platform-channel-handle=5040 /prefetch:2
      4⤵
      PID:7024
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\l1htkhcg.m01" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --field-trial-handle=3928,i,9987967866533280089,14523935321125415570,262144 --variations-seed-version --mojo-platform-channel-handle=5080 /prefetch:1
      4⤵
      PID:7040
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\l1htkhcg.m01" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --field-trial-handle=3960,i,9987967866533280089,14523935321125415570,262144 --variations-seed-version --mojo-platform-channel-handle=5108 /prefetch:2
      4⤵
      PID:7048
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\l1htkhcg.m01" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --field-trial-handle=3980,i,9987967866533280089,14523935321125415570,262144 --variations-seed-version --mojo-platform-channel-handle=5092 /prefetch:1
      4⤵
      PID:6808
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\l1htkhcg.m01" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --field-trial-handle=4016,i,9987967866533280089,14523935321125415570,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:2
      4⤵
      PID:4240
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\l1htkhcg.m01" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --field-trial-handle=4040,i,9987967866533280089,14523935321125415570,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:1
      4⤵
      PID:4372
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\l1htkhcg.m01" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --field-trial-handle=4056,i,9987967866533280089,14523935321125415570,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:2
      4⤵
      PID:5300
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\l1htkhcg.m01" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --field-trial-handle=4076,i,9987967866533280089,14523935321125415570,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:1
      4⤵
      PID:4996
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\l1htkhcg.m01" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --field-trial-handle=4088,i,9987967866533280089,14523935321125415570,262144 --variations-seed-version --mojo-platform-channel-handle=5244 /prefetch:2
      4⤵
      PID:4532
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\l1htkhcg.m01" --always-read-main-dll --field-trial-handle=5128,i,9987967866533280089,14523935321125415570,262144 --variations-seed-version --mojo-platform-channel-handle=3916 /prefetch:8
      4⤵
      PID:3348
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\l1htkhcg.m01" --always-read-main-dll --field-trial-handle=5240,i,9987967866533280089,14523935321125415570,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:8
      4⤵
      PID:1460
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\l1htkhcg.m01" --always-read-main-dll --field-trial-handle=5464,i,9987967866533280089,14523935321125415570,262144 --variations-seed-version --mojo-platform-channel-handle=5020 /prefetch:8
      4⤵
      PID:948
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --no-sandbox --mute-audio --onnx-enabled-for-ee --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\l1htkhcg.m01" --always-read-main-dll --field-trial-handle=5428,i,9987967866533280089,14523935321125415570,262144 --variations-seed-version --mojo-platform-channel-handle=5012 /prefetch:8
      4⤵
      PID:2812
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tpq1dlu3.bin"
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious use of FindShellTrayWindow
    PID:6340
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\tpq1dlu3.bin /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\tpq1dlu3.bin\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7fff240df208,0x7fff240df214,0x7fff240df220
      4⤵
      PID:4892
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tpq1dlu3.bin" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --field-trial-handle=2632,i,790980458041139096,1385876764588229765,262144 --variations-seed-version --mojo-platform-channel-handle=2612 /prefetch:2
      4⤵
      PID:3928
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tpq1dlu3.bin" --always-read-main-dll --field-trial-handle=1804,i,790980458041139096,1385876764588229765,262144 --variations-seed-version --mojo-platform-channel-handle=2652 /prefetch:3
      4⤵
      PID:4804
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tpq1dlu3.bin" --always-read-main-dll --field-trial-handle=2260,i,790980458041139096,1385876764588229765,262144 --variations-seed-version --mojo-platform-channel-handle=2868 /prefetch:8
      4⤵
      PID:4528
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tpq1dlu3.bin" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3020,i,790980458041139096,1385876764588229765,262144 --variations-seed-version --mojo-platform-channel-handle=3092 /prefetch:1
      4⤵
      PID:796
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tpq1dlu3.bin" --instant-process --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3028,i,790980458041139096,1385876764588229765,262144 --variations-seed-version --mojo-platform-channel-handle=3108 /prefetch:1
      4⤵
      PID:4416
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tpq1dlu3.bin" --always-read-main-dll --field-trial-handle=3536,i,790980458041139096,1385876764588229765,262144 --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:8
      4⤵
      PID:5924
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tpq1dlu3.bin" --always-read-main-dll --field-trial-handle=3540,i,790980458041139096,1385876764588229765,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:8
      4⤵
      PID:6400
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tpq1dlu3.bin" --always-read-main-dll --field-trial-handle=3548,i,790980458041139096,1385876764588229765,262144 --variations-seed-version --mojo-platform-channel-handle=4412 /prefetch:8
      4⤵
      PID:6524
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tpq1dlu3.bin" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --field-trial-handle=3564,i,790980458041139096,1385876764588229765,262144 --variations-seed-version --mojo-platform-channel-handle=4492 /prefetch:1
      4⤵
      PID:6432
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tpq1dlu3.bin" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --field-trial-handle=3580,i,790980458041139096,1385876764588229765,262144 --variations-seed-version --mojo-platform-channel-handle=3012 /prefetch:2
      4⤵
      PID:6560
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tpq1dlu3.bin" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --field-trial-handle=3596,i,790980458041139096,1385876764588229765,262144 --variations-seed-version --mojo-platform-channel-handle=4380 /prefetch:1
      4⤵
      PID:5192
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tpq1dlu3.bin" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --field-trial-handle=3636,i,790980458041139096,1385876764588229765,262144 --variations-seed-version --mojo-platform-channel-handle=4860 /prefetch:2
      4⤵
      PID:1064
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tpq1dlu3.bin" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --field-trial-handle=3560,i,790980458041139096,1385876764588229765,262144 --variations-seed-version --mojo-platform-channel-handle=4848 /prefetch:1
      4⤵
      PID:3156
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tpq1dlu3.bin" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --field-trial-handle=3660,i,790980458041139096,1385876764588229765,262144 --variations-seed-version --mojo-platform-channel-handle=4896 /prefetch:2
      4⤵
      PID:6964
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tpq1dlu3.bin" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --field-trial-handle=3740,i,790980458041139096,1385876764588229765,262144 --variations-seed-version --mojo-platform-channel-handle=4884 /prefetch:1
      4⤵
      PID:2392
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tpq1dlu3.bin" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --field-trial-handle=3756,i,790980458041139096,1385876764588229765,262144 --variations-seed-version --mojo-platform-channel-handle=4976 /prefetch:2
      4⤵
      PID:2792
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tpq1dlu3.bin" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --field-trial-handle=3784,i,790980458041139096,1385876764588229765,262144 --variations-seed-version --mojo-platform-channel-handle=4964 /prefetch:1
      4⤵
      PID:1556
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tpq1dlu3.bin" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --field-trial-handle=3812,i,790980458041139096,1385876764588229765,262144 --variations-seed-version --mojo-platform-channel-handle=4936 /prefetch:2
      4⤵
      PID:2044
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tpq1dlu3.bin" --always-read-main-dll --field-trial-handle=5080,i,790980458041139096,1385876764588229765,262144 --variations-seed-version --mojo-platform-channel-handle=4884 /prefetch:8
      4⤵
      PID:6048
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tpq1dlu3.bin" --always-read-main-dll --field-trial-handle=5108,i,790980458041139096,1385876764588229765,262144 --variations-seed-version --mojo-platform-channel-handle=3736 /prefetch:8
      4⤵
      PID:4000
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tpq1dlu3.bin" --always-read-main-dll --field-trial-handle=3684,i,790980458041139096,1385876764588229765,262144 --variations-seed-version --mojo-platform-channel-handle=5596 /prefetch:8
      4⤵
      PID:6752
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --no-sandbox --mute-audio --onnx-enabled-for-ee --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tpq1dlu3.bin" --always-read-main-dll --field-trial-handle=3680,i,790980458041139096,1385876764588229765,262144 --variations-seed-version --mojo-platform-channel-handle=5640 /prefetch:8
      4⤵
      PID:2888
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\b50rrz0q.3jd"
    3⤵
    PID:3780
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir=C:\Users\Admin\AppData\Local\Temp\b50rrz0q.3jd
      4⤵
      Checks processor information in registry
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:1716
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1972 -prefsLen 27099 -prefMapHandle 1976 -prefMapSize 270331 -ipcHandle 2080 -initialChannelId {8ba66e2b-8786-4849-83ad-14c72b262be7} -parentPid 1716 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1716" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
        5⤵
        
        PID:3952
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2104 -prefsLen 27135 -prefMapHandle 2084 -prefMapSize 270331 -ipcHandle 2480 -initialChannelId {5a6ca426-e677-49b5-bcfa-47b591675894} -parentPid 1716 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1716" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
        5⤵
        
        PID:5576
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\b3afed83-0fa2-4d05-a593-299f857634ad.dmp"
        5⤵
        
        PID:5540
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2260 -prefsLen 27135 -prefMapHandle 2780 -prefMapSize 270331 -ipcHandle 2796 -initialChannelId {969a1bd9-7c60-41d1-ba3b-a3bf4df6fbe6} -parentPid 1716 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1716" -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 gpu
        5⤵
        
        PID:2652
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\507901e4-eed8-47b7-bc6c-fe5c5eb75001.dmp"
        5⤵
        
        PID:832
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3064 -prefsLen 27135 -prefMapHandle 3196 -prefMapSize 270331 -ipcHandle 2796 -initialChannelId {c5349dbf-81bb-42bb-aa1a-27227fbcab34} -parentPid 1716 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1716" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 gpu
        5⤵
        
        PID:4568
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3820 -prefsLen 27325 -prefMapHandle 3824 -prefMapSize 270331 -jsInitHandle 3828 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3836 -initialChannelId {9f77af4d-dc1b-470a-86a0-4054273d7116} -parentPid 1716 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1716" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
        5⤵
        Checks processor information in registry
        
        PID:376
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\adae488f-460a-4753-a468-37fd66a08210.dmp"
        5⤵
        
        PID:7136
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3852 -prefsLen 27325 -prefMapHandle 3964 -prefMapSize 270331 -ipcHandle 3996 -initialChannelId {944843f0-9fe5-45a3-b2ec-a05399a270fc} -parentPid 1716 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1716" -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 gpu
        5⤵
        
        PID:4420
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\8f1ba493-cf36-417d-b8bd-1c83c977d6df.dmp"
        5⤵
        
        PID:456
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4208 -prefsLen 27325 -prefMapHandle 4204 -prefMapSize 270331 -ipcHandle 4196 -initialChannelId {aca97aab-2195-4910-bcc6-c85e60dc0101} -parentPid 1716 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1716" -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 rdd
        5⤵
        
        PID:6976
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4560 -prefsLen 34878 -prefMapHandle 4564 -prefMapSize 270331 -jsInitHandle 4568 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4576 -initialChannelId {4b95be71-215d-4de9-931f-938d95548025} -parentPid 1716 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1716" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
        5⤵
        Checks processor information in registry
        
        PID:932
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4944 -prefsLen 34878 -prefMapHandle 4948 -prefMapSize 270331 -ipcHandle 4956 -initialChannelId {6436fb09-6585-4af7-9dfa-ea15807d410d} -parentPid 1716 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1716" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 utility
        5⤵
        Checks processor information in registry
        
        PID:1420
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5360 -prefsLen 32818 -prefMapHandle 5364 -prefMapSize 270331 -jsInitHandle 5368 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5400 -initialChannelId {48c5f747-2e5f-4b69-b084-daa6acca86af} -parentPid 1716 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1716" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
        5⤵
        Checks processor information in registry
        
        PID:2148
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5384 -prefsLen 32818 -prefMapHandle 5388 -prefMapSize 270331 -jsInitHandle 5392 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5408 -initialChannelId {1764a8bb-f77b-44a4-b9ab-fea5d3feff0c} -parentPid 1716 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1716" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
        5⤵
        Checks processor information in registry
        
        PID:6800
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5676 -prefsLen 32818 -prefMapHandle 5680 -prefMapSize 270331 -jsInitHandle 5684 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5696 -initialChannelId {148c3fe8-8866-4fbc-87a3-85b9c675e1c6} -parentPid 1716 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1716" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
        5⤵
        Checks processor information in registry
        
        PID:5892
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nn4khdqu.zza"
    3⤵
    - Enumerates system info in registry
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    PID:2100
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\nn4khdqu.zza /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\nn4khdqu.zza\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\nn4khdqu.zza --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fff32c8dcf8,0x7fff32c8dd04,0x7fff32c8dd10
      4⤵
      PID:6464
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nn4khdqu.zza" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=2028,i,15126956709641316753,3827657388043231564,262144 --variations-seed-version --mojo-platform-channel-handle=2024 /prefetch:2
      4⤵
      PID:6352
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nn4khdqu.zza" --field-trial-handle=1916,i,15126956709641316753,3827657388043231564,262144 --variations-seed-version --mojo-platform-channel-handle=2388 /prefetch:3
      4⤵
      PID:3808
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nn4khdqu.zza" --field-trial-handle=2124,i,15126956709641316753,3827657388043231564,262144 --variations-seed-version --mojo-platform-channel-handle=2628 /prefetch:8
      4⤵
      PID:4488
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nn4khdqu.zza" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=2844,i,15126956709641316753,3827657388043231564,262144 --variations-seed-version --mojo-platform-channel-handle=2780 /prefetch:1
      4⤵
      PID:6812
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nn4khdqu.zza" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=2852,i,15126956709641316753,3827657388043231564,262144 --variations-seed-version --mojo-platform-channel-handle=2932 /prefetch:1
      4⤵
      PID:1656
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nn4khdqu.zza" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3252,i,15126956709641316753,3827657388043231564,262144 --variations-seed-version --mojo-platform-channel-handle=3264 /prefetch:1
      4⤵
      PID:7060
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nn4khdqu.zza" --extension-process --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=3276,i,15126956709641316753,3827657388043231564,262144 --variations-seed-version --mojo-platform-channel-handle=3840 /prefetch:2
      4⤵
      PID:6524
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nn4khdqu.zza" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=3308,i,15126956709641316753,3827657388043231564,262144 --variations-seed-version --mojo-platform-channel-handle=3848 /prefetch:1
      4⤵
      PID:2280
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nn4khdqu.zza" --extension-process --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=3320,i,15126956709641316753,3827657388043231564,262144 --variations-seed-version --mojo-platform-channel-handle=3856 /prefetch:2
      4⤵
      PID:528
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nn4khdqu.zza" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=3948,i,15126956709641316753,3827657388043231564,262144 --variations-seed-version --mojo-platform-channel-handle=3880 /prefetch:1
      4⤵
      PID:5880
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nn4khdqu.zza" --field-trial-handle=4196,i,15126956709641316753,3827657388043231564,262144 --variations-seed-version --mojo-platform-channel-handle=4048 /prefetch:8
      4⤵
      PID:6972
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nn4khdqu.zza" --field-trial-handle=4180,i,15126956709641316753,3827657388043231564,262144 --variations-seed-version --mojo-platform-channel-handle=4460 /prefetch:8
      4⤵
      PID:3900
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nn4khdqu.zza" --field-trial-handle=4500,i,15126956709641316753,3827657388043231564,262144 --variations-seed-version --mojo-platform-channel-handle=4512 /prefetch:8
      4⤵
      PID:6332

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1588

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:4184

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:5180

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:7060

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Program Files\Crashpad\settings.dat
Size 40B
SHA256 3cbb543f32ffd5ff6aad40840fd0240683d03b4de1a1eee7185efedbae8c5b7c
MD5 ec632cf4bf374370cf8c7911bd38ef15
SHA1 dbe756494de615b4ba84b9e8762bd4026a4ad466
SHA512 04a706297926d2a8b6332dbdb93a6493d66c72b80a922b6ec16ee174f07dd82cc4026263b4fc154a03564547003388b9990155877c6afe173f951b8121feba24
MD5 SHA1 SHA512

Submit Download

chrome_installer.log

Path C:\Program Files\chrome_installer.log
Size 7KB
SHA256 6f8f6b018bb68f1d65587bde285a348ab9d8f5b79703776a05e7ea5dd2ccd0a1
MD5 c97a27f013e326788978ba0bdfc8d535
SHA1 6c625ea3e5242063f0e76391c3472977cf3f1dd0
SHA512 5cd28f06385b98799796d0a74e8a9b78cbcacb9397b3bb7666ef9aee26fb466f095d801c94bc6dc0db99053f848a9370f8394e00fc613036195bfa2ae6dc416f
SSDEEP 96:FohV3D+KiAwK34K3ierpl44pTpTYNwK2fIK21qRpueDI7v4CtkwK3lIK309:CNni/vqrn44pTpTYiFIzqRJI7ACtTuI5
MD5 SHA1 SHA512 SSDEEP

Submit Download

activity-stream.contile.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ocrnrqc5.default-release\activity-stream.contile.json
Size 5KB
SHA256 f9b6946ef0afa5ed4f42adb96c82f93e7a2308fe575d10400fde546c86eb12b7
MD5 26ca9b26bf5f526ef4b37a3ecf48a5bf
SHA1 3c4aa8643d570448dc38e1cb38732c582dff17b0
SHA512 2322c97d0561ea71fa780b0bdb0edf48cd9595acdd61f365158808de5ef80104051768f15a3095c94e89ff5a3c18124f02e34a2a7f8ea2a4d651a0c031629391
SSDEEP 96:Ke+w9tvrXQ8BnVcAd80oz+ZnjcmCsezEol:Ke+ctvrQ8Bnnd80uanjcmYz7l
MD5 SHA1 SHA512 SSDEEP

Submit Download

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ocrnrqc5.default-release\activity-stream.discovery_stream.json
Size 23KB
SHA256 38fe1520825c1e9be7f199cdf71450dc4a57f012b59c3ac5b0c3d1d1a7c42ec6
MD5 678b817d80541f0ebe0403de11f78091
SHA1 43aa1309820525d6d443e3fab46bb23e7a4148c7
SHA512 75bb85dd252ea8733c6df2d18fdff57bfdeea5f1c7ad497a7d8581c832118a92dfb28615b73fa9e7f3c76769934dcf04a1e1fc3acfd0196e882eb6128584b9d3
SSDEEP 384:zyaAieLlRpbJu2h0RMHdnmu8R5uvbfvYKtXyRgY+RaAoI2:zyVi8B0+B1v8eYu4D
MD5 SHA1 SHA512 SSDEEP

Submit Download

577120C5183923526312DC856F6825FC1C7D072F

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ocrnrqc5.default-release\cache2\entries\577120C5183923526312DC856F6825FC1C7D072F
Size 13KB
SHA256 040c0e0b76641fefb7518ac58abc63fdefa63be1be4fc1ef2f66e0d8dc05be51
MD5 bbb1eb4e6ecc3e6a9095f3fad6b9f863
SHA1 906fce29f4d9825c4d5d786ff79a1742ba7f66c9
SHA512 ac04a05d2aeb296d60eb0a387ba4e6292f4d257025c234d5a90a903a2f0efbe671e939bb7c78272dbc4d4bdf7e1698a1af4c74726454a91075ee2e6f16e685d5
SSDEEP 384:HV9BpiO024Yo7hSznZOML+CbcxDEclrIVy8eUEPS1i:1EZYo7hSz8MLPbcxDEcVIVy8DoSM
MD5 SHA1 SHA512 SSDEEP

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ocrnrqc5.default-release\startupCache\webext.sc.lz4
Size 104KB
SHA256 9cec38ab79c9608508befa4f98eb6d01a03ff951ca544a66c50b9cae359b2655
MD5 33c41a2d383276701a307123a2d1b455
SHA1 e39871ca2ba2140eeb0b163671ec79809ef21a5a
SHA512 6b658cb2c6327c07ac51c10183d7fa5d12336e3d60161b74f702c9689d3fb7a825d8ec45f35b0426e78c7f5e10f6511125c33eb0f542425bbf0443d63c3a3986
SSDEEP 1536:jTrlikOU1hN2ulJeimVcZ/JkLWETE0seiAad77E7aE2EkCv4TmpnsK6Z9h4LmUCs:j3l0ulJywwVTE0EYv2+PpsrbsbUrC
MD5 SHA1 SHA512 SSDEEP

Submit Download

81acb033-c84f-47db-ad14-90796f688088.tmp

Path C:\Users\Admin\AppData\Local\Temp\81acb033-c84f-47db-ad14-90796f688088.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

f70cbde3-c7b3-4f2e-a2d5-4de89dab3aa7.tmp

Path C:\Users\Admin\AppData\Local\Temp\f70cbde3-c7b3-4f2e-a2d5-4de89dab3aa7.tmp
Size 242KB
SHA256 81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82
MD5 541f52e24fe1ef9f8e12377a6ccae0c0
SHA1 189898bb2dcae7d5a6057bc2d98b8b450afaebb6
SHA512 d779d78a15c5efca51ebd6b96a7ccb6d718741bdf7d9a37f53b2eb4b98aa1a78bc4cfa57d6e763aab97276c8f9088940ac0476690d4d46023ff4bf52f3326c88
SSDEEP 3072:r+nmRykNgoldZ8GjJCiUXZSk+QSVh85PxEalRVHmcld9R6yYfEp4ABUGDcaKklrv:k3oF4Z4h45P99Fld9RBQYBVcaxlnfL
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\l1htkhcg.m01\Crashpad\settings.dat
Size 280B
SHA256 5f5e7d7aad7ad5d77be1dba40b63ad9c2ba7c79a3c556ee0baa7a1cb3d0de0f3
MD5 a912f087211f5ff29da80f92b3da8a66
SHA1 483c230751ef72385fc9631a62a082374433e014
SHA512 9ab3e53fc9797b5e6b8eaa783e88138236049d847edd6f3e98ab1716fddd28138396f1496592669e4f157b65768cc7606812393f14ff5bc1208f3873099f6768
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\l1htkhcg.m01\Crashpad\settings.dat
Size 280B
SHA256 d6c61f148645fb1d378a2f153ffca5f01498090e902cf3e27d3c4f55cfed1511
MD5 8c72e103a5c3ca78df1f803a05a3db35
SHA1 15dada2e4e746d767fca1dcd25881ee158e3ca5c
SHA512 d5ceb5fc1995cb3ac0f33bb2e0b779d3a7b15cdf3967fcd8172d2c4b1aecdbb8a2391e6509a07342f7598b577bdc852fb15574c917d4f865033833a98cd2ee6f
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Temp\l1htkhcg.m01\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\l1htkhcg.m01\Default\Code Cache\js\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Temp\l1htkhcg.m01\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 186B
SHA256 ff561b3f255e90f89169d47376a07221e8361d97c23c2ef5badd23923ca4552e
MD5 54cb0fe1309301e86f3d772be6c91bf4
SHA1 f1cdc4b05a7da98f32066069242305660f7c2d3d
SHA512 8271ab717e902db21bf600fc2c8446ac7028dc5ca3daa5b166c0ce4eb4e027357a1bdcef81846866d502522c4f5b190965d10d78a929448ba3d24adb5413094e
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Temp\l1htkhcg.m01\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 259B
SHA256 605026528497d60d84d241b96a40a02c4226804c5d321d4539b205e87940ad49
MD5 dffaca2306c3d5475df79f0429f86a88
SHA1 5ee2fa3c69967173c211e3e1192fcea757930cf6
SHA512 276db54f3646d36fdc2e73a7d314dac17e8d27d17480b66782ec7e931a51e67bad6c4b03dd3718fe93f426899c908e347522dca66515adbae14093acd7304bc2
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Temp\l1htkhcg.m01\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 322B
SHA256 026138f4091674137ccb564e861245e1572aa74f83ee0752c9b42383a06e5550
MD5 0ba4d5b029abdf0aed77bcd63f52a600
SHA1 3df8a4a97218528ace2a96c1c6eb3809bb1d19f8
SHA512 57e9259f5163895b8139581e1091d827423e6281bd48b5fc76aa5e8d57dbee91187836c0a2d8e67caa1a58f69d5779944ccfcd16c759181bbd849c7982e62603
MD5 SHA1 SHA512

Submit Download

index.txt~RFe57cc39.TMP

Path C:\Users\Admin\AppData\Local\Temp\l1htkhcg.m01\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt~RFe57cc39.TMP
Size 120B
SHA256 ca8f8e13430df130685d745ac2a73d162240e1800a46788a7dbcf0dd04cd9e18
MD5 8296ce296b584ad3598605237e894132
SHA1 029c0ce088a35088e2a98a65717971a600b0d686
SHA512 ce2eff862a0417935782bf364622c4c84a14849e1a7ebd96be0da263e9c830d3176e8b10d9341db531187e51973edb9c5a39049c604eec537d7a837eef0c30b4
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\l1htkhcg.m01\Local State
Size 3KB
SHA256 b41eb53f30b0717b03ebfcc3d666acb09568833beb2f1556d9a10c035ec626f8
MD5 f24298583d1949ffc7e3f96bc4f7c88b
SHA1 8903b8b8377741c918543eeb054bb61a0891a4d7
SHA512 7c4ea5d98b686aa71da175091ac10db734d3cc8b10c3b0529aadff12fd4eae0d8aceaa4d5725b742099fda9b81a289584b7220a9bab44d3040f58552c662face
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\l1htkhcg.m01\Local State
Size 4KB
SHA256 6d453f6ddfb383b438099013aa3b8f280cac7cf976677abec12aa92b6de220e8
MD5 192e111f005b957db8062be122983e02
SHA1 78eaaba4409c4cdd2af722f4e1af0a154ec4f7ec
SHA512 9a31913474cb80a42666660dab08fa0c7bc44fc41f38b4726ca458eb2d54df189c21aa9e165676392ef4e2c01bc50fef789aae2a365ce21cbf162423c5e0ecf1
SSDEEP 96:mrqGNkCufL2qPdYOI58Frh/cInURoDotov41DQBmaPYvq5uKjUJGqCU9B7a:HGNbo2KooDUw6U3rjEGnUa
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State~RFe57c11d.TMP

Path C:\Users\Admin\AppData\Local\Temp\l1htkhcg.m01\Local State~RFe57c11d.TMP
Size 1KB
SHA256 a24044d37e225ac3295a9f32b43cf6fc6c8b8559f58f10c14ed2c0cec24dc814
MD5 2d96d587222f401298863e74b0717f56
SHA1 60fc79575ff1f78578c039097a3d2c49581f8af2
SHA512 215e6f172b770bee6de6c4f3eb6ddb0c292711ac279a12bb213e6ff69a37d35dc30c2fda427e259db265849b25f68a4a84407d4245b02fd7ef124f1916393d87
MD5 SHA1 SHA512

Submit Download

58da1fc4-e281-43d7-8f84-3a64bd58bc2f.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir988_1581881668\58da1fc4-e281-43d7-8f84-3a64bd58bc2f.tmp
Size 154KB
SHA256 a468f5875b4e55ea732e3df283b4f4ea941be738b238122979ca5d8006a3a8fe
MD5 4ad81f6ccc657d1da582c75c5db037cb
SHA1 ab0370e7d32ebed71fe9787d3a4a2fc0c652a28e
SHA512 66461474f8b36d6d470797df9d4a3cc4698bceb7054c97166eed98b74def84f58486fdb909928aaeafee793799a436210b5d7091acce6232b23eb6ba926ad227
SSDEEP 3072:OqeD5sKZ7XcbMSqnDhcfXE0IfnpWpyKIrFn2wNkR7aUPuWm6u:yD5sIXcYSqDGc0kkpIZ2weeX6u
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\tpq1dlu3.bin\Crashpad\settings.dat
Size 280B
SHA256 9defe722cf881e17baa4d7ca468f7c36586884df6e3549089a84a7dcc757dfc9
MD5 2f0b5ab18c32562ef3751046362d0a81
SHA1 177f1f13811a1a563a8b9cd2abba7e8e93fe29df
SHA512 d1bfa676a0b4dfa5a6c7c3ae7d4e955ebd1d767476f8d192a6c5339f63c53cc660325551ecec46164e538bca2faf3fbf158823586c8a0afe6b0e2254ffea75e0
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\tpq1dlu3.bin\Crashpad\settings.dat
Size 280B
SHA256 5293dfe53af71920d0e48b648ab7182522ea661860633cb10c43171675ceef37
MD5 04ff0c9a0fc3d553288521c785e77977
SHA1 577bde07bea4f144a8eab27bffae4323f4349f25
SHA512 9147bdefba641fe9a7bfd0375377897f3379fde689bdf46cfca6bad5365671917bccafae09952ccdd42c6457edd9978ecb3820dccfeb29934204d74eb652d80f
MD5 SHA1 SHA512

Submit Download

f_000001

Path C:\Users\Admin\AppData\Local\Temp\tpq1dlu3.bin\Default\Cache\Cache_Data\f_000001
Size 34KB
SHA256 8c97e1a3437f857eb8a346a360274ea339a09eda1b965ee1445d870c09b066ca
MD5 4227139d34ecd3be139bf6c7d75fce5b
SHA1 0e984113aa96daf31d002392523ad0dfc9cc3870
SHA512 bdb38f430aa623a17b26044288841a07c82691ee858325b158423839fad99a75b192fe0df269898cd76e22a7e54250611f852ccb763ce82db2f7d1c4eb6fcb52
SSDEEP 768:iFPCuSWxAknP3gQlE3brX+48360GKKAC4FZ8ELh/SAE9gnmlV:iFPCuSonPJErr18ZGKK1oLQH95
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000002

Path C:\Users\Admin\AppData\Local\Temp\tpq1dlu3.bin\Default\Cache\Cache_Data\f_000002
Size 99KB
SHA256 cad25cfcc108f11e81cf1a339916e956b5ccd3ab3da38a3bd7a3a7a01adcd3f4
MD5 86e9c0ad8befdb46f1ecda1d3f2c70ad
SHA1 cf9520c235db04ac02e98a7f7c9f3d5d631d4199
SHA512 30a1265891f03df0c46d4f310d97ffa312b84d485a214d895a1c5e260474260d6637592b20d9cf4efa507c131694f63253577fdb352e8e0c46505e02183e0ab4
SSDEEP 1536:GAqrSnLU5BxYE4bP9zel9rbvjJvNCLtY25wJ0qPKldrT6LTMyT2ItH3RHTZ:GAqrSLSvYEwsVbrTfUPdqL4S2iTZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000003

Path C:\Users\Admin\AppData\Local\Temp\tpq1dlu3.bin\Default\Cache\Cache_Data\f_000003
Size 63KB
SHA256 a9c9c90931e351cba32704d61f1d329d7a9df76145a8d0dc71e194f293abf425
MD5 ceddc0ede5679a07157e742c028d8cc1
SHA1 48af4601ef9feaf67aa08de7e7e6d7f646db4041
SHA512 8c81f96035fe679bd86a4cc490d10e2754817be3fd08fe2a11a0a4bea82e3d102ed4d2a69e20ec347314658b51f931b17e9f3a1ea82c4e28256cc4165431ff66
SSDEEP 1536:RRLKoT08wUGIDL9uWiYp8araK2xQbypF449xYPMk2xmct/p5CWbL:RRLzT0E56c82RlypFT9WPMkYmctxsi
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000005

Path C:\Users\Admin\AppData\Local\Temp\tpq1dlu3.bin\Default\Cache\Cache_Data\f_000005
Size 383KB
SHA256 dc3af441eb066cbda7e42f12fb2b4a3df6f7d56b64b94ad8d099de55e4738c46
MD5 294155765131d445bb3d8e94bebe8d75
SHA1 b6e1cddb101abbddba067e18c9830f8215acb459
SHA512 f86e15e69866fbb47971334f45e19fd4c1ed72ddaff109696cc190fbeaed60904731be665cb98371bf8e291e9ddf7f9772ed24ffdddd21e3564d624c7d2b1bb7
SSDEEP 6144:D9KxWHBWzAY0a9Fufaaqy1h6wVY41jhnSJ5x8T398XPQUI0YLg8FHe8y8KwrTZkd:D4xWhhbE091h6FoSnx8T98YmYBFHIbwg
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00000c

Path C:\Users\Admin\AppData\Local\Temp\tpq1dlu3.bin\Default\Cache\Cache_Data\f_00000c
Size 72KB
SHA256 d532c0033bd892149ba6d22122425ce16e0b9916be3b96edb5d1215892741705
MD5 e8397f14ee34e3d2661d6a762db8ce28
SHA1 c897cf196851f971ac0a728866c1bd1eba41590c
SHA512 b2a8530593aedc867af7daab3fbe40c2649549f977120bdbd073839efe8b5546c5eee83d5788262d0373c5674d90505d02046758b5f6ad0819e5dac71b2ba65b
SSDEEP 1536:Xllt4fEDp707LH1E9kb+zw4oGp6LHXDjMrupuAHnVY3jUUX1AqaPdJp3MdF3TsBf:1PdpcLVE9kcw4oGp6zXCun1Y4UXiJide
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00000d

Path C:\Users\Admin\AppData\Local\Temp\tpq1dlu3.bin\Default\Cache\Cache_Data\f_00000d
Size 16KB
SHA256 283e231a1dedf20c3f98eb1452ec52d042179d31a6ee482e54b51066074faf42
MD5 46b49aad1412c12943384f8afb51204f
SHA1 e6a38f254f0681007745ededdde176ec64670723
SHA512 8b521405691a78c9f03740f2484f6f07ae881cb1ea5d18336fa44771ec025d1dab438c1a849c30a3b7fbabd9dc391fe4aff499a09de1af6391611d1752ee8d45
SSDEEP 384:iEEbbexRg+TpS0d0qXYsoXB+SBuqkXL214/R7MI7fm:WexRbw0/XYf+SBQ/xMD
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00000e

Path C:\Users\Admin\AppData\Local\Temp\tpq1dlu3.bin\Default\Cache\Cache_Data\f_00000e
Size 28KB
SHA256 b421c05a340e40d4d4bd1831521268b6f0afd0461ec3991cfa8d5314bf3207b4
MD5 57f9a7c7e2be49102533a2ceb7a05e51
SHA1 850ab0a80577b7f7effe196cba037899e71594c5
SHA512 66406d54a1d1a44f30e19a9bff1242b50fdcfbf66c33e4c23daaa756c06f50a2e39c991e7a8dfd9a81184cc37c2062d0406070be132e28a22307896e63b55447
SSDEEP 768:dT+CJ4QL+F8S4bApn9Ua0ndjCaixJ/fVW2/AGYnS:TJ45F8SgjXnNCa4fVWVnS
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000010

Path C:\Users\Admin\AppData\Local\Temp\tpq1dlu3.bin\Default\Cache\Cache_Data\f_000010
Size 17KB
SHA256 5e41837a6aba4a285df072ad0290e7f9e1dc4682799f71e33222a3a0d6e5a082
MD5 9e6475d889c8916a680317ec48b212c1
SHA1 daea8c5b6cf03d05fb8ee7fcc18320eefd2ee0ca
SHA512 7c4f34e50b5bf4bc95d59a2ae648a673e4a7dbb9669f73d6512dd12521335297886168c5c00f60cca5f85a655265c49355c3ad113e62124577f75f45abaf534c
SSDEEP 384:DlDTvwo0JYeOCqDG+G8fPv4yDs3HsxaYprRr2y0BYi1n:BXwoy9OCHifts3HsYKroBpn
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000015

Path C:\Users\Admin\AppData\Local\Temp\tpq1dlu3.bin\Default\Cache\Cache_Data\f_000015
Size 68KB
SHA256 fe2fbf50c33ae9e12935df44eb094e541236f27fbbd97ec1bdaec2bf03e69054
MD5 7f3bae3ddb127530a3b1ec2c8501a056
SHA1 3d2a9ec8ebda8961af05bd4f2fbe0aea180fa762
SHA512 e8a5c7cbb1081d5e229b231b3e50a2d0211082981a44628cb6e01dee18087b73240633f649fc1a0103f24613178973997d7a74961bd4ea7dbea49296c48b0e10
SSDEEP 1536:NupBZ1xSO3cQmUY/lbFBw70hbBD9AfA1pwdpPq3Yf3AZ:NunZ18O3NOlJpd+kpwdpi1
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000017

Path C:\Users\Admin\AppData\Local\Temp\tpq1dlu3.bin\Default\Cache\Cache_Data\f_000017
Size 70KB
SHA256 30b4527ac16dda6093c174e8e842c7208d6c1cc26693f6f1a849d52b17b41d37
MD5 362644b225a27e4a658d69e9b17a8d19
SHA1 99e0fd685d570022b40800612b5dd13b801044a8
SHA512 cf1122d85319b28c69ccdf3f12b7362ffde1cafe952edb0e4a40370d1fb80dc6f8ab70e50ae8f07166c29e254d5a138ad8fb346d796752efbd14642afe5905dc
SSDEEP 1536:SPD6v1B+LiVECo6I6hUr2ZEwVjnZefbudrSb3fFQ9RMVFO:SPD6v1B+kvfYWnP5Sb3fFQT
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000019

Path C:\Users\Admin\AppData\Local\Temp\tpq1dlu3.bin\Default\Cache\Cache_Data\f_000019
Size 18KB
SHA256 cb78510332b46564f4369bf31ff85c1ab0016bbcef3110b9b9388b88f1cf4795
MD5 9e32121253edde20161adf93523eb060
SHA1 4b9267459ba3c68bd08e6492a270ccaefe2c2dbf
SHA512 7b5c22ac424e32122637c434f4a087b87ba43ac341c008a4df3d0f57f443e38c68f75ae6087e16cf3d7c651a8a35b80faaa8a28b866b1c0def48e3b6c451fae8
SSDEEP 384:USS65/+IiYmwVYkgDdUlzU7SjcKalWW4sIkb6d2e/Oc+C2kZu:lS64ZimDWz/jcK3WRIkMnmo2Su
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00002d

Path C:\Users\Admin\AppData\Local\Temp\tpq1dlu3.bin\Default\Cache\Cache_Data\f_00002d
Size 16KB
SHA256 23cebdde3aa3c9b38e0647ae2bd6daedae2f62adee6521dbf726731d00bf14b5
MD5 fdbdb95b5ac5c4edecb625ceaccf87b5
SHA1 8da620668bc6b3ee6c2eac8c258d80afa06ead0c
SHA512 08c9c96ffa14e4be65c50bed0683a5d817ea190a493cca1119dbec30807a9e5846baa86c96dd97603620ee67c3acee2cda678cb246fdbd033aed1805aef1d2f1
SSDEEP 384:BhBYbM/UQhdWQz2xB4uINwHHKwq2Lx+J7Yj83GyEskVvyWpg5Fe:DqQUwWQz2xBrnnbNLUBYI2yEVVKWpn
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00002f

Path C:\Users\Admin\AppData\Local\Temp\tpq1dlu3.bin\Default\Cache\Cache_Data\f_00002f
Size 33KB
SHA256 89ab09e7b2d516d5292607553dec92832148ab1a3c37529b7ae4a108477cc387
MD5 baebf31c834043f30f329f8105626445
SHA1 743c63a89cb813094b68af4b8bd2886624c1a08e
SHA512 c98727173145a6b93cb3c1790d9067503966ff617ca50201c68e60051269223cf728b65b439456bf197921324c3f133c057690e8ceaf3f899561def9dc41cf74
SSDEEP 768:AdkIw38+GJp0WyTh17LiGi3m6W2MNc+0lgntGsWEOn:AdzoApU2Gu7INc+0l0t0
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000031

Path C:\Users\Admin\AppData\Local\Temp\tpq1dlu3.bin\Default\Cache\Cache_Data\f_000031
Size 37KB
SHA256 6df0197d5710db66a7ef315a0576051377f58955d73c1f4b23db7ad183df8d3a
MD5 69581708d86ec10c6489065b51ee5483
SHA1 91fe71d2a355d958d826f336a880c844a72c13cf
SHA512 7931780512d21f926e193d29f39656e9d4b626487d81d58b6977054ae78d941860ecc56eb1c6ce042431471b871a0c8b0efe09b2fe40eaf5214d45ae16c585f5
SSDEEP 768:tx2YIheOWrWX5LytLNWQho0hd7NV79tIQNY:tkY/8ytxWfqd7NV79mQNY
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000034

Path C:\Users\Admin\AppData\Local\Temp\tpq1dlu3.bin\Default\Cache\Cache_Data\f_000034
Size 17KB
SHA256 1c252d3f3dc6616ebbfc5cd29e8537f2abdbfa6b34a624c9a20038ffe1c3cf53
MD5 0408f0b32584dacda0d3bc0a5233d8db
SHA1 798be1217f22d352ebaef5402d4245cea48ab48a
SHA512 9e344569a968561d6c9cf7ccf8caccf9140cb995a69c7bfe9f23a939393d13633749a13417f6e73347a62e65107df03bb63c0cead6c7574f153f707c94e603ba
SSDEEP 384:11lSwURGstPKEYa5FnpxYdxoAscuJjEK/M0AK4:8HRGst3DPpxYdxotJjEJ0AK4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Trust Tokens

Path C:\Users\Admin\AppData\Local\Temp\tpq1dlu3.bin\Default\Network\Trust Tokens
Size 36KB
SHA256 19e1e0d60dc0a70455014fec98b5e4b73e93a80651600368745ab0d4a49c9529
MD5 4203aba60fd9de5b4232fc624db3f817
SHA1 1f07dfc552d6b509c83c36cb05986007ce29e250
SHA512 6240f8ef505e093f0ea99306adfa90969b3de094cde08b61076bd2c737763c0815108f532ec17e766fe15f9b1bcb9d82096f799ef04d50c3ce2305d8247bfeb1
SSDEEP 24:TL33lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:TL31DtX5nDOvyKDhU1cSB
MD5 SHA1 SHA512 SSDEEP

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Temp\tpq1dlu3.bin\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 192B
SHA256 2e5ec8a4b80c96d0eae4259aa3437e11a4aa48e2bfb33c1a4dffcc3003c9f177
MD5 3f609b618c5fab3b34cf961813c77c6d
SHA1 85f1e5c30d50843a0a64271f917c7c2d54556282
SHA512 ce7a9a69c1db218064d27584c93e71856ed950ad543fcf4644c3568145e45b19c3311961cbb063aa881f2a2b068e838d1ab3b80ec028226950a4a16255b102ee
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Temp\tpq1dlu3.bin\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 257B
SHA256 f86d2617a98c3445b7853afa6247dd36c89e5eb0b24fa4c64696630a8b9ea040
MD5 ca6ff0b4b55ab28e85a200106c4be822
SHA1 eff5d5f0c727002bf961d2cdf81de2b4a5bc36d3
SHA512 a0da42e70fdeab8ecc18150651705ac9289c119b11fbd1859ef7a470b80d053635c9df47258cd4145fc0db82a7f27f6fafc4e37fbf946194243c1df9e2f16763
MD5 SHA1 SHA512

Submit Download

index.txt~RFe57e9a4.TMP

Path C:\Users\Admin\AppData\Local\Temp\tpq1dlu3.bin\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt~RFe57e9a4.TMP
Size 119B
SHA256 da8c74440a8ecc0627c9487f8056b808181e6833cf66c72afb47313a34a4ea66
MD5 26d5019faf5f016382a43273dcf08544
SHA1 e16ee56ab9284cac0cb478b7f07154e93d16a642
SHA512 152130984a6f6eb6f9de6d45dcffd985d87322f7bfec0fc78db5c7032d67f26da8298633265d35f24be5aefbc1f97af013238085d4526b3414ea06b66d9d048e
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\tpq1dlu3.bin\Local State
Size 3KB
SHA256 10c8cabc0a43686fa20ddba098b21d07568d379436e6ef5b83631155e64b29cc
MD5 3190210e2310934a48848716aab4396c
SHA1 7e3f97723297a335f01a7b60afa4e01ee94ebc85
SHA512 4b43f638574909c27fb359724307a2b72774038912e1e32ec0a3049ab283c437dbe04395647b20dcc4edf7cb4e373044b93f45a373d66e57998a90b7f7039983
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\tpq1dlu3.bin\Local State
Size 4KB
SHA256 22994ab44def094893c0a11390c1182bac893f5f832711210c290f8be8c21a6e
MD5 78bf0ecb6e6341423edc33acfbee57ae
SHA1 25ed414e8066f59f32776d0b0b65762de1665a0b
SHA512 68abca121e9382e2bfba3f665a45450ecf1de2cdafc3da898760d2bee86e12d6cf4a841eaa8b75ff75d2428da979a4ee94a1e559426f4da7a6fe3b227b9409a0
SSDEEP 96:vqGNkCufLFV3ll58Frh/cInURoDotovl+DlBnP5SvQmuZ0qJG8BCU0WBea:yGNboFV3yooDUwmbPgu0mG8IU0u
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State~RFe57dc56.TMP

Path C:\Users\Admin\AppData\Local\Temp\tpq1dlu3.bin\Local State~RFe57dc56.TMP
Size 1KB
SHA256 2770d5755422b0cdab17165702af30b3de4c646fa673690d3da7ffee64d4032c
MD5 9eb8b02eaab4cb2458c04a6402af0594
SHA1 772d9a515b64ec3c329fc51a00c8eb027c7cde01
SHA512 9ad13474b8c30af7c83866fe918b1b1e3f44588656fe27a4d6bc49f313e2200c0a3d60979a3849dd164238881906d7ab2ca105b453e2a33b705fe77954cb1b3d
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\xz4io3p5.z4r\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

32.png

Path C:\Users\Admin\AppData\Local\Temp\xz4io3p5.z4r\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\32.png
Size 1KB
SHA256 c0b2a99e82bfa9b629fc903c77bd36fd3b148b25fb67ae196cbda262c593efcf
MD5 b422f26131f7d87105b2ef5bcc8996d1
SHA1 5bebedb12720c3b09dbafe9204bdc8eb0f7971d4
SHA512 1a4b3406afb311ad824a1adfcb33f336de09efab34c66e058936a57d4f73ac33431eacf1fdb11f516f56107a93741aab3b9fa5c85d805466ca58c3e24bcc9c28
MD5 SHA1 SHA512

Submit Download

48.png

Path C:\Users\Admin\AppData\Local\Temp\xz4io3p5.z4r\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\48.png
Size 2KB
SHA256 a16b7fa466101581d443223247589ff21fdf73f1b09d43ac740fa128d0252931
MD5 33da9ad751e4a3b21bfccca9e6727e8f
SHA1 05d5ceb6a2b80de82a2f70442f68ae803dad22f4
SHA512 5af9ef87eb7c050158b7add761ca06273094a5a2d5dba87991c7ab20fa2dfb7e7f7ebf1fbae21286781144ec1fe3531457deaedfd2a668975dc7184020c6f0a9
MD5 SHA1 SHA512

Submit Download

64.png

Path C:\Users\Admin\AppData\Local\Temp\xz4io3p5.z4r\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\64.png
Size 3KB
SHA256 4fea2d966296665a3ae1d35c0eae541b0ef7b9b1a9890e9e65314f80db5a3e21
MD5 1efcc119d02c61752598ca121cd0babd
SHA1 6d0736581b02aee66d51fe29e68babca6a59fdb5
SHA512 8d5554a167907f96720a126e901aa25f01e1f58f9469f8366e7f2352ce16da82fa3963845cdd586837c5aeafb3092a2aec6d3e755bec2031d12325b4799d44e1
MD5 SHA1 SHA512

Submit Download

32.png

Path C:\Users\Admin\AppData\Local\Temp\xz4io3p5.z4r\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\32.png
Size 1KB
SHA256 3197a2ac164c5bacb65f02fd9a6eb9c0a533fdf3b24f43043bbe9af65ed6608a
MD5 60953b3aca67505c2c7ea1a902e84d51
SHA1 5e6a8e04a96e36306c66409edd4775a606f13f54
SHA512 2e65ec84471c3f703617171aa32f1a0d6c57d73e1d5c074b92d20d580df78e7ac4eef5ce54ab7defd0027bb38e33c44a6602d3e123a2fd310e514af0f5b38086
MD5 SHA1 SHA512

Submit Download

48.png

Path C:\Users\Admin\AppData\Local\Temp\xz4io3p5.z4r\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\48.png
Size 2KB
SHA256 9bdfc3aa03d4e41b0d83862ce02f9fe7fdb55a492280d86d551b91a24efd47ca
MD5 1625c1dd7bab831d8ab5308a1a71d525
SHA1 f1c145985a7c8c18891caaba0f46729bcbd1f63b
SHA512 75079bcb02482abd10b121d81fe39607dcac17bb3107ca274c549b570bb473260dfdbdd13df769b1745425ac5433a22fd392a2a1d815897e0c2091b787bada8e
MD5 SHA1 SHA512

Submit Download

64.png

Path C:\Users\Admin\AppData\Local\Temp\xz4io3p5.z4r\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\64.png
Size 2KB
SHA256 57d5cd9fa59f944ffc78ec2a12633a79e2f923124fc50676ffbecaef5021b4a9
MD5 e6671b804d6013a6706ea598e2d854c5
SHA1 40e4f401fe4afbf7bda49a02fe94f5308868460e
SHA512 7b11a47497ae5810ec4c7038ebf8358f03d79126886feb6daffd92d116fd606f530ecced9c3d635c0f57b9f9eb80ed9e8fa4eb98b029f9fd798d9b89ccd279a8
MD5 SHA1 SHA512

Submit Download

32.png

Path C:\Users\Admin\AppData\Local\Temp\xz4io3p5.z4r\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\32.png
Size 927B
SHA256 af50d64bd3cc7c3d201cb5abf0d76f44737e2a4040741ce178d9765fe440bcc5
MD5 26496798ba29a454042d60c9633c1e72
SHA1 65977f9cc15dd73026c91b479f1bc678050c8c45
SHA512 a4a61f66c712fcd27681073c2f30fda3a98fb6348ac4451d8a8e181e525f4ad8491a09d19c17dfb8f01a53eecbfc3ba25f370afd9df5b2ecb9b613236ecdd3cd
MD5 SHA1 SHA512

Submit Download

48.png

Path C:\Users\Admin\AppData\Local\Temp\xz4io3p5.z4r\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\48.png
Size 1KB
SHA256 3339af4538fdfa40bb438469e35f6b7668d5c5ac93db0ef4a9e2fbf9ae884446
MD5 815ddced6b03c8a62cb590ea4585fcba
SHA1 9f7e8cce2319b15ec63d89f837a173bd247e6998
SHA512 ec7069b51959572c40dfa02f380b081912053898b4d4f86166b90bd277f9e8271d0fb3f0627e82645052ebe021c2e24698785e5214e82190a2298f32dd879b3d
MD5 SHA1 SHA512

Submit Download

64.png

Path C:\Users\Admin\AppData\Local\Temp\xz4io3p5.z4r\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\64.png
Size 1KB
SHA256 e895cbcc424d6000a15b21d7cc9dec96deb2403a1469761ba3d9f11528c215b1
MD5 f2222b9d8dea52f5ce7d75378de76037
SHA1 e3b266fca2e5bf8bd82a62791902e879af7ff6fd
SHA512 74b947bc915c89f27954b5d0c8c790316ace581a20f7031aa91af3d95303ff0dd8cb4c87d3746ef2b13f76e0e8bba1b5b4a6916f3230c0514164fb1700640f66
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\xz4io3p5.z4r\Default\shared_proto_db\metadata\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\xz4io3p5.z4r\Default\shared_proto_db\metadata\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\xz4io3p5.z4r\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\xz4io3p5.z4r\ShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\xz4io3p5.z4r\ShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\xz4io3p5.z4r\ShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Google Chrome (2).lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome (2).lnk
Size 2KB
SHA256 767f145d99ec6897dccb1c65b06883b313cec2fce5825d5c02110809b8b3d71f
MD5 b9713368a3c9788352eff5339282e76b
SHA1 6fa0440dfb32a96e02a81ecf74234bafbe5499ea
SHA512 50ff15bea0e5f666952b1dc03b42cec90dc069657cf98a4dcbf695b285222884ae2b318be80366a4c8dc5bd230db42d30cd572074ba7903883007d60bb201e2a
MD5 SHA1 SHA512

Submit Download

J5K4QKGB7398I4I8VHIU.temp

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\J5K4QKGB7398I4I8VHIU.temp
Size 4KB
SHA256 e82677dceb7b6e04dece86eb1370f5ac1ec203946a297e29e45dec5f9ab4d698
MD5 06a88569562d85bb585f0ae481687346
SHA1 c9a986ab91853913b6175461b2c91c4960423262
SHA512 a3c6f5ea47875b93065016374abf5498a2cd1c4719aa212a70f86ae149b320fcf29023a3bb48f04afcf389deed4c21b6d838a47bb80567ad7495d68cde4c8c77
SSDEEP 48:jNdQbdOC/yHVLJ9zUoYUVdLXuHLpWEdQbdOC/yHVLJ9zvYUAgdLXuHG2e:M6JUohurQ6JveIu4
MD5 SHA1 SHA512 SSDEEP

Submit Download

5d55f058-e47e-4f68-9dd7-8064ae107d02.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\5d55f058-e47e-4f68-9dd7-8064ae107d02.dmp
Size 60KB
SHA256 be1bc7e6147432a3409215e6d0ef588b7d4b6a4751d5f7d03cb16ce2c4018510
MD5 d55894a1280e409f5ab2947e381f57b5
SHA1 4472f5568c8a73703e857847bfe115071f1b3afa
SHA512 9c2f19ba68c491393a96169e087230f589be415e4bc6e16d65a857e0d3e9fe0767de896b6f66e7d9843bb7b8dbf05390686ef2dc2b8736cfd6cf0bd65cdf4c2a
SSDEEP 768:v8kO4BYUFHL/Iz3miKdGjOUjT91hKuyQIYr:kkNITjz91UuyQIYr
MD5 SHA1 SHA512 SSDEEP

Submit Download

5d55f058-e47e-4f68-9dd7-8064ae107d02.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\5d55f058-e47e-4f68-9dd7-8064ae107d02.extra
Size 1KB
SHA256 38b9272f04c03896d6edebefe5ae04a203a9a092543682e83ca30ad3239f4792
MD5 48d6d220dc02f391181f7266b08f8c3b
SHA1 4210cd4a9c75d1d0da77984f99641cdfd1efe67c
SHA512 a3a1e2d0f55b48297672f668d8d4368d3e05697f892e3da11a9be61a8f07437605b4173f85033bd4dfb2e02e8efff9a67ef44dc8e2580cccc0a319c374181af7
MD5 SHA1 SHA512

Submit Download

5d55f058-e47e-4f68-9dd7-8064ae107d02.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\5d55f058-e47e-4f68-9dd7-8064ae107d02.extra
Size 3KB
SHA256 6834918d239117cd8202e238bf4ce8b18df1e99be2aa028d46eb1e7f0f968de8
MD5 bd4749085be0e8b97659799781a63954
SHA1 f7937b32055e5148e47024860588c37e0ce66234
SHA512 ca754cd8bbcb76c1942aa30ba52029b9a32c327fab35452fb27ce796e4f638dc391cd6c616b09d2227879fb1ea60333421cac6cd03ab2de6e6159d6fac4aec1a
MD5 SHA1 SHA512

Submit Download

aed436b5-c018-4f50-bd89-5d68df67ca14.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\aed436b5-c018-4f50-bd89-5d68df67ca14.dmp
Size 65KB
SHA256 5e8fef986076b05a097ac81382e4a8630bd62364599ab180116771f114fad8fa
MD5 fe6a2e97f01f0e4ac4e0cff9888fb5b0
SHA1 926f5a9797c991d7b446c38138346f4ee05d248e
SHA512 52d95d8c81d700436fa51a1c88672c76b62061f90a316287b1291be57007959587a0c8de6617dbe62862b10907ceecc21593443ed5ca15d9adb0812de9d84a6e
SSDEEP 768:fOozArd/4X0X50ISMJJGiOlOzMqKuyQIYr:2v8e50ISisi2OzMRuyQIYr
MD5 SHA1 SHA512 SSDEEP

Submit Download

aed436b5-c018-4f50-bd89-5d68df67ca14.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\aed436b5-c018-4f50-bd89-5d68df67ca14.extra
Size 10KB
SHA256 68270bce99c9b72ff3c6e1085ffe3e4ffc2dd24986295911eb4bd4266499bafd
MD5 e7387aaa40183753868f049792fece66
SHA1 590c84a86209fc2e44c7446aeea2d10600e357f2
SHA512 9eafeec56be0eaa82d937962fcb9aee4c242c3e54d0de153b7e3cb4bd7b851de697549d29e0c0c273a0b917051bbf5bd02717fffc53d291f65052d3a76c2bb74
SSDEEP 96:S7WCrTaHY6pw6FF29dW640Rh7CsevBb1d0pjMLlIrLlhTLlaXv7agcBvtILI5qwG:Sh/8YL/7uvZ8FLzxsPpwlKzYfoZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

aed436b5-c018-4f50-bd89-5d68df67ca14.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\aed436b5-c018-4f50-bd89-5d68df67ca14.extra
Size 10KB
SHA256 9bd7b27b8849cf7e14d8b7b5984ee0d6a892d914d3f6e6cb9583917bd7f6c4c8
MD5 b434201083f9ec2982688c027e866711
SHA1 f6dba9daa1644cfe431c5cd5acc7f637e8ebefdc
SHA512 a8b9bf8c98f137b5f3909cb7092954274d3f36636daf67299467dc56ee2510ef20300be44aed8573c76e8303b15665951a518657e1851d165f4421ea389a7951
SSDEEP 192:ShkcFaiR4MmnQYapdVxzPPWBHC4TofKNdalCzYfod3bLEEh:ekcFaiSI13WBHC4T3a7A1T
MD5 SHA1 SHA512 SSDEEP

Submit Download

d0885b3f-454d-4829-a92a-de53b9fe5a73.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\d0885b3f-454d-4829-a92a-de53b9fe5a73.dmp
Size 64KB
SHA256 a8ac15ecfdb3b44d5dc76d5b02d3825e3e486f12d02846176868bd87bfe77836
MD5 c9c28f16f658a4b7739c1d59da8183ad
SHA1 dde2f519783198feda3507705f400cab0e9a1b7c
SHA512 b73c2035dada4a4b692d0bfe75729f3d029fab9dc281dc010e9bc6846840b90bf95548f8138e09210f25fdbd365a8fc1ffefa2b210ad4d1b12764e7e9aa8064c
SSDEEP 384:sPWozkWBOBUK6KTKcUO54H9IgOBKJjS+7lORYUFIkPpPsfzr56X6uyQIY3b:seozkWal4dI8dZ0PlPpPevwKuyQIYr
MD5 SHA1 SHA512 SSDEEP

Submit Download

d0885b3f-454d-4829-a92a-de53b9fe5a73.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\d0885b3f-454d-4829-a92a-de53b9fe5a73.extra
Size 10KB
SHA256 ce4b6f98b93874b28dffcdcaa274ae7e2d45d0ddd748bafd071746122b5c2786
MD5 23ac53c53653a017b40fba46fc7acad3
SHA1 768457824542589d0ac95855a8e75ddf1ef50ec8
SHA512 469a4dacca69e367360b9c95fa9a7a04a0346035050b0ed7ec0b738b89ad6ce077cf63e429ee6d23de19d8f5de3348ce0e80fe86d0af60860d14a6ae8ca1edb9
SSDEEP 96:S7WC+lSTaHY6pw6FF29dW640Rh7CsevBb1d0pjMLlIrLlhTLlaXv7a0cBvtILI57:Sh+lC8YL/7uvZ8FL/xsPpwlkUfo2
MD5 SHA1 SHA512 SSDEEP

Submit Download

d0885b3f-454d-4829-a92a-de53b9fe5a73.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\d0885b3f-454d-4829-a92a-de53b9fe5a73.extra
Size 10KB
SHA256 75b0339c0f390111c8775468154744313836581e23b5d31c35846ba98c372ee4
MD5 80c8a8fe702d736b64516274dca8ab52
SHA1 090f3a60d49156c25fa615f0ab43ffd04c1ac0b5
SHA512 6b221dc03c65ba511add610fefc3f4367bd7cda5906f96518e73583901c9020f8187bfbd3382fd474ec6ef2e549be0cb9af7d606a0bf4bbe64aa2800dac1bd35
SSDEEP 192:Sh+lbcFaiR4MmnQYapdVxzPPWBHy4TofKNdalsUfoubLEEh:e+VcFaiSI13WBHy4T3a7AuT
MD5 SHA1 SHA512 SSDEEP

Submit Download

e259667c-699e-4959-9ddd-4c3afa01e879.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\e259667c-699e-4959-9ddd-4c3afa01e879.dmp
Size 64KB
SHA256 977a92d52571fbc6c4c7758e1afbbf074c72a3d70b063d488aea0176e0d8c709
MD5 f17512e69a9d9829eba30ae9b971f7e3
SHA1 9157db3623c33702a440239c3b0f9c18a10a0003
SHA512 583d396d62aed1da23b17e07a3a34a8ac2c50cfb3e9f6444a4788cb7ae3c6cd88b9cadcdda69255df14b6d8c12b11c7bcf3fb8ef1d1ff78263a5d528f7148ad0
SSDEEP 768:EbHrozCTmzvCgGnPJDzb9dIfyMJKbqR929kOnJKuyQIYr:6rfmzKgaIKS929lnsuyQIYr
MD5 SHA1 SHA512 SSDEEP

Submit Download

e259667c-699e-4959-9ddd-4c3afa01e879.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\e259667c-699e-4959-9ddd-4c3afa01e879.extra
Size 10KB
SHA256 40ce6b251471a19286e9ddfebf1274f18ed26364636a7ef11a84d3ff0d577eda
MD5 e1531b0b2b32a18eaa144575b06db8f2
SHA1 e7183722e6b67d222ed25f9728a368472854c03f
SHA512 6859148329f0c17e646ce064d00ace596cf06730101500e85340186893c3b28fe9b2f322c1d3daa0c2e244152aac02d46dd6e9de426df595d36159b3cfbded77
SSDEEP 96:S7WC+TaHY6pw6FF29dW640Rh7CTvBb1d0pjMLlIrLlhTLlaXv7aYcBvtILI5qwv7:ShG8YL/7WvZ8FL7xsPpwl5mfoz
MD5 SHA1 SHA512 SSDEEP

Submit Download

e259667c-699e-4959-9ddd-4c3afa01e879.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\e259667c-699e-4959-9ddd-4c3afa01e879.extra
Size 10KB
SHA256 fee99cae2e0cb522b9af2203040c09c2e6ea800edf18041e9e1eb06da1b2b37e
MD5 f7a3c1bd7b0f6832071156ffeffd03b4
SHA1 fd3a3c504db485e4ceafc4806300beef481c58a1
SHA512 9adedbff9406eb35608e2ee985e39e0d2153b369ef139666fec94131558e1c455ac6fa5a5c6db947447a664006d30361f08c6eaacac3c614ad484dd63ab6d4db
SSDEEP 192:ShvcFaiR4MmnQYaVdVxzPPWBHC4TofKNdalBmfofbLEEh:evcFaiSW13WBHC4T3aSAfT
MD5 SHA1 SHA512 SSDEEP

Submit Download

f8f99955-e08a-4d47-8fc5-8f9eb3ed16e0.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\f8f99955-e08a-4d47-8fc5-8f9eb3ed16e0.dmp
Size 66KB
SHA256 430189c581b5d654f83484f5970777bd73855a3a679e8357e6015cb77b54ef3a
MD5 052a6d2901cdc80ff427ec5e7274edf6
SHA1 67974eddd3598e755e687eb3b26cf8e9ee36956c
SHA512 123f00b4ea5e5b9a88fb1f969e52e32c055cb69e0153d8b00f2c6bc7d2dd23a0184b870a7dc16c8bb607450c228ce63fb0802f604cbb47f540bd395449ba2113
SSDEEP 768:tGSozdopTMwI10PfREsNHoxw9KuyQIYr:rVI10EQIeguyQIYr
MD5 SHA1 SHA512 SSDEEP

Submit Download

f8f99955-e08a-4d47-8fc5-8f9eb3ed16e0.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\f8f99955-e08a-4d47-8fc5-8f9eb3ed16e0.extra
Size 10KB
SHA256 185964b1a7571ccf29d072c7e83a3e7fd44a7f6d41ba6fde7250238c91b04ad1
MD5 e7b90704a3a9d6f763abb25abf72f1aa
SHA1 6c1b1f29d56bb86e81b48880803bc5c6727826a9
SHA512 5c1e8f4b9fdb3c48cc2a2a7cb7de2e6b2dd00e1bd271103e4029265696b1d3d0090e840112428141993ac4fcb3931d4118e0ca4616a457df1144850dcccaee99
SSDEEP 96:S7WCATaHY6pw6FF29dW640Rh7CsevBb1d0pjMLlIrLlhTLlaXv7aqcBvtILI5qwE:ShM8YL/7uvZ8FLZxsPpwlXGfoW
MD5 SHA1 SHA512 SSDEEP

Submit Download

f8f99955-e08a-4d47-8fc5-8f9eb3ed16e0.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\f8f99955-e08a-4d47-8fc5-8f9eb3ed16e0.extra
Size 10KB
SHA256 ec636e7ec6f76ac3030b9afba5469d7abd045b40c60c3b6604080b61f0dcb5d9
MD5 3371f7bda233227ce56eb93dbbd74e2e
SHA1 3b84300fae9496ba8604e3af1682ef6d5258bb4c
SHA512 1bdecf1de4d89bf3495d42599c2169468aac28ae579255806a60e4cba18e971069d01bd5249ed5301141469c00b0543ac208b43eb1306498810b52268a47ecba
SSDEEP 192:ShVcFaiR4MmnQYapdVxzPPWBHo4TofKNdalvGfoObLEEh:eVcFaiSI13WBHo4T3aYAOT
MD5 SHA1 SHA512 SSDEEP

Submit Download

compatibility.ini

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ocrnrqc5.default-release\compatibility.ini
Size 198B
SHA256 252b7fff962848c61092e82a3d87adca163849767713a93ab533bb397f1f53bb
MD5 ce9ef13caa8a74c25157b184aa038475
SHA1 db03a9935d8bb3ce6b120aca98feade536805160
SHA512 0f6f5053e78167ef5cc5fa70ed3a87dd116df0671a590299277a197341bed983e3d77e37ad2c33cd4afe880fab9ed1c7f7502210040617a01f97a81c1e1d4f29
MD5 SHA1 SHA512

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ocrnrqc5.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 25d6237c84cc6ef6ec8fcf6a3f01b877a0d30ebcce5cd298850cf1b1162caff8
MD5 75bcd46ea4f8e930a2722fb6e3460d6c
SHA1 dc4df1d082e57192f84f1be0e68e5f5d2f2ec829
SHA512 fa4bd38e56630376892a546b2d5db10ea3355b17c08a1da38b31baeeea06556e86a7fdcd5092d3c164424ad9a5211547c45e8d721c69a78ffbe8d6c2dbfac7c1
SSDEEP 192:DOv5zboPfZIvyj4AD61/66JozGzgCl6mSSdz:MboHZIvyjlk/66JozGzgC1bd
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ocrnrqc5.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 e4326acfd79744b1b0aa4f1ba5e31a8dd25c8497faa58455fcc3d1d90818d868
MD5 63edb802f0f7aa41124a1ee85ac59c46
SHA1 f842fb13777aebb2ed63a4d98c8738e6346345c1
SHA512 444ae6cb2d34d737535b456742cc8b22886ba0018309a8caab93c5b659b8eaf32fc948e4fcc444e81ff6149930baeb02aa9bf85e02c5c7dbc7410c08a6f1cf6e
SSDEEP 192:6w1/66JozGzgCl6mSSdsOv5zbowZIvyj4SV:6q/66JozGzgC1bZbowZIvyj1
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ocrnrqc5.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 81761ed58646bea9991c563cb163e4c8f5c571218c5d4b1797785f3cc111577a
MD5 98d9209033940673e8c5a4c470f671c7
SHA1 23374244634b45e0eb9474466f7d52d944ca6d94
SHA512 7cb868681aad411c6e998a4eac24f9cb34550625799b4ef3d53a2d1a296a6c22947b1b220a37a19d8753cb626037cf80586ece380ad89084631e532af209d6c1
SSDEEP 192:6JV1/66JozGzgCl6mSSdGOv5zboP/ZIvyj4SV:6N/66JozGzgC1b7bonZIvyj1
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ocrnrqc5.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 d4bb99316fcf8afae4d3c3a1f6e538a7078ebe2e7d5ee5dcda1df7af618fc194
MD5 7cb856d88770480510fa58e39e0fee5e
SHA1 0b9ce4a6a3eca84008208dbe083e15fed12d6656
SHA512 4002ad6ed87e1cd3aff5e7f03e5b42cfbb80da318736d9f80328f14d9aa44df5857f3b314bbbaf3be8676257305b4b1f76877e42fb2489ac450d90c2d39af7ec
SSDEEP 192:9q1/66JozGzgCl6mSSdgOv5zboSbIvyj4A4:9U/66JozGzgC1bNboSbIvyj6
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ocrnrqc5.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 e88a5f37a5589fe436e181570e82a8462a2b5ee92bacec858e9860bf133d73dd
MD5 79223513524eb30b28df77bb199cf7f5
SHA1 68f6d9e4c282a216a8e5e5ff1a68272fdf119e82
SHA512 6f20b6673b2cfc1a78da56db51a555653cb9e41819ef5b5b94df55b4f43fc8324495bf5a8233dd9e92090208442b3f2441244525ea0a393e46e475352002f741
SSDEEP 192:9M1/66JozGzgCl6mSSdDOv5zboOZIvyj4S:92/66JozGzgC1bWboOZIvyj
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ocrnrqc5.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 15cb72c06b650d624722f5e5730426bd16ba937583d03d73916fc26b4d475401
MD5 efeacda8ccef0c770209f7fab9a5d1cb
SHA1 b05c06f3787ab2d5ecc5b1224753c58d04157ce2
SHA512 43458eb3d86eb06fafd7e09645371eea8a73c40cae827ff50bf00674dc058407b0dade9d914134ac29858c1efa4525542c0833268a163f08ce364253ade0fff6
SSDEEP 192:6Z1/66JozGzgCl6mSSdGOv5zboP/ZIvyj4SV:6X/66JozGzgC1b7bonZIvyj1
MD5 SHA1 SHA512 SSDEEP

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ocrnrqc5.default-release\datareporting\glean\events\events
Size 1KB
SHA256 ff1fa921c493a416c85606438a6543c5741658727be2bf448412bb030baa41d6
MD5 be8043f02c94f4a2d9ead03b552afc0f
SHA1 b0c2d469858a3cc172dca765e1770de80027a813
SHA512 2186d1cb16c97d1e48bea6675eaf2ab38ad2ed9184bb1c1308a4a620c4a58dcfc980e851b805f56da1c86f6d22b862460b770690c1d44819a1a159aae1b44151
MD5 SHA1 SHA512

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ocrnrqc5.default-release\datareporting\glean\events\events
Size 1KB
SHA256 0d1d1a0a2507298c047e18522ab62d957352551a9153b460c74bd50eaaf6509b
MD5 55dfaa36b9dd35f98776cebeff8ceaf5
SHA1 c47f7be98c1014caa31b2592abb381f74d5f6565
SHA512 3c4b4c264fa61c7211f41c31b1eea4a2262e38f71043c4da4e68ff865e482b391b9b535fe3ff60675238d18d0f5f19e6139877d453da7f6595fc30d6f280363f
MD5 SHA1 SHA512

Submit Download

054cce4f-9fe2-47db-82f7-03c1bd33850c

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ocrnrqc5.default-release\datareporting\glean\pending_pings\054cce4f-9fe2-47db-82f7-03c1bd33850c
Size 886B
SHA256 9f52a8bf734620e86663327688abd6f9c31c30deabf268fec109441a91dcc657
MD5 55fc602618c464b2cecc18c2fa0a04f0
SHA1 874dfd119012a36eeea8d9e1ef8d6fc51dd964de
SHA512 a50d421dd855a113d68a4176a1e9322ef395367f37681176ea902aa08f99123bf6c96cf0c6a2933f551751ad3a00273fda4e7385acd2bcb83a77918c8821340d
MD5 SHA1 SHA512

Submit Download

10962fbd-25dc-4657-b368-fd3bc88bbf10

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ocrnrqc5.default-release\datareporting\glean\pending_pings\10962fbd-25dc-4657-b368-fd3bc88bbf10
Size 3KB
SHA256 d3fcb9679f6ec5a690c2c6892299ccf9f4229ff30baad95e18eb9bd3eef08561
MD5 2618ec2299b09a73efce995a72c0bcff
SHA1 9ef8c0eedaee6592a60c6760ca3484c081330ac7
SHA512 c8ab244b04b961c8075b64569701e86ff4db8c8d1ecba0d392fa8b2642dfb4c0e89790b9eb67c53f7076e4ed9f8cedf5d5b3a777c78281bd744753b35a43416d
MD5 SHA1 SHA512

Submit Download

3cca8527-3753-4ae7-b4ee-5afabb6d5b83

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ocrnrqc5.default-release\datareporting\glean\pending_pings\3cca8527-3753-4ae7-b4ee-5afabb6d5b83
Size 16KB
SHA256 803b7bf36e98c05bda5e82ffc77a7e2d5c91e85659b353368d13a29b4564836c
MD5 fb5931359bb1047ffeb6bbc7f4aa570b
SHA1 e362dc8c010ab1075d6054eae997a74e8a134a09
SHA512 f7b144b4fd4b5fb763af6e5eee9493e344cdc17ea2d502b3be55f4e2ec7917a85c75f01a7619354e6d46c89279bafd4227ea5c6e19db55f1e6f49d161b85fda4
SSDEEP 192:hLJCI1271p1SB1rP39Pqtr6lPbp6iVkKcHJfoLAK4ESZThGyvD54+mgiHgJACn7T:xJh21Snj9PukTpeK4aBwk1pSaRhbDcFZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

557b0456-edfd-43bd-8b8e-7181a66751ba

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ocrnrqc5.default-release\datareporting\glean\pending_pings\557b0456-edfd-43bd-8b8e-7181a66751ba
Size 2KB
SHA256 bc01e708898ec3d79d8dbe5ef1e2476b5250ccaffeb2d5460aa48f2236f6a7e8
MD5 ff9042486710c43134eb4df63de5346f
SHA1 968661fff88d6193a254902c0bbe4606aba316cd
SHA512 86b0ab5efcda64b7afe2ee1e4420f596fcc7768f9a05a9a23eba3ac6095b929545dd31aae70425efea3eeac12082c831250e3a78cefea3652ff9bfa3b6adf334
MD5 SHA1 SHA512

Submit Download

627ec59a-bcff-4ff0-95a1-3414d7bc362c

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ocrnrqc5.default-release\datareporting\glean\pending_pings\627ec59a-bcff-4ff0-95a1-3414d7bc362c
Size 235B
SHA256 b52bed49084d1d91459beba440825d30488bec235ff141378f31592f9790f48a
MD5 4b28d9be54adf1cda75439488436ac8f
SHA1 ff910d7fbc02a68aa4ac7240c04ea89f8a537a9d
SHA512 101374482d7835fe960d3e1f5ed97cf46cfa15139629c9d1309ca361be4f1caf67a99f48b421074c855fc94f612c8e7f0b7a9d735b1392997eb30f67482888ba
MD5 SHA1 SHA512

Submit Download

63474054-f8fc-435a-af2c-598c0c5ca884

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ocrnrqc5.default-release\datareporting\glean\pending_pings\63474054-f8fc-435a-af2c-598c0c5ca884
Size 3KB
SHA256 1ed15ff5fd8d5944b20704ff86a71c6f4845233a2b25914295a984482185fd82
MD5 f85d8d95112999ad29530f7195679874
SHA1 f1f3496ae397ace55907bb2f13c1e2cf6a47c4f1
SHA512 f7605f80d954ef8747e6849a427582b5ca4116080d8bbab0cbeacec0c2e6b477fb3bd01ebd23410dcfc0118d517835cd757710b1bda3bf399f4a822a9b80810d
MD5 SHA1 SHA512

Submit Download

64093681-f8f7-4f86-89b9-49e603b35d84

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ocrnrqc5.default-release\datareporting\glean\pending_pings\64093681-f8f7-4f86-89b9-49e603b35d84
Size 235B
SHA256 3dac32b51f62e044767c317ac9dd2bff9b6d9e27d0c1b332070c1d8befaaf1d7
MD5 9fb5b08d0aeef465a87c61b4a06cc2bf
SHA1 9355287979cb768e6d2377d82f035bb75cf59562
SHA512 96b25043a9b8b9164ef986fe00619f36acf170b856629386d70d231a93fb1da4478355f772312013926f34d7b713442ac82903d0cf66cbe1d0cfbd2d55d28371
MD5 SHA1 SHA512

Submit Download

699f2c33-46e7-4ee2-b88b-7d42076a87c3

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ocrnrqc5.default-release\datareporting\glean\pending_pings\699f2c33-46e7-4ee2-b88b-7d42076a87c3
Size 896B
SHA256 91fec0a0e9d32f9ccd37800fc356c22e085dcd171b14a1bec14571adcd889734
MD5 dca5763205ac54176ad848c0617361c2
SHA1 3f2a0ff976a95a4a5f953962d4d77ec2ce718dc1
SHA512 604423c2d6cbbec2bd0bd5b74e77658ced0a60ff1b2361cafed2a24a268dd59f784f104b641f18728f1978b57d31a6f69c141520ed4d890c10721b499f3678cf
MD5 SHA1 SHA512

Submit Download

6f3a291f-ec90-49de-b85e-d1aff663a74a

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ocrnrqc5.default-release\datareporting\glean\pending_pings\6f3a291f-ec90-49de-b85e-d1aff663a74a
Size 3KB
SHA256 d322f885cafecee34b7e45178b1af314fd25740e45d9231c3d5913a884b95f90
MD5 81793ee618d9b4708faa27b9a1a328df
SHA1 703b3352a264b925d5a87950648f48e2a4e42738
SHA512 f5f700d7cd6f902fb7bd1db949c9def2942ae33fc4c1f6a80e09ebc766eded9e01519c0a7f6eef50ce68e0c8488f3aed37c2b8654ad2946bf560c61fc7c8a22c
MD5 SHA1 SHA512

Submit Download

707dc17d-2297-4c86-bc2f-341ca7cf8580

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ocrnrqc5.default-release\datareporting\glean\pending_pings\707dc17d-2297-4c86-bc2f-341ca7cf8580
Size 883B
SHA256 b0a38b44b86bae5e806c25415731da1a77e44bbfb6c0305f6f7e39e19387fa98
MD5 a1d78ec6e343edf10b169578a2eb6acc
SHA1 d0dda2603a58ba90e7cb71d6124a9882e2729ecb
SHA512 04a04e41e4c3081dd3660bb881a0eac2328291bdedeaeaa3efd618dd7b3eb06646e4e6b8b665a0ebc7443cbd83fe26f4f12537fe563be91b290fed666fa6131e
MD5 SHA1 SHA512

Submit Download

731e3c4f-4288-4d50-9bae-66add2bbef98

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ocrnrqc5.default-release\datareporting\glean\pending_pings\731e3c4f-4288-4d50-9bae-66add2bbef98
Size 2KB
SHA256 ccc415985f3dfc124f6a36ebbb7177d69a4b6bd20868ab8591a856dda3d76437
MD5 e0563002b4c776cc596a503073e3a00b
SHA1 3afd0c721f11ce788c528029b557335e6a3ce615
SHA512 e063a06008f060e44feb3754ebd68ddea7af1af2df33ba85b73ae986c6b814232a14e95cd2a6f7a164c2aacede25fa13b7d0e71d4adcdaed9d1f11b9dac51620
MD5 SHA1 SHA512

Submit Download

8786eb96-b6bc-4ca5-9fca-889e7aa5b52b

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ocrnrqc5.default-release\datareporting\glean\pending_pings\8786eb96-b6bc-4ca5-9fca-889e7aa5b52b
Size 3KB
SHA256 77323510dd860aac2db12bbdacef0189fdf6809414cee49230dabfec0195ee76
MD5 9025c17c6ed465e98643b37e32d49995
SHA1 da9b6d1d0a8d319ac2c596b1eadca862e459577a
SHA512 37d85ab5be7139086d89d289beb460e8e882b30ec9587ea2ebcf33d8f3c902351a1d5106695a035f28a88dd7d0c5807f68b8401c6beb765e3cd79992855f5b72
MD5 SHA1 SHA512

Submit Download

a2505993-fd18-4b0a-a649-356245e78208

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ocrnrqc5.default-release\datareporting\glean\pending_pings\a2505993-fd18-4b0a-a649-356245e78208
Size 871B
SHA256 5f249d686e154abdb33bd8943f2f3d41d59739def33dd9fb2c38b6a679ce7f74
MD5 9ef7abae665581496fc33b7aa68f32e6
SHA1 3553f24741fb309545a09dd74c71837c9e2ffc68
SHA512 9fea467692bc3dde092263da151371b77a784e662014a9938be9f826af13696d8cf8652e51a01f06919037b7fb8fd38bcef397b1edf1c3e303fa5dfafb7ec4fc
MD5 SHA1 SHA512

Submit Download

c3698203-ed02-4e21-807d-28d82c6eb0bf

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ocrnrqc5.default-release\datareporting\glean\pending_pings\c3698203-ed02-4e21-807d-28d82c6eb0bf
Size 235B
SHA256 2633af9273d070142c75acc1e1c76a9b92cd6e1b1c928cf0dc3dbce3855933b3
MD5 10487ab8748fe6ced1281ce7cdb33fe3
SHA1 eb0320b7f70f1abc102d5a550552b1c31076b4e7
SHA512 36f3c216459e4c0713fabe7b34ca51fad378cb543fbcfc3b686fedf03c956c423bd129ba4f8596b045455e49592affa31759da639b3757b07305c3d4f28776a3
MD5 SHA1 SHA512

Submit Download

ca73633c-99b8-493f-93da-2404811d7c87

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ocrnrqc5.default-release\datareporting\glean\pending_pings\ca73633c-99b8-493f-93da-2404811d7c87
Size 3KB
SHA256 3f8fa774c79fd3418eac90b0ea857115f4ad6eb98bbadf5af46db086a5d65477
MD5 5a7b65b3954127c12342fd1973f76a03
SHA1 e04ae71e49ef2ffc9f5c46c58169ee480901005e
SHA512 dc0d300257837b701dc465f26b4c09186673ef3a47c5968913fc977e62f224886c9290600a43b57796d22f01c95793395caedaad51c2f850d7ff0110c55f4711
MD5 SHA1 SHA512

Submit Download

ccc962e2-ce84-4539-80e5-5f0c33ef33c5

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ocrnrqc5.default-release\datareporting\glean\pending_pings\ccc962e2-ce84-4539-80e5-5f0c33ef33c5
Size 3KB
SHA256 0e255d3647051826c9dac702551311c1f8b3ad5c94cc074407a694e000e5f314
MD5 022f068303ea458480cca92f1f19c0d3
SHA1 e353ac63d5283200fae5391c241ff0d959ab4bae
SHA512 31de915ced9fd72e5c8ad5624da5e551dc56163773ae03bfa427bd09096f3a3c8e27368a67f5ea3686817f29014ebb480376ef4dd929a09c3f0984a395c8cb19
MD5 SHA1 SHA512

Submit Download

d147c6fc-3e9c-4043-b06c-c68825caf428

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ocrnrqc5.default-release\datareporting\glean\pending_pings\d147c6fc-3e9c-4043-b06c-c68825caf428
Size 235B
SHA256 c9cd3198f6ae6a6272b86360f68a6507aafac0b25b392dce871a466e6db34ff9
MD5 62b14949e95e4ff86aaeaccc1b7166a2
SHA1 62460652eeac8d02fd3c3eee09b2c473b4ed544d
SHA512 4a9682130bc1106e4d8a5c08d64c17e8e7850348172bf047cc2c79c8cee159a8e4ce5135862bfd2830996097d53978e7bbb69f6f7f731c87a2013981371ad170
MD5 SHA1 SHA512

Submit Download

e2df88b7-a5a1-440b-98d1-09a4c2f27eac

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ocrnrqc5.default-release\datareporting\glean\pending_pings\e2df88b7-a5a1-440b-98d1-09a4c2f27eac
Size 3KB
SHA256 70dce0170f06dd388ba8b129b364529600f9a32916ec048a3e8d760ca41b9caf
MD5 34abb501bf13aebd37baad93098c44f7
SHA1 5a5418451012241142097bf3af9bbf7a56e8a12f
SHA512 6749f727132d4df35e38af1ad39160eccff95fded17d3946f58b993c02822490838e7995f2a361f199d4341dd8a85cfe9fbd769ced19a0d4a38de3364ae1a186
MD5 SHA1 SHA512

Submit Download

f1c8a15b-f4b5-4806-8744-fd97941d22a3

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ocrnrqc5.default-release\datareporting\glean\pending_pings\f1c8a15b-f4b5-4806-8744-fd97941d22a3
Size 3KB
SHA256 cafd722072c9604675c86ac67a5a0fc45962f5131b4363ba22840366859a0c79
MD5 4a9434098ecb5c970931ee460a13ea10
SHA1 3db165c1a10f709237faff4ee8b0d1800bbad9a9
SHA512 217349e8a199f58d4cf9a6ebd19c9eb3968bfce88fe53235ba4b106b573a1edbde1603dfa07e4a1e6450e340c851dd3c6f9fccbc8a0b77485e072938e3458ea5
MD5 SHA1 SHA512

Submit Download

f4272ef2-6593-4a41-82b3-5e38af67816b

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ocrnrqc5.default-release\datareporting\glean\pending_pings\f4272ef2-6593-4a41-82b3-5e38af67816b
Size 3KB
SHA256 0a36ec4cfc770ea5c36736d1ba96eac35875235ff984d44797052294153cb682
MD5 e88eda12676d69a25e6df4ce8117a8fe
SHA1 a21cd69728efc66757fbcabdf5e663382ca48295
SHA512 d8c10b6f22686576aa1d2fe3e77702c3254c7adcb4ee0da38cabe5e3e8aaa33d61b36624142e08aa75d4fedea20ea8b4f96b9be634318e326f1ead3547ea1b2b
MD5 SHA1 SHA512

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ocrnrqc5.default-release\prefs-1.js
Size 6KB
SHA256 7d15a752a7d5d2df1d65fd766933badd38b3471e9fcae029f26e9e0fb3e4c899
MD5 ff48b12acb2e355ed883d1e521433606
SHA1 2c6f95b4a074f4e065cb2fab46ca34350c7538b6
SHA512 843c7860f3bb211fae360cb39b17cd6f89b7b11a8a63803a8ab69b20ab1199c68949e03c5242b8d39646303655d5d189750327775c997d76a429fe9fe3742836
SSDEEP 96:xHWUTUGqGq3Yf6Kgn91zSCSSlDsdv9j8n/HaJEBw88n8L4cnm9g3:UhRof6H97SStfzBw88Y
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ocrnrqc5.default-release\prefs-1.js
Size 6KB
SHA256 170cc38675b6d10a102e17f899b33f052dadfb3472dde86fa683ebf1c8a14237
MD5 9dd3107a1c361b9a2b01f2d428ddac64
SHA1 bb8dde07dc4176005e356a8f9deb085bc618b2de
SHA512 aeeffb0587fd8e63d1581d4747749bc5d7f2a1a1c777f9b3542fc944418b0f377ee410ab5e3cd88bc63c4ff8b7b3a7a7b92651fab4b4dd79a873c008d94ce326
SSDEEP 96:xHWUTUGqGq3Yf6Kgn91zSmSSlDsdv9j3n/HaJEBw88n8L4cnm2Bg3:UhRof6H9rSStUzBw88R
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ocrnrqc5.default-release\prefs.js
Size 6KB
SHA256 1a101d427ddee9cb35f080bcac5ddf49dd9c4eb4b2a740b4bfd1b3763ec92f7e
MD5 e096596b81b6ad104b37e3c01bff72a8
SHA1 b67efd20b4c0925a94e3f7a8764dba3c5ae940d7
SHA512 a69eb2ba6fa40acbed08c6fe180228bd75b73848d4234e2fbc47cc5a75678bafdc4688315ee41bb9b43c3663f61a7b6deea72103ed4a8a60dee77801771c5f2b
SSDEEP 96:xHWUTUGqGq3Yf6KJMno1zSgSSlDsdv9jun/HaJEBw88n8L4cnm9g3:UhRof6GMo9SStFzBw88Y
MD5 SHA1 SHA512 SSDEEP

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ocrnrqc5.default-release\sessionCheckpoints.json
Size 90B
SHA256 00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2
MD5 c4ab2ee59ca41b6d6a6ea911f35bdc00
SHA1 5942cd6505fc8a9daba403b082067e1cdefdfbc4
SHA512 71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2
MD5 SHA1 SHA512

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ocrnrqc5.default-release\sessionCheckpoints.json
Size 53B
SHA256 792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da
MD5 ea8b62857dfdbd3d0be7d7e4a954ec9a
SHA1 b43bc4b3ea206a02ef8f63d5bfad0c96bf2a3b2a
SHA512 076ee83534f42563046d25086166f82e1a3ec61840c113aec67abe2d8195daa247d827d0c54e7e8f8a1bbf2d082a3763577587e84342ec160ff97905243e6d19
MD5 SHA1 SHA512

Submit Download

dpnhupnp.dll

Path C:\Windows\System32\Container\dpnhupnp.dll
Size 10KB
SHA256 7cf4535e85ec02365c54bf460992344fe1e319381e794e51a7ce0f9cb0438929
MD5 ba32bb24b7da23bd7ee7ae4b576338cd
SHA1 17731367250361c6b1aaf24f988b8dd1150b1e92
SHA512 4317c083c491e74ef7e1ad30d79164b3d6ba360f3b83a88d220b21385837049a33c3023c5f9d10c42980c45fecc747d271263242976435abab7612c26e486be4
SSDEEP 96:FjxR3HUNj9fs2Qz6IDyBTFdesMH3aLbJ0lq5/sEWRuWwl:FtmzzyyBJdQH3aXSlSWRuW
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4248-2352-0x0000000000DF0000-0x0000000000EF0000-memory.dmp

Download

memory/4248-2349-0x0000000000DF0000-0x0000000000EF0000-memory.dmp

Download

memory/4248-2354-0x0000000000DF0000-0x0000000000EF0000-memory.dmp

Download

memory/4248-2377-0x0000000000DF0000-0x0000000000EF0000-memory.dmp

Download

memory/4248-2374-0x0000000000DF0000-0x0000000000EF0000-memory.dmp

Download

memory/4248-2378-0x0000000000DF0000-0x0000000000EF0000-memory.dmp

Download

memory/4248-2379-0x0000000000DF0000-0x0000000000EF0000-memory.dmp

Download

memory/4248-2380-0x0000000000DF0000-0x0000000000EF0000-memory.dmp

Download

memory/4248-2381-0x0000000000DF0000-0x0000000000EF0000-memory.dmp

Download

memory/4248-2383-0x0000000000DF0000-0x0000000000EF0000-memory.dmp

Download

memory/4248-2525-0x0000000000DF0000-0x0000000000EF0000-memory.dmp

Download

memory/4248-2533-0x0000000000DF0000-0x0000000000EF0000-memory.dmp

Download

memory/4248-2526-0x0000000000DF0000-0x0000000000EF0000-memory.dmp

Download

memory/4248-2527-0x0000000000DF0000-0x0000000000EF0000-memory.dmp

Download

memory/4248-2539-0x0000000000DF0000-0x0000000000EF0000-memory.dmp

Download

memory/4248-2541-0x0000000000DF0000-0x0000000000EF0000-memory.dmp

Download

memory/4248-2545-0x0000000000DF0000-0x0000000000EF0000-memory.dmp

Download

memory/4248-2551-0x0000000000DF0000-0x0000000000EF0000-memory.dmp

Download

memory/4248-2584-0x0000000000DF0000-0x0000000000EF0000-memory.dmp

Download

memory/4248-2585-0x0000000000DF0000-0x0000000000EF0000-memory.dmp

Download

memory/4248-2588-0x0000000000DF0000-0x0000000000EF0000-memory.dmp

Download

memory/4248-2589-0x0000000000DF0000-0x0000000000EF0000-memory.dmp

Download

memory/4248-2555-0x0000000000DF0000-0x0000000000EF0000-memory.dmp

Download

memory/4248-2563-0x0000000000DF0000-0x0000000000EF0000-memory.dmp

Download

memory/4248-2542-0x0000000000DF0000-0x0000000000EF0000-memory.dmp

Download

memory/4248-2537-0x0000000000DF0000-0x0000000000EF0000-memory.dmp

Download

memory/4248-2384-0x0000000000DF0000-0x0000000000EF0000-memory.dmp

Download

memory/4248-2488-0x0000000000DF0000-0x0000000000EF0000-memory.dmp

Download

memory/4248-2489-0x0000000000DF0000-0x0000000000EF0000-memory.dmp

Download

memory/4248-2388-0x0000000000DF0000-0x0000000000EF0000-memory.dmp

Download

memory/4248-2398-0x0000000000DF0000-0x0000000000EF0000-memory.dmp

Download

memory/4248-2399-0x0000000000DF0000-0x0000000000EF0000-memory.dmp

Download

memory/4248-2400-0x0000000000DF0000-0x0000000000EF0000-memory.dmp

Download

memory/4248-2405-0x0000000000DF0000-0x0000000000EF0000-memory.dmp

Download

memory/4248-2406-0x0000000000DF0000-0x0000000000EF0000-memory.dmp

Download

memory/4248-2409-0x0000000000DF0000-0x0000000000EF0000-memory.dmp

Download

memory/4248-2415-0x0000000000DF0000-0x0000000000EF0000-memory.dmp

Download

memory/4248-2416-0x0000000000DF0000-0x0000000000EF0000-memory.dmp

Download

memory/4248-2418-0x0000000000DF0000-0x0000000000EF0000-memory.dmp

Download

memory/4248-2420-0x0000000000DF0000-0x0000000000EF0000-memory.dmp

Download

memory/4248-2427-0x0000000000DF0000-0x0000000000EF0000-memory.dmp

Download

memory/4248-2458-0x0000000000DF0000-0x0000000000EF0000-memory.dmp

Download

memory/4248-2459-0x0000000000DF0000-0x0000000000EF0000-memory.dmp

Download

memory/4248-2460-0x0000000000DF0000-0x0000000000EF0000-memory.dmp

Download

memory/4248-2428-0x0000000000DF0000-0x0000000000EF0000-memory.dmp

Download

memory/4248-2432-0x0000000000DF0000-0x0000000000EF0000-memory.dmp

Download

memory/4248-2429-0x0000000000DF0000-0x0000000000EF0000-memory.dmp

Download

memory/4248-2421-0x0000000000DF0000-0x0000000000EF0000-memory.dmp

Download

memory/4248-2417-0x0000000000DF0000-0x0000000000EF0000-memory.dmp

Download

memory/4248-2414-0x0000000000DF0000-0x0000000000EF0000-memory.dmp

Download

memory/4248-2403-0x0000000000DF0000-0x0000000000EF0000-memory.dmp

Download

memory/4248-2391-0x0000000000DF0000-0x0000000000EF0000-memory.dmp

Download

memory/4248-2385-0x0000000000DF0000-0x0000000000EF0000-memory.dmp

Download

memory/4248-0-0x0000000000D10000-0x0000000000DCE000-memory.dmp

Download

memory/4248-2353-0x0000000000DF0000-0x0000000000EF0000-memory.dmp

Download

memory/4248-2358-0x0000000000DF0000-0x0000000000EF0000-memory.dmp

Download

memory/4248-2033-0x0000000000DF0000-0x0000000000EF0000-memory.dmp

Download

memory/4248-2034-0x0000000000DF0000-0x0000000000EF0000-memory.dmp

Download

memory/4248-2035-0x0000000000DF0000-0x0000000000EF0000-memory.dmp

Download

memory/4248-2038-0x0000000000DF0000-0x0000000000EF0000-memory.dmp

Download

memory/4248-2046-0x0000000000DF0000-0x0000000000EF0000-memory.dmp

Download

memory/4248-2047-0x0000000000DF0000-0x0000000000EF0000-memory.dmp

Download

memory/4248-2048-0x0000000000DF0000-0x0000000000EF0000-memory.dmp

Download

memory/4248-2055-0x0000000000DF0000-0x0000000000EF0000-memory.dmp

Download

memory/4248-2059-0x0000000000DF0000-0x0000000000EF0000-memory.dmp

Download

memory/4248-2065-0x0000000000DF0000-0x0000000000EF0000-memory.dmp

Download

memory/4248-2073-0x0000000000DF0000-0x0000000000EF0000-memory.dmp

Download

memory/4248-2074-0x0000000000DF0000-0x0000000000EF0000-memory.dmp

Download

memory/4248-2075-0x0000000000DF0000-0x0000000000EF0000-memory.dmp

Download

memory/4248-2058-0x0000000000DF0000-0x0000000000EF0000-memory.dmp

Download

memory/4248-2053-0x0000000000DF0000-0x0000000000EF0000-memory.dmp

Download

memory/4248-2049-0x0000000000DF0000-0x0000000000EF0000-memory.dmp

Download

memory/4248-2042-0x0000000000DF0000-0x0000000000EF0000-memory.dmp

Download

memory/4248-2032-0x0000000000DF0000-0x0000000000EF0000-memory.dmp

Download

memory/4248-2015-0x0000000000DF0000-0x0000000000EF0000-memory.dmp

Download

memory/4248-1805-0x0000000000DF0000-0x0000000000EF0000-memory.dmp

Download

memory/4248-1886-0x0000000000DF0000-0x0000000000EF0000-memory.dmp

Download

memory/4248-1887-0x0000000000DF0000-0x0000000000EF0000-memory.dmp

Download

memory/4248-1920-0x0000000000DF0000-0x0000000000EF0000-memory.dmp

Download

memory/4248-1922-0x0000000000DF0000-0x0000000000EF0000-memory.dmp

Download

memory/4248-1921-0x0000000000DF0000-0x0000000000EF0000-memory.dmp

Download

memory/4248-1870-0x0000000000DF0000-0x0000000000EF0000-memory.dmp

Download

memory/4248-1869-0x0000000005370000-0x0000000005380000-memory.dmp

Download

memory/4248-1813-0x0000000000DF0000-0x0000000000EF0000-memory.dmp

Download

memory/4248-1814-0x0000000000DF0000-0x0000000000EF0000-memory.dmp

Download

memory/4248-1815-0x0000000000DF0000-0x0000000000EF0000-memory.dmp

Download

memory/4248-1806-0x0000000000DF0000-0x0000000000EF0000-memory.dmp

Download

memory/4248-1533-0x0000000006720000-0x000000000673E000-memory.dmp

Download

memory/4248-1419-0x0000000006C30000-0x000000000715C000-memory.dmp

Download

memory/4248-1414-0x0000000006460000-0x00000000064B0000-memory.dmp

Download

memory/4248-1404-0x00000000063E0000-0x0000000006456000-memory.dmp

Download

memory/4248-1400-0x0000000006530000-0x00000000066F2000-memory.dmp

Download

memory/4248-1048-0x00000000062B0000-0x0000000006362000-memory.dmp

Download

memory/4248-192-0x00000000060D0000-0x0000000006136000-memory.dmp

Download

memory/4248-153-0x0000000005370000-0x0000000005380000-memory.dmp

Download

memory/4248-111-0x0000000005930000-0x0000000005ED4000-memory.dmp

Download

memory/5824-1804-0x000001A24EE20000-0x000001A24EE2C000-memory.dmp

Download