phantomstealer | 4c6c075eef30621a8ec9fbcd400292b3de3063e31a8589d189a33b6487cbf3dd

Analysis

max time kernel
149s
max time network
104s
platform
windows11-21h2_x64
resource
win11-20251015-en
resource tags

arch:x64arch:x86image:win11-20251015-enlocale:en-usos:windows11-21h2-x64system
submitted
31/10/2025, 04:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MSVCP140.dll
Size 5.7MB
Sample251031-etscesfv2g
SHA256 363022bd7bf8deb61785a3ec95d107893370f329ae2460effc5a1addd100995d
MD5 64837a9c4b7165f305ea9b6d1554a68e
SHA1 2cb5e9901bc76ecbd303c765e035f228e3e0b291
SHA512 f92bd14c9798c27138f9a07eceb8099101d209dd5e281cbdf7b45809cb8d324c1f0206195950cebee86c4542c545a29bb4f0418670fdf10abc1fb0a6f763086c
SSDEEP 49152:BlClpF9AqFx3mqO0+rjJEipVb/sC6aF/Sad0H7/UAeVCux70BEsHIMY3LkYP2GuS:rqOrpV7Fld0bSaKMkP8BR3WKc
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

collection discovery phantomstealer persistence

Malware Config

Extracted

Credentials

Protocol
smtp
Host
mail.sourc3trade.com
Port
587
Username
[email protected]
Password
yr!{f[L6r}9W!m/z

Extracted

Family

phantomstealer

Version

v3.5.0

Credentials

Protocol
smtp
Host
mail.sourc3trade.com
Port
587
Username
[email protected]
Password
yr!{f[L6r}9W!m/z
Email to
[email protected]

Mutex

12YHANZ1JWN7VAAFXR6S

Attributes

anti_analysis
0
cb_enables_ssl
1
debug
0
keylogger
1
start_delay
0
startup
0

Signatures

Phantomstealer family
phantomstealer

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-954806191-3584048385-2656851463-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AddInProcess32.exe
Key opened	\REGISTRY\USER\S-1-5-21-954806191-3584048385-2656851463-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AddInProcess32.exe
Key opened	\REGISTRY\USER\S-1-5-21-954806191-3584048385-2656851463-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AddInProcess32.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-954806191-3584048385-2656851463-1000\Software\Microsoft\Windows\CurrentVersion\Run\DefaultDomain = "cmd.exe /C pushd \"C:\\Windows\\system32\\Container\" && start \"\" \"C:\\Windows\\system32\\Container\\DefaultDomain\""	rundll32.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
97	icanhazip.com

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\system32\Container\adsnt.dll	rundll32.exe
File created	C:\Windows\system32\Container\dhcpsapi.dll	rundll32.exe
File created	C:\Windows\system32\Container\EhStorAuthn.exe	rundll32.exe
File created	C:\Windows\system32\Container\threadpoolwinrt.dll	rundll32.exe
File created	C:\Windows\system32\Container\wcmcsp.dll	rundll32.exe
File created	C:\Windows\system32\Container\wshbth.dll	rundll32.exe
File created	C:\Windows\system32\Container\appsruprov.dll	rundll32.exe
File created	C:\Windows\system32\Container\computelibeventlog.dll	rundll32.exe
File created	C:\Windows\system32\Container\dmiso8601utils.dll	rundll32.exe
File created	C:\Windows\system32\Container\PresentationHost.exe	rundll32.exe
File created	C:\Windows\system32\Container\regini.exe	rundll32.exe
File created	C:\Windows\system32\Container\vcruntime140.dll	rundll32.exe
File created	C:\Windows\system32\Container\@WindowsUpdateToastIcon.contrast-white.png	rundll32.exe
File created	C:\Windows\system32\Container\AuditPolicyGPInterop.dll	rundll32.exe
File created	C:\Windows\system32\Container\dot3dlg.dll	rundll32.exe
File created	C:\Windows\system32\Container\dusmapi.dll	rundll32.exe
File created	C:\Windows\system32\Container\EnterpriseDesktopAppMgmtCSP.dll	rundll32.exe
File created	C:\Windows\system32\Container\fveapi.dll	rundll32.exe
File created	C:\Windows\system32\Container\bdeunlock.exe	rundll32.exe
File created	C:\Windows\system32\Container\dxdiagn.dll	rundll32.exe
File created	C:\Windows\system32\Container\regidle.dll	rundll32.exe
File created	C:\Windows\system32\Container\rsaenh.dll	rundll32.exe
File created	C:\Windows\system32\Container\xwizard.dtd	rundll32.exe
File created	C:\Windows\system32\Container\BrokerLib.dll	rundll32.exe
File created	C:\Windows\system32\Container\DevicesFlowBroker.dll	rundll32.exe
File created	C:\Windows\system32\Container\fsquirt.exe	rundll32.exe
File created	C:\Windows\system32\Container\nrtapi.dll	rundll32.exe
File created	C:\Windows\system32\Container\SysFxUI.dll	rundll32.exe
File created	C:\Windows\system32\Container\Windows.Networking.Vpn.dll	rundll32.exe
File created	C:\Windows\system32\Container\winmsipc.dll	rundll32.exe
File created	C:\Windows\system32\Container\eappcfg.dll	rundll32.exe
File created	C:\Windows\system32\Container\setupcl.exe	rundll32.exe
File created	C:\Windows\system32\Container\vmictimeprovider.dll	rundll32.exe
File created	C:\Windows\system32\Container\credwiz.exe	rundll32.exe
File created	C:\Windows\system32\Container\security.dll	rundll32.exe
File created	C:\Windows\system32\Container\wimgapi.dll	rundll32.exe
File created	C:\Windows\system32\Container\ndproxystub.dll	rundll32.exe
File created	C:\Windows\system32\Container\fmapi.dll	rundll32.exe
File created	C:\Windows\system32\Container\OptionalFeatures.exe	rundll32.exe
File created	C:\Windows\system32\Container\capiprovider.dll	rundll32.exe
File created	C:\Windows\system32\Container\KBDIT.DLL	rundll32.exe
File created	C:\Windows\system32\Container\KBDTZM.DLL	rundll32.exe
File created	C:\Windows\system32\Container\panmap.dll	rundll32.exe
File created	C:\Windows\system32\Container\sppsvc.exe	rundll32.exe
File created	C:\Windows\system32\Container\UevAppMonitor.exe	rundll32.exe
File created	C:\Windows\system32\Container\AppXDeploymentServer.dll	rundll32.exe
File created	C:\Windows\system32\Container\mswmdm.dll	rundll32.exe
File created	C:\Windows\system32\Container\MusNotifyIcon.exe	rundll32.exe
File created	C:\Windows\system32\Container\SettingsHandlers_Mouse.dll	rundll32.exe
File created	C:\Windows\system32\Container\apisetschema.dll	rundll32.exe
File created	C:\Windows\system32\Container\fveprompt.exe	rundll32.exe
File created	C:\Windows\system32\Container\kbdarmph.dll	rundll32.exe
File created	C:\Windows\system32\Container\perfd00A.dat	rundll32.exe
File created	C:\Windows\system32\Container\WinRtTracing.dll	rundll32.exe
File created	C:\Windows\system32\Container\Windows.AccountsControl.dll	rundll32.exe
File created	C:\Windows\system32\Container\Windows.Networking.Connectivity.dll	rundll32.exe
File created	C:\Windows\system32\Container\ClipDLS.exe	rundll32.exe
File created	C:\Windows\system32\Container\gptext.dll	rundll32.exe
File created	C:\Windows\system32\Container\mscandui.dll	rundll32.exe
File created	C:\Windows\system32\Container\RdpSa.exe	rundll32.exe
File created	C:\Windows\system32\Container\AppxSysprep.dll	rundll32.exe
File created	C:\Windows\system32\Container\dialclient.dll	rundll32.exe
File created	C:\Windows\system32\Container\dssec.dat	rundll32.exe
File created	C:\Windows\system32\Container\WMVSENCD.DLL	rundll32.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 228 set thread context of 3688	228	rundll32.exe	78

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe

Checks processor information in registry 2 TTPs 38 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	AddInProcess32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	AddInProcess32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Enumerates system info in registry 2 TTPs 12 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3688	AddInProcess32.exe
3688	AddInProcess32.exe
2420	chrome.exe
2420	chrome.exe
3688	AddInProcess32.exe
3688	AddInProcess32.exe
3688	AddInProcess32.exe
3688	AddInProcess32.exe
3688	AddInProcess32.exe
3688	AddInProcess32.exe
3688	AddInProcess32.exe
3688	AddInProcess32.exe
2376	firefox.exe
2376	firefox.exe
3688	AddInProcess32.exe
2376	firefox.exe
2376	firefox.exe
2376	firefox.exe
2376	firefox.exe
2376	firefox.exe
2376	firefox.exe
2376	firefox.exe
2376	firefox.exe
2376	firefox.exe
2376	firefox.exe
2376	firefox.exe
2376	firefox.exe
2376	firefox.exe
2376	firefox.exe
3688	AddInProcess32.exe
3688	AddInProcess32.exe
3688	AddInProcess32.exe
3688	AddInProcess32.exe
3688	AddInProcess32.exe
3688	AddInProcess32.exe
3688	AddInProcess32.exe
3688	AddInProcess32.exe
3688	AddInProcess32.exe
3688	AddInProcess32.exe
3688	AddInProcess32.exe
3688	AddInProcess32.exe
3688	AddInProcess32.exe
3688	AddInProcess32.exe
3688	AddInProcess32.exe
3688	AddInProcess32.exe
3688	AddInProcess32.exe
3688	AddInProcess32.exe
3688	AddInProcess32.exe
6756	firefox.exe
6756	firefox.exe
6756	firefox.exe
6756	firefox.exe
6756	firefox.exe
6756	firefox.exe
6756	firefox.exe
6756	firefox.exe
6756	firefox.exe
6756	firefox.exe
6756	firefox.exe
6756	firefox.exe
6756	firefox.exe
6756	firefox.exe
6756	firefox.exe
6756	firefox.exe

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: SeDebugPrivilege	3688	AddInProcess32.exe
Token: SeShutdownPrivilege	2420	chrome.exe
Token: SeCreatePagefilePrivilege	2420	chrome.exe
Token: SeShutdownPrivilege	2420	chrome.exe
Token: SeCreatePagefilePrivilege	2420	chrome.exe
Token: SeShutdownPrivilege	2420	chrome.exe
Token: SeCreatePagefilePrivilege	2420	chrome.exe
Token: SeShutdownPrivilege	2420	chrome.exe
Token: SeCreatePagefilePrivilege	2420	chrome.exe
Token: SeShutdownPrivilege	2420	chrome.exe
Token: SeCreatePagefilePrivilege	2420	chrome.exe
Token: SeShutdownPrivilege	2448	chrome.exe
Token: SeCreatePagefilePrivilege	2448	chrome.exe
Token: SeShutdownPrivilege	2448	chrome.exe
Token: SeCreatePagefilePrivilege	2448	chrome.exe

Suspicious use of FindShellTrayWindow 46 IoCs

pid	Process
2420	chrome.exe
2420	chrome.exe
2376	firefox.exe
2376	firefox.exe
2376	firefox.exe
2376	firefox.exe
2376	firefox.exe
2376	firefox.exe
2376	firefox.exe
2376	firefox.exe
2376	firefox.exe
2376	firefox.exe
2376	firefox.exe
2376	firefox.exe
2376	firefox.exe
2376	firefox.exe
2376	firefox.exe
2376	firefox.exe
2376	firefox.exe
2376	firefox.exe
2376	firefox.exe
2376	firefox.exe
6376	msedge.exe
6928	msedge.exe
6756	firefox.exe
6756	firefox.exe
6756	firefox.exe
6756	firefox.exe
6756	firefox.exe
6756	firefox.exe
6756	firefox.exe
6756	firefox.exe
6756	firefox.exe
6756	firefox.exe
6756	firefox.exe
6756	firefox.exe
6756	firefox.exe
6756	firefox.exe
6756	firefox.exe
6756	firefox.exe
6756	firefox.exe
6756	firefox.exe
6756	firefox.exe
6756	firefox.exe
2448	chrome.exe
2448	chrome.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2376	firefox.exe
6756	firefox.exe
3688	AddInProcess32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 228 wrote to memory of 3688	228	rundll32.exe	78
PID 228 wrote to memory of 3688	228	rundll32.exe	78
PID 228 wrote to memory of 3688	228	rundll32.exe	78
PID 228 wrote to memory of 3688	228	rundll32.exe	78
PID 228 wrote to memory of 3688	228	rundll32.exe	78
PID 228 wrote to memory of 3688	228	rundll32.exe	78
PID 3688 wrote to memory of 2420	3688	AddInProcess32.exe	80
PID 3688 wrote to memory of 2420	3688	AddInProcess32.exe	80
PID 2420 wrote to memory of 1544	2420	chrome.exe	81
PID 2420 wrote to memory of 1544	2420	chrome.exe	81
PID 2420 wrote to memory of 5964	2420	chrome.exe	82
PID 2420 wrote to memory of 5964	2420	chrome.exe	82
PID 2420 wrote to memory of 5328	2420	chrome.exe	83
PID 2420 wrote to memory of 5328	2420	chrome.exe	83
PID 3688 wrote to memory of 1544	3688	AddInProcess32.exe	81
PID 2420 wrote to memory of 5424	2420	chrome.exe	84
PID 2420 wrote to memory of 5424	2420	chrome.exe	84
PID 3688 wrote to memory of 1544	3688	AddInProcess32.exe	81
PID 2420 wrote to memory of 32	2420	chrome.exe	85
PID 2420 wrote to memory of 32	2420	chrome.exe	85
PID 2420 wrote to memory of 3852	2420	chrome.exe	86
PID 2420 wrote to memory of 3852	2420	chrome.exe	86
PID 2420 wrote to memory of 2660	2420	chrome.exe	87
PID 2420 wrote to memory of 2660	2420	chrome.exe	87
PID 2420 wrote to memory of 660	2420	chrome.exe	88
PID 2420 wrote to memory of 660	2420	chrome.exe	88
PID 2420 wrote to memory of 3256	2420	chrome.exe	89
PID 2420 wrote to memory of 3256	2420	chrome.exe	89
PID 2420 wrote to memory of 2872	2420	chrome.exe	90
PID 2420 wrote to memory of 2872	2420	chrome.exe	90
PID 3688 wrote to memory of 2420	3688	AddInProcess32.exe	80
PID 3688 wrote to memory of 2420	3688	AddInProcess32.exe	80
PID 2420 wrote to memory of 3568	2420	chrome.exe	91
PID 2420 wrote to memory of 3568	2420	chrome.exe	91
PID 3688 wrote to memory of 1544	3688	AddInProcess32.exe	81
PID 3688 wrote to memory of 1544	3688	AddInProcess32.exe	81
PID 3688 wrote to memory of 5424	3688	AddInProcess32.exe	84
PID 3688 wrote to memory of 5424	3688	AddInProcess32.exe	84
PID 2420 wrote to memory of 6060	2420	chrome.exe	92
PID 2420 wrote to memory of 6060	2420	chrome.exe	92
PID 3688 wrote to memory of 3256	3688	AddInProcess32.exe	89
PID 2420 wrote to memory of 4292	2420	chrome.exe	93
PID 2420 wrote to memory of 4292	2420	chrome.exe	93
PID 3688 wrote to memory of 3256	3688	AddInProcess32.exe	89
PID 2420 wrote to memory of 5056	2420	chrome.exe	94
PID 2420 wrote to memory of 5056	2420	chrome.exe	94
PID 3688 wrote to memory of 2872	3688	AddInProcess32.exe	90
PID 3688 wrote to memory of 2872	3688	AddInProcess32.exe	90
PID 3688 wrote to memory of 3852	3688	AddInProcess32.exe	86
PID 3688 wrote to memory of 3852	3688	AddInProcess32.exe	86
PID 3688 wrote to memory of 660	3688	AddInProcess32.exe	88
PID 3688 wrote to memory of 660	3688	AddInProcess32.exe	88
PID 3688 wrote to memory of 2420	3688	AddInProcess32.exe	80
PID 3688 wrote to memory of 2420	3688	AddInProcess32.exe	80
PID 3688 wrote to memory of 5964	3688	AddInProcess32.exe	82
PID 3688 wrote to memory of 5964	3688	AddInProcess32.exe	82
PID 3688 wrote to memory of 3568	3688	AddInProcess32.exe	91
PID 3688 wrote to memory of 3568	3688	AddInProcess32.exe	91
PID 3688 wrote to memory of 5328	3688	AddInProcess32.exe	83
PID 3688 wrote to memory of 5328	3688	AddInProcess32.exe	83
PID 3688 wrote to memory of 1544	3688	AddInProcess32.exe	81
PID 3688 wrote to memory of 1544	3688	AddInProcess32.exe	81
PID 3688 wrote to memory of 5424	3688	AddInProcess32.exe	84
PID 3688 wrote to memory of 5424	3688	AddInProcess32.exe	84

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-954806191-3584048385-2656851463-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AddInProcess32.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-954806191-3584048385-2656851463-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AddInProcess32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\MSVCP140.dll,#1
1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:228
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - outlook_office_path
  - outlook_win_path
  PID:3688
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\a4ajlz32.xhg"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2420
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\a4ajlz32.xhg /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\a4ajlz32.xhg\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\a4ajlz32.xhg --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ffefc05dcf8,0x7ffefc05dd04,0x7ffefc05dd10
      4⤵
      PID:1544
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\a4ajlz32.xhg" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=1900,i,9657589638761264967,11932867481242573328,262144 --variations-seed-version --mojo-platform-channel-handle=1896 /prefetch:2
      4⤵
      PID:5964
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\a4ajlz32.xhg" --field-trial-handle=1964,i,9657589638761264967,11932867481242573328,262144 --variations-seed-version --mojo-platform-channel-handle=1992 /prefetch:11
      4⤵
      PID:5328
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\a4ajlz32.xhg" --field-trial-handle=2160,i,9657589638761264967,11932867481242573328,262144 --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:13
      4⤵
      PID:5424
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\a4ajlz32.xhg" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=2916,i,9657589638761264967,11932867481242573328,262144 --variations-seed-version --mojo-platform-channel-handle=2928 /prefetch:1
      4⤵
      PID:32
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\a4ajlz32.xhg" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=2932,i,9657589638761264967,11932867481242573328,262144 --variations-seed-version --mojo-platform-channel-handle=2944 /prefetch:1
      4⤵
      PID:3852
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\a4ajlz32.xhg" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3296,i,9657589638761264967,11932867481242573328,262144 --variations-seed-version --mojo-platform-channel-handle=3328 /prefetch:1
      4⤵
      PID:2660
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\a4ajlz32.xhg" --extension-process --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=3308,i,9657589638761264967,11932867481242573328,262144 --variations-seed-version --mojo-platform-channel-handle=3380 /prefetch:9
      4⤵
      PID:660
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\a4ajlz32.xhg" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=2876,i,9657589638761264967,11932867481242573328,262144 --variations-seed-version --mojo-platform-channel-handle=2904 /prefetch:1
      4⤵
      PID:3256
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\a4ajlz32.xhg" --extension-process --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=3392,i,9657589638761264967,11932867481242573328,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:9
      4⤵
      PID:2872
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\a4ajlz32.xhg" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=4200,i,9657589638761264967,11932867481242573328,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:1
      4⤵
      PID:3568
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\a4ajlz32.xhg" --field-trial-handle=2896,i,9657589638761264967,11932867481242573328,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:14
      4⤵
      PID:6060
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\a4ajlz32.xhg" --field-trial-handle=3368,i,9657589638761264967,11932867481242573328,262144 --variations-seed-version --mojo-platform-channel-handle=3352 /prefetch:14
      4⤵
      PID:4292
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\a4ajlz32.xhg" --field-trial-handle=4472,i,9657589638761264967,11932867481242573328,262144 --variations-seed-version --mojo-platform-channel-handle=4484 /prefetch:14
      4⤵
      PID:5056
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\a4ajlz32.xhg" --field-trial-handle=4908,i,9657589638761264967,11932867481242573328,262144 --variations-seed-version --mojo-platform-channel-handle=4928 /prefetch:14
      4⤵
      PID:2344
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\a4ajlz32.xhg" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=5024,i,9657589638761264967,11932867481242573328,262144 --variations-seed-version --mojo-platform-channel-handle=5072 /prefetch:1
      4⤵
      PID:4568
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\a4ajlz32.xhg" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=5052,i,9657589638761264967,11932867481242573328,262144 --variations-seed-version --mojo-platform-channel-handle=5036 /prefetch:1
      4⤵
      PID:2804
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\a4ajlz32.xhg" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=5092,i,9657589638761264967,11932867481242573328,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:1
      4⤵
      PID:4408
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\a4ajlz32.xhg" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --field-trial-handle=5196,i,9657589638761264967,11932867481242573328,262144 --variations-seed-version --mojo-platform-channel-handle=5056 /prefetch:1
      4⤵
      PID:5988
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\s2pcth00.lc3"
    3⤵
    PID:4984
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir=C:\Users\Admin\AppData\Local\Temp\s2pcth00.lc3
      4⤵
      Checks processor information in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:2376
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1948 -prefsLen 27097 -prefMapHandle 1952 -prefMapSize 270279 -ipcHandle 2036 -initialChannelId {44861b45-c187-4a01-8141-6bbf4cd6db47} -parentPid 2376 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2376" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
        5⤵
        
        PID:6092
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2444 -prefsLen 27133 -prefMapHandle 2448 -prefMapSize 270279 -ipcHandle 2204 -initialChannelId {cf5db33b-0df0-4a48-9f35-8d12ba259321} -parentPid 2376 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2376" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
        5⤵
        
        PID:4804
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\23d5050c-d7bf-48fd-a6b5-c84a3aaf6606.dmp"
        5⤵
        
        PID:2144
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2304 -prefsLen 27133 -prefMapHandle 3024 -prefMapSize 270279 -ipcHandle 3040 -initialChannelId {fb1e1bfd-750d-4a07-a979-d7be565504e8} -parentPid 2376 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2376" -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 gpu
        5⤵
        
        PID:684
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\0a80fe5f-ac04-4be1-b46e-c5bdf3b4d263.dmp"
        5⤵
        
        PID:1404
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3040 -prefsLen 27198 -prefMapHandle 3456 -prefMapSize 270279 -ipcHandle 3520 -initialChannelId {2556b4fb-073d-46dc-9cd2-355ec8e2e5eb} -parentPid 2376 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2376" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 gpu
        5⤵
        
        PID:3736
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4008 -prefsLen 27323 -prefMapHandle 4012 -prefMapSize 270279 -jsInitHandle 4016 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3168 -initialChannelId {89624e15-0925-4406-b440-d64fbbbd1118} -parentPid 2376 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2376" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
        5⤵
        Checks processor information in registry
        
        PID:5272
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\17c97178-6114-465a-a1c2-ad187f87f220.dmp"
        5⤵
        
        PID:6044
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3516 -prefsLen 27323 -prefMapHandle 4216 -prefMapSize 270279 -ipcHandle 4224 -initialChannelId {5d8b98e1-2b79-4aba-8668-ad63a7ae037d} -parentPid 2376 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2376" -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 gpu
        5⤵
        
        PID:3088
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\31fe89ab-95b8-436a-8821-a45d47b8da4e.dmp"
        5⤵
        
        PID:5844
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3904 -prefsLen 27323 -prefMapHandle 3892 -prefMapSize 270279 -ipcHandle 4436 -initialChannelId {236af09f-b63b-47c6-a7ca-b7146f586414} -parentPid 2376 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2376" -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 rdd
        5⤵
        
        PID:2132
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4844 -prefsLen 34876 -prefMapHandle 4848 -prefMapSize 270279 -jsInitHandle 4852 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4860 -initialChannelId {cacc4e32-4e0f-4470-8dfd-2173c93c1946} -parentPid 2376 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2376" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
        5⤵
        Checks processor information in registry
        
        PID:4460
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 2892 -prefsLen 34929 -prefMapHandle 2936 -prefMapSize 270279 -ipcHandle 2688 -initialChannelId {df8dbfb5-652c-4bfd-b7bb-ca05efc09a13} -parentPid 2376 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2376" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 utility
        5⤵
        Checks processor information in registry
        
        PID:6784
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5440 -prefsLen 32952 -prefMapHandle 5436 -prefMapSize 270279 -jsInitHandle 5396 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2860 -initialChannelId {40335abf-0f98-4e7a-8f1a-036081882565} -parentPid 2376 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2376" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
        5⤵
        Checks processor information in registry
        
        PID:2144
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5480 -prefsLen 32952 -prefMapHandle 5484 -prefMapSize 270279 -jsInitHandle 5488 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5496 -initialChannelId {592af93c-9798-44d9-9223-e4522b2844cb} -parentPid 2376 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2376" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
        5⤵
        Checks processor information in registry
        
        PID:2808
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5756 -prefsLen 32952 -prefMapHandle 5760 -prefMapSize 270279 -jsInitHandle 5764 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5772 -initialChannelId {865f3ce0-9fdc-4840-91a5-e7edb4c939e6} -parentPid 2376 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2376" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
        5⤵
        Checks processor information in registry
        
        PID:6560
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lmcy1tyw.lko"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious use of FindShellTrayWindow
    PID:6376
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\lmcy1tyw.lko /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\lmcy1tyw.lko\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x23c,0x240,0x244,0x238,0x24c,0x7ffefa08f208,0x7ffefa08f214,0x7ffefa08f220
      4⤵
      PID:6416
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lmcy1tyw.lko" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --field-trial-handle=2340,i,7034147561134600327,2643259248068839288,262144 --variations-seed-version --mojo-platform-channel-handle=2336 /prefetch:2
      4⤵
      PID:1980
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lmcy1tyw.lko" --always-read-main-dll --field-trial-handle=2036,i,7034147561134600327,2643259248068839288,262144 --variations-seed-version --mojo-platform-channel-handle=2344 /prefetch:11
      4⤵
      PID:5692
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lmcy1tyw.lko" --always-read-main-dll --field-trial-handle=2556,i,7034147561134600327,2643259248068839288,262144 --variations-seed-version --mojo-platform-channel-handle=1768 /prefetch:13
      4⤵
      PID:6912
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lmcy1tyw.lko" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3308,i,7034147561134600327,2643259248068839288,262144 --variations-seed-version --mojo-platform-channel-handle=3372 /prefetch:1
      4⤵
      PID:4936
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lmcy1tyw.lko" --instant-process --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3316,i,7034147561134600327,2643259248068839288,262144 --variations-seed-version --mojo-platform-channel-handle=3376 /prefetch:1
      4⤵
      PID:4872
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lmcy1tyw.lko" --always-read-main-dll --field-trial-handle=3528,i,7034147561134600327,2643259248068839288,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:14
      4⤵
      PID:7120
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lmcy1tyw.lko" --always-read-main-dll --field-trial-handle=3532,i,7034147561134600327,2643259248068839288,262144 --variations-seed-version --mojo-platform-channel-handle=3744 /prefetch:14
      4⤵
      PID:7128
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lmcy1tyw.lko" --always-read-main-dll --field-trial-handle=3548,i,7034147561134600327,2643259248068839288,262144 --variations-seed-version --mojo-platform-channel-handle=3748 /prefetch:14
      4⤵
      PID:7136
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lmcy1tyw.lko" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --field-trial-handle=3680,i,7034147561134600327,2643259248068839288,262144 --variations-seed-version --mojo-platform-channel-handle=3796 /prefetch:1
      4⤵
      PID:7164
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lmcy1tyw.lko" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --field-trial-handle=3704,i,7034147561134600327,2643259248068839288,262144 --variations-seed-version --mojo-platform-channel-handle=3804 /prefetch:9
      4⤵
      PID:6728
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lmcy1tyw.lko" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --field-trial-handle=3736,i,7034147561134600327,2643259248068839288,262144 --variations-seed-version --mojo-platform-channel-handle=3836 /prefetch:1
      4⤵
      PID:6716
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lmcy1tyw.lko" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --field-trial-handle=3788,i,7034147561134600327,2643259248068839288,262144 --variations-seed-version --mojo-platform-channel-handle=3824 /prefetch:9
      4⤵
      PID:2064
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lmcy1tyw.lko" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --field-trial-handle=3828,i,7034147561134600327,2643259248068839288,262144 --variations-seed-version --mojo-platform-channel-handle=3924 /prefetch:1
      4⤵
      PID:3488
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lmcy1tyw.lko" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --field-trial-handle=3856,i,7034147561134600327,2643259248068839288,262144 --variations-seed-version --mojo-platform-channel-handle=3956 /prefetch:9
      4⤵
      PID:3364
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lmcy1tyw.lko" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --field-trial-handle=3876,i,7034147561134600327,2643259248068839288,262144 --variations-seed-version --mojo-platform-channel-handle=3872 /prefetch:1
      4⤵
      PID:4320
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lmcy1tyw.lko" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --field-trial-handle=3900,i,7034147561134600327,2643259248068839288,262144 --variations-seed-version --mojo-platform-channel-handle=3972 /prefetch:9
      4⤵
      PID:1896
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lmcy1tyw.lko" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --field-trial-handle=3908,i,7034147561134600327,2643259248068839288,262144 --variations-seed-version --mojo-platform-channel-handle=4056 /prefetch:1
      4⤵
      PID:2660
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lmcy1tyw.lko" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --field-trial-handle=3948,i,7034147561134600327,2643259248068839288,262144 --variations-seed-version --mojo-platform-channel-handle=4036 /prefetch:9
      4⤵
      PID:760
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lmcy1tyw.lko" --always-read-main-dll --field-trial-handle=4108,i,7034147561134600327,2643259248068839288,262144 --variations-seed-version --mojo-platform-channel-handle=4152 /prefetch:14
      4⤵
      PID:5628
    - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=1128
        5⤵
        
        PID:2344
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lmcy1tyw.lko" --always-read-main-dll --field-trial-handle=3536,i,7034147561134600327,2643259248068839288,262144 --variations-seed-version --mojo-platform-channel-handle=3700 /prefetch:14
      4⤵
      PID:4756
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lmcy1tyw.lko" --always-read-main-dll --field-trial-handle=3780,i,7034147561134600327,2643259248068839288,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:14
      4⤵
      PID:4020
    - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=592
        5⤵
        
        PID:4772
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lmcy1tyw.lko" --always-read-main-dll --field-trial-handle=3860,i,7034147561134600327,2643259248068839288,262144 --variations-seed-version --mojo-platform-channel-handle=4152 /prefetch:14
      4⤵
      PID:580
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lmcy1tyw.lko" --always-read-main-dll --field-trial-handle=5288,i,7034147561134600327,2643259248068839288,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:14
      4⤵
      PID:2768
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --no-sandbox --mute-audio --onnx-enabled-for-ee --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lmcy1tyw.lko" --always-read-main-dll --field-trial-handle=4260,i,7034147561134600327,2643259248068839288,262144 --variations-seed-version --mojo-platform-channel-handle=5400 /prefetch:14
      4⤵
      PID:2068
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\mpeltu3l.njm"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious use of FindShellTrayWindow
    PID:6928
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\mpeltu3l.njm /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\mpeltu3l.njm\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x23c,0x240,0x244,0x238,0x24c,0x7ffefa08f208,0x7ffefa08f214,0x7ffefa08f220
      4⤵
      PID:1336
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\mpeltu3l.njm" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --field-trial-handle=2120,i,6151518958792042231,13849652093718418767,262144 --variations-seed-version --mojo-platform-channel-handle=2116 /prefetch:2
      4⤵
      PID:4320
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\mpeltu3l.njm" --always-read-main-dll --field-trial-handle=1824,i,6151518958792042231,13849652093718418767,262144 --variations-seed-version --mojo-platform-channel-handle=2148 /prefetch:11
      4⤵
      PID:5544
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\mpeltu3l.njm" --always-read-main-dll --field-trial-handle=2220,i,6151518958792042231,13849652093718418767,262144 --variations-seed-version --mojo-platform-channel-handle=2208 /prefetch:13
      4⤵
      PID:664
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\mpeltu3l.njm" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3372,i,6151518958792042231,13849652093718418767,262144 --variations-seed-version --mojo-platform-channel-handle=3392 /prefetch:1
      4⤵
      PID:3080
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\mpeltu3l.njm" --instant-process --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3400,i,6151518958792042231,13849652093718418767,262144 --variations-seed-version --mojo-platform-channel-handle=3412 /prefetch:1
      4⤵
      PID:4976
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\mpeltu3l.njm" --always-read-main-dll --field-trial-handle=3764,i,6151518958792042231,13849652093718418767,262144 --variations-seed-version --mojo-platform-channel-handle=3772 /prefetch:14
      4⤵
      PID:2304
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\mpeltu3l.njm" --always-read-main-dll --field-trial-handle=3752,i,6151518958792042231,13849652093718418767,262144 --variations-seed-version --mojo-platform-channel-handle=3932 /prefetch:14
      4⤵
      PID:4540
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\mpeltu3l.njm" --always-read-main-dll --field-trial-handle=3776,i,6151518958792042231,13849652093718418767,262144 --variations-seed-version --mojo-platform-channel-handle=3944 /prefetch:14
      4⤵
      PID:2312
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\mpeltu3l.njm" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --field-trial-handle=3888,i,6151518958792042231,13849652093718418767,262144 --variations-seed-version --mojo-platform-channel-handle=4072 /prefetch:1
      4⤵
      PID:5380
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\mpeltu3l.njm" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --field-trial-handle=3912,i,6151518958792042231,13849652093718418767,262144 --variations-seed-version --mojo-platform-channel-handle=4076 /prefetch:9
      4⤵
      PID:4292
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\mpeltu3l.njm" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --field-trial-handle=3772,i,6151518958792042231,13849652093718418767,262144 --variations-seed-version --mojo-platform-channel-handle=3972 /prefetch:1
      4⤵
      PID:4884
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\mpeltu3l.njm" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --field-trial-handle=3960,i,6151518958792042231,13849652093718418767,262144 --variations-seed-version --mojo-platform-channel-handle=4148 /prefetch:9
      4⤵
      PID:2236
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\mpeltu3l.njm" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --field-trial-handle=3976,i,6151518958792042231,13849652093718418767,262144 --variations-seed-version --mojo-platform-channel-handle=4060 /prefetch:1
      4⤵
      PID:2760
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\mpeltu3l.njm" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --field-trial-handle=3992,i,6151518958792042231,13849652093718418767,262144 --variations-seed-version --mojo-platform-channel-handle=4208 /prefetch:9
      4⤵
      PID:4568
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\mpeltu3l.njm" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --field-trial-handle=4064,i,6151518958792042231,13849652093718418767,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:1
      4⤵
      PID:228
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\mpeltu3l.njm" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --field-trial-handle=4104,i,6151518958792042231,13849652093718418767,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:9
      4⤵
      PID:6212
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\mpeltu3l.njm" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --field-trial-handle=4128,i,6151518958792042231,13849652093718418767,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:1
      4⤵
      PID:6264
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\mpeltu3l.njm" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --field-trial-handle=4156,i,6151518958792042231,13849652093718418767,262144 --variations-seed-version --mojo-platform-channel-handle=3368 /prefetch:9
      4⤵
      PID:3900
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\mpeltu3l.njm" --always-read-main-dll --field-trial-handle=4300,i,6151518958792042231,13849652093718418767,262144 --variations-seed-version --mojo-platform-channel-handle=4352 /prefetch:14
      4⤵
      PID:2408
    - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=1128
        5⤵
        
        PID:3124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\mpeltu3l.njm" --always-read-main-dll --field-trial-handle=5156,i,6151518958792042231,13849652093718418767,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:14
      4⤵
      PID:3552
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\mpeltu3l.njm" --always-read-main-dll --field-trial-handle=5104,i,6151518958792042231,13849652093718418767,262144 --variations-seed-version --mojo-platform-channel-handle=4872 /prefetch:14
      4⤵
      PID:6424
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\mpeltu3l.njm" --always-read-main-dll --field-trial-handle=5384,i,6151518958792042231,13849652093718418767,262144 --variations-seed-version --mojo-platform-channel-handle=5396 /prefetch:14
      4⤵
      PID:2628
    - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=592
        5⤵
        
        PID:3760
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\mpeltu3l.njm" --always-read-main-dll --field-trial-handle=5556,i,6151518958792042231,13849652093718418767,262144 --variations-seed-version --mojo-platform-channel-handle=5588 /prefetch:14
      4⤵
      PID:3816
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --no-sandbox --mute-audio --onnx-enabled-for-ee --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\mpeltu3l.njm" --always-read-main-dll --field-trial-handle=5544,i,6151518958792042231,13849652093718418767,262144 --variations-seed-version --mojo-platform-channel-handle=5612 /prefetch:14
      4⤵
      PID:5352
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5puh1jz4.5uk"
    3⤵
    PID:1272
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir=C:\Users\Admin\AppData\Local\Temp\5puh1jz4.5uk
      4⤵
      Checks processor information in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:6756
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1964 -prefsLen 27097 -prefMapHandle 1968 -prefMapSize 270331 -ipcHandle 2056 -initialChannelId {a19f5a0c-ec2c-46d4-8545-c84109698073} -parentPid 6756 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6756" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
        5⤵
        
        PID:2764
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2304 -prefsLen 27133 -prefMapHandle 2300 -prefMapSize 270331 -ipcHandle 2332 -initialChannelId {5a995591-1ff7-4be5-88bf-0274e28eb94e} -parentPid 6756 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6756" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
        5⤵
        
        PID:1364
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\a5ec26d7-136b-485a-81da-114611feb0dc.dmp"
        5⤵
        
        PID:5700
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2728 -prefsLen 27133 -prefMapHandle 2732 -prefMapSize 270331 -ipcHandle 2740 -initialChannelId {709bed82-9ca4-4e43-9920-e84645031758} -parentPid 6756 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6756" -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 gpu
        5⤵
        
        PID:324
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\f2e5aa8f-9ed7-40a5-8e98-f93ca68e849d.dmp"
        5⤵
        
        PID:5232
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2740 -prefsLen 27133 -prefMapHandle 3028 -prefMapSize 270331 -ipcHandle 3124 -initialChannelId {5b20a757-89b7-4626-8348-dfde56bc192a} -parentPid 6756 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6756" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 gpu
        5⤵
        
        PID:6412
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3792 -prefsLen 27274 -prefMapHandle 3796 -prefMapSize 270331 -jsInitHandle 3800 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3808 -initialChannelId {b3af7791-3986-4a04-b9ec-d6337146b3eb} -parentPid 6756 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6756" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
        5⤵
        Checks processor information in registry
        
        PID:4604
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\84fb9b8e-342f-4b9b-8f46-1d3d0331d4f5.dmp"
        5⤵
        
        PID:4212
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3124 -prefsLen 27274 -prefMapHandle 3524 -prefMapSize 270331 -ipcHandle 3796 -initialChannelId {ca2ba7fa-93fc-4a23-a546-2c03e74c3dbb} -parentPid 6756 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6756" -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 gpu
        5⤵
        
        PID:3000
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\70b3004c-3cd1-4fc1-93b0-c9fac1337434.dmp"
        5⤵
        
        PID:5380
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4196 -prefsLen 27274 -prefMapHandle 4200 -prefMapSize 270331 -ipcHandle 4140 -initialChannelId {94cd5ef4-bbb0-40ef-8fa0-ae0b3bcf0a02} -parentPid 6756 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6756" -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 rdd
        5⤵
        
        PID:7012
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4564 -prefsLen 34827 -prefMapHandle 4568 -prefMapSize 270331 -jsInitHandle 4572 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 1172 -initialChannelId {aa8a90f4-dfd8-41b7-9866-6b4790669d79} -parentPid 6756 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6756" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
        5⤵
        Checks processor information in registry
        
        PID:7080
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 2680 -prefsLen 34876 -prefMapHandle 3040 -prefMapSize 270331 -ipcHandle 4980 -initialChannelId {7eeed487-5406-4de8-9fb1-bd340b4cedd8} -parentPid 6756 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6756" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 utility
        5⤵
        Checks processor information in registry
        
        PID:5732
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5124 -prefsLen 32766 -prefMapHandle 5128 -prefMapSize 270331 -jsInitHandle 5132 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5140 -initialChannelId {b39dd818-b573-4065-8a33-09211a2c4c8d} -parentPid 6756 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6756" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
        5⤵
        Checks processor information in registry
        
        PID:2808
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5332 -prefsLen 32818 -prefMapHandle 5336 -prefMapSize 270331 -jsInitHandle 5340 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5348 -initialChannelId {047d4953-d588-4da6-ba2f-bb9f5cc415ce} -parentPid 6756 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6756" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
        5⤵
        Checks processor information in registry
        
        PID:6488
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5536 -prefsLen 32818 -prefMapHandle 5540 -prefMapSize 270331 -jsInitHandle 5544 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5552 -initialChannelId {d4eb94d6-0a27-42ee-b233-acead432a354} -parentPid 6756 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6756" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
        5⤵
        Checks processor information in registry
        
        PID:3340
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cuzj2zdj.yqo"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    PID:2448
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\cuzj2zdj.yqo /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\cuzj2zdj.yqo\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\cuzj2zdj.yqo --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0xe4,0x108,0x10c,0xa8,0x110,0x7ffefc05dcf8,0x7ffefc05dd04,0x7ffefc05dd10
      4⤵
      PID:2820
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cuzj2zdj.yqo" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=2288,i,12088616252847615178,17319717656264206510,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:2
      4⤵
      PID:4972
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cuzj2zdj.yqo" --field-trial-handle=1804,i,12088616252847615178,17319717656264206510,262144 --variations-seed-version --mojo-platform-channel-handle=2256 /prefetch:11
      4⤵
      PID:360
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cuzj2zdj.yqo" --field-trial-handle=2052,i,12088616252847615178,17319717656264206510,262144 --variations-seed-version --mojo-platform-channel-handle=2372 /prefetch:13
      4⤵
      PID:2876
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cuzj2zdj.yqo" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=2864,i,12088616252847615178,17319717656264206510,262144 --variations-seed-version --mojo-platform-channel-handle=2876 /prefetch:1
      4⤵
      PID:4196
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cuzj2zdj.yqo" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=2880,i,12088616252847615178,17319717656264206510,262144 --variations-seed-version --mojo-platform-channel-handle=2888 /prefetch:1
      4⤵
      PID:1136
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cuzj2zdj.yqo" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3264,i,12088616252847615178,17319717656264206510,262144 --variations-seed-version --mojo-platform-channel-handle=3284 /prefetch:1
      4⤵
      PID:3596
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cuzj2zdj.yqo" --extension-process --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=3300,i,12088616252847615178,17319717656264206510,262144 --variations-seed-version --mojo-platform-channel-handle=3372 /prefetch:9
      4⤵
      PID:4400
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cuzj2zdj.yqo" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=3324,i,12088616252847615178,17319717656264206510,262144 --variations-seed-version --mojo-platform-channel-handle=3376 /prefetch:1
      4⤵
      PID:6220
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cuzj2zdj.yqo" --extension-process --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=3340,i,12088616252847615178,17319717656264206510,262144 --variations-seed-version --mojo-platform-channel-handle=3384 /prefetch:9
      4⤵
      PID:5800
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cuzj2zdj.yqo" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=3720,i,12088616252847615178,17319717656264206510,262144 --variations-seed-version --mojo-platform-channel-handle=4124 /prefetch:1
      4⤵
      PID:2464
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cuzj2zdj.yqo" --field-trial-handle=4416,i,12088616252847615178,17319717656264206510,262144 --variations-seed-version --mojo-platform-channel-handle=4412 /prefetch:14
      4⤵
      PID:5380
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cuzj2zdj.yqo" --field-trial-handle=4448,i,12088616252847615178,17319717656264206510,262144 --variations-seed-version --mojo-platform-channel-handle=4456 /prefetch:14
      4⤵
      PID:6464
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cuzj2zdj.yqo" --field-trial-handle=4128,i,12088616252847615178,17319717656264206510,262144 --variations-seed-version --mojo-platform-channel-handle=4492 /prefetch:14
      4⤵
      PID:7000
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cuzj2zdj.yqo" --field-trial-handle=4912,i,12088616252847615178,17319717656264206510,262144 --variations-seed-version --mojo-platform-channel-handle=4924 /prefetch:14
      4⤵
      PID:6040
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cuzj2zdj.yqo" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=5020,i,12088616252847615178,17319717656264206510,262144 --variations-seed-version --mojo-platform-channel-handle=5080 /prefetch:1
      4⤵
      PID:4272
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cuzj2zdj.yqo" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=5048,i,12088616252847615178,17319717656264206510,262144 --variations-seed-version --mojo-platform-channel-handle=5032 /prefetch:1
      4⤵
      PID:5176
  - - C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
      4⤵
      PID:444

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:4408

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:7136

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

activity-stream.contile.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\igxd945v.default-release\activity-stream.contile.json
Size 5KB
SHA256 f9b6946ef0afa5ed4f42adb96c82f93e7a2308fe575d10400fde546c86eb12b7
MD5 26ca9b26bf5f526ef4b37a3ecf48a5bf
SHA1 3c4aa8643d570448dc38e1cb38732c582dff17b0
SHA512 2322c97d0561ea71fa780b0bdb0edf48cd9595acdd61f365158808de5ef80104051768f15a3095c94e89ff5a3c18124f02e34a2a7f8ea2a4d651a0c031629391
SSDEEP 96:Ke+w9tvrXQ8BnVcAd80oz+ZnjcmCsezEol:Ke+ctvrQ8Bnnd80uanjcmYz7l
MD5 SHA1 SHA512 SSDEEP

Submit Download

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\igxd945v.default-release\activity-stream.discovery_stream.json
Size 23KB
SHA256 01c1179234a4fd5af2957f8e84f5f22285d66d4b6b9831e3964c588546bcab35
MD5 d5baeb10793dc2bed948e18ffb99d168
SHA1 6e4c26b164caad920a38dba9ebe531f068f2e784
SHA512 f941367ff6a3e9f176a8977a76d2f8e6ee6da010516bc3185f0691e3444ebe3d388e33a9ede95741b3d52984ca016e7eb66bdc1ea8157114b7985ab8f38543b6
SSDEEP 384:NyaYYIhWLlRAu8OtHiffrHdnrR0vug5cYyRgsQGKRgIvAJ:NyxYMEF8MiL1HgbIn
MD5 SHA1 SHA512 SSDEEP

Submit Download

577120C5183923526312DC856F6825FC1C7D072F

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\igxd945v.default-release\cache2\entries\577120C5183923526312DC856F6825FC1C7D072F
Size 14KB
SHA256 ed21336f3fc9d68760f89cbc46c325a1a2266145852739ab687d5d312df9e5c1
MD5 0de72547904bc8f785c333e4b21ea076
SHA1 e75b967e59c640a078d68e34aad042ad4877b96a
SHA512 8af4834220d19d831409749567648144a605a540202768d46253d412f85a781dc6e8471a40f0abe73ed8a56d98d39a14d144c58ed3050fba06b71c1a0e261861
SSDEEP 384:HV9BpiO024Yi7hSznZOML+CbcxDEclrIVy8eboXoze:1EZYi7hSz8MLPbcxDEcVIVy8n
MD5 SHA1 SHA512 SSDEEP

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\igxd945v.default-release\startupCache\webext.sc.lz4
Size 104KB
SHA256 44a50c3e12a6507cf0d3821ac36bb331730c705b754a088edbead05f0ed6e40c
MD5 e4fc0b3011ea6a113e06755085c71178
SHA1 f4efa22361cfc08529dff8cfa71be4ffa3f58d54
SHA512 c8f11f06556ff0d32c6a4ac677880972eda241833e34fe8d9a7e0c0b7fa40faa69c41d2b58a94583d33ca6274eb36d5f56089a6fc8ee0492557e5bbed086907b
SSDEEP 1536:jTrli7j/DDjSn6MbdOgVvY/JdLWETExSPf5S7a53K0oLkpsZw3OFhZ9UyQntD88g:j3lBn6MbxgfVTEkxzpNOx9Un98zXfQ7K
MD5 SHA1 SHA512 SSDEEP

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\a4ajlz32.xhg\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\a4ajlz32.xhg\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\a4ajlz32.xhg\Default\Site Characteristics Database\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

32.png

Path C:\Users\Admin\AppData\Local\Temp\a4ajlz32.xhg\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\32.png
Size 1KB
SHA256 3197a2ac164c5bacb65f02fd9a6eb9c0a533fdf3b24f43043bbe9af65ed6608a
MD5 60953b3aca67505c2c7ea1a902e84d51
SHA1 5e6a8e04a96e36306c66409edd4775a606f13f54
SHA512 2e65ec84471c3f703617171aa32f1a0d6c57d73e1d5c074b92d20d580df78e7ac4eef5ce54ab7defd0027bb38e33c44a6602d3e123a2fd310e514af0f5b38086
MD5 SHA1 SHA512

Submit Download

48.png

Path C:\Users\Admin\AppData\Local\Temp\a4ajlz32.xhg\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\48.png
Size 2KB
SHA256 9bdfc3aa03d4e41b0d83862ce02f9fe7fdb55a492280d86d551b91a24efd47ca
MD5 1625c1dd7bab831d8ab5308a1a71d525
SHA1 f1c145985a7c8c18891caaba0f46729bcbd1f63b
SHA512 75079bcb02482abd10b121d81fe39607dcac17bb3107ca274c549b570bb473260dfdbdd13df769b1745425ac5433a22fd392a2a1d815897e0c2091b787bada8e
MD5 SHA1 SHA512

Submit Download

64.png

Path C:\Users\Admin\AppData\Local\Temp\a4ajlz32.xhg\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\64.png
Size 2KB
SHA256 57d5cd9fa59f944ffc78ec2a12633a79e2f923124fc50676ffbecaef5021b4a9
MD5 e6671b804d6013a6706ea598e2d854c5
SHA1 40e4f401fe4afbf7bda49a02fe94f5308868460e
SHA512 7b11a47497ae5810ec4c7038ebf8358f03d79126886feb6daffd92d116fd606f530ecced9c3d635c0f57b9f9eb80ed9e8fa4eb98b029f9fd798d9b89ccd279a8
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\a4ajlz32.xhg\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\a4ajlz32.xhg\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\a4ajlz32.xhg\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\a4ajlz32.xhg\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Action Predictor

Path C:\Users\Admin\AppData\Local\Temp\cuzj2zdj.yqo\Default\Network Action Predictor
Size 4KB
SHA256 8c471cab38a1696289186d01b06ff6af2a888852dc18d6fb8d2a0e54898104ed
MD5 d25d5e1dc1d93430e64ee17e48ce442e
SHA1 d5c7ca9a57e6cc68927a249fe8e601d52680ac7a
SHA512 f4cff7510b4ad81090e0b1842652f8eb7995f7aefd0ce651151bc24ca3a4305d34ecae41cf193d9b846e8f6359ccf545e5d05e63e6e766fa9761ccebce620f6c
MD5 SHA1 SHA512

Submit Download

Trust Tokens

Path C:\Users\Admin\AppData\Local\Temp\cuzj2zdj.yqo\Default\Network\Trust Tokens
Size 36KB
SHA256 19e1e0d60dc0a70455014fec98b5e4b73e93a80651600368745ab0d4a49c9529
MD5 4203aba60fd9de5b4232fc624db3f817
SHA1 1f07dfc552d6b509c83c36cb05986007ce29e250
SHA512 6240f8ef505e093f0ea99306adfa90969b3de094cde08b61076bd2c737763c0815108f532ec17e766fe15f9b1bcb9d82096f799ef04d50c3ce2305d8247bfeb1
SSDEEP 24:TL33lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:TL31DtX5nDOvyKDhU1cSB
MD5 SHA1 SHA512 SSDEEP

Submit Download

128.png

Path C:\Users\Admin\AppData\Local\Temp\cuzj2zdj.yqo\Default\Web Applications\Temp\scoped_dir2448_407753749\Icons\128.png
Size 5KB
SHA256 99b19cf47ea4e47b933229e92b87a474fbd5af7936bdf885c2240d0e6f4bdaaa
MD5 6a371e7bbf132a71f031772845249b9c
SHA1 36f499f3a2e2bf885019d914a0cc6e8b3e035a79
SHA512 b1fdcd5af84fa476808b8e89794d9df9f8e48b3e7c1a2239deae10832834d01bf311803ac95b3774d781be791b47389310ca866e1a6b497925ca6e2f004555a6
SSDEEP 96:n0NgAMSinf795k4ITgiEAyaD39SOOcqS+e60qq/zsB:n0Ngpf795k4CwG9ST3S0wzsB
MD5 SHA1 SHA512 SSDEEP

Submit Download

192.png

Path C:\Users\Admin\AppData\Local\Temp\cuzj2zdj.yqo\Default\Web Applications\Temp\scoped_dir2448_407753749\Icons\192.png
Size 2KB
SHA256 9cfd1ad226821af533499bd832a5674df52a720b19e054580a2b999e19dd7b1a
MD5 22ba8844019e231a435903176a618bf5
SHA1 0ce576800f66bc2145c8df72b9efbe0c7431aff8
SHA512 2e754fce3268dac2f8f9261f4d4337a7990a990121327c9d491f27fba5c4680968c7589bfa0d04082410f975cda97c46912ba8e1c39f8a6da15cb32c02929cfa
MD5 SHA1 SHA512

Submit Download

256.png

Path C:\Users\Admin\AppData\Local\Temp\cuzj2zdj.yqo\Default\Web Applications\Temp\scoped_dir2448_407753749\Icons\256.png
Size 11KB
SHA256 f64a3d1e393f9a114632d22bc8a01b328895127ff1796e2c3d18b206622fab1c
MD5 024859c892ef6882e8a3e1be4675d23c
SHA1 30ba3b6255e2514b9782ee29f6b8b55ed350a29e
SHA512 58caafadba7cda1db596f5a3c2f94fd3a167cbc21ad98387820ebd808a52eff0e23a5a8292b34a8e284aec4bf2573998ca62f0effb5b647af1bee96ded8bb384
SSDEEP 192:F4aCtq9F5vnIb8/0yNBlV28QNP716enZiP3dGu5yIs9gGDyIMWQo2BkL6O1sSO:Veq9vvPdBrQNL8PNoIsPGYwBO1sP
MD5 SHA1 SHA512 SSDEEP

Submit Download

96.png

Path C:\Users\Admin\AppData\Local\Temp\cuzj2zdj.yqo\Default\Web Applications\Temp\scoped_dir2448_407753749\Icons\96.png
Size 3KB
SHA256 6c5f0e1efa0cf592b01bc20be9c3f348a4285e4604e555216c064b64a05961c0
MD5 7b0532144ec2ce1915a3707ec9084aab
SHA1 81cab7df8538d1f757a3e58318716a9a1ed08d5a
SHA512 aefca0ca127e2b91a5c7206b8103b2afd977258643c12e972a292522152964da1beceaaba0b8f4f40e85e705bb9c9e5826ba49eb2d9b925dc07964096863dcaf
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\lmcy1tyw.lko\Crashpad\settings.dat
Size 280B
SHA256 1b9789e8504fb3031c3c97a4db4943c57ddb7a3a2e203be38e1c7a5bbe6858ff
MD5 2ab02e542aa743ebdbb989561b6df773
SHA1 2af69795602b99531d3e387079b44a8d01ff0949
SHA512 eabac26e7e3dc8c5a6b27516f20e828b9e786f0eb0f9d88e3bd6eef5c5c1fe5a9c25df69b4d90c4884b7e04a5a485c59757df3cb7b72b6d84b8752508a0ce9a6
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\lmcy1tyw.lko\Crashpad\settings.dat
Size 280B
SHA256 bd6bb11dba5572123e853945fc9d4581f0fbd47458501a3184f36e285d0bd285
MD5 a481a4199a17485937b528f7bb419884
SHA1 4910e48e26fd449ce817f1153d15588e23af2aa6
SHA512 d03e6caecbb924633c5a88a36e5ef232a2a7c89e8d451b68b4bb10fda98a1520d2c134d86897d269e3563b536ebc5e73e002d58b02f703f0fe4be9d6aaf8be1d
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Temp\lmcy1tyw.lko\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\lmcy1tyw.lko\Default\Code Cache\wasm\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Temp\lmcy1tyw.lko\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 192B
SHA256 1627fc983d16f997e648b8e9843e0ee6bb61d022128834ebd14c1c13bf9b214c
MD5 be4e72c3d681c43d0d985967192f2468
SHA1 d878020d3419e5fe8d4d2473cd0ea3461ee0ee6f
SHA512 78fec6df775b222abcf35b93604ca8380bf9c274a644c18d682aa62dbb33c9d719bd0455147b8c3481b95b61df721f2e7f4fff2964ce0324ad619b22930ae504
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Temp\lmcy1tyw.lko\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 257B
SHA256 fd5b817340d06bca1b5a3fcc694006d664648c12d44335ecaa267972bc9f07b7
MD5 cc300c8e18403003ad5812526204110f
SHA1 af34188f7e390dd0fd6f865a2b787b2cd6f0729e
SHA512 75fb5a0e343ecec4cf2bcff2f5f25a357db4df5d57f0a80ba67ac26c950b76939a016d7a03a36cc5cafc2ccc3c03156b000dd2fd169ad9d0de7658b7992b39c8
MD5 SHA1 SHA512

Submit Download

index.txt~RFe57d736.TMP

Path C:\Users\Admin\AppData\Local\Temp\lmcy1tyw.lko\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt~RFe57d736.TMP
Size 119B
SHA256 71b4e6a3461a7924ee10db8fa578890ed768fa6bd900c26b7ca0cd81f9baa8d6
MD5 4856c76d5a6714542dce851cc4540833
SHA1 9f2d2d5c91b05bb5bfcfc2a2ab099ae1504427e6
SHA512 b396fabba63860182b48d5ed673dac88bedfdacd9c4622e8275f43d45cea00cc773f629981ea9c3e7f437e11b887c8c074111767750b6e52dbdca950e96c5f18
MD5 SHA1 SHA512

Submit Download

e180d019-a241-4232-b1fa-8021b8b4e3a0.tmp

Path C:\Users\Admin\AppData\Local\Temp\lmcy1tyw.lko\Default\e180d019-a241-4232-b1fa-8021b8b4e3a0.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\lmcy1tyw.lko\Local State
Size 3KB
SHA256 2668bf885c070a515d52e2250b4a70e15ee38d29055c1afc8e0b79f96bee8c63
MD5 87838520043f5173c67ee7900d8fdc8d
SHA1 d6a4d6d39489021d3add23808aec8d21279ca0b2
SHA512 6eb0c2f9e56c414a31c60b4965276ebccfbc20e276d37fdf6c289524c8b3fbd844835617e6635cd506769309583af9c215a76658d4991a701187a584f535cec8
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\lmcy1tyw.lko\Local State
Size 4KB
SHA256 891755a3a23be1f669a2232b2bee77427b2e42188ae89f0ec6175a6727aa14e6
MD5 48744d0b8efae0e64a8ca00d9a246fdd
SHA1 daffdfc322536f9e9ac5f8a301fff11f61fa4465
SHA512 410b31cd302ad37b6ee9fc156a4249bb4a9fbd98a1fb460bc6e89475f71aefe1cebc0ca18d06b00633124c3d0e8ead4cbf0016230c3ef41f4c4e73239540b587
SSDEEP 96:hqGNkCuf9Wvk58Frh/cInURoDotov3gDfBQ2vgI4UJSiACUDBQa:IGNbyW/ooDUwmp74ESgUx
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State~RFe57cd14.TMP

Path C:\Users\Admin\AppData\Local\Temp\lmcy1tyw.lko\Local State~RFe57cd14.TMP
Size 1KB
SHA256 b54b7a6938d1f79d4cc4f5a0287294a61f7c838906f99a1b7fc5db942dac3d77
MD5 c16f211fe1c5e4a6c6056a7d01eb924d
SHA1 701f5735db5056ae6fcaba6813a83232d5e9f1f2
SHA512 a0eb803bed3da09fe0f8b54f6b35f9921b9db9a7fd1601dc1ca1b449d4e3218b0c10527a18fa6830120beb17caa56598a419beb26b8ef1dd86dd2a859d48bf85
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\mpeltu3l.njm\Crashpad\settings.dat
Size 280B
SHA256 9cc0af202868485ed8c98bc79b45069dd8749f085d6e517c29688cd5b658dc43
MD5 5cc1ad29763d7fc0d8d730e513e0d8ee
SHA1 c5dd527875310b04c0825a249563e825b4f14a7a
SHA512 0255e828149f130ebfcbe8ad866b983fb8acb372b9cab12d0e0a3353b1132c0b0a609ce2cd80801303659a3393b1d8aff7d606e449795f83c10e00ab14b8bba0
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\mpeltu3l.njm\Crashpad\settings.dat
Size 280B
SHA256 4f2766fc4c19ecbbfe0b2c16675b118f28dbc9eec1c1060934761f55cbec162a
MD5 95441d96cedd487cbc8829c0cdee69af
SHA1 9c5ffadb2ae58eac277fd9330647db369d17927c
SHA512 9139147aead30d34e0a0d0041773486921343f1e83f6ca2664fd0e1392c7db115d2fc417928a1c19f9a05947d9788cbd5188f0cfc26d481dc12d5cb843c2e46d
MD5 SHA1 SHA512

Submit Download

f_000001

Path C:\Users\Admin\AppData\Local\Temp\mpeltu3l.njm\Default\Cache\Cache_Data\f_000001
Size 34KB
SHA256 8c97e1a3437f857eb8a346a360274ea339a09eda1b965ee1445d870c09b066ca
MD5 4227139d34ecd3be139bf6c7d75fce5b
SHA1 0e984113aa96daf31d002392523ad0dfc9cc3870
SHA512 bdb38f430aa623a17b26044288841a07c82691ee858325b158423839fad99a75b192fe0df269898cd76e22a7e54250611f852ccb763ce82db2f7d1c4eb6fcb52
SSDEEP 768:iFPCuSWxAknP3gQlE3brX+48360GKKAC4FZ8ELh/SAE9gnmlV:iFPCuSonPJErr18ZGKK1oLQH95
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000002

Path C:\Users\Admin\AppData\Local\Temp\mpeltu3l.njm\Default\Cache\Cache_Data\f_000002
Size 99KB
SHA256 cad25cfcc108f11e81cf1a339916e956b5ccd3ab3da38a3bd7a3a7a01adcd3f4
MD5 86e9c0ad8befdb46f1ecda1d3f2c70ad
SHA1 cf9520c235db04ac02e98a7f7c9f3d5d631d4199
SHA512 30a1265891f03df0c46d4f310d97ffa312b84d485a214d895a1c5e260474260d6637592b20d9cf4efa507c131694f63253577fdb352e8e0c46505e02183e0ab4
SSDEEP 1536:GAqrSnLU5BxYE4bP9zel9rbvjJvNCLtY25wJ0qPKldrT6LTMyT2ItH3RHTZ:GAqrSLSvYEwsVbrTfUPdqL4S2iTZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000003

Path C:\Users\Admin\AppData\Local\Temp\mpeltu3l.njm\Default\Cache\Cache_Data\f_000003
Size 63KB
SHA256 a9c9c90931e351cba32704d61f1d329d7a9df76145a8d0dc71e194f293abf425
MD5 ceddc0ede5679a07157e742c028d8cc1
SHA1 48af4601ef9feaf67aa08de7e7e6d7f646db4041
SHA512 8c81f96035fe679bd86a4cc490d10e2754817be3fd08fe2a11a0a4bea82e3d102ed4d2a69e20ec347314658b51f931b17e9f3a1ea82c4e28256cc4165431ff66
SSDEEP 1536:RRLKoT08wUGIDL9uWiYp8araK2xQbypF449xYPMk2xmct/p5CWbL:RRLzT0E56c82RlypFT9WPMkYmctxsi
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000004

Path C:\Users\Admin\AppData\Local\Temp\mpeltu3l.njm\Default\Cache\Cache_Data\f_000004
Size 383KB
SHA256 dc3af441eb066cbda7e42f12fb2b4a3df6f7d56b64b94ad8d099de55e4738c46
MD5 294155765131d445bb3d8e94bebe8d75
SHA1 b6e1cddb101abbddba067e18c9830f8215acb459
SHA512 f86e15e69866fbb47971334f45e19fd4c1ed72ddaff109696cc190fbeaed60904731be665cb98371bf8e291e9ddf7f9772ed24ffdddd21e3564d624c7d2b1bb7
SSDEEP 6144:D9KxWHBWzAY0a9Fufaaqy1h6wVY41jhnSJ5x8T398XPQUI0YLg8FHe8y8KwrTZkd:D4xWhhbE091h6FoSnx8T98YmYBFHIbwg
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00000a

Path C:\Users\Admin\AppData\Local\Temp\mpeltu3l.njm\Default\Cache\Cache_Data\f_00000a
Size 16KB
SHA256 283e231a1dedf20c3f98eb1452ec52d042179d31a6ee482e54b51066074faf42
MD5 46b49aad1412c12943384f8afb51204f
SHA1 e6a38f254f0681007745ededdde176ec64670723
SHA512 8b521405691a78c9f03740f2484f6f07ae881cb1ea5d18336fa44771ec025d1dab438c1a849c30a3b7fbabd9dc391fe4aff499a09de1af6391611d1752ee8d45
SSDEEP 384:iEEbbexRg+TpS0d0qXYsoXB+SBuqkXL214/R7MI7fm:WexRbw0/XYf+SBQ/xMD
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00000b

Path C:\Users\Admin\AppData\Local\Temp\mpeltu3l.njm\Default\Cache\Cache_Data\f_00000b
Size 28KB
SHA256 b421c05a340e40d4d4bd1831521268b6f0afd0461ec3991cfa8d5314bf3207b4
MD5 57f9a7c7e2be49102533a2ceb7a05e51
SHA1 850ab0a80577b7f7effe196cba037899e71594c5
SHA512 66406d54a1d1a44f30e19a9bff1242b50fdcfbf66c33e4c23daaa756c06f50a2e39c991e7a8dfd9a81184cc37c2062d0406070be132e28a22307896e63b55447
SSDEEP 768:dT+CJ4QL+F8S4bApn9Ua0ndjCaixJ/fVW2/AGYnS:TJ45F8SgjXnNCa4fVWVnS
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00000c

Path C:\Users\Admin\AppData\Local\Temp\mpeltu3l.njm\Default\Cache\Cache_Data\f_00000c
Size 72KB
SHA256 d532c0033bd892149ba6d22122425ce16e0b9916be3b96edb5d1215892741705
MD5 e8397f14ee34e3d2661d6a762db8ce28
SHA1 c897cf196851f971ac0a728866c1bd1eba41590c
SHA512 b2a8530593aedc867af7daab3fbe40c2649549f977120bdbd073839efe8b5546c5eee83d5788262d0373c5674d90505d02046758b5f6ad0819e5dac71b2ba65b
SSDEEP 1536:Xllt4fEDp707LH1E9kb+zw4oGp6LHXDjMrupuAHnVY3jUUX1AqaPdJp3MdF3TsBf:1PdpcLVE9kcw4oGp6zXCun1Y4UXiJide
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00000f

Path C:\Users\Admin\AppData\Local\Temp\mpeltu3l.njm\Default\Cache\Cache_Data\f_00000f
Size 17KB
SHA256 5e41837a6aba4a285df072ad0290e7f9e1dc4682799f71e33222a3a0d6e5a082
MD5 9e6475d889c8916a680317ec48b212c1
SHA1 daea8c5b6cf03d05fb8ee7fcc18320eefd2ee0ca
SHA512 7c4f34e50b5bf4bc95d59a2ae648a673e4a7dbb9669f73d6512dd12521335297886168c5c00f60cca5f85a655265c49355c3ad113e62124577f75f45abaf534c
SSDEEP 384:DlDTvwo0JYeOCqDG+G8fPv4yDs3HsxaYprRr2y0BYi1n:BXwoy9OCHifts3HsYKroBpn
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000011

Path C:\Users\Admin\AppData\Local\Temp\mpeltu3l.njm\Default\Cache\Cache_Data\f_000011
Size 68KB
SHA256 fe2fbf50c33ae9e12935df44eb094e541236f27fbbd97ec1bdaec2bf03e69054
MD5 7f3bae3ddb127530a3b1ec2c8501a056
SHA1 3d2a9ec8ebda8961af05bd4f2fbe0aea180fa762
SHA512 e8a5c7cbb1081d5e229b231b3e50a2d0211082981a44628cb6e01dee18087b73240633f649fc1a0103f24613178973997d7a74961bd4ea7dbea49296c48b0e10
SSDEEP 1536:NupBZ1xSO3cQmUY/lbFBw70hbBD9AfA1pwdpPq3Yf3AZ:NunZ18O3NOlJpd+kpwdpi1
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000012

Path C:\Users\Admin\AppData\Local\Temp\mpeltu3l.njm\Default\Cache\Cache_Data\f_000012
Size 70KB
SHA256 30b4527ac16dda6093c174e8e842c7208d6c1cc26693f6f1a849d52b17b41d37
MD5 362644b225a27e4a658d69e9b17a8d19
SHA1 99e0fd685d570022b40800612b5dd13b801044a8
SHA512 cf1122d85319b28c69ccdf3f12b7362ffde1cafe952edb0e4a40370d1fb80dc6f8ab70e50ae8f07166c29e254d5a138ad8fb346d796752efbd14642afe5905dc
SSDEEP 1536:SPD6v1B+LiVECo6I6hUr2ZEwVjnZefbudrSb3fFQ9RMVFO:SPD6v1B+kvfYWnP5Sb3fFQT
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00001a

Path C:\Users\Admin\AppData\Local\Temp\mpeltu3l.njm\Default\Cache\Cache_Data\f_00001a
Size 18KB
SHA256 cb78510332b46564f4369bf31ff85c1ab0016bbcef3110b9b9388b88f1cf4795
MD5 9e32121253edde20161adf93523eb060
SHA1 4b9267459ba3c68bd08e6492a270ccaefe2c2dbf
SHA512 7b5c22ac424e32122637c434f4a087b87ba43ac341c008a4df3d0f57f443e38c68f75ae6087e16cf3d7c651a8a35b80faaa8a28b866b1c0def48e3b6c451fae8
SSDEEP 384:USS65/+IiYmwVYkgDdUlzU7SjcKalWW4sIkb6d2e/Oc+C2kZu:lS64ZimDWz/jcK3WRIkMnmo2Su
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000024

Path C:\Users\Admin\AppData\Local\Temp\mpeltu3l.njm\Default\Cache\Cache_Data\f_000024
Size 33KB
SHA256 89ab09e7b2d516d5292607553dec92832148ab1a3c37529b7ae4a108477cc387
MD5 baebf31c834043f30f329f8105626445
SHA1 743c63a89cb813094b68af4b8bd2886624c1a08e
SHA512 c98727173145a6b93cb3c1790d9067503966ff617ca50201c68e60051269223cf728b65b439456bf197921324c3f133c057690e8ceaf3f899561def9dc41cf74
SSDEEP 768:AdkIw38+GJp0WyTh17LiGi3m6W2MNc+0lgntGsWEOn:AdzoApU2Gu7INc+0l0t0
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000025

Path C:\Users\Admin\AppData\Local\Temp\mpeltu3l.njm\Default\Cache\Cache_Data\f_000025
Size 16KB
SHA256 23cebdde3aa3c9b38e0647ae2bd6daedae2f62adee6521dbf726731d00bf14b5
MD5 fdbdb95b5ac5c4edecb625ceaccf87b5
SHA1 8da620668bc6b3ee6c2eac8c258d80afa06ead0c
SHA512 08c9c96ffa14e4be65c50bed0683a5d817ea190a493cca1119dbec30807a9e5846baa86c96dd97603620ee67c3acee2cda678cb246fdbd033aed1805aef1d2f1
SSDEEP 384:BhBYbM/UQhdWQz2xB4uINwHHKwq2Lx+J7Yj83GyEskVvyWpg5Fe:DqQUwWQz2xBrnnbNLUBYI2yEVVKWpn
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000032

Path C:\Users\Admin\AppData\Local\Temp\mpeltu3l.njm\Default\Cache\Cache_Data\f_000032
Size 37KB
SHA256 6df0197d5710db66a7ef315a0576051377f58955d73c1f4b23db7ad183df8d3a
MD5 69581708d86ec10c6489065b51ee5483
SHA1 91fe71d2a355d958d826f336a880c844a72c13cf
SHA512 7931780512d21f926e193d29f39656e9d4b626487d81d58b6977054ae78d941860ecc56eb1c6ce042431471b871a0c8b0efe09b2fe40eaf5214d45ae16c585f5
SSDEEP 768:tx2YIheOWrWX5LytLNWQho0hd7NV79tIQNY:tkY/8ytxWfqd7NV79mQNY
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000039

Path C:\Users\Admin\AppData\Local\Temp\mpeltu3l.njm\Default\Cache\Cache_Data\f_000039
Size 17KB
SHA256 1c252d3f3dc6616ebbfc5cd29e8537f2abdbfa6b34a624c9a20038ffe1c3cf53
MD5 0408f0b32584dacda0d3bc0a5233d8db
SHA1 798be1217f22d352ebaef5402d4245cea48ab48a
SHA512 9e344569a968561d6c9cf7ccf8caccf9140cb995a69c7bfe9f23a939393d13633749a13417f6e73347a62e65107df03bb63c0cead6c7574f153f707c94e603ba
SSDEEP 384:11lSwURGstPKEYa5FnpxYdxoAscuJjEK/M0AK4:8HRGst3DPpxYdxotJjEJ0AK4
MD5 SHA1 SHA512 SSDEEP

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Temp\mpeltu3l.njm\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 192B
SHA256 34482984db0e7e5562d6f212f93c48b1716d67fdad75428b3806aa09b4070c40
MD5 9161e296f25b2845f5ba2a599b23bef2
SHA1 d768e59c300e719b5af16bc656ddded746df1a3b
SHA512 fc31d1848e91f84d2307cbd3f2f22fccdfe6dd1dc2b725c1db99414aa22b305f68b8fda75d78106cbccaf3c441d3b69ae4535c6cd81617f26e7634827150a086
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Temp\mpeltu3l.njm\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 257B
SHA256 2c6d5824a8957d039f045834a398262409223c6a967d9b325955d673052768cd
MD5 eb9b68f9c2e3dbfd08db2365fb8858fc
SHA1 62f3a248032282250a9a4ddaa1388e7566eaf27e
SHA512 8194bb8da82cd1940115714259e1afb79a285a747abf80e090753e0f747229cf2bc7ff43aa2844f70f852332d5cf8dccb34ef5bcbaadbf8a51b5358930dd0654
MD5 SHA1 SHA512

Submit Download

index.txt~RFe57f00d.TMP

Path C:\Users\Admin\AppData\Local\Temp\mpeltu3l.njm\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt~RFe57f00d.TMP
Size 119B
SHA256 752fd1006eb6af5507a04c5eb4e007c28b9a1824e5b4c0a6e77cdac4233b74e4
MD5 f0a2f5ac24bcfa44c0b1eb6e98b074ff
SHA1 fe410b91e396112e41c4ef06713d5d2e9e867eda
SHA512 7fdfdea9e10cef404de01a2a4b76bed05af0d895e722e4aff72bf99e5a3534a5bb25b3a1da72e9314908e0175522d51bbd13cc3ad9a533ae5986283a57004ed9
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\mpeltu3l.njm\Local State
Size 3KB
SHA256 5487fdfcc92c26348fa333cbfa256d5213584dc5fdc11d338eb6854b13a60648
MD5 c39b42a873c0f6cac44892afab8862bc
SHA1 9e20a41499a4cfaa7ad96156c36349790de169a1
SHA512 ec236cd0fd6695e822b29a9680bdfce9a6011873cd8d6c3c40ca33932e33c94bf5f5f8eb09f7f18121a0916b7b1a60e1ae3f8002c83a8aae4cee53a1b6f1863a
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\mpeltu3l.njm\Local State
Size 4KB
SHA256 5567961dad923a3a297faae416ca6a564e0f23e6e5d92f7b2cf5f7cba98a379c
MD5 56825aba04b76d34464fb0f3fefdd760
SHA1 a2f434caec1eaaf86bf9c4843b9bd0ceb2603dbf
SHA512 64f93a65de89dfcb8538af0727fbee3807f1bfe84ecef97a7c3fa82d29e5f38acda26eccdb75f47ac2945022c9de3fb7e9a0c2653c00bb44bfd1c7f3573e6bcd
SSDEEP 96:vBqGNkCuf9uAajs258Frh/cInURoDotov0SDOBSVDuv6nMgrkgJS4CUDhqkBha:QGNbyuAdooDUwJujgrkQS5UVqF
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State~RFe57e36b.TMP

Path C:\Users\Admin\AppData\Local\Temp\mpeltu3l.njm\Local State~RFe57e36b.TMP
Size 1KB
SHA256 ace61828eb390613f09d3ffe022ed6646e6470ea3c167f1b1722574328dae1f8
MD5 c8b14b1218c4418de8ab9ef94d664586
SHA1 2ef525902790a1e594f61ec605de25ecd7d6d339
SHA512 2a13390fac1abc7ad4e116b1c76b8d5bc0b854d9cb2f0a3f56c071e82c02712d41c0f594a49ea3ad1a36efaafc443b22f705d203d64533073ab0138d8557c8fd
MD5 SHA1 SHA512

Submit Download

b9444426-b8ae-4d02-8efb-8bc7e14ede7b.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2420_1178388532\b9444426-b8ae-4d02-8efb-8bc7e14ede7b.tmp
Size 154KB
SHA256 a468f5875b4e55ea732e3df283b4f4ea941be738b238122979ca5d8006a3a8fe
MD5 4ad81f6ccc657d1da582c75c5db037cb
SHA1 ab0370e7d32ebed71fe9787d3a4a2fc0c652a28e
SHA512 66461474f8b36d6d470797df9d4a3cc4698bceb7054c97166eed98b74def84f58486fdb909928aaeafee793799a436210b5d7091acce6232b23eb6ba926ad227
SSDEEP 3072:OqeD5sKZ7XcbMSqnDhcfXE0IfnpWpyKIrFn2wNkR7aUPuWm6u:yD5sIXcYSqDGc0kkpIZ2weeX6u
MD5 SHA1 SHA512 SSDEEP

Submit Download

YJSYL6K0310959VYZ4FL.temp

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\YJSYL6K0310959VYZ4FL.temp
Size 4KB
SHA256 9863d767d8b3f1d66630297ecfd5eeae70d882d78af7676ab7de19c5308d7046
MD5 ee59856c9c37790954d8712cd53071d8
SHA1 ec09bb9def888dc8a21a070305165dd2f6e9e0c8
SHA512 4d170f9dceee6674cb1fb2bb3b65c2e8622985f9335d59a386b5123fff7cfaef14925deb83f804dc3c82725caf94c570b63deaa4d9cb08f8d3533cbdd0b4a5e0
SSDEEP 48:/hudOEyyzAIhOXLJ9zUoYodLXuHFupEhudOEyyzAIhOXLJ9zvY9gdLXuHF12h:af0XXtJUoNusDf0XXtJvSIuM
MD5 SHA1 SHA512 SSDEEP

Submit Download

ccba5a5986c77e43.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Size 4KB
SHA256 294f92ff878bc6cdac135af3bd6ebf7d9fbeee80a13ef03322e35b474234de22
MD5 9dd4218eb8889fe7d1efe7ca33751314
SHA1 3d327a094c0af16695e4d50cde9aa8f0fd2a4448
SHA512 c31cdd5ee1d358b6900ab28b0a3825ca496d5514792866336ca47328db59cddf3bda918838d3522bd4909dd9d74d3603b4a87cdf393bf189c96565e5f95cf81a
SSDEEP 48:ehudOEyyzAIhOXLJ9zUoYU6TdLXuHFupBhudOEyyzAIhOXLJ9zvYU6GgdLXuHF1s:Pf0XXtJUoD65usWf0XXtJvD6GIuM
MD5 SHA1 SHA512 SSDEEP

Submit Download

0a80fe5f-ac04-4be1-b46e-c5bdf3b4d263.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\0a80fe5f-ac04-4be1-b46e-c5bdf3b4d263.dmp
Size 63KB
SHA256 9ecbb0d5ded09ad7a024bf426f86b18b41d6920d5cb0c7bdc83d951b41cc1a76
MD5 43d93b215d788302b3868417087c4fb1
SHA1 ed227b3fb428c90e3d2e9c36fa936c0aa4e8fb91
SHA512 efe017a3023ddbfb2e772fb6cb419f09a9754bce8b83fdfbc7a36271ad2ec9191a33182afcedbd4a6fceacb41915428d361de59f5532a15842d9b8f98419599e
SSDEEP 768:5LkSyc9jdzcT5i5exvBLTp+r12pMyl08W8qrHEG+x7hBKvqsIMs4OxLiO72:lt9jdz6iSz+r12vBKvqsIMx
MD5 SHA1 SHA512 SSDEEP

Submit Download

0a80fe5f-ac04-4be1-b46e-c5bdf3b4d263.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\0a80fe5f-ac04-4be1-b46e-c5bdf3b4d263.extra
Size 10KB
SHA256 4dce10f5dd1d9f760cb216e0b74447ac49a177d23632beabfb7cb8ad99494a0a
MD5 596e7696f5fe45671e5c553ff6438319
SHA1 27d0f65514056d6a8922e6b483deb5664c6c53d6
SHA512 e2932aca4ad9168a4a9366f387a14fe3717263ea3d39473afea24597a4957cde5b6692cb657a9125ad1f961be416b8f0e25a74458e69db59c340a2d063df1bec
SSDEEP 96:STWCsTntY6pw6lF29dt40Rh7CsevBb1d0DjMLlIrLlhTLlaXv7aCMutILfcBCqw5:S5ApYb/7uvZ8PLVxsP5wlQ2foK
MD5 SHA1 SHA512 SSDEEP

Submit Download

0a80fe5f-ac04-4be1-b46e-c5bdf3b4d263.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\0a80fe5f-ac04-4be1-b46e-c5bdf3b4d263.extra
Size 10KB
SHA256 672537209ae4619dcb94588a784c3f2805ae3be850ed4addc4755f267222bdeb
MD5 e0494a58e5cfdcabf4a8d5db2385004d
SHA1 f46d44c494a2c8dbd2809623073a54e946abb42d
SHA512 94df07d29bbbf8228c9523e589184f7bbc09f9bd76df3f94a44a2830210aec29af25b8e872280ef0b0a420c0764a6bcedd274b1c097360fc5b3363258973c034
SSDEEP 192:S5GcFQiR4M4DnQYapdVxzPhWBHB4T/fKNtalY2foKbLgwx:iGcFQiUDI1JWBHB4TmaBAKR
MD5 SHA1 SHA512 SSDEEP

Submit Download

17c97178-6114-465a-a1c2-ad187f87f220.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\17c97178-6114-465a-a1c2-ad187f87f220.dmp
Size 65KB
SHA256 4710053f9e6f55cc8e1f55a4ced008a064f06feb6f22d982eeb7f8e1c45b1f04
MD5 b48987f45c7330a31294afbbf6ed376b
SHA1 c52f46d6078bd2e24dcf1bc22da15132899956fc
SHA512 e320301c422ad40a8cb076d85cc0a492e9be6d52826938e2df1644c9221b22211a5252dcf22aecb5e428b0c44ac2d99620f6c1b82229c5a2c4480af8bea5038a
SSDEEP 768:8kiS2sg7/eOvQI9wn4vameEnGKaud1F9zGs5l08W8qrHEG+x7hBKvqsIMs4OxLiT:P2x7/eOvQI24y05d1F9zGspBKvqsIMx
MD5 SHA1 SHA512 SSDEEP

Submit Download

17c97178-6114-465a-a1c2-ad187f87f220.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\17c97178-6114-465a-a1c2-ad187f87f220.extra
Size 10KB
SHA256 e2db4dc20a65face584baad0fa1d3b0e7c29401a735fcf1e0d5fb1986492fc7f
MD5 24f1be1baffd7dde79f22c4ea5bfb1ac
SHA1 f844965716b35e9cbd21bd6e364bdd2ffef7ff69
SHA512 36d94ab896d53d06432568a57b2353bda5b8bc1ff130452ac0b23cc4fc512f724a13a3483462f2713f149c0d4a1c7a5510d35768d5bbad881463fa56c57ed8b7
SSDEEP 96:STWCnTntY6pw6lF29dt40Rh7CsevBb1d0DjMLlIrLlhTLlaXv7a0utILfcBCqwvu:S5TpYb/7uvZ8PLyxsP5wlWGfov
MD5 SHA1 SHA512 SSDEEP

Submit Download

17c97178-6114-465a-a1c2-ad187f87f220.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\17c97178-6114-465a-a1c2-ad187f87f220.extra
Size 10KB
SHA256 cc7aa257a19864baba4ba8e6a2fce93b3a9d85b40e1cabde240350252a592566
MD5 52016cb28dc6a694eff74e29d2527358
SHA1 53e2618e077e0e2a04feea325274f656a2d25077
SHA512 fb425754fd712811621806cecd1e7ebc103e8b43905bddf862d6efe9cac953bd47854eb489878fc03a8d505c933859e982bf4e821eab0bb383eedfb91b63cdf2
SSDEEP 192:S5DcFQiR4M4DnQYapdVxzPhWBHW4T/fKNtal+GfoDbLgwx:iDcFQiUDI1JWBHW4Tma/ADR
MD5 SHA1 SHA512 SSDEEP

Submit Download

23d5050c-d7bf-48fd-a6b5-c84a3aaf6606.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\23d5050c-d7bf-48fd-a6b5-c84a3aaf6606.dmp
Size 66KB
SHA256 d5698947b334a553ec974716a306f8b2dacea5a2499aa09eccb2e957b5a35b92
MD5 5fa904bc359a895b9386bfbfeeda4954
SHA1 51d4b6d45b7a4c6f2c2271e9e370812ce725a62e
SHA512 ae023c6e8da74316d4f85ee415608557517780e646572793cd4b3c8cbf78842326e67d0c379f9330f1bcecaa9fee6c9c92bc8437477a7843b7744de6e6f6e30f
SSDEEP 768:CdkSPBPnl5jeGpzeSEUvVtN136/J5kfl08W8qrHEG+x7hBKvqsIMs4OxLiO72:+Px3eGoSEItN1q/T6BKvqsIMx
MD5 SHA1 SHA512 SSDEEP

Submit Download

23d5050c-d7bf-48fd-a6b5-c84a3aaf6606.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\23d5050c-d7bf-48fd-a6b5-c84a3aaf6606.extra
Size 1KB
SHA256 82f81be89a41d003fc5a54f2e083c59ad6c0063a9dece8ab3fefe672b81f216d
MD5 a7f3ffd24c4577a85fc0b4acaab8e117
SHA1 b53675c632e92b681e01debdaa9583b39a225e62
SHA512 56436e796abf06e4925469ac2be1502314d4dbf437273de2199d520ff7448346b73efa7d88c042aa0f54abeab474e074d9f52636e68204f7992c1461fd505d82
MD5 SHA1 SHA512

Submit Download

23d5050c-d7bf-48fd-a6b5-c84a3aaf6606.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\23d5050c-d7bf-48fd-a6b5-c84a3aaf6606.extra
Size 3KB
SHA256 fcc739b519ce893b7289d9009d0a69baaa6443112b18f9268f24e7e506eaf09e
MD5 e9e97529843ae4e30986c77fa6e2aa92
SHA1 7a3f3c1954dc3c5574a0476c7ebdad73e113a4f9
SHA512 363858cc9ed497e8609c676a00262577ac84615c57c08287388cfba4012fcffd7c2031017e487a46af7ccb93753fae4a41398467d4116f4340fe6fb95afb33fe
MD5 SHA1 SHA512

Submit Download

31fe89ab-95b8-436a-8821-a45d47b8da4e.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\31fe89ab-95b8-436a-8821-a45d47b8da4e.dmp
Size 66KB
SHA256 cef2a0f16c1f4836d3ead270bd30a917a492a0857d3237baca32bda170f756f7
MD5 eca72488080d44f0f2fcec8b6b657499
SHA1 9d478e9f3c8d3b796cd33349df5f199035c482a3
SHA512 2cc0018c9e404c5bd832dac0f4a341852ae9c7f5f314a49213113773ab572dc619ec8aa7dd6db3a879ced81af9e0a74db1428e48f324356984aaf4aad557bcc9
SSDEEP 768:GZiSMbBNr2DSk0XNf3yFYsx1cY+VtLl08W8qrHEG+x7hBKvqsIMs4OxLiO72:Yir2D0Nf3fsx1WXBKvqsIMx
MD5 SHA1 SHA512 SSDEEP

Submit Download

31fe89ab-95b8-436a-8821-a45d47b8da4e.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\31fe89ab-95b8-436a-8821-a45d47b8da4e.extra
Size 10KB
SHA256 2c3e66aa397726e0374c33fff9fb80c249dd985defd2d4e654c7c24b666c8f54
MD5 671cab55bd35b2e83bb062a13aa469c4
SHA1 d4c29f0dea23aff120ffcbecf1c59a1c9a7f97e4
SHA512 15bacc16e11649431ae12dc2d6952e42ebd16f3bbd4f379b3a1c8fc737e0b8ac7d29f753570f89b2e1657a8dca4fea61a2bae6eb7e2599bdd5c064d38c71a1f2
SSDEEP 96:STWC66TntY6pw6lF29dt40Rh7CsevBb1d0DjMLlIrLlhTLlaXv7aGutILfcBCqwA:S56qpYb/7uvZ8PLsxsP5wlF1foz
MD5 SHA1 SHA512 SSDEEP

Submit Download

31fe89ab-95b8-436a-8821-a45d47b8da4e.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\31fe89ab-95b8-436a-8821-a45d47b8da4e.extra
Size 10KB
SHA256 ec335834bf8bfe68d8739bfe4da67c0d0febbcbb00030502f69140d0c8bfbe09
MD5 e8a6cee8b25212b2f6fc1a2e63fbff4d
SHA1 0497c456e046745058d1b113fd789e2d14328c5d
SHA512 fbfe72d366c4563317346694195a8226d3d196f1c0c23c60d6f692684ab519f278d14f7e66461e7915d30c71efffa6102b4858fec4b5a7c00a168db393e6a00d
SSDEEP 192:S56UcFQiR4M4DnQYapdVxzPhWBHY4T/fKNtald1fofbLgwx:iDcFQiUDI1JWBHY4TmaBAfR
MD5 SHA1 SHA512 SSDEEP

Submit Download

compatibility.ini

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\igxd945v.default-release\compatibility.ini
Size 198B
SHA256 252b7fff962848c61092e82a3d87adca163849767713a93ab533bb397f1f53bb
MD5 ce9ef13caa8a74c25157b184aa038475
SHA1 db03a9935d8bb3ce6b120aca98feade536805160
SHA512 0f6f5053e78167ef5cc5fa70ed3a87dd116df0671a590299277a197341bed983e3d77e37ad2c33cd4afe880fab9ed1c7f7502210040617a01f97a81c1e1d4f29
MD5 SHA1 SHA512

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\igxd945v.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 67fb2ee0e9333d9c7f45a106fde70a9f20ac6a904ab65f60d115fcf60ed138df
MD5 522050359825841f849b8c1fc1cb6d02
SHA1 68a20a92eea0620700d238c6a0bfe5be3179f8c6
SHA512 48fea3aaa6740b2a8735a5d16d70ca04041f07323d81b0d40d23c454470fdcbf071b5d202dd4b7b4f40e2ad67238040083ade6ce5bf5fa8464a524dc5bd8d6dd
SSDEEP 192:iA1/66Joz0dzgCl6mSSdwOv5zboHBZ9jyjoA:i6/66JozQzgC1bJbohZ9jyj
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\igxd945v.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 3c6edbc8f255bb0113af01cd15ec580fbdd4b891ef67bf6818587c8a64ef55df
MD5 0800a31ca615355f4f869c601856226b
SHA1 6159179e98ec80dc81a57beeb51aa3fb2559e53b
SHA512 249bcc2bee4e2103f9917bdc43a82794dc27636ee833542eebb495c6dde62b01b28e142ff316834ff106bbc1bb7ba30bb73ce9d4e3f826e6a9e62d6b4001a065
SSDEEP 192:sOv5zboHBZ9jyjoAEK1/66Joz0dzgCl6mSSdz:PbohZ9jyj60/66JozQzgC1bd
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\igxd945v.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 bc8a4f4b8e453303096dd9c91100f64e806b10a3e6bc4348fd3cceeafc547cd7
MD5 11cd741301047028e6bddecbf7bbaa7d
SHA1 cae059bdc73d50d83d02eb060132c63f99d16500
SHA512 612dd61923a14074ccd1400554d051a7cc6982e7fc70b72360748821d672300b28a86a78dc9e194639c38234bb81ec5393516b61cc337fddeebe1c7fbb4f773b
SSDEEP 192:JP1/66Joz0dzgCl6mSSdwOv5zboHBZ9jyjoA4:Jd/66JozQzgC1bJbohZ9jyjq
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\igxd945v.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 5815b2e972b44d060ac1d7ba8b8164dce7a414d7a887d5374d86e73c347dbd67
MD5 9808975adabeb4a38b7616fbfddd85ed
SHA1 b29677e56db62fd479cdac907b5eb29d906cf3fc
SHA512 ff9143211e2fbd533b30b3e6bd99be805b86fd373a410a03bd96029431af332c77a72e016a581fe4c5e128db1ed474c5214c0df6b8d9f979be03746330d033d3
SSDEEP 192:VOv5zboHBZ9jyjoA3v1/66Joz0dzgCl6mSSdz:KbohZ9jyjx9/66JozQzgC1bd
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\igxd945v.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 f78463a0ca82b909a6adad5eba913040aad9d865c91a0c1a482f1d39239a9dc0
MD5 5bb67e0962be9a7d0070c02119cc69cb
SHA1 964dc323ad87229b9d16770d9aa13c7f8c61df29
SHA512 6f359cfa96ffd946dba393ee2a3098cb6f6135ef2490a90d4da8ad9e1db4cc0ec836407756c68cdca0436b2e34ebad428f336647206c28e2cb656869e087a334
SSDEEP 192:N91/66Joz0dzgCl6mSSdwOv5zboHcJZ9jyjoA4:Nb/66JozQzgC1bJboSZ9jyjq
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\igxd945v.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 41478faacab5df9c5a06f8818590ff085245f4246ddbe28e4ae0e57d6c42888b
MD5 1c2da0504851a40179d37006c5a85b57
SHA1 38ac6cbc5cb0917adf1dcfb1b10c9c413508e711
SHA512 46414a2b704ab1276dab4ddae772f511c6c2d605405f1140b450e7373fdd6e8e36b60ecdd09cde5db31cf4834f87a112376155c342f1221655e3e7afb01a8eae
SSDEEP 192:eOv5zboxJb9jyjoAkp1/66Joz0dzgCl6mSSdz:1boHb9jyjqn/66JozQzgC1bd
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\igxd945v.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 b92ef8027b670f8027823b89e49d2f3404e4db0af4659dc822bbff5bc23ae436
MD5 58cf2056a534e440da699e8645f9b571
SHA1 282d927bc20a75364b68ccccf8dd8cdf0f48ce03
SHA512 dce453895c8c8acaab3e781659eac1eea496d3552863aa45b5b24850cf6dcde5aea6f3be37f543cd42a141c6a259f733a690deae5546d13d6bf871a26761d955
SSDEEP 192:yR1/66Joz0dzgCl6mSSdwOv5zboHcJZ9jyjoA:yP/66JozQzgC1bJboSZ9jyj
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\igxd945v.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 4a4f059a7e36ccb2825e29511c61bfb2264edfb3bc870c9858f52251f675f111
MD5 bca798ea2de0becd16639cdbd09f9dae
SHA1 7e76a947ad5dd5a74a14f39cc198ca4a9f8d1f7b
SHA512 3ee77930501dc1bb95e58ee28eb5ff2b4689e5661ed7a6ce48fba39bbdb293e03ec354f55c0a6904ec20a530e29a437672e095343b00fc7588a63192b6df9a45
SSDEEP 192:sOv5zboHcJZ9jyjoAkE1/66Joz0dzgCl6mSSdz:PboSZ9jyjqO/66JozQzgC1bd
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\igxd945v.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 5fcb58a086d7ff094dd8320543a222faa30f61fe11ad5ef9221da689ab661fd2
MD5 58cf2a7dc1466c3b215e286acb1ff438
SHA1 f6a26f64ac4f4b9a90be55207cb863ebf312b1a5
SHA512 b9d444500e7fa34c8d31f90579fc8245992bb5a2176c728da0b95c7236d6055f67a940eea207efc485ca2fec5f7fb6ff0af89ebd971e501b06c7ea96cfa262fe
SSDEEP 192:LOv5zboIb9jyjoAO1/66Joz0dzgCl6mSSdz:UboIb9jyjW/66JozQzgC1bd
MD5 SHA1 SHA512 SSDEEP

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\igxd945v.default-release\datareporting\glean\events\events
Size 1KB
SHA256 76c2c8b54528c3ee8c3825ca9cdbe355f7ae0327d6d491c2377aedbf7f7f8ef1
MD5 efc78f7b2825dcdec4ed42d17e8966c4
SHA1 a69e4df40b14d36dd64b297d493b0097a716f26b
SHA512 cacf4e4e4c1f970785ef030c1ab637277f3484801fd6f0bea39edce0d5ef892fe53bd3bbb9e6892313ffd77687c7eb1b20ad0f763ba0578c7a29a05c5ee20337
MD5 SHA1 SHA512

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\igxd945v.default-release\datareporting\glean\events\events
Size 1KB
SHA256 f01d5d30a5f7fc8a861ec917c5f61818f74542b5eae4effb8aa71a37ac9a9f50
MD5 b0758bcf90ae1376c11341797c09c790
SHA1 5a3d1a2d43a41cd01a2d9914d3a88fa95efe7f08
SHA512 a19972d13481281b8714701bc4ca8b89f40e76195b4b100646c1637fbafdc3005e4d8575e7dfb6166d338f0d10bd1b0bb9ad6f812caeac8faef3f7ca3a9d4cde
MD5 SHA1 SHA512

Submit Download

03b99963-5532-4081-b03f-edd6cc78d3ec

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\igxd945v.default-release\datareporting\glean\pending_pings\03b99963-5532-4081-b03f-edd6cc78d3ec
Size 3KB
SHA256 580a717952baace145f7a7855510bf82a9b7909d63763db66cf3514cfa1f7ee9
MD5 e23a60859c4106cf8689d127b4c15f67
SHA1 b3e5cf70c368037a6aa679bf15d421abf82dae25
SHA512 c25c3ecae863e9000cb3034eefab3552a9f0cc5b02e9c8ac5fa37e17802fbdced64d83cafa43e1262f954e3363abc77f2b8fc1df9e21b2ade3bf356f7b6aa56b
MD5 SHA1 SHA512

Submit Download

061a742f-742d-4f44-9c46-5830d67f252e

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\igxd945v.default-release\datareporting\glean\pending_pings\061a742f-742d-4f44-9c46-5830d67f252e
Size 3KB
SHA256 ef45df3aa2ab6dcc00d678d7cde3224f510882a46cec10dc45b3788ecf09a705
MD5 c78746776b5fa75b02ce54d23f7402ee
SHA1 e7388a4869e0949b21f69f6be582a00326e7e968
SHA512 575530568ed3f587318a2a8129057e7c42957d952f8955982e362c4ec1a0d3294dc37ea54d216f8b8716ccd909c4a3a946eeeecd3665d875f18826e8e636ce0c
MD5 SHA1 SHA512

Submit Download

26c6479f-ab53-4054-8869-530059d6f4b1

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\igxd945v.default-release\datareporting\glean\pending_pings\26c6479f-ab53-4054-8869-530059d6f4b1
Size 235B
SHA256 7c3bad7592b8a627f8f9cbfa8616a634b22545a76d416ec7b4fb0444afe19d3a
MD5 4d65c82c54741a3b37d34ce9e61ffbab
SHA1 db0170e4b487f3116c9c13cfb4fa210e947cd73b
SHA512 4f62ff6829f3cf104d1d04231c560012fa92223a01e85917c6bfef6a76640dcf5e15c9fc5fa4ed9f268e24755b7796632718e7c0b9075971fd8d9e3c7d3f71f6
MD5 SHA1 SHA512

Submit Download

3091fe03-6414-44b0-bf37-b45d43594e2e

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\igxd945v.default-release\datareporting\glean\pending_pings\3091fe03-6414-44b0-bf37-b45d43594e2e
Size 886B
SHA256 ee6e8abfefec537313ff19cf5357afa7366209f8cd83c4cc6fd875a742a093b2
MD5 ba85b5abed2fe781abf5fd5e26fc99f0
SHA1 cb8172072cbd36c9ce3b7550460a593dd6e2331b
SHA512 d7c06d4045c32e964e0e0f717cfe94aab62b3293a0e0dd8ab88dc61d1ec95aeda8e087f842c5908f301dd9fcad42e96fffcf4636fff14ece602669af1b4a34d2
MD5 SHA1 SHA512

Submit Download

3dfa7507-f052-4d01-bbca-1682c0295acd

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\igxd945v.default-release\datareporting\glean\pending_pings\3dfa7507-f052-4d01-bbca-1682c0295acd
Size 3KB
SHA256 a6f0cef096df02cbebb56c46ea5f24b06b02a44639c6818d4bcf394529807d41
MD5 d8d8536ad897a50e2e6c1f7b15d110ce
SHA1 48ab0983fe4a047da69c9d3795970f16c4a92512
SHA512 8e68a24e28aafe179cb4a917599c76b960b25422245ac29dd7b19edda7ab0f7e2a2e5f0a9a2f4e2c8bccd55763eab53adddf07e26947f1971333337707a18b28
MD5 SHA1 SHA512

Submit Download

3fdb5466-664c-469a-a4b1-8b73d54f7023

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\igxd945v.default-release\datareporting\glean\pending_pings\3fdb5466-664c-469a-a4b1-8b73d54f7023
Size 16KB
SHA256 55627f3a76921869de936ac60132d99a8340b85ffeea7ca805212761e67c7330
MD5 31ecd57036f07ef221e4cde8c7c4b821
SHA1 155d5178cd9883897e5382b002aabd3ab9cc7a92
SHA512 03a11893c4d5ccf0a023ae12da3aff9f6db32dde4ed45cb7ae76b559bfb6b5942bc3f4504d801b0328d9602167e1f249fce82fd3ceafe2dc5f16f388d856c16a
SSDEEP 192:Zv6fEY+ryOmilGfPpZl/GYg5CbBk9MVycK0G9lIpSR0Koq7zeB+ODoosJqNDO19x:4fbQYuOsySR0Koq7yxDoosJqRgJ4O
MD5 SHA1 SHA512 SSDEEP

Submit Download

4b558a0f-7122-4afc-9455-4fa20954fa19

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\igxd945v.default-release\datareporting\glean\pending_pings\4b558a0f-7122-4afc-9455-4fa20954fa19
Size 235B
SHA256 3a202e388d8b28531cd5a760b1af6b1ae33b27ac33d271a644875b6a31d7866c
MD5 d3953e92383fb4b46d3254b4f7521048
SHA1 42b74ff260f93e4f44bc84a318047c64ef395990
SHA512 f2a1e24769309ac909ada74992f11b8867b189466729e148cac27557296a9ee8a71a0fa79c2ed3d4ade26d7c5ade23e81b784653131d9eeaf03527a406dbbef3
MD5 SHA1 SHA512

Submit Download

4f064853-a5bb-4c98-8e40-887365484561

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\igxd945v.default-release\datareporting\glean\pending_pings\4f064853-a5bb-4c98-8e40-887365484561
Size 3KB
SHA256 1b854a011aaaf75b61cb81c6995fcda33eed848416a69d45ac5e18da5f839db8
MD5 2e007b87621508075d53dd74f07b7447
SHA1 08539f81efc9c44fe042f8ce3defb4ed77c33a2a
SHA512 34fdac7230f8004a7ea6b35d692908a414c6b4fa8ec917395798d9ef3601e6ed3ccd01560bfc29fefe46a0bd76ef3bce5ae89068c23127ae49729354cc08b464
MD5 SHA1 SHA512

Submit Download

50888b6c-6594-4d66-984f-2a62624697b1

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\igxd945v.default-release\datareporting\glean\pending_pings\50888b6c-6594-4d66-984f-2a62624697b1
Size 3KB
SHA256 701d4621f7f18d1ca5730d95eeb875f677d4d940087f9166f462de8c3272d622
MD5 2c5b840e505932ccbf5ab40fcc2cf2fd
SHA1 6b7f091214743a6b85924380b7824c20edf8c1e5
SHA512 53a8582460fbcf52be72ce2fdda6211e8e55473e35f9ef523346d526ed67cfb7ae2a1a97e91ae02d71b2890d4341007154ad7ef2a650b99f2c3ece80da640b53
MD5 SHA1 SHA512

Submit Download

574a4a61-85f9-4ac7-ae96-1a5138b12d62

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\igxd945v.default-release\datareporting\glean\pending_pings\574a4a61-85f9-4ac7-ae96-1a5138b12d62
Size 235B
SHA256 60b36b22f2a871f9252b3fa277ed87b5759d23d422557bb0189119a43e464e1c
MD5 5141ec1e30aebf81f03e27d24bb723a4
SHA1 14e0c1e6fbc15c646c042e7da95242cc4910b52d
SHA512 728bb7bab3b67aa15709c929dc2daf8905199180bd7d382512080b06ac652169b594f6e584b91396422e0ce21354aad81788600b77b1a6505240cc7e62e1d30f
MD5 SHA1 SHA512

Submit Download

7c88651a-40e0-4f25-8608-d0f309f42c13

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\igxd945v.default-release\datareporting\glean\pending_pings\7c88651a-40e0-4f25-8608-d0f309f42c13
Size 2KB
SHA256 73618b93efb792c19fb037523b232172835faebd8c943ba4c3d054f3a29bf7c9
MD5 339025ba045eca32a2b5079a084ca9f3
SHA1 7fad9beb0b837afee52a338d4df849b3cc7f00a0
SHA512 02cc6b4397720bf5b503adf4f714a652f46769cd48e8b14a7c1b093e7385c0bd9bbdefe26a5ecb2cf3ae0b79a66a3c039cc20ebff00715bf15894c4c04491a9b
MD5 SHA1 SHA512

Submit Download

94c36e0c-b1e3-4575-9a18-c791277026d4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\igxd945v.default-release\datareporting\glean\pending_pings\94c36e0c-b1e3-4575-9a18-c791277026d4
Size 886B
SHA256 547292f5cfb9a0ae99f96c1e7e47cfc12cd6d400e68e3ff8f0dfdb4d76d3dfbf
MD5 c0d41905baff421c358eaf572fe65f6b
SHA1 6a3bd991e8a3e9c393d07a7a3b286ea9869e0f04
SHA512 f63f82e9ee77eacbc98cf154501824ac01780efe543be1b673fdfb2dcffbe21fbfc7f452f8d46061f3f98ec65e7ed54cb7c19c317d6e5b1ba0dbaf0b4fb552ea
MD5 SHA1 SHA512

Submit Download

9de764ab-fa3e-4912-9136-372295cd672c

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\igxd945v.default-release\datareporting\glean\pending_pings\9de764ab-fa3e-4912-9136-372295cd672c
Size 871B
SHA256 dcb40efa93805785c5a4e39a197ccd44337bff91fab97649f42e7a7dfcb8bbe6
MD5 40becbc1cbcec8db14a3c62e8a169420
SHA1 92193ee28502c934e9e1e77418d53a1f382df559
SHA512 acc3ba0af46d15c7ef2f4df519a05738cecbafc5979407338d112b03fb9488f963fca04a52f87ce13f636baf0351ca58e6e413f585ab01037e0981dc51f94c7e
MD5 SHA1 SHA512

Submit Download

a346b6b2-8604-4340-944a-7c68dcb71a98

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\igxd945v.default-release\datareporting\glean\pending_pings\a346b6b2-8604-4340-944a-7c68dcb71a98
Size 3KB
SHA256 1416ae0a079dbd6f5770258476a008c3b02821ca6527c6704cc01bd40f7b5795
MD5 a2c012b96fb767db53466aacc3c26231
SHA1 e7e2f7572fa353a968fb657cca9565a78bafeddf
SHA512 2fdd023a30c44ded76553f1d92b49d81a3d4923cb3b08271e05ee5fc62859a81a6ae417aaedeefd2e092a062b626a2be6c3ca259c870f17b2f58115b626d57e7
MD5 SHA1 SHA512

Submit Download

bb524add-8222-4fbd-874e-1df148a4d3bd

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\igxd945v.default-release\datareporting\glean\pending_pings\bb524add-8222-4fbd-874e-1df148a4d3bd
Size 3KB
SHA256 2445b9470213b4689597cc503bceb5a5719021c2a181ac58026c8933d8b5f3aa
MD5 a21a4c683c5122b671732bd1fcf31bea
SHA1 76d9da1bae6347874b4917d3af6259ebccf80fd7
SHA512 4d79b5b8a4fcaf6970d689819b6b5f73bed232863254a7f2cf48eb31d7446274e6fc07e7e5cbb656cf0f9688c42ca366c262e51d493252a5b9f15e2626f09668
MD5 SHA1 SHA512

Submit Download

c314aed3-3f5a-4099-b556-14ec743151ff

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\igxd945v.default-release\datareporting\glean\pending_pings\c314aed3-3f5a-4099-b556-14ec743151ff
Size 3KB
SHA256 b537256782d4de70b520e43e4ff44099abfb2b9e4422e22a2521f5660f934e6e
MD5 c178d7b3a212e0aca12efe70faedfe1b
SHA1 0655ff48e5cde50f23bb03fdaf52367900828055
SHA512 b5b307136809bd991b9e10c2115eef887a0fa182f915bfd20e692046d372ac3260a1714c345f9e68bd50e7c9d4c3c3c93954bc5b4f47f6cc128b96c804a05dae
MD5 SHA1 SHA512

Submit Download

cd5871f2-17b3-4afe-8504-7d103933f1e3

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\igxd945v.default-release\datareporting\glean\pending_pings\cd5871f2-17b3-4afe-8504-7d103933f1e3
Size 235B
SHA256 779fc3f6bfc82ccbb137df6d3a3b118b4e1e7fc0cbfe9d62e0d982ec996828c7
MD5 b156f89f4a842b4bdec80d5052fdfc2e
SHA1 df80824e172f4fffa8b5c1413b0a5bf4d6b316b7
SHA512 28dc33378f022c8820cad3ed0384d7e6840c6b2ec5f08b6c1ccbf1a26a5cf4af8aca9d0f174529d1455afe57a111580230f6e7c338e81d7cc5ab7c530486a4a8
MD5 SHA1 SHA512

Submit Download

ed0e1968-4fff-47bb-9c7b-a77d834c3e82

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\igxd945v.default-release\datareporting\glean\pending_pings\ed0e1968-4fff-47bb-9c7b-a77d834c3e82
Size 883B
SHA256 10a77d97f4f0273f30abcf541ab32d152f45fd97893c5c1d7a2202ec6fddc1b2
MD5 912e5f175a4893b7de2d4cdda3341089
SHA1 29f1bd3468b4e9843ac80ad163f98286234f0690
SHA512 291d7af3ebec65836602476813be0a620b466022a31d3b86ac341b94349afc3ed94168f9062578c2ca9cbf34ec9b4260a4d0f8d98127bf2a8c8de0ed5a5f2c0b
MD5 SHA1 SHA512

Submit Download

fd7f71f6-7777-4cee-84bb-0647243f67fa

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\igxd945v.default-release\datareporting\glean\pending_pings\fd7f71f6-7777-4cee-84bb-0647243f67fa
Size 2KB
SHA256 b65a6b92d2eb5d4e03cc656e985e518ce03f19c4be9e62e4dd602c3867b6fc97
MD5 22fd7b071109d13e15d23a4199587b06
SHA1 5b335167f5f32a26ac9416c1d6f0dd3644c5f53f
SHA512 03de85724132cf0e1994c02e0e66286d597268740e89a4f85e4ddfd386ee3b3f1a61cdcab9dbfbd928eb137422ff41fb92f92f8b3aa60af7a2c1a547ef40d424
MD5 SHA1 SHA512

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\igxd945v.default-release\prefs-1.js
Size 6KB
SHA256 0dd3178aab204c051a917f5189375714a4c7e270e83ccf0e9d4cd4eb5923aac9
MD5 bc87da95d45e186e6bb0a06b304c2ba8
SHA1 f39369358130c2bae2e20a11f0a5aa694587a9c9
SHA512 3e79a70bc82c46c4f9d78a26cab8a38a7b51f32c29e0d1cdb5e14a857a5e48b19fdb7d683f5a7426c0d167d71bb06b11bfc396474dd5649826f87990e8f5bd15
SSDEEP 96:xHKUTUMqGqgfpKCnwl1zSupSSlhdv9jL5nKyHYmy9Bw88H8L4cnjw7:wfRgfp1KLpSSw8Ymy9Bw88N
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\igxd945v.default-release\prefs-1.js
Size 6KB
SHA256 c1144b7afe0329f63d30803478f0228bd2a6ce4fd9b6731250e9713ca048c6e5
MD5 6e9a551d43bfd473af970f9849311438
SHA1 f5ddb82a57680cd21c7570e1b8cd02e86925bc3b
SHA512 c47b07d19a65a044f8206d5ab124d219a64be5ae5250dc0c85da600eb90b1fa0a7dec6583cb672e34e11d1ec087bdf929f9c2daac84ded3f9dc5fc86fbebae65
SSDEEP 96:xHKUTUMqGqgfpKCnwl1zSu9SSlhdv9jFnKyHYmy9Bw88H8L4cnjNf7:wfRgfp1K39SSo8Ymy9Bw88A
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\igxd945v.default-release\prefs.js
Size 6KB
SHA256 2ec91facd5605afb60c28bc5f5a184024dd15c776608d43e7b00422973d3ebb3
MD5 4774eb19efd2035379f3b56215853bc3
SHA1 24527864d479b81a97ac6ede7abffa7fa39bcb7e
SHA512 8cb46faa653aebf64d7b56f7056b3c15d320d94c1105bc56f3b21d4617eb3b70e03b6ca33119be45eddab6d06e9d5b05766a018e98c661a12175dd20e446255a
SSDEEP 96:xHKUTUMqGqgfpKonj1zSNZYZSSlhdv9j7nKyHYmy9Bw88H8L4cnjw7:wfRgfpzj+ZYZSSS8Ymy9Bw88N
MD5 SHA1 SHA512 SSDEEP

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\igxd945v.default-release\sessionCheckpoints.json
Size 53B
SHA256 792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da
MD5 ea8b62857dfdbd3d0be7d7e4a954ec9a
SHA1 b43bc4b3ea206a02ef8f63d5bfad0c96bf2a3b2a
SHA512 076ee83534f42563046d25086166f82e1a3ec61840c113aec67abe2d8195daa247d827d0c54e7e8f8a1bbf2d082a3763577587e84342ec160ff97905243e6d19
MD5 SHA1 SHA512

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\igxd945v.default-release\sessionCheckpoints.json
Size 90B
SHA256 00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2
MD5 c4ab2ee59ca41b6d6a6ea911f35bdc00
SHA1 5942cd6505fc8a9daba403b082067e1cdefdfbc4
SHA512 71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2
MD5 SHA1 SHA512

Submit Download

dpnhupnp.dll

Path C:\Windows\System32\Container\dpnhupnp.dll
Size 28KB
SHA256 5cf4a8d9233ae1033788efe8f1296ffe64a314e1c38ccca33fbcbad8f3db4a7f
MD5 e750ca03b67b1b50dace1875cff645d6
SHA1 bfcb9780a6357e53c414d96d56291c4eba67cd88
SHA512 e735db461bb583ef07f4a5c69c6b38cb4a6d5782cda587ba55ad3ccd49a048e29cf3dac53824db4c48ae95760b5fe8e841f5fb6430e5f6261d6a9ccf4bc6c318
SSDEEP 96:rel2VLEi2Q46yNk59Mv8mVsY7YazvZ5DsmMWr7b5GEWquWw:ryPyyNk5GzXYSvDxr75WquW
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1544-1904-0x0000020493C60000-0x0000020493C6C000-memory.dmp

Download

memory/3688-2382-0x0000000000B70000-0x0000000000C70000-memory.dmp

Download

memory/3688-2332-0x0000000000B70000-0x0000000000C70000-memory.dmp

Download

memory/3688-2347-0x0000000005BF0000-0x0000000005CF0000-memory.dmp

Download

memory/3688-2365-0x0000000000B70000-0x0000000000C70000-memory.dmp

Download

memory/3688-2366-0x0000000005BF0000-0x0000000005CF0000-memory.dmp

Download

memory/3688-2367-0x0000000005BF0000-0x0000000005CF0000-memory.dmp

Download

memory/3688-2368-0x0000000000B70000-0x0000000000C70000-memory.dmp

Download

memory/3688-2369-0x0000000005BF0000-0x0000000005CF0000-memory.dmp

Download

memory/3688-2370-0x0000000000B70000-0x0000000000C70000-memory.dmp

Download

memory/3688-2372-0x0000000005BF0000-0x0000000005CF0000-memory.dmp

Download

memory/3688-2373-0x0000000000B70000-0x0000000000C70000-memory.dmp

Download

memory/3688-2379-0x0000000000B70000-0x0000000000C70000-memory.dmp

Download

memory/3688-2380-0x0000000000B70000-0x0000000000C70000-memory.dmp

Download

memory/3688-2381-0x0000000005BF0000-0x0000000005CF0000-memory.dmp

Download

memory/3688-2436-0x0000000005BF0000-0x0000000005CF0000-memory.dmp

Download

memory/3688-2437-0x0000000000B70000-0x0000000000C70000-memory.dmp

Download

memory/3688-2438-0x0000000000B70000-0x0000000000C70000-memory.dmp

Download

memory/3688-2565-0x0000000000B70000-0x0000000000C70000-memory.dmp

Download

memory/3688-2566-0x0000000000B70000-0x0000000000C70000-memory.dmp

Download

memory/3688-2728-0x0000000005BF0000-0x0000000005CF0000-memory.dmp

Download

memory/3688-2729-0x0000000000B70000-0x0000000000C70000-memory.dmp

Download

memory/3688-2730-0x0000000005BF0000-0x0000000005CF0000-memory.dmp

Download

memory/3688-2731-0x0000000000B70000-0x0000000000C70000-memory.dmp

Download

memory/3688-2732-0x0000000000B70000-0x0000000000C70000-memory.dmp

Download

memory/3688-2733-0x0000000005BF0000-0x0000000005CF0000-memory.dmp

Download

memory/3688-2734-0x0000000000B70000-0x0000000000C70000-memory.dmp

Download

memory/3688-2736-0x0000000000B70000-0x0000000000C70000-memory.dmp

Download

memory/3688-2741-0x0000000000B70000-0x0000000000C70000-memory.dmp

Download

memory/3688-2742-0x0000000000B70000-0x0000000000C70000-memory.dmp

Download

memory/3688-2744-0x0000000005BF0000-0x0000000005CF0000-memory.dmp

Download

memory/3688-2745-0x0000000000B70000-0x0000000000C70000-memory.dmp

Download

memory/3688-2750-0x0000000005BF0000-0x0000000005CF0000-memory.dmp

Download

memory/3688-2751-0x0000000000B70000-0x0000000000C70000-memory.dmp

Download

memory/3688-2752-0x0000000000B70000-0x0000000000C70000-memory.dmp

Download

memory/3688-2753-0x0000000005BF0000-0x0000000005CF0000-memory.dmp

Download

memory/3688-2754-0x0000000000B70000-0x0000000000C70000-memory.dmp

Download

memory/3688-2760-0x0000000005BF0000-0x0000000005CF0000-memory.dmp

Download

memory/3688-2761-0x0000000005BF0000-0x0000000005CF0000-memory.dmp

Download

memory/3688-2762-0x0000000000B70000-0x0000000000C70000-memory.dmp

Download

memory/3688-2763-0x0000000000B70000-0x0000000000C70000-memory.dmp

Download

memory/3688-2755-0x0000000000B70000-0x0000000000C70000-memory.dmp

Download

memory/3688-2746-0x0000000000B70000-0x0000000000C70000-memory.dmp

Download

memory/3688-2735-0x0000000000B70000-0x0000000000C70000-memory.dmp

Download

memory/3688-2567-0x0000000005BF0000-0x0000000005CF0000-memory.dmp

Download

memory/3688-2568-0x0000000000B70000-0x0000000000C70000-memory.dmp

Download

memory/3688-2569-0x0000000000B70000-0x0000000000C70000-memory.dmp

Download

memory/3688-2570-0x0000000000B70000-0x0000000000C70000-memory.dmp

Download

memory/3688-2571-0x0000000000B70000-0x0000000000C70000-memory.dmp

Download

memory/3688-2575-0x0000000005BF0000-0x0000000005CF0000-memory.dmp

Download

memory/3688-2572-0x0000000005BF0000-0x0000000005CF0000-memory.dmp

Download

memory/3688-2439-0x0000000005BF0000-0x0000000005CF0000-memory.dmp

Download

memory/3688-2443-0x0000000000B70000-0x0000000000C70000-memory.dmp

Download

memory/3688-2444-0x0000000005BF0000-0x0000000005CF0000-memory.dmp

Download

memory/3688-2440-0x0000000000B70000-0x0000000000C70000-memory.dmp

Download

memory/3688-0-0x0000000000800000-0x00000000008BE000-memory.dmp

Download

memory/3688-2383-0x0000000000B70000-0x0000000000C70000-memory.dmp

Download

memory/3688-2374-0x0000000000B70000-0x0000000000C70000-memory.dmp

Download

memory/3688-2371-0x0000000000B70000-0x0000000000C70000-memory.dmp

Download

memory/3688-2350-0x0000000000B70000-0x0000000000C70000-memory.dmp

Download

memory/3688-2353-0x0000000000B70000-0x0000000000C70000-memory.dmp

Download

memory/3688-2355-0x0000000005BF0000-0x0000000005CF0000-memory.dmp

Download

memory/3688-2351-0x0000000000B70000-0x0000000000C70000-memory.dmp

Download

memory/3688-2352-0x0000000005BF0000-0x0000000005CF0000-memory.dmp

Download

memory/3688-2341-0x0000000000B70000-0x0000000000C70000-memory.dmp

Download

memory/3688-2342-0x0000000000B70000-0x0000000000C70000-memory.dmp

Download

memory/3688-2335-0x0000000000B70000-0x0000000000C70000-memory.dmp

Download

memory/3688-2326-0x0000000005BF0000-0x0000000005CF0000-memory.dmp

Download

memory/3688-2328-0x0000000000B70000-0x0000000000C70000-memory.dmp

Download

memory/3688-2327-0x0000000000B70000-0x0000000000C70000-memory.dmp

Download

memory/3688-2318-0x0000000005BF0000-0x0000000005CF0000-memory.dmp

Download

memory/3688-2089-0x0000000005BF0000-0x0000000005CF0000-memory.dmp

Download

memory/3688-2090-0x0000000000B70000-0x0000000000C70000-memory.dmp

Download

memory/3688-2091-0x0000000000B70000-0x0000000000C70000-memory.dmp

Download

memory/3688-2092-0x0000000000B70000-0x0000000000C70000-memory.dmp

Download

memory/3688-2093-0x0000000000B70000-0x0000000000C70000-memory.dmp

Download

memory/3688-2080-0x0000000000B70000-0x0000000000C70000-memory.dmp

Download

memory/3688-2081-0x0000000000B70000-0x0000000000C70000-memory.dmp

Download

memory/3688-2074-0x0000000000B70000-0x0000000000C70000-memory.dmp

Download

memory/3688-2078-0x0000000005BF0000-0x0000000005CF0000-memory.dmp

Download

memory/3688-2075-0x0000000000B70000-0x0000000000C70000-memory.dmp

Download

memory/3688-1974-0x0000000005BF0000-0x0000000005CF0000-memory.dmp

Download

memory/3688-1927-0x0000000000B70000-0x0000000000C70000-memory.dmp

Download

memory/3688-1929-0x0000000000B70000-0x0000000000C70000-memory.dmp

Download

memory/3688-1930-0x0000000004EA0000-0x0000000004EB0000-memory.dmp

Download

memory/3688-1922-0x0000000005BF0000-0x0000000005CF0000-memory.dmp

Download

memory/3688-1880-0x0000000000B70000-0x0000000000C70000-memory.dmp

Download

memory/3688-1881-0x0000000000B70000-0x0000000000C70000-memory.dmp

Download

memory/3688-1649-0x00000000053C0000-0x00000000053DE000-memory.dmp

Download

memory/3688-1550-0x0000000006680000-0x0000000006BAC000-memory.dmp

Download

memory/3688-1533-0x0000000005EB0000-0x0000000005F00000-memory.dmp

Download

memory/3688-1531-0x0000000005E30000-0x0000000005EA6000-memory.dmp

Download

memory/3688-1527-0x0000000005F80000-0x0000000006142000-memory.dmp

Download

memory/3688-1100-0x0000000005CF0000-0x0000000005DA2000-memory.dmp

Download

memory/3688-171-0x0000000005B80000-0x0000000005BE6000-memory.dmp

Download

memory/3688-151-0x0000000004EA0000-0x0000000004EB0000-memory.dmp

Download

memory/3688-114-0x0000000005460000-0x0000000005A06000-memory.dmp

Download