phantomstealer | 095dd3ed90661edc100fd8fbaabcfe0b855b308c51df390bb666622368a2c095

Analysis

max time kernel
99s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20251016-en
resource tags

arch:x64arch:x86image:win10v2004-20251016-enlocale:en-usos:windows10-2004-x64system
submitted
31/10/2025, 17:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
_095dd3ed90661edc100fd8fbaabcfe0b855b308c51df390bb666622368a2c095.js
Size 1013KB
Sample251031-vj2fca1jht
SHA256 095dd3ed90661edc100fd8fbaabcfe0b855b308c51df390bb666622368a2c095
MD5 01d50097956726966151f342e7b55471
SHA1 2742082bde0127e0427612cd63bc48c5563b8a82
SHA512 66463470ed571554c8ab616b0fca82fb2b80d617537884d92a12e4295dca53f17568ef0ce2be68c429ffaec0bc383eb3ec19acb6b822fc98795d846e12126f10
SSDEEP 6144:CfYcJfYF6f+fYR2226fYA2222222226l226fB226fYcB22222226fYO226fY+22B:qgPF
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

adware discovery execution phantomstealer persistence spyware

Malware Config

Extracted

Family

phantomstealer

Version

v3.5.0

https://api.telegram.org/bot8458785334:AAGBvJVivkLeP9vHbvOWzZxBtCUpCFVEdvs/sendMessage?chat_id=1934716051

Mutex

O2HTXNUBRZ5JIT6443GD

Attributes

anti_analysis
0
cb_enables_ssl
0
debug
0
keylogger
1
start_delay
1
startup
1

Signatures

Phantomstealer family
phantomstealer

Badlisted process makes network request 7 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
4	2316	wscript.exe
25	6008	powershell.exe
27	6008	powershell.exe
40	992	msiexec.exe
42	992	msiexec.exe
44	992	msiexec.exe
46	992	msiexec.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-389786158-2176552546-1679795138-1000\Control Panel\International\Geo\Nation	wscript.exe

Executes dropped EXE 1 IoCs

pid	Process
1360	msiexec.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-389786158-2176552546-1679795138-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\msiexec = "C:\\Users\\Admin\\AppData\\Roaming\\msiexec.exe"	msiexec.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	explorer.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
25	drive.google.com
40	drive.google.com
24	drive.google.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
386	icanhazip.com

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
992	msiexec.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2164	powershell.exe
992	msiexec.exe

Drops file in Program Files directory 16 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\msedge_installer.log	setup.exe
File opened for modification	C:\Program Files\MsEdgeCrashpad\settings.dat	setup.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\24593ded-e09c-4f4f-85d9-c26019aa57f0.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\4808_13406403797854207_4808.pma	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\760_13406403797922049_760.pma	setup.exe
File opened for modification	C:\Program Files\MsEdgeCrashpad\settings.dat	setup.exe
File opened for modification	C:\Program Files\MsEdgeCrashpad\metadata	setup.exe
File opened for modification	C:\Program Files\MsEdgeCrashpad\settings.dat	setup.exe
File opened for modification	C:\Program Files\MsEdgeCrashpad\settings.dat	setup.exe
File opened for modification	C:\Program Files\MsEdgeCrashpad\metadata	setup.exe
File opened for modification	C:\Program Files\MsEdgeCrashpad\throttle_store.dat	setup.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\0f7bfeaa-3881-49d1-bcdc-8390047adeee.tmp	setup.exe
File opened for modification	C:\Program Files\MsEdgeCrashpad\throttle_store.dat	setup.exe
File opened for modification	C:\Program Files\MsEdgeCrashpad\throttle_store.dat	setup.exe
File opened for modification	C:\Program Files\msedge_installer.log	setup.exe
File opened for modification	C:\Program Files\MsEdgeCrashpad\throttle_store.dat	setup.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe

Checks processor information in registry 2 TTPs 32 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-389786158-2176552546-1679795138-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-389786158-2176552546-1679795138-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-389786158-2176552546-1679795138-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-389786158-2176552546-1679795138-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134064037978523554"	msedge.exe

Modifies registry class 25 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-389786158-2176552546-1679795138-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-389786158-2176552546-1679795138-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-389786158-2176552546-1679795138-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-389786158-2176552546-1679795138-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-389786158-2176552546-1679795138-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-389786158-2176552546-1679795138-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents"	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-389786158-2176552546-1679795138-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-389786158-2176552546-1679795138-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-389786158-2176552546-1679795138-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e80922b16d365937a46956b92703aca08af0000	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-389786158-2176552546-1679795138-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-389786158-2176552546-1679795138-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-389786158-2176552546-1679795138-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-389786158-2176552546-1679795138-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-389786158-2176552546-1679795138-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-389786158-2176552546-1679795138-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-389786158-2176552546-1679795138-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-389786158-2176552546-1679795138-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-389786158-2176552546-1679795138-1000\{C221CF1B-4A55-453D-AAC7-C9034BCD0403}	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-389786158-2176552546-1679795138-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-389786158-2176552546-1679795138-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-389786158-2176552546-1679795138-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-389786158-2176552546-1679795138-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	explorer.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4268	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
6008	powershell.exe
6008	powershell.exe
2164	powershell.exe
2164	powershell.exe
2164	powershell.exe
992	msiexec.exe
992	msiexec.exe
992	msiexec.exe
3592	chrome.exe
3592	chrome.exe
992	msiexec.exe
992	msiexec.exe
992	msiexec.exe
992	msiexec.exe
992	msiexec.exe
992	msiexec.exe
992	msiexec.exe
992	msiexec.exe
992	msiexec.exe
4112	firefox.exe
4112	firefox.exe
4112	firefox.exe
4112	firefox.exe
4112	firefox.exe
4112	firefox.exe
4112	firefox.exe
4112	firefox.exe
4112	firefox.exe
4112	firefox.exe
4112	firefox.exe
4112	firefox.exe
4112	firefox.exe
4112	firefox.exe
4112	firefox.exe
4112	firefox.exe
4112	firefox.exe
4112	firefox.exe
4112	firefox.exe
4112	firefox.exe
992	msiexec.exe
992	msiexec.exe
992	msiexec.exe
992	msiexec.exe
992	msiexec.exe
992	msiexec.exe
992	msiexec.exe
992	msiexec.exe
992	msiexec.exe
992	msiexec.exe
992	msiexec.exe
992	msiexec.exe
992	msiexec.exe
992	msiexec.exe
992	msiexec.exe
992	msiexec.exe
992	msiexec.exe
992	msiexec.exe
992	msiexec.exe
992	msiexec.exe
5004	firefox.exe
5004	firefox.exe
5004	firefox.exe
5004	firefox.exe
5004	firefox.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2164	powershell.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	6008	powershell.exe
Token: SeDebugPrivilege	2164	powershell.exe
Token: SeDebugPrivilege	992	msiexec.exe
Token: SeShutdownPrivilege	3592	chrome.exe
Token: SeCreatePagefilePrivilege	3592	chrome.exe
Token: SeShutdownPrivilege	3592	chrome.exe
Token: SeCreatePagefilePrivilege	3592	chrome.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
3592	chrome.exe
3592	chrome.exe
4112	firefox.exe
4112	firefox.exe
4112	firefox.exe
4112	firefox.exe
4112	firefox.exe
4112	firefox.exe
4112	firefox.exe
4112	firefox.exe
4112	firefox.exe
4112	firefox.exe
4112	firefox.exe
4112	firefox.exe
4112	firefox.exe
4112	firefox.exe
4112	firefox.exe
4112	firefox.exe
4112	firefox.exe
4112	firefox.exe
4112	firefox.exe
4112	firefox.exe
2364	msedge.exe
1060	msedge.exe
5004	firefox.exe
5004	firefox.exe
5004	firefox.exe
5004	firefox.exe
5004	firefox.exe
5004	firefox.exe
5004	firefox.exe
5004	firefox.exe
5004	firefox.exe
5004	firefox.exe
5004	firefox.exe
5004	firefox.exe
5004	firefox.exe
5004	firefox.exe
5004	firefox.exe
5004	firefox.exe
5004	firefox.exe
5004	firefox.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4268	explorer.exe
4268	explorer.exe
4112	firefox.exe
5004	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2316 wrote to memory of 448	2316	wscript.exe	92
PID 2316 wrote to memory of 448	2316	wscript.exe	92
PID 4268 wrote to memory of 6008	4268	explorer.exe	95
PID 4268 wrote to memory of 6008	4268	explorer.exe	95
PID 2164 wrote to memory of 992	2164	powershell.exe	101
PID 2164 wrote to memory of 992	2164	powershell.exe	101
PID 2164 wrote to memory of 992	2164	powershell.exe	101
PID 2164 wrote to memory of 992	2164	powershell.exe	101
PID 992 wrote to memory of 3592	992	msiexec.exe	107
PID 992 wrote to memory of 3592	992	msiexec.exe	107
PID 3592 wrote to memory of 3828	3592	chrome.exe	108
PID 3592 wrote to memory of 3828	3592	chrome.exe	108
PID 3592 wrote to memory of 5444	3592	chrome.exe	109
PID 3592 wrote to memory of 5444	3592	chrome.exe	109
PID 3592 wrote to memory of 5424	3592	chrome.exe	110
PID 3592 wrote to memory of 5424	3592	chrome.exe	110
PID 3592 wrote to memory of 4948	3592	chrome.exe	111
PID 3592 wrote to memory of 4948	3592	chrome.exe	111
PID 3592 wrote to memory of 396	3592	chrome.exe	112
PID 3592 wrote to memory of 396	3592	chrome.exe	112
PID 3592 wrote to memory of 4032	3592	chrome.exe	113
PID 3592 wrote to memory of 4032	3592	chrome.exe	113
PID 3592 wrote to memory of 2360	3592	chrome.exe	114
PID 3592 wrote to memory of 2360	3592	chrome.exe	114
PID 3592 wrote to memory of 5388	3592	chrome.exe	115
PID 3592 wrote to memory of 5388	3592	chrome.exe	115
PID 3592 wrote to memory of 1884	3592	chrome.exe	116
PID 3592 wrote to memory of 1884	3592	chrome.exe	116
PID 3592 wrote to memory of 3900	3592	chrome.exe	117
PID 3592 wrote to memory of 3900	3592	chrome.exe	117
PID 3592 wrote to memory of 556	3592	chrome.exe	118
PID 3592 wrote to memory of 556	3592	chrome.exe	118
PID 992 wrote to memory of 5444	992	msiexec.exe	109
PID 992 wrote to memory of 5444	992	msiexec.exe	109
PID 992 wrote to memory of 5424	992	msiexec.exe	110
PID 992 wrote to memory of 5424	992	msiexec.exe	110
PID 992 wrote to memory of 3592	992	msiexec.exe	107
PID 992 wrote to memory of 3592	992	msiexec.exe	107
PID 992 wrote to memory of 4948	992	msiexec.exe	111
PID 992 wrote to memory of 4948	992	msiexec.exe	111
PID 992 wrote to memory of 3828	992	msiexec.exe	108
PID 992 wrote to memory of 3828	992	msiexec.exe	108
PID 3592 wrote to memory of 5896	3592	chrome.exe	119
PID 3592 wrote to memory of 5896	3592	chrome.exe	119
PID 3592 wrote to memory of 1048	3592	chrome.exe	120
PID 3592 wrote to memory of 1048	3592	chrome.exe	120
PID 992 wrote to memory of 5388	992	msiexec.exe	115
PID 992 wrote to memory of 5388	992	msiexec.exe	115
PID 992 wrote to memory of 3900	992	msiexec.exe	117
PID 992 wrote to memory of 3900	992	msiexec.exe	117
PID 3592 wrote to memory of 3236	3592	chrome.exe	121
PID 3592 wrote to memory of 3236	3592	chrome.exe	121
PID 992 wrote to memory of 5444	992	msiexec.exe	109
PID 992 wrote to memory of 5444	992	msiexec.exe	109
PID 992 wrote to memory of 5424	992	msiexec.exe	110
PID 992 wrote to memory of 5424	992	msiexec.exe	110
PID 992 wrote to memory of 4032	992	msiexec.exe	113
PID 992 wrote to memory of 4032	992	msiexec.exe	113
PID 992 wrote to memory of 1884	992	msiexec.exe	116
PID 992 wrote to memory of 1884	992	msiexec.exe	116
PID 992 wrote to memory of 556	992	msiexec.exe	118
PID 992 wrote to memory of 556	992	msiexec.exe	118
PID 992 wrote to memory of 3592	992	msiexec.exe	107
PID 992 wrote to memory of 3592	992	msiexec.exe	107

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\_095dd3ed90661edc100fd8fbaabcfe0b855b308c51df390bb666622368a2c095.js
1⤵
- Badlisted process makes network request
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2316
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe" B:windowssystem32cmd.exe
  2⤵
  - Enumerates connected drives
  PID:448

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4268
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Recr=$env:appdata+'\Tich';$Grig=gc $Recr;$Shirtysepa=$Grig[4908..4910] -join '';.($Shirtysepa) $Grig"
  2⤵
  - Badlisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:6008

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "$Recr=$env:appdata+'\Tich';$Grig=gc $Recr;$Shirtysepa=$Grig[4908..4910] -join '';.($Shirtysepa) $Grig"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2164
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\SysWOW64\msiexec.exe"
  2⤵
  - Badlisted process makes network request
  - Adds Run key to start application
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:992
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\3oh12umi.csm"
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3592
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\3oh12umi.csm /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\3oh12umi.csm\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\3oh12umi.csm --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff9ace2dcf8,0x7ff9ace2dd04,0x7ff9ace2dd10
      4⤵
      PID:3828
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\3oh12umi.csm" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=1876,i,16329328291290275984,2739253088112445686,262144 --variations-seed-version --mojo-platform-channel-handle=1872 /prefetch:2
      4⤵
      PID:5444
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\3oh12umi.csm" --field-trial-handle=1984,i,16329328291290275984,2739253088112445686,262144 --variations-seed-version --mojo-platform-channel-handle=2060 /prefetch:3
      4⤵
      PID:5424
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\3oh12umi.csm" --field-trial-handle=2156,i,16329328291290275984,2739253088112445686,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:8
      4⤵
      PID:4948
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\3oh12umi.csm" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=2872,i,16329328291290275984,2739253088112445686,262144 --variations-seed-version --mojo-platform-channel-handle=2936 /prefetch:1
      4⤵
      PID:396
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\3oh12umi.csm" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=2880,i,16329328291290275984,2739253088112445686,262144 --variations-seed-version --mojo-platform-channel-handle=2940 /prefetch:1
      4⤵
      PID:4032
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\3oh12umi.csm" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3224,i,16329328291290275984,2739253088112445686,262144 --variations-seed-version --mojo-platform-channel-handle=3304 /prefetch:1
      4⤵
      PID:2360
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\3oh12umi.csm" --extension-process --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=3236,i,16329328291290275984,2739253088112445686,262144 --variations-seed-version --mojo-platform-channel-handle=3316 /prefetch:2
      4⤵
      PID:5388
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\3oh12umi.csm" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=3344,i,16329328291290275984,2739253088112445686,262144 --variations-seed-version --mojo-platform-channel-handle=3324 /prefetch:1
      4⤵
      PID:1884
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\3oh12umi.csm" --extension-process --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=3376,i,16329328291290275984,2739253088112445686,262144 --variations-seed-version --mojo-platform-channel-handle=3332 /prefetch:2
      4⤵
      PID:3900
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\3oh12umi.csm" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=4080,i,16329328291290275984,2739253088112445686,262144 --variations-seed-version --mojo-platform-channel-handle=3240 /prefetch:1
      4⤵
      PID:556
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\3oh12umi.csm" --field-trial-handle=3856,i,16329328291290275984,2739253088112445686,262144 --variations-seed-version --mojo-platform-channel-handle=4356 /prefetch:8
      4⤵
      PID:5896
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\3oh12umi.csm" --field-trial-handle=4392,i,16329328291290275984,2739253088112445686,262144 --variations-seed-version --mojo-platform-channel-handle=4372 /prefetch:8
      4⤵
      PID:1048
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\3oh12umi.csm" --field-trial-handle=4368,i,16329328291290275984,2739253088112445686,262144 --variations-seed-version --mojo-platform-channel-handle=4432 /prefetch:8
      4⤵
      PID:3236
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\4yemzgqp.hyf"
    3⤵
    PID:3196
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir=C:\Users\Admin\AppData\Local\Temp\4yemzgqp.hyf
      4⤵
      Checks processor information in registry
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:4112
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2004 -prefsLen 27099 -prefMapHandle 2008 -prefMapSize 270279 -ipcHandle 2088 -initialChannelId {4b790ee9-8d9a-4591-b541-3dcce9d6d320} -parentPid 4112 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4112" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
        5⤵
        
        PID:1920
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2572 -prefsLen 27135 -prefMapHandle 2576 -prefMapSize 270279 -ipcHandle 2256 -initialChannelId {cca9ac30-9f5e-4101-9b62-0a165d875e75} -parentPid 4112 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4112" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
        5⤵
        
        PID:5572
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\d83df412-a944-4ce1-8b83-bf051c8250c0.dmp"
        5⤵
        
        PID:5428
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2308 -prefsLen 27135 -prefMapHandle 2920 -prefMapSize 270279 -ipcHandle 2924 -initialChannelId {cf1dd576-0260-4b27-8271-16172a189040} -parentPid 4112 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4112" -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 gpu
        5⤵
        
        PID:2164
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\8e6447b6-0a29-46bb-98e0-dcfff0b5ab54.dmp"
        5⤵
        
        PID:2416
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2932 -prefsLen 27135 -prefMapHandle 1992 -prefMapSize 270279 -ipcHandle 3184 -initialChannelId {bcd37fbc-6b27-4ea8-b3c1-02326181964e} -parentPid 4112 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4112" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 gpu
        5⤵
        
        PID:2184
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\11d82aeb-db44-47bd-92bd-cd6242e8f244.dmp"
        5⤵
        
        PID:3092
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3184 -prefsLen 27200 -prefMapHandle 3348 -prefMapSize 270279 -ipcHandle 3576 -initialChannelId {ef2e0c09-031d-4832-a20c-4399dc185935} -parentPid 4112 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4112" -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 gpu
        5⤵
        
        PID:3944
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3836 -prefsLen 27276 -prefMapHandle 3840 -prefMapSize 270279 -jsInitHandle 3844 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3852 -initialChannelId {e6714175-b5a7-4889-9fc0-7057653d92a2} -parentPid 4112 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4112" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 tab
        5⤵
        Checks processor information in registry
        
        PID:5912
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\16461df9-5387-4bc0-8484-1f1e33c44c0b.dmp"
        5⤵
        
        PID:3352
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3576 -prefsLen 27276 -prefMapHandle 4028 -prefMapSize 270279 -ipcHandle 3644 -initialChannelId {820bf76f-6be0-4b5a-a8fb-8a4b3a6a7e1f} -parentPid 4112 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4112" -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 gpu
        5⤵
        
        PID:3120
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\fc5a39c0-2801-457c-bce6-74b15a8f2be6.dmp"
        5⤵
        
        PID:5404
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4172 -prefsLen 27276 -prefMapHandle 4196 -prefMapSize 270279 -ipcHandle 4220 -initialChannelId {5531575e-946c-4b23-ab35-8c9c10d506ea} -parentPid 4112 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4112" -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 rdd
        5⤵
        
        PID:64
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3456 -prefsLen 34775 -prefMapHandle 3464 -prefMapSize 270279 -jsInitHandle 2800 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 1668 -initialChannelId {28eb1ff2-8df9-4e1a-be2f-8742d8b64cfa} -parentPid 4112 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4112" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
        5⤵
        Checks processor information in registry
        
        PID:4012
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5144 -prefsLen 35012 -prefMapHandle 5148 -prefMapSize 270279 -ipcHandle 5188 -initialChannelId {299d9567-1f4e-406b-a4c7-63c8448a5b13} -parentPid 4112 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4112" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 utility
        5⤵
        Checks processor information in registry
        
        PID:3740
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5168 -prefsLen 32900 -prefMapHandle 5172 -prefMapSize 270279 -jsInitHandle 5176 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5220 -initialChannelId {01d487e4-f0b3-4864-948a-3352c9544273} -parentPid 4112 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4112" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
        5⤵
        Checks processor information in registry
        
        PID:2420
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5372 -prefsLen 32900 -prefMapHandle 5376 -prefMapSize 270279 -jsInitHandle 5380 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5508 -initialChannelId {2aad8052-ed1f-41bd-81b9-18afd3573eb2} -parentPid 4112 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4112" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
        5⤵
        Checks processor information in registry
        
        PID:4744
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5708 -prefsLen 32952 -prefMapHandle 5712 -prefMapSize 270279 -jsInitHandle 5716 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5172 -initialChannelId {7b473adb-ca8f-4896-b4e3-c91c8c7f9f7f} -parentPid 4112 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4112" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab
        5⤵
        Checks processor information in registry
        
        PID:5760
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\knncw2ha.gvp"
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious use of FindShellTrayWindow
    PID:2364
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\knncw2ha.gvp /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\knncw2ha.gvp\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x238,0x23c,0x240,0x234,0x24c,0x7ff9ae9ef208,0x7ff9ae9ef214,0x7ff9ae9ef220
      4⤵
      PID:2776
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\knncw2ha.gvp" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --field-trial-handle=2188,i,2278401754571934554,4082296879950951060,262144 --variations-seed-version --mojo-platform-channel-handle=2176 /prefetch:2
      4⤵
      PID:5732
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\knncw2ha.gvp" --always-read-main-dll --field-trial-handle=1896,i,2278401754571934554,4082296879950951060,262144 --variations-seed-version --mojo-platform-channel-handle=2212 /prefetch:3
      4⤵
      PID:4624
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\knncw2ha.gvp" --always-read-main-dll --field-trial-handle=2300,i,2278401754571934554,4082296879950951060,262144 --variations-seed-version --mojo-platform-channel-handle=2456 /prefetch:8
      4⤵
      PID:5676
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\knncw2ha.gvp" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3184,i,2278401754571934554,4082296879950951060,262144 --variations-seed-version --mojo-platform-channel-handle=3260 /prefetch:1
      4⤵
      PID:4156
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\knncw2ha.gvp" --instant-process --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3192,i,2278401754571934554,4082296879950951060,262144 --variations-seed-version --mojo-platform-channel-handle=3264 /prefetch:1
      4⤵
      PID:5984
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\knncw2ha.gvp" --always-read-main-dll --field-trial-handle=3612,i,2278401754571934554,4082296879950951060,262144 --variations-seed-version --mojo-platform-channel-handle=3696 /prefetch:8
      4⤵
      PID:1508
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\knncw2ha.gvp" --always-read-main-dll --field-trial-handle=3616,i,2278401754571934554,4082296879950951060,262144 --variations-seed-version --mojo-platform-channel-handle=3712 /prefetch:8
      4⤵
      PID:536
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\knncw2ha.gvp" --always-read-main-dll --field-trial-handle=3624,i,2278401754571934554,4082296879950951060,262144 --variations-seed-version --mojo-platform-channel-handle=3768 /prefetch:8
      4⤵
      PID:1044
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\knncw2ha.gvp" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --field-trial-handle=3728,i,2278401754571934554,4082296879950951060,262144 --variations-seed-version --mojo-platform-channel-handle=3788 /prefetch:1
      4⤵
      PID:3496
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\knncw2ha.gvp" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --field-trial-handle=3780,i,2278401754571934554,4082296879950951060,262144 --variations-seed-version --mojo-platform-channel-handle=3828 /prefetch:2
      4⤵
      PID:3120
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\knncw2ha.gvp" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --field-trial-handle=3796,i,2278401754571934554,4082296879950951060,262144 --variations-seed-version --mojo-platform-channel-handle=3148 /prefetch:1
      4⤵
      PID:212
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\knncw2ha.gvp" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --field-trial-handle=3848,i,2278401754571934554,4082296879950951060,262144 --variations-seed-version --mojo-platform-channel-handle=3864 /prefetch:2
      4⤵
      PID:4352
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\knncw2ha.gvp" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --field-trial-handle=3776,i,2278401754571934554,4082296879950951060,262144 --variations-seed-version --mojo-platform-channel-handle=3940 /prefetch:1
      4⤵
      PID:5896
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\knncw2ha.gvp" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --field-trial-handle=3944,i,2278401754571934554,4082296879950951060,262144 --variations-seed-version --mojo-platform-channel-handle=3952 /prefetch:2
      4⤵
      PID:3932
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\knncw2ha.gvp" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --field-trial-handle=3992,i,2278401754571934554,4082296879950951060,262144 --variations-seed-version --mojo-platform-channel-handle=4000 /prefetch:1
      4⤵
      PID:3552
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\knncw2ha.gvp" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --field-trial-handle=4020,i,2278401754571934554,4082296879950951060,262144 --variations-seed-version --mojo-platform-channel-handle=4004 /prefetch:2
      4⤵
      PID:1032
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\knncw2ha.gvp" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --field-trial-handle=4036,i,2278401754571934554,4082296879950951060,262144 --variations-seed-version --mojo-platform-channel-handle=4100 /prefetch:1
      4⤵
      PID:932
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\knncw2ha.gvp" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --field-trial-handle=4068,i,2278401754571934554,4082296879950951060,262144 --variations-seed-version --mojo-platform-channel-handle=4108 /prefetch:2
      4⤵
      PID:5552
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\knncw2ha.gvp" --always-read-main-dll --field-trial-handle=4064,i,2278401754571934554,4082296879950951060,262144 --variations-seed-version --mojo-platform-channel-handle=3148 /prefetch:8
      4⤵
      PID:6512
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\knncw2ha.gvp" --always-read-main-dll --field-trial-handle=5000,i,2278401754571934554,4082296879950951060,262144 --variations-seed-version --mojo-platform-channel-handle=3876 /prefetch:8
      4⤵
      PID:6520
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\knncw2ha.gvp" --always-read-main-dll --field-trial-handle=5480,i,2278401754571934554,4082296879950951060,262144 --variations-seed-version --mojo-platform-channel-handle=3924 /prefetch:8
      4⤵
      PID:6528
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --no-sandbox --mute-audio --onnx-enabled-for-ee --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\knncw2ha.gvp" --always-read-main-dll --field-trial-handle=5488,i,2278401754571934554,4082296879950951060,262144 --variations-seed-version --mojo-platform-channel-handle=5756 /prefetch:8
      4⤵
      PID:6536
  - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\knncw2ha.gvp" --always-read-main-dll --field-trial-handle=3220,i,2278401754571934554,4082296879950951060,262144 --variations-seed-version --mojo-platform-channel-handle=5260 /prefetch:8
      4⤵
      PID:6156
  - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\knncw2ha.gvp" --always-read-main-dll --field-trial-handle=3220,i,2278401754571934554,4082296879950951060,262144 --variations-seed-version --mojo-platform-channel-handle=5260 /prefetch:8
      4⤵
      PID:5820
  - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\Installer\setup.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
      4⤵
      Drops file in Program Files directory
      PID:760
    - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\Installer\setup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x1e0,0x1e4,0x204,0x1dc,0x228,0x7ff6dee16a68,0x7ff6dee16a74,0x7ff6dee16a80
        5⤵
        Drops file in Program Files directory
        
        PID:5760
    - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\Installer\setup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\Installer\setup.exe" --msedge --system-level --verbose-logging --installerdata="C:\Program Files (x86)\Microsoft\Edge\Application\master_preferences" --create-shortcuts=1 --install-level=0
        5⤵
        Drops file in Program Files directory
        
        PID:4808
      - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\Installer\setup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x21c,0x220,0x224,0x1f8,0x228,0x7ff6dee16a68,0x7ff6dee16a74,0x7ff6dee16a80
        6⤵
        Drops file in Program Files directory
        
        PID:2140
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\msncld5p.0ln"
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious use of FindShellTrayWindow
    PID:1060
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\msncld5p.0ln /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\msncld5p.0ln\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ff9ae9ef208,0x7ff9ae9ef214,0x7ff9ae9ef220
      4⤵
      PID:6624
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\msncld5p.0ln" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --field-trial-handle=2140,i,2420598117817375998,15155607195381952559,262144 --variations-seed-version --mojo-platform-channel-handle=2136 /prefetch:2
      4⤵
      PID:204
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\msncld5p.0ln" --always-read-main-dll --field-trial-handle=1784,i,2420598117817375998,15155607195381952559,262144 --variations-seed-version --mojo-platform-channel-handle=2156 /prefetch:3
      4⤵
      PID:2448
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\msncld5p.0ln" --always-read-main-dll --field-trial-handle=2308,i,2420598117817375998,15155607195381952559,262144 --variations-seed-version --mojo-platform-channel-handle=2476 /prefetch:8
      4⤵
      PID:5788
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\msncld5p.0ln" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3116,i,2420598117817375998,15155607195381952559,262144 --variations-seed-version --mojo-platform-channel-handle=3172 /prefetch:1
      4⤵
      PID:3704
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\msncld5p.0ln" --instant-process --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3124,i,2420598117817375998,15155607195381952559,262144 --variations-seed-version --mojo-platform-channel-handle=3180 /prefetch:1
      4⤵
      PID:2388
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\msncld5p.0ln" --always-read-main-dll --field-trial-handle=3520,i,2420598117817375998,15155607195381952559,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:8
      4⤵
      PID:6448
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\msncld5p.0ln" --always-read-main-dll --field-trial-handle=3500,i,2420598117817375998,15155607195381952559,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:8
      4⤵
      PID:6436
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\msncld5p.0ln" --always-read-main-dll --field-trial-handle=3556,i,2420598117817375998,15155607195381952559,262144 --variations-seed-version --mojo-platform-channel-handle=3680 /prefetch:8
      4⤵
      PID:6468
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\msncld5p.0ln" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --field-trial-handle=3568,i,2420598117817375998,15155607195381952559,262144 --variations-seed-version --mojo-platform-channel-handle=3684 /prefetch:1
      4⤵
      PID:6472
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\msncld5p.0ln" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --field-trial-handle=3576,i,2420598117817375998,15155607195381952559,262144 --variations-seed-version --mojo-platform-channel-handle=3716 /prefetch:2
      4⤵
      PID:4400
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\msncld5p.0ln" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --field-trial-handle=3660,i,2420598117817375998,15155607195381952559,262144 --variations-seed-version --mojo-platform-channel-handle=3732 /prefetch:1
      4⤵
      PID:6076
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\msncld5p.0ln" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --field-trial-handle=3708,i,2420598117817375998,15155607195381952559,262144 --variations-seed-version --mojo-platform-channel-handle=3756 /prefetch:2
      4⤵
      PID:3964
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\msncld5p.0ln" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --field-trial-handle=3748,i,2420598117817375998,15155607195381952559,262144 --variations-seed-version --mojo-platform-channel-handle=3784 /prefetch:1
      4⤵
      PID:64
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\msncld5p.0ln" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --field-trial-handle=3776,i,2420598117817375998,15155607195381952559,262144 --variations-seed-version --mojo-platform-channel-handle=3860 /prefetch:2
      4⤵
      PID:3084
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\msncld5p.0ln" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --field-trial-handle=3852,i,2420598117817375998,15155607195381952559,262144 --variations-seed-version --mojo-platform-channel-handle=3740 /prefetch:1
      4⤵
      PID:6488
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\msncld5p.0ln" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --field-trial-handle=3888,i,2420598117817375998,15155607195381952559,262144 --variations-seed-version --mojo-platform-channel-handle=3904 /prefetch:2
      4⤵
      PID:6492
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\msncld5p.0ln" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --field-trial-handle=3916,i,2420598117817375998,15155607195381952559,262144 --variations-seed-version --mojo-platform-channel-handle=3848 /prefetch:1
      4⤵
      PID:3000
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\msncld5p.0ln" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --field-trial-handle=3948,i,2420598117817375998,15155607195381952559,262144 --variations-seed-version --mojo-platform-channel-handle=4016 /prefetch:2
      4⤵
      PID:3228
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\msncld5p.0ln" --always-read-main-dll --field-trial-handle=5260,i,2420598117817375998,15155607195381952559,262144 --variations-seed-version --mojo-platform-channel-handle=5276 /prefetch:8
      4⤵
      PID:3764
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\msncld5p.0ln" --always-read-main-dll --field-trial-handle=5264,i,2420598117817375998,15155607195381952559,262144 --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:8
      4⤵
      PID:1088
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\msncld5p.0ln" --always-read-main-dll --field-trial-handle=5392,i,2420598117817375998,15155607195381952559,262144 --variations-seed-version --mojo-platform-channel-handle=5440 /prefetch:8
      4⤵
      PID:6688
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --no-sandbox --mute-audio --onnx-enabled-for-ee --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\msncld5p.0ln" --always-read-main-dll --field-trial-handle=5480,i,2420598117817375998,15155607195381952559,262144 --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:8
      4⤵
      PID:6960
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lzyinwvk.dtz"
    3⤵
    PID:1116
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir=C:\Users\Admin\AppData\Local\Temp\lzyinwvk.dtz
      4⤵
      Checks processor information in registry
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:5004
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1980 -prefsLen 27099 -prefMapHandle 1988 -prefMapSize 270331 -ipcHandle 2076 -initialChannelId {24f1297f-7fad-4185-ba80-291293065f14} -parentPid 5004 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5004" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
        5⤵
        
        PID:3356
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2320 -prefsLen 27135 -prefMapHandle 2332 -prefMapSize 270331 -ipcHandle 2324 -initialChannelId {2e1d25f7-c8dc-4023-9ed8-d53fd891add2} -parentPid 5004 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5004" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
        5⤵
        
        PID:3416
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\ce306c2e-0841-47a9-a7f1-4f97c9816df5.dmp"
        5⤵
        
        PID:5920
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2076 -prefsLen 27135 -prefMapHandle 2708 -prefMapSize 270331 -ipcHandle 2772 -initialChannelId {161f2415-02c7-4f88-98b6-3cbf39ce1953} -parentPid 5004 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5004" -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 gpu
        5⤵
        
        PID:4664
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3724 -prefsLen 27325 -prefMapHandle 3728 -prefMapSize 270331 -jsInitHandle 3732 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3740 -initialChannelId {8d4c633a-fcb8-42a8-b884-537f576ee06e} -parentPid 5004 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5004" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 tab
        5⤵
        Checks processor information in registry
        
        PID:5408
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\de11e3d0-6072-4744-8b97-99306f7721e8.dmp"
        5⤵
        
        PID:5628
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3948 -prefsLen 27325 -prefMapHandle 3952 -prefMapSize 270331 -ipcHandle 3964 -initialChannelId {352b7ea8-740a-4c65-9ba5-a10dc7d71113} -parentPid 5004 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5004" -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 gpu
        5⤵
        
        PID:3500
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\d2decac4-3588-4f35-877a-e21c8af52cd9.dmp"
        5⤵
        
        PID:5772
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4084 -prefsLen 27325 -prefMapHandle 4080 -prefMapSize 270331 -ipcHandle 4076 -initialChannelId {2d8048c8-f9af-42d1-b975-ce51794f8697} -parentPid 5004 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5004" -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 rdd
        5⤵
        
        PID:6976
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4432 -prefsLen 34878 -prefMapHandle 4436 -prefMapSize 270331 -jsInitHandle 4440 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2992 -initialChannelId {796107cd-43c9-448e-a2b7-99afa837f815} -parentPid 5004 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5004" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
        5⤵
        
        PID:6604
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4868 -prefsLen 34878 -prefMapHandle 4872 -prefMapSize 270331 -ipcHandle 4880 -initialChannelId {a7076f1c-9b30-476a-ba7f-177ee161baca} -parentPid 5004 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5004" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 utility
        5⤵
        
        PID:3380
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\24l2zpcz.12n"
    3⤵
    PID:2408
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\24l2zpcz.12n /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\24l2zpcz.12n\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\24l2zpcz.12n --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff9accfdcf8,0x7ff9accfdd04,0x7ff9accfdd10
      4⤵
      PID:3680
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\24l2zpcz.12n" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=2388,i,339289735240839072,1885229833530757948,262144 --variations-seed-version --mojo-platform-channel-handle=2384 /prefetch:2
      4⤵
      PID:5896
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\24l2zpcz.12n" --field-trial-handle=1764,i,339289735240839072,1885229833530757948,262144 --variations-seed-version --mojo-platform-channel-handle=2464 /prefetch:3
      4⤵
      PID:6840
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\24l2zpcz.12n" --field-trial-handle=2052,i,339289735240839072,1885229833530757948,262144 --variations-seed-version --mojo-platform-channel-handle=2476 /prefetch:8
      4⤵
      PID:3068
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\24l2zpcz.12n" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=2756,i,339289735240839072,1885229833530757948,262144 --variations-seed-version --mojo-platform-channel-handle=2892 /prefetch:1
      4⤵
      PID:3928
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\24l2zpcz.12n" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=2896,i,339289735240839072,1885229833530757948,262144 --variations-seed-version --mojo-platform-channel-handle=2912 /prefetch:1
      4⤵
      PID:4692
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\24l2zpcz.12n" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3220,i,339289735240839072,1885229833530757948,262144 --variations-seed-version --mojo-platform-channel-handle=3292 /prefetch:1
      4⤵
      PID:6576
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\24l2zpcz.12n" --extension-process --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=3236,i,339289735240839072,1885229833530757948,262144 --variations-seed-version --mojo-platform-channel-handle=3308 /prefetch:2
      4⤵
      PID:6584
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\24l2zpcz.12n" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=3264,i,339289735240839072,1885229833530757948,262144 --variations-seed-version --mojo-platform-channel-handle=3316 /prefetch:1
      4⤵
      PID:4372
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\24l2zpcz.12n" --extension-process --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=2876,i,339289735240839072,1885229833530757948,262144 --variations-seed-version --mojo-platform-channel-handle=3368 /prefetch:2
      4⤵
      PID:6468
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\24l2zpcz.12n" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=3956,i,339289735240839072,1885229833530757948,262144 --variations-seed-version --mojo-platform-channel-handle=4000 /prefetch:1
      4⤵
      PID:6740
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\24l2zpcz.12n" --field-trial-handle=4352,i,339289735240839072,1885229833530757948,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:8
      4⤵
      PID:3496
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\24l2zpcz.12n" --field-trial-handle=4412,i,339289735240839072,1885229833530757948,262144 --variations-seed-version --mojo-platform-channel-handle=4424 /prefetch:8
      4⤵
      PID:1112
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\24l2zpcz.12n" --field-trial-handle=4440,i,339289735240839072,1885229833530757948,262144 --variations-seed-version --mojo-platform-channel-handle=4452 /prefetch:8
      4⤵
      PID:6520
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\24l2zpcz.12n" --field-trial-handle=4448,i,339289735240839072,1885229833530757948,262144 --variations-seed-version --mojo-platform-channel-handle=4408 /prefetch:8
      4⤵
      PID:3948
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\24l2zpcz.12n" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=4488,i,339289735240839072,1885229833530757948,262144 --variations-seed-version --mojo-platform-channel-handle=5092 /prefetch:1
      4⤵
      PID:6436
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\24l2zpcz.12n" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=5060,i,339289735240839072,1885229833530757948,262144 --variations-seed-version --mojo-platform-channel-handle=5044 /prefetch:1
      4⤵
      PID:4064
  - - C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
      4⤵
      PID:6896
    - - C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x268,0x26c,0x270,0x244,0x274,0x7ff7d8831f58,0x7ff7d8831f64,0x7ff7d8831f70
        5⤵
        
        PID:7144
    - - C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\initial_preferences" --create-shortcuts=1 --install-level=0
        5⤵
        
        PID:3804
      - C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x268,0x26c,0x270,0x244,0x274,0x7ff7d8831f58,0x7ff7d8831f64,0x7ff7d8831f70
        6⤵
        
        PID:1768
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\24l2zpcz.12n" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=5156,i,339289735240839072,1885229833530757948,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:1
      4⤵
      PID:4716
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\24l2zpcz.12n" --field-trial-handle=6092,i,339289735240839072,1885229833530757948,262144 --variations-seed-version --mojo-platform-channel-handle=5148 /prefetch:8
      4⤵
      PID:5160

C:\Users\Admin\AppData\Roaming\msiexec.exe
C:\Users\Admin\AppData\Roaming\msiexec.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1360

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

msedge_installer.log

Path C:\Program Files\msedge_installer.log
Size 113KB
SHA256 58ed8340d81f927add3fd0eed1d0d1a163629f420d410ecf65f56270df285a56
MD5 b64fa158f33d33d2368bd72c2852492f
SHA1 1a4cea9c37d2a909efc4a235bf324ccf277a0c28
SHA512 8508633cb7ea1df6567f0b881734e9bd09d5be1f4dfb8dd711205741b69ab47dd8d1e7c563033bc2eaff89854b23076295e8084905f798ceada6ce3545255bec
SSDEEP 3072:1nQ1zOG03cpUOhiVtu6rvZ+KpcfbVhNodnv3:1nQ1fhinrvZ+Kp4bVhNodnv3
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 4c96378bb86f9caff5a1940a80eec2b76a1fc2676d1a50bf2b0ac81d84dd8112
MD5 9ecf8d98a8b2602acfbbee8026b48346
SHA1 654379ea2596d29855b057b94ae9797a28fdbd86
SHA512 485a0042071bd35a37dba8013c372acae7dc4ffe75bb2e28eb6d1b45cd108a2aca83304ddff13bd5f182a276dae7c4f9a3ea675a11a3995564f5d3531e38faaf
MD5 SHA1 SHA512

Submit Download

activity-stream.contile.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1akhe1kg.default-release\activity-stream.contile.json
Size 5KB
SHA256 bc6829575cade8c38602e1b077fc626d2c0ac8bf09d63abc1169d86af128c0e6
MD5 f3329d5a2b0901b3a702961216abf112
SHA1 5d9dd0263a40327cf1c12bdc037ade5d7764ab35
SHA512 043bb9398b599cc512b277843af0110f4dc194c7ecff0a737baf23fa99cb104f3afbd0e766b8f51071617c2141eb92006d36500926aa7961dfe8d9e21eee04e5
SSDEEP 96:KjuJctv1iBd/bXdBs+M5Lap4rNojIz519pIAng6QakLl:Kj/tv0Bd/7dyplaOrNojIzT9eWQakLl
MD5 SHA1 SHA512 SSDEEP

Submit Download

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1akhe1kg.default-release\activity-stream.discovery_stream.json
Size 24KB
SHA256 b1427a9230d958f16ed5384f7dcc0d175d95643553ec09eeba4eaccf975adff2
MD5 0dda5ba3de0c7829063509e6bb64556b
SHA1 8e439475b363c279e1a11ba7e5a6f89fe5318d22
SHA512 8ce8cc2fa566c65cb68568f8680061fb6d81978f5b185ac086f62573bfacef6a6a88eb5e95ce3d0d44e742192765fbafc4d9361ef825dbcbbd40101580b0375a
SSDEEP 384:yya2LlR4yRgE5ObtcLhGRPfgvsIKZHdnPu8WizYoROAx2hga:yyFgLSNYv1W8WizYFJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

577120C5183923526312DC856F6825FC1C7D072F

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1akhe1kg.default-release\cache2\entries\577120C5183923526312DC856F6825FC1C7D072F
Size 13KB
SHA256 c9cf7a62fb94f3d428807475970a4e624283350f543b1ccfef56d27852c03c82
MD5 1e91807476b2cbb130c1b3c1902185c6
SHA1 4f9ff660e45e7fe21dada155451b495e96b2a1cc
SHA512 86688fae925a8c1b9ad54f3297c3b72b3e28a63cfa7aba7f6e0394eaba1eb237c307e1a89a8b4c1c09f9dd9d95c597ad62e558f5aca94a628f6aaba6b2cc2951
SSDEEP 384:HV9BpiO024Yp7hSznZOML+CbcxDEclrIVy8e09d9aC:1EZYp7hSz8MLPbcxDEcVIVy8oC
MD5 SHA1 SHA512 SSDEEP

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1akhe1kg.default-release\startupCache\webext.sc.lz4
Size 104KB
SHA256 2e5af2b798deb0baffb426713a8ced8fc85fa229e33587b4a677561cc3f2175b
MD5 e931ac228df41ad63230ae8cd5cedae8
SHA1 b02a528a7bb454cb45191067b2a4b769af396ea3
SHA512 f6b47c1b24d82a98699c69ecc24544bba86baab2d1684729644bd3c827f186d069e42277ebba3020743874a62b4bbc10fafc1a73b919a2e122335d7b127ac233
SSDEEP 1536:jTrliF1/DDypG6MTeKmVcIi0kLWETExSPf5S7a53K0oLkpsZw3OFhZ9UyXEjQv7b:j3l1G6MT0UhVTEkxzpNOx9U70sqdJ3
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Temp\24l2zpcz.12n\Default\Preferences
Size 2KB
SHA256 76ff52016081da05d5b860f76fb58ac6c300b024a122dd8ce9907c5a2569f456
MD5 532fb215f49f4dcd67a92c81726055e0
SHA1 8b3887f7c605479711f661395d5ca07ec90d837e
SHA512 658c5c58247172f43589382f7adc6cb74daaa61c04387cca49163800c8c8fb535a5df1ee23aec243ae7b0074742c816823bbbbd1d7b11ce1fb6dac0206a1bdd3
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Temp\24l2zpcz.12n\Default\Preferences
Size 9KB
SHA256 e1e417b557d13eb9384f25f27d2aa9672c819626ffc3afc52a8dcafe3192f512
MD5 31295cd78a6b0703643c3a0c4d78a9fe
SHA1 d5625de9bb848b4d0247dfe5fbc569dc8f96bb53
SHA512 c7cf7bdece58b6b79d20ba3a559c843e4ad05817862ef808bc6c8ea888a2adc00150eec49fc8650f053337b36586dd1449d655c3c932cf073ca4b5aa26a7ccb4
SSDEEP 192:wY8NeXZ8PRpoXS+WN40ggr+zjACiHB4MQyIsnA/gx:wY8NesXoXcz+vALhZx
MD5 SHA1 SHA512 SSDEEP

Submit Download

32.png

Path C:\Users\Admin\AppData\Local\Temp\24l2zpcz.12n\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\32.png
Size 1KB
SHA256 3197a2ac164c5bacb65f02fd9a6eb9c0a533fdf3b24f43043bbe9af65ed6608a
MD5 60953b3aca67505c2c7ea1a902e84d51
SHA1 5e6a8e04a96e36306c66409edd4775a606f13f54
SHA512 2e65ec84471c3f703617171aa32f1a0d6c57d73e1d5c074b92d20d580df78e7ac4eef5ce54ab7defd0027bb38e33c44a6602d3e123a2fd310e514af0f5b38086
MD5 SHA1 SHA512

Submit Download

48.png

Path C:\Users\Admin\AppData\Local\Temp\24l2zpcz.12n\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\48.png
Size 2KB
SHA256 9bdfc3aa03d4e41b0d83862ce02f9fe7fdb55a492280d86d551b91a24efd47ca
MD5 1625c1dd7bab831d8ab5308a1a71d525
SHA1 f1c145985a7c8c18891caaba0f46729bcbd1f63b
SHA512 75079bcb02482abd10b121d81fe39607dcac17bb3107ca274c549b570bb473260dfdbdd13df769b1745425ac5433a22fd392a2a1d815897e0c2091b787bada8e
MD5 SHA1 SHA512

Submit Download

64.png

Path C:\Users\Admin\AppData\Local\Temp\24l2zpcz.12n\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\64.png
Size 2KB
SHA256 57d5cd9fa59f944ffc78ec2a12633a79e2f923124fc50676ffbecaef5021b4a9
MD5 e6671b804d6013a6706ea598e2d854c5
SHA1 40e4f401fe4afbf7bda49a02fe94f5308868460e
SHA512 7b11a47497ae5810ec4c7038ebf8358f03d79126886feb6daffd92d116fd606f530ecced9c3d635c0f57b9f9eb80ed9e8fa4eb98b029f9fd798d9b89ccd279a8
MD5 SHA1 SHA512

Submit Download

32.png

Path C:\Users\Admin\AppData\Local\Temp\24l2zpcz.12n\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\32.png
Size 927B
SHA256 af50d64bd3cc7c3d201cb5abf0d76f44737e2a4040741ce178d9765fe440bcc5
MD5 26496798ba29a454042d60c9633c1e72
SHA1 65977f9cc15dd73026c91b479f1bc678050c8c45
SHA512 a4a61f66c712fcd27681073c2f30fda3a98fb6348ac4451d8a8e181e525f4ad8491a09d19c17dfb8f01a53eecbfc3ba25f370afd9df5b2ecb9b613236ecdd3cd
MD5 SHA1 SHA512

Submit Download

48.png

Path C:\Users\Admin\AppData\Local\Temp\24l2zpcz.12n\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\48.png
Size 1KB
SHA256 3339af4538fdfa40bb438469e35f6b7668d5c5ac93db0ef4a9e2fbf9ae884446
MD5 815ddced6b03c8a62cb590ea4585fcba
SHA1 9f7e8cce2319b15ec63d89f837a173bd247e6998
SHA512 ec7069b51959572c40dfa02f380b081912053898b4d4f86166b90bd277f9e8271d0fb3f0627e82645052ebe021c2e24698785e5214e82190a2298f32dd879b3d
MD5 SHA1 SHA512

Submit Download

64.png

Path C:\Users\Admin\AppData\Local\Temp\24l2zpcz.12n\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\64.png
Size 1KB
SHA256 e895cbcc424d6000a15b21d7cc9dec96deb2403a1469761ba3d9f11528c215b1
MD5 f2222b9d8dea52f5ce7d75378de76037
SHA1 e3b266fca2e5bf8bd82a62791902e879af7ff6fd
SHA512 74b947bc915c89f27954b5d0c8c790316ace581a20f7031aa91af3d95303ff0dd8cb4c87d3746ef2b13f76e0e8bba1b5b4a6916f3230c0514164fb1700640f66
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\24l2zpcz.12n\Local State
Size 3KB
SHA256 906116e1908a084e6a9c9ed574068e97775fb51a4558febe102700a32b4ce70d
MD5 0efac25cd54072da0016ccd1a87dc5b5
SHA1 799fa4487c53c7df81d460bb6d89644eb7ed6c17
SHA512 8f9a9292254e28e2f1319448753baf25609b19602965d5aa7ff340c32067e9436b2f8bf6cc7f9f9f679a16dfed1ce91b306e62d4ce9d65cb5a398c475d67d167
MD5 SHA1 SHA512

Submit Download

Local State~RFe5961dd.TMP

Path C:\Users\Admin\AppData\Local\Temp\24l2zpcz.12n\Local State~RFe5961dd.TMP
Size 1KB
SHA256 ebb5e2227b281481fc165cbdcc165de46e291a98312c713db391db1e0c259d85
MD5 5371d9fd3865cf57fe76589564e8c0a2
SHA1 0793e45975f6054b40d1cc6b5652c6329d166b04
SHA512 4e45bb6e6b28d2e5d0ee76a3d30b24f26c439dd47467be103e517bde2470323c028555431f09d8d7e5fe32d5f14b6e24a843aa6e353a4d28e19b1840af102740
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\3oh12umi.csm\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\3oh12umi.csm\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\3oh12umi.csm\Default\Site Characteristics Database\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\3oh12umi.csm\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\3oh12umi.csm\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\3oh12umi.csm\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\3oh12umi.csm\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

6fc66c59-05bc-4d1b-9ed6-3d044a570bc2.tmp

Path C:\Users\Admin\AppData\Local\Temp\6fc66c59-05bc-4d1b-9ed6-3d044a570bc2.tmp
Size 154KB
SHA256 a468f5875b4e55ea732e3df283b4f4ea941be738b238122979ca5d8006a3a8fe
MD5 4ad81f6ccc657d1da582c75c5db037cb
SHA1 ab0370e7d32ebed71fe9787d3a4a2fc0c652a28e
SHA512 66461474f8b36d6d470797df9d4a3cc4698bceb7054c97166eed98b74def84f58486fdb909928aaeafee793799a436210b5d7091acce6232b23eb6ba926ad227
SSDEEP 3072:OqeD5sKZ7XcbMSqnDhcfXE0IfnpWpyKIrFn2wNkR7aUPuWm6u:yD5sIXcYSqDGc0kkpIZ2weeX6u
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_pqu2fwvd.ovm.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_pqu2fwvd.ovm.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\knncw2ha.gvp\Crashpad\settings.dat
Size 280B
SHA256 856b199a0fc296c3b1e473fe739e7a447351de0c1f034e3de578d7c84bb4c2f6
MD5 489da6a4a0824ea8a7517445be27884d
SHA1 a405fbf14b1a2412cbb6438df6989b05016aadb1
SHA512 1fdc8c6c30ecd00958f5884c3e0037a17f5f5f5a1893d7515e26ed3dc0e3825afc7eaaf76ffc2f45ccd78667a997482d070c7157ce277700b00863069204a64a
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\knncw2ha.gvp\Crashpad\settings.dat
Size 280B
SHA256 9f42fb920b7faaaaff8ba26780298a5eeea080f2b8120dc939fee88ec41e17b6
MD5 2b07f329c5fe164b0d92beb2a2b325fb
SHA1 6749976e7f1233b2484bbb76eb844698f6dcf285
SHA512 e700a3706f4eda0e3ef9669223c98609c502f56c2fe85e99738e7202df6aae1da3ea9a5b39be055deab05435f58564d4ee770aa66a1e3659849d9c6291955a06
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Temp\knncw2ha.gvp\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\knncw2ha.gvp\Default\Code Cache\js\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Temp\knncw2ha.gvp\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 186B
SHA256 fd1baff31c796ca5b0256870e45bc6ed1080a65f29332baab9d1a7fee4bb2db4
MD5 7dc2c2258e9b4cab7a97ebb118a53800
SHA1 096a62ca8db981ee0b1c6b3e77a40fd9d1e0d97c
SHA512 bbc3bd7979d3901c683e840c75efc7b32dc9cf2f9d23c35314f19b3a4940d275e8b782527d1a326869264fb1cdfa58017e1217a7dc168920c93637eb911a0d79
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Temp\knncw2ha.gvp\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 259B
SHA256 66801c34386dd2643a5fcb8a787853b66916084b406bc969bb6c261bdc6dc74a
MD5 9d327b99a44511bcb369134f5eeb11b6
SHA1 4c7771796e4eac02bbc1da880475c8658e04b34c
SHA512 c5fee1ea824fdd77a8b4cbd14eb9abb3cfa6bbf4b0b2a29b00ccf6b0073c63306c1f2b789a947177d629831c6476d574151bcba8c82a8aee401d9acb07e46e32
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Temp\knncw2ha.gvp\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 324B
SHA256 f045818423a76e3a3cf6eb3190d1fb70fb70c2c11fea9546fa6aaa79ef4ad9e9
MD5 1f62ddaca380e07842da907d36568e69
SHA1 1bc5816a85dc9f5845113aa4245cf95d8b55f1cd
SHA512 a34de714bb707c63574b399ed799decbcaf1cf9f7643d5ae8ca140dc971d9acfd6daf03828da576a16b1286fe1aee841b317f3978f038078bae1ac4a0fff8d19
MD5 SHA1 SHA512

Submit Download

index.txt~RFe58df01.TMP

Path C:\Users\Admin\AppData\Local\Temp\knncw2ha.gvp\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt~RFe58df01.TMP
Size 120B
SHA256 bbb1391ef24de00b4c272d0dc1257569c7e268ff61423e554e0b893962396a5f
MD5 4012d4965e8be93b5b43ae07b5b4040e
SHA1 f7f4dccd0f41b065e9474d88b4f1c51a6f8e71e6
SHA512 28bbd00a05f151a2160cb13dd7c2653358630bca97537dd65f21e5402ecddf33a613acb6024d6c2ae9c3fce6b67d6a11b0b24ed9a328e8e6f9f76781b7054cd9
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Temp\knncw2ha.gvp\Default\Sync Data\Logs\sync_diagnostic.log
Size 2KB
SHA256 6446208ddae3a4051e303fdc12680ce5d84022752df08bba2e435f4afd54b4c2
MD5 29bee5b0281aae91c683a5d9106f36b9
SHA1 a2e86c20355f89043837be78e7f5d8a0732e9b60
SHA512 086acff367969b1b72eda24a5b2d522fc7ec0a55bbfa3d88bc71ac13b3e95de79b5101ae7b817fe4d2010b2c6ff0813cb0fbb3d5e2a9b6598940ba4d67bf34e8
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\knncw2ha.gvp\Local State
Size 3KB
SHA256 83d62e0696142a8147cbed364bd4c02a5d2a1fa602902067ca1789d0bd844a38
MD5 113f90a8d60606a1a61f0194eca91479
SHA1 55684a0f1b189eda280cab4396cd576a6f407cb5
SHA512 3754360638f1d929c0b4985d6796ff924df8a6d3d6d29d0eb62b24d015e2999d845bbecf0c28415244431ee365675238a2bec39b0c8297daefad32b9b45c5908
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\knncw2ha.gvp\Local State
Size 4KB
SHA256 32b3a048dccb4894e8fcdad03fab9ce9a399c0be0d8589632b4df8848303cc67
MD5 96e65bafe652ab026947b11e68b0fa05
SHA1 3f02eab685a16c2debcaf3c6a7813d3a4e48b81b
SHA512 cd787c55414c0acc53069ec864a8d3c447982426c2d867d10809410bb5c768406be898e1f51c348d70ba96d241b5ee529a3e5b8d62ada82018cc517f42f0c8ea
SSDEEP 96:oqGNkCufT+FW58Frh/cInURoDotovRx5D9BrPbvjaNPoaJXICUgjB6a:zGNbM+rooDUw5j7qPoWXJUgz
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State~RFe58d3c6.TMP

Path C:\Users\Admin\AppData\Local\Temp\knncw2ha.gvp\Local State~RFe58d3c6.TMP
Size 1KB
SHA256 28cf13b5255954c510c0ac9f82df4b8da1139dde44c48cdddd9fd80ab759d1de
MD5 93f572457c29600dadee2a260f389d86
SHA1 44b30e66accebe99f63ce326a3f5626c5ba59f55
SHA512 dc0387cbf8e64e4b535681c6bf1a6fb04f2b4dcca01aa5db7e8d36ee432c68cf9350e7216bc12d89d3749a03165e79c72ea754de23f229e0fca6d7ebd98ef279
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\msncld5p.0ln\Crashpad\settings.dat
Size 280B
SHA256 f8797b16c7b9b8ed82dfc8f771298eaaa66e1afba9c4a3548ffa079ebe5b3ba3
MD5 574b12b9ee65b26cf071576d1d78a49a
SHA1 28cd1f609b1f263c6a2026f3799283bf66aaf2e1
SHA512 894e91da51f04f152db30db96b8d2538098d813af7b255d6826545b31789ca312049bd6e071dabfba4f4f3e9e58c2b96efcda846b2132ac9b21b62e181326cfa
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\msncld5p.0ln\Crashpad\settings.dat
Size 280B
SHA256 0bdae89c238803146f5ab643f2aebff552470e52ac5cd69194eeecb2b6e48d16
MD5 4f810e18996fcab0924de5edbffc4d81
SHA1 3b7e99992b408d97203a08994a7a95c1c16e837d
SHA512 789fd6ebafe9d1f1b3b2bb35c74c8392b5bead15052be755819a3436c3b701a4a26ddbe61738ed5ada464e4abeb41d9d59a6018ee159a308974c4e869ba7ce75
MD5 SHA1 SHA512

Submit Download

77e48b1d-54a5-48e6-bdf1-32b5e9ea9a01.tmp

Path C:\Users\Admin\AppData\Local\Temp\msncld5p.0ln\Default\77e48b1d-54a5-48e6-bdf1-32b5e9ea9a01.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

f_000001

Path C:\Users\Admin\AppData\Local\Temp\msncld5p.0ln\Default\Cache\Cache_Data\f_000001
Size 34KB
SHA256 8c97e1a3437f857eb8a346a360274ea339a09eda1b965ee1445d870c09b066ca
MD5 4227139d34ecd3be139bf6c7d75fce5b
SHA1 0e984113aa96daf31d002392523ad0dfc9cc3870
SHA512 bdb38f430aa623a17b26044288841a07c82691ee858325b158423839fad99a75b192fe0df269898cd76e22a7e54250611f852ccb763ce82db2f7d1c4eb6fcb52
SSDEEP 768:iFPCuSWxAknP3gQlE3brX+48360GKKAC4FZ8ELh/SAE9gnmlV:iFPCuSonPJErr18ZGKK1oLQH95
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000002

Path C:\Users\Admin\AppData\Local\Temp\msncld5p.0ln\Default\Cache\Cache_Data\f_000002
Size 99KB
SHA256 cad25cfcc108f11e81cf1a339916e956b5ccd3ab3da38a3bd7a3a7a01adcd3f4
MD5 86e9c0ad8befdb46f1ecda1d3f2c70ad
SHA1 cf9520c235db04ac02e98a7f7c9f3d5d631d4199
SHA512 30a1265891f03df0c46d4f310d97ffa312b84d485a214d895a1c5e260474260d6637592b20d9cf4efa507c131694f63253577fdb352e8e0c46505e02183e0ab4
SSDEEP 1536:GAqrSnLU5BxYE4bP9zel9rbvjJvNCLtY25wJ0qPKldrT6LTMyT2ItH3RHTZ:GAqrSLSvYEwsVbrTfUPdqL4S2iTZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000003

Path C:\Users\Admin\AppData\Local\Temp\msncld5p.0ln\Default\Cache\Cache_Data\f_000003
Size 63KB
SHA256 e4802c53b33c408c166435c771b044a85b5a2117c938cb18a1dcba0a4cb6c9f0
MD5 029f2c272cfb8ff949480df0e862a7bd
SHA1 693fe5eab5da743cbf4ff97a75130ed38401f914
SHA512 092c32978d113f6796ce261ba9bc02b64ccedf6493c66c2e7b8e0b8b420ead250c76b4eb83a15e4506870d00b9ffdcf27da6b4a95174b743cc5d205c62acad04
SSDEEP 1536:/kCVbNPAWQquXVNEug9RkthKuQfHiPLtvUFFJcPwngLCqp6:/kCdtAWQlPiMt60LtvUFFJJX
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000004

Path C:\Users\Admin\AppData\Local\Temp\msncld5p.0ln\Default\Cache\Cache_Data\f_000004
Size 384KB
SHA256 a6c6aa996815cfbba8f68f289f1bfedef04c070a90be8477fcf0a2ebff83f014
MD5 732ec3e73c2fbd09ab329056045db82d
SHA1 41092a7a563735ca06bedefec8608c73211a876d
SHA512 c50417d4b8f314de8ce72cfd1831fcdfd6eef0e80e8d5eb3be7a3f41450c82c334825c05d0d2f694ef7d80d4dacd1c70fc47c69f1b10d15bdafa70ce2b4a0275
SSDEEP 12288:lakxulWoAq6wIY56RxdRheMchcNaiGKGB/B:lQlWoAKIY56HhkhcMtp5
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00000a

Path C:\Users\Admin\AppData\Local\Temp\msncld5p.0ln\Default\Cache\Cache_Data\f_00000a
Size 72KB
SHA256 60263c7f2f418ebd47d8f654ff83fc7a85b5e4321e17d3f07725d81d09787e1c
MD5 f4a78ee2c4bcf1974ec8da85b17e62d6
SHA1 1adef41a1b6b79a42062cbd20c31af906c5a07dc
SHA512 8fd53cd1d3b220998ef74e7ad97c798e0dadbf47d4f03d70adfdb539a86e3781ecd9f4e4b108da5678d333bebc5db85795bc8e5c355912de4bed6e8c380598ee
SSDEEP 1536:eojWGWaffvHwRMAkgdswevDQ6yxccXu4rbmcf+E3FL/nMhA0Vn:0an+M0dqvcFccNmcfvd/pYn
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00000b

Path C:\Users\Admin\AppData\Local\Temp\msncld5p.0ln\Default\Cache\Cache_Data\f_00000b
Size 16KB
SHA256 283e231a1dedf20c3f98eb1452ec52d042179d31a6ee482e54b51066074faf42
MD5 46b49aad1412c12943384f8afb51204f
SHA1 e6a38f254f0681007745ededdde176ec64670723
SHA512 8b521405691a78c9f03740f2484f6f07ae881cb1ea5d18336fa44771ec025d1dab438c1a849c30a3b7fbabd9dc391fe4aff499a09de1af6391611d1752ee8d45
SSDEEP 384:iEEbbexRg+TpS0d0qXYsoXB+SBuqkXL214/R7MI7fm:WexRbw0/XYf+SBQ/xMD
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00000c

Path C:\Users\Admin\AppData\Local\Temp\msncld5p.0ln\Default\Cache\Cache_Data\f_00000c
Size 28KB
SHA256 b421c05a340e40d4d4bd1831521268b6f0afd0461ec3991cfa8d5314bf3207b4
MD5 57f9a7c7e2be49102533a2ceb7a05e51
SHA1 850ab0a80577b7f7effe196cba037899e71594c5
SHA512 66406d54a1d1a44f30e19a9bff1242b50fdcfbf66c33e4c23daaa756c06f50a2e39c991e7a8dfd9a81184cc37c2062d0406070be132e28a22307896e63b55447
SSDEEP 768:dT+CJ4QL+F8S4bApn9Ua0ndjCaixJ/fVW2/AGYnS:TJ45F8SgjXnNCa4fVWVnS
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00000e

Path C:\Users\Admin\AppData\Local\Temp\msncld5p.0ln\Default\Cache\Cache_Data\f_00000e
Size 68KB
SHA256 fe2fbf50c33ae9e12935df44eb094e541236f27fbbd97ec1bdaec2bf03e69054
MD5 7f3bae3ddb127530a3b1ec2c8501a056
SHA1 3d2a9ec8ebda8961af05bd4f2fbe0aea180fa762
SHA512 e8a5c7cbb1081d5e229b231b3e50a2d0211082981a44628cb6e01dee18087b73240633f649fc1a0103f24613178973997d7a74961bd4ea7dbea49296c48b0e10
SSDEEP 1536:NupBZ1xSO3cQmUY/lbFBw70hbBD9AfA1pwdpPq3Yf3AZ:NunZ18O3NOlJpd+kpwdpi1
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000011

Path C:\Users\Admin\AppData\Local\Temp\msncld5p.0ln\Default\Cache\Cache_Data\f_000011
Size 17KB
SHA256 5e41837a6aba4a285df072ad0290e7f9e1dc4682799f71e33222a3a0d6e5a082
MD5 9e6475d889c8916a680317ec48b212c1
SHA1 daea8c5b6cf03d05fb8ee7fcc18320eefd2ee0ca
SHA512 7c4f34e50b5bf4bc95d59a2ae648a673e4a7dbb9669f73d6512dd12521335297886168c5c00f60cca5f85a655265c49355c3ad113e62124577f75f45abaf534c
SSDEEP 384:DlDTvwo0JYeOCqDG+G8fPv4yDs3HsxaYprRr2y0BYi1n:BXwoy9OCHifts3HsYKroBpn
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000015

Path C:\Users\Admin\AppData\Local\Temp\msncld5p.0ln\Default\Cache\Cache_Data\f_000015
Size 70KB
SHA256 30b4527ac16dda6093c174e8e842c7208d6c1cc26693f6f1a849d52b17b41d37
MD5 362644b225a27e4a658d69e9b17a8d19
SHA1 99e0fd685d570022b40800612b5dd13b801044a8
SHA512 cf1122d85319b28c69ccdf3f12b7362ffde1cafe952edb0e4a40370d1fb80dc6f8ab70e50ae8f07166c29e254d5a138ad8fb346d796752efbd14642afe5905dc
SSDEEP 1536:SPD6v1B+LiVECo6I6hUr2ZEwVjnZefbudrSb3fFQ9RMVFO:SPD6v1B+kvfYWnP5Sb3fFQT
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00001a

Path C:\Users\Admin\AppData\Local\Temp\msncld5p.0ln\Default\Cache\Cache_Data\f_00001a
Size 18KB
SHA256 cb78510332b46564f4369bf31ff85c1ab0016bbcef3110b9b9388b88f1cf4795
MD5 9e32121253edde20161adf93523eb060
SHA1 4b9267459ba3c68bd08e6492a270ccaefe2c2dbf
SHA512 7b5c22ac424e32122637c434f4a087b87ba43ac341c008a4df3d0f57f443e38c68f75ae6087e16cf3d7c651a8a35b80faaa8a28b866b1c0def48e3b6c451fae8
SSDEEP 384:USS65/+IiYmwVYkgDdUlzU7SjcKalWW4sIkb6d2e/Oc+C2kZu:lS64ZimDWz/jcK3WRIkMnmo2Su
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000021

Path C:\Users\Admin\AppData\Local\Temp\msncld5p.0ln\Default\Cache\Cache_Data\f_000021
Size 33KB
SHA256 89ab09e7b2d516d5292607553dec92832148ab1a3c37529b7ae4a108477cc387
MD5 baebf31c834043f30f329f8105626445
SHA1 743c63a89cb813094b68af4b8bd2886624c1a08e
SHA512 c98727173145a6b93cb3c1790d9067503966ff617ca50201c68e60051269223cf728b65b439456bf197921324c3f133c057690e8ceaf3f899561def9dc41cf74
SSDEEP 768:AdkIw38+GJp0WyTh17LiGi3m6W2MNc+0lgntGsWEOn:AdzoApU2Gu7INc+0l0t0
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000022

Path C:\Users\Admin\AppData\Local\Temp\msncld5p.0ln\Default\Cache\Cache_Data\f_000022
Size 16KB
SHA256 23cebdde3aa3c9b38e0647ae2bd6daedae2f62adee6521dbf726731d00bf14b5
MD5 fdbdb95b5ac5c4edecb625ceaccf87b5
SHA1 8da620668bc6b3ee6c2eac8c258d80afa06ead0c
SHA512 08c9c96ffa14e4be65c50bed0683a5d817ea190a493cca1119dbec30807a9e5846baa86c96dd97603620ee67c3acee2cda678cb246fdbd033aed1805aef1d2f1
SSDEEP 384:BhBYbM/UQhdWQz2xB4uINwHHKwq2Lx+J7Yj83GyEskVvyWpg5Fe:DqQUwWQz2xBrnnbNLUBYI2yEVVKWpn
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000036

Path C:\Users\Admin\AppData\Local\Temp\msncld5p.0ln\Default\Cache\Cache_Data\f_000036
Size 17KB
SHA256 129869a663855feceda858c947161e71ffbfc4c6b989af8c43660e064e3bdcb3
MD5 41f7733899baebd46ca67703ebaa77bc
SHA1 f337c055af531d4cc0fda456868bc89a841d8121
SHA512 57d866082bc507b88afbfa4fb5baa8df6f22537f9de4219736920c346fe7d12914d7e57a2f5890bfe6b4eb5b0c89f9a51f5e0a0a24c417dfd7062761c53a35bb
SSDEEP 384:KiAGf872QJNGMP13OFVfLuEtBFUCHkvQZITj4Z2YJEv8HIt2LF:0GEyqf9ezKEtBFUzv74o2HoY
MD5 SHA1 SHA512 SSDEEP

Submit Download

ExtensionActivityComp

Path C:\Users\Admin\AppData\Local\Temp\msncld5p.0ln\Default\ExtensionActivityComp
Size 4KB
SHA256 8c471cab38a1696289186d01b06ff6af2a888852dc18d6fb8d2a0e54898104ed
MD5 d25d5e1dc1d93430e64ee17e48ce442e
SHA1 d5c7ca9a57e6cc68927a249fe8e601d52680ac7a
SHA512 f4cff7510b4ad81090e0b1842652f8eb7995f7aefd0ce651151bc24ca3a4305d34ecae41cf193d9b846e8f6359ccf545e5d05e63e6e766fa9761ccebce620f6c
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Temp\msncld5p.0ln\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 192B
SHA256 795074246c0795b9c68f8ad1d01646727f5736d071fe562fc953f27d4725eaeb
MD5 64ed33e001587e5b3ad39c17e4db6840
SHA1 257171afe02bf47c991b5c715bbf70718a363e5a
SHA512 7fd56a15ec129a326c1807c1c57d3054ff30bef40e916b3aef334f3662369ade10c0ede4ca4d0027cfb2e24865cfcbff445d3cf10058390c4e2684e0302132d7
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Temp\msncld5p.0ln\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 257B
SHA256 b6c16069acf0d24e59031a57fa6d9ec6003ef71eb7b6894b98f65a8b882a0a93
MD5 8ded096d54cdda77e58952e55c3f04b5
SHA1 2e3dcc8d54471d6e8a794bff48b53dde2ee8313c
SHA512 05280ce8e60c82bfb2c2319d403de5d37266060e49fa9c7dceec1e6b80e80edfe61a1eb3467978cd2378de37caa672aca297aa874b856fe4303c2f9eaedcabcb
MD5 SHA1 SHA512

Submit Download

index.txt~RFe58f7f7.TMP

Path C:\Users\Admin\AppData\Local\Temp\msncld5p.0ln\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt~RFe58f7f7.TMP
Size 119B
SHA256 7d8ebbee1d40c0d51976e432641377647a2297cb055ededf1a052342fb14cbd5
MD5 338698cbdcdd543dbd07cf91c9e9dbaf
SHA1 1230705352c4532a85b2531031600f48ae3e0170
SHA512 4225710a1788dbe77530ef8904249e8bf1b0eb20cd684b4f831871e7031fdda00ed9df92947fadf527b944e58fdda3a5611ea67321eadaadf8703f5ec7fafb3b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\msncld5p.0ln\Local State
Size 3KB
SHA256 294e74fcec1544811ea623bc9b70c83c46980d497b9cb049f14919b73d415e97
MD5 640e8e5f8b54a9f83a164a3fb99c9d71
SHA1 e584e8e8b4307d3b58af64897748b116d5fbd8ae
SHA512 1fcb2e23035da2750a0fa735383405ff56179bbce0421604590cc1b6050091055b5622f431f04e7512a22bcebeeb87403d31bba67ff170f4381d0143b62d538a
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\msncld5p.0ln\Local State
Size 7KB
SHA256 8373cce6734e6759b09386a4c98baf031843136aa4512f3c1ce3839f4a1de33b
MD5 f4f1c70de3b18370487732dec3810df0
SHA1 e06ee4790a853ef2126004d05a0b388e6bacee7c
SHA512 3e5fd84d24320b13d9838e38d48e410528e69f53e8c58972f8b536f8b127b5223da376afeebc1d54dc089b9e981ffce6a9ba97c7fd1899013a4b86b4cf276b08
SSDEEP 192:uuUL8NBIB2MrKoDUhGBAyQh/kXZUXYqOq6:nC8NBIBB/cpd0qh6
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\msncld5p.0ln\Local State
Size 4KB
SHA256 959fb769e6799eb792a01b5012a04d5b0bc3b45fb9e6dc8da267072cd9468a4c
MD5 1742a38a5c32f8f7274b5a6d27ab3208
SHA1 b3110cb32428910a1a2f74ce47512d8aeb6d6f3f
SHA512 628323fda685449b1381a8e784fa33371832f65abe997736795527ccd713cda932b196693dd5e289907e81e819310ed0fc94b312733d0df3c054c0921c28ef88
SSDEEP 96:XqGNkCufT41b58Frh/cInURoDotovZxKDBMLBXPEvjjrG0JXYCUqwsBXa:6GNbMDooDUw0BofyGkXZUd
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State~RFe58ed59.TMP

Path C:\Users\Admin\AppData\Local\Temp\msncld5p.0ln\Local State~RFe58ed59.TMP
Size 1KB
SHA256 522ce7bdb4756b2b914e9429a6164e01dcb88ddfa40598d69ea54191ec04cabd
MD5 39046bd9d168e4bd6ec11967d1affa68
SHA1 4c8633d578a7db9ae05d0325f7614f920e29d81a
SHA512 02363103b7b726b697a73a202f029144b69205f5af5b011ed9f108902cbef60834ff8b2f54c7fb34a7b524ca35bd6fbdb688efd4888bdfc9e2fdb38c947b17fd
MD5 SHA1 SHA512

Submit Download

ccba5a5986c77e43.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Size 4KB
SHA256 8e95c0520107e95281bc3bc5d51ea2c4032b7cdead8eecd6ff51438979b42f4d
MD5 030aa5255710b13804f1656461fb3c45
SHA1 ac1f3b38cc74bab3f8d8488f0d1e47d9f4060f13
SHA512 c10b53174d531ef3b1e721d7d3eb3757ee470a9cfdedd943772d29e8210ea225ef45fa30cf4391997fca76586e817245587989051f1513387fbcd6bfc727021a
SSDEEP 48:1G/KdOnFX7oE4J9zUoYvedLXuHoxUpZ3/KdOnFX7oE4J9zvYvLgdLXuHoxv2n:+ZyJUoemuIxUTZyJveLIuIxy
MD5 SHA1 SHA512 SSDEEP

Submit Download

11d82aeb-db44-47bd-92bd-cd6242e8f244.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\11d82aeb-db44-47bd-92bd-cd6242e8f244.dmp
Size 65KB
SHA256 66b3cb57290000d196c318894264a014d27f209504ef240f9e9fc801fb9fd388
MD5 3ed0fd7dcb1f7ffa6709544cb570cf84
SHA1 7c52dd7d06ee1fc5044ae21881ea4a54cdca5f35
SHA512 3f0e8b49d122f03a87660f165093eaf2d2279577d6978aab885e96eeaf08439662c2eb71d9264984316008dfedecb3b0f3012bdb70277100981fe07da798f203
SSDEEP 768:vDmmAAt/ReckAK6n2pBW8eWUdrWhf/681oRnGv:lt/Re9APncBW8eWMrWhH6+oRW
MD5 SHA1 SHA512 SSDEEP

Submit Download

11d82aeb-db44-47bd-92bd-cd6242e8f244.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\11d82aeb-db44-47bd-92bd-cd6242e8f244.extra
Size 10KB
SHA256 555b35f434c27456a760cacb64e716bd34c61eecd3e80c1b9fd7a7131053f339
MD5 d22e8d5ff1bf669525cd25dfab3a03b9
SHA1 49c73b7912a0e2b1651136e4b13d8026680438fa
SHA512 c16567af15394c3bdd5795136d8c37c86cb48b5d9e7811e646ae3928ece8e6deb126e8ba7e06357ea1868a6964d0b8203a154fe0fed388154296ba5e0442d20c
SSDEEP 96:S7WC2dATc16Y6pw6FF29dW640Rh7CsevBb1d0pjMLlIrLlhTLlaXv7aAcBvtILIC:ShuMzYL/7uvZ8FLTxsPpwlmbfoS
MD5 SHA1 SHA512 SSDEEP

Submit Download

11d82aeb-db44-47bd-92bd-cd6242e8f244.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\11d82aeb-db44-47bd-92bd-cd6242e8f244.extra
Size 10KB
SHA256 823ca3ca89ed53fcb17d41496669d8e9bf5ff1d784bee9125731fd6321530c37
MD5 6389313677b389c666e0c362864ecbce
SHA1 1712c18ea37769dd50e51bd733ac22bf0208030d
SHA512 b58cff7fb0082e420964c2178d66b30186e18396abefebe7997f9fc3180b298b1dd7dd5b0004d803d769d128105a131196a70f3ac526179d470d277c93af8982
SSDEEP 192:ShukcFaiR4MmnQYapdVxzPPWBHQ4TofKNdal+bfoibLtgtjt:eFcFaiSI13WBHQ4T3aaAie
MD5 SHA1 SHA512 SSDEEP

Submit Download

16461df9-5387-4bc0-8484-1f1e33c44c0b.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\16461df9-5387-4bc0-8484-1f1e33c44c0b.dmp
Size 66KB
SHA256 1f1b799d8a8241bc70b666cb7a082ce021abb6d1550f01b00bb3104b731eb443
MD5 517b882f9426ecd47b7336d8f68d77e5
SHA1 174c92c26f54c90988bd72c457f1e3ce60c95ed4
SHA512 f4e8eec9d29f91def4fd22be1ad4bb37b0c7694fa20ef1c269b3c858782bd0d7bf3351e775c676e4f9e246c75d8f037b11eeeca02993dcbf63bdf39d7e15e3f4
SSDEEP 768:R7mmXjtvEDC4UTvo2pqTf3nSA681oRnGv:xtvEJUTo2pqTfCA6+oRW
MD5 SHA1 SHA512 SSDEEP

Submit Download

16461df9-5387-4bc0-8484-1f1e33c44c0b.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\16461df9-5387-4bc0-8484-1f1e33c44c0b.extra
Size 10KB
SHA256 a30b4a653dee634d1a0897420c1dace2d5c070ab7e052d37ab2db16155e314a7
MD5 3f18d5f55df70fad44d67908da88e165
SHA1 8e6ecb72d92ecdce9de7ff90a5426e5fda80e7ed
SHA512 881d74eb8896ea79aea9d4c52bf33e0a667c2bdf42a0d53471428c3cd039fc3602b594ba838f55089099bbba8cead6ed0f214b3aca7a4927d871308c6fa2a155
SSDEEP 96:S7WC2OATc16Y6pw6FF29dW640Rh7CsevBb1d0pjMLlIrLlhTLlaXv7a1cBvtILIh:ShJMzYL/7uvZ8FLmxsPpwlCrfoZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

16461df9-5387-4bc0-8484-1f1e33c44c0b.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\16461df9-5387-4bc0-8484-1f1e33c44c0b.extra
Size 10KB
SHA256 d56cc74ca051cf440738a8ca8dd7687f10e9259882f92efb8dd1b517c7e0f163
MD5 57e82875ce169d9363b64566423b8857
SHA1 6bb2e20042efc1dad23cefc54cb4e632b06f5efc
SHA512 4b1c31a0adce288f4b1cfee5721033d98150deba5149fe2f45d2e54140e6ed70fcb2ec7057269e1b8aa7eab16a6fa72ba9c40957f5ca0ddea7999eb44e743d2d
SSDEEP 192:ShJkcFaiR4MmnQYapdVxzPPWBHz4TofKNdalarfo1bLtgtjt:eucFaiSI13WBHz4T3aOA1e
MD5 SHA1 SHA512 SSDEEP

Submit Download

8e6447b6-0a29-46bb-98e0-dcfff0b5ab54.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\8e6447b6-0a29-46bb-98e0-dcfff0b5ab54.dmp
Size 65KB
SHA256 fa495f7cfc2c2889d9e36f3674aade3586f965a10d1e9159c509716e82071a56
MD5 92b39cf1ed091a41c3e3babe60146c13
SHA1 0d3833b8461beccb760459e5225bdd820618828d
SHA512 6d8877c376e094daf6ee1994da6e84cc8eac5ec353f9141526919b1a820d7e45662e064690d593576a1b0d9d49464dd2609096712e84dbbad088a393d14714f7
SSDEEP 1536:5ypA8AVaDXjyF8XQQfbhnDryVZFA6+oRW:5fVaDXjyFQfbhnDeVZF0oRW
MD5 SHA1 SHA512 SSDEEP

Submit Download

8e6447b6-0a29-46bb-98e0-dcfff0b5ab54.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\8e6447b6-0a29-46bb-98e0-dcfff0b5ab54.extra
Size 10KB
SHA256 7598e4ef1a81eb619cd2be3e5e01457aa97fffa3e478dde71d19324655cce1f8
MD5 c3404493fb6645a375f15868afcc1f39
SHA1 b775eb41723036b8bfadec0260a9b3cac36c411f
SHA512 153c2565c85a40a211ed0623fb02139b751beb29c7fa2f3509fd7bcb18602fac93cf0cae5dbff4b95f38ecd6b42e9e98a4c41e73ed5e80bdb24046179a99a518
SSDEEP 96:S7WC2jATc16Y6pw6FF29dW640Rh7CTvBb1d0pjMLlIrLlhTLlaXv7a2cBvtILI5o:ShMMzYL/7WvZ8FLdxsPpwlv/fob
MD5 SHA1 SHA512 SSDEEP

Submit Download

8e6447b6-0a29-46bb-98e0-dcfff0b5ab54.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\8e6447b6-0a29-46bb-98e0-dcfff0b5ab54.extra
Size 10KB
SHA256 755533277b04763ee9fcba9f80bcf54db90a7d9cc4880fe757a8a192dd46f81f
MD5 63374e705b148f94319ceb60b008461e
SHA1 3b21c6f74c69a7cde887909dd750f92e60987b5c
SHA512 14e4da0575d15b3f0d3b550f4d2ed11edf508af41a2c9c9c9adcf5a08ca587e4e90c625298deddcd68450f43af90c528812308a7e501329033ed9c30829bc8e4
SSDEEP 192:ShMkcFaiR4MmnQYaVdVxzPPWBHi4TofKNdal3/foXbLtgtjt:eDcFaiSW13WBHi4T3aBAXe
MD5 SHA1 SHA512 SSDEEP

Submit Download

d83df412-a944-4ce1-8b83-bf051c8250c0.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\d83df412-a944-4ce1-8b83-bf051c8250c0.dmp
Size 61KB
SHA256 a76e314a9c4000c64d83615bc3b1f1aede992f7868de9e605bd5cbbaef918f76
MD5 89c763ef4c7b26f0c3f6a2e8baf05325
SHA1 8a3796f90cb156ed17c857416e545b6914a6fea8
SHA512 8af1bf535b2788240a99ded7f73b798b14669dae6d8ecae8f172b756ec5d3da8aa615b2fac3679e26423ffa3f99a76a4306bcff62d26cb6f67e84ee11a89dfda
SSDEEP 384:H0CRrRpTraUZlwTrgFNY776mNCZW4KqKOoz1zQ681oRE0Z8l8SP5X:H0CRFpTra4lwTrgr989jha681oRnGv
MD5 SHA1 SHA512 SSDEEP

Submit Download

d83df412-a944-4ce1-8b83-bf051c8250c0.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\d83df412-a944-4ce1-8b83-bf051c8250c0.extra
Size 1KB
SHA256 87bdc1bdc601debce77587a5c1ab9da5e160c28307923d1305f76af35c831c6f
MD5 e2edc4f629f2c72bf4be094e2ce2200d
SHA1 9ae999a921b4cfc27e955ad824a0a9ed54707fa8
SHA512 28be9ae2a8975d45519a4bf5239d19d2b092b2480976cb9d1853a63dada8cb17b98b4f5761ef5f1eb335e4bbdcc35d227a6f88abf653bb7c7d3c6339602ce425
MD5 SHA1 SHA512

Submit Download

d83df412-a944-4ce1-8b83-bf051c8250c0.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\d83df412-a944-4ce1-8b83-bf051c8250c0.extra
Size 3KB
SHA256 130fa32dc6d04ef9fe5e0a1e8f67668bc66f33ee0c6d498f63e8f486c43da42d
MD5 ca8e876a0b71043e9d0972bfeab1cbc5
SHA1 67344001b5c44c8b792896b608f6a8d299d0cef0
SHA512 a6c436bef1994aaf9e55ceffd5061fe6517d8b87da8f31e44cb50926432262354bd1d740f781da1bf2cf288ba7f0b3ff6c2400a4a19fdb3b5a9d6e54259bffee
MD5 SHA1 SHA512

Submit Download

fc5a39c0-2801-457c-bce6-74b15a8f2be6.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\fc5a39c0-2801-457c-bce6-74b15a8f2be6.dmp
Size 65KB
SHA256 8c29373b5edae3011d7e2ecdd1dc8d9c321a3a7ac687a552848a8bb5e9dd567b
MD5 eef5be1dd73374a26c4d2ba3f4284641
SHA1 6cf3964bb272c66f34f023e8698a5a86e5a71257
SHA512 fab87164d68987aec0b62d0cf777139d9242b8aba5268bd10854df0c9aadc795dc08112855ea9ca314f4f5c7ed512e512111459e8381a56c7987527b58764b17
SSDEEP 768:s8mmuIxwIo+OLIMWcauGDQSeuC681oRnGv:Bxwl+SeUGDo6+oRW
MD5 SHA1 SHA512 SSDEEP

Submit Download

fc5a39c0-2801-457c-bce6-74b15a8f2be6.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\fc5a39c0-2801-457c-bce6-74b15a8f2be6.extra
Size 10KB
SHA256 e0be88191dfb2b262b390070717a25974e02e9932c53e743c86d00eb186fe4fa
MD5 1d7232fc0665e8ef2d2ef3d041a32390
SHA1 a880ac14fd617f93745d3a59f5a2f574a9a693c0
SHA512 540b5989667c845ede75c17d7d3c8d7f4ee4eb8fe7101cf9901b7407843bb5bbb870f29e30e772bdc55832957cca5b7d604cebe5c080a4c1ceb54618488009c7
SSDEEP 96:S7WC2il+ATc16Y6pw6FF29dW640Rh7CsevBb1d0pjMLlIrLlhTLlaXv7afcBvtI5:ShFl+MzYL/7uvZ8FLkxsPpwlHeEfo+Y
MD5 SHA1 SHA512 SSDEEP

Submit Download

fc5a39c0-2801-457c-bce6-74b15a8f2be6.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\fc5a39c0-2801-457c-bce6-74b15a8f2be6.extra
Size 10KB
SHA256 9fe4b22a1603b51980f3a3ea3c60e44f82838db0552968defbbb3b3c10e7d7d0
MD5 8643b7768ff496eb25c45a1b2f016ac4
SHA1 7154f1cfd1e7c43b5ebd3a98cb6d5a7d25485a34
SHA512 0da58fb95f7e63a8617755dbb872cf94fe5abc420bd2fc048493571257c83eed814a0b7e72f5d652614e8dde03edbb722ead684b1ec8adf36586a167a8b3c4e6
SSDEEP 192:ShFl+kcFaiR4MmnQYapdVxzPPWBHF4TofKNdalfeEfo+obLtgtjt:eF/cFaiSI13WBHF4T3aMEALe
MD5 SHA1 SHA512 SSDEEP

Submit Download

compatibility.ini

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1akhe1kg.default-release\compatibility.ini
Size 198B
SHA256 252b7fff962848c61092e82a3d87adca163849767713a93ab533bb397f1f53bb
MD5 ce9ef13caa8a74c25157b184aa038475
SHA1 db03a9935d8bb3ce6b120aca98feade536805160
SHA512 0f6f5053e78167ef5cc5fa70ed3a87dd116df0671a590299277a197341bed983e3d77e37ad2c33cd4afe880fab9ed1c7f7502210040617a01f97a81c1e1d4f29
MD5 SHA1 SHA512

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1akhe1kg.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 d4a5745e9a66087b6d219af5214db4c1d8d09839cc5745f0e19f81c424d894e5
MD5 e3b1ac0c271f474f7e3541e105b16211
SHA1 f4d4de92e4b23af254b52c2fc886b897a4e6622d
SHA512 0d4b2379f78a6beed3ff1e352c22bdee1f69b7d36b9f91fc67bdca8c870e7f7cc4224f78168d89695864abe8c2319e5b7144b04f212161c775d1dbd7666a5e6b
SSDEEP 192:691/66JozGzgCl6mSSdx27Ov5zboiZkM3yj7dSV:C/66JozGzgC1bXboiZL3yjq
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1akhe1kg.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 6fb5b8e5275d5963b3760c191f1c52248b7e475ef160694e83dc634e96bf87d4
MD5 cb29472ca493a0e4e6d78b6c515dbf1a
SHA1 eefb76f90a94d4e0b63882c458518915cb08552b
SHA512 3071396547cc730401acf9467f1d7b008723555221532b39dab706626a8c8f06d633a7646c4be7af96ce3679bae2632d01e68da5bcbea3ccea0aeb88578091d5
SSDEEP 192:627Ov5zboVkM3yj7dSJzD91/66JozGzgCl6mSSd:6boVL3yjIzX/66JozGzgC1b
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1akhe1kg.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 11187b66b17c0b52e7a16ae9c04953e49211437f7dfeaf6b8366c5599ea42f57
MD5 f83c8d2d1ec3e60c4ab54ff7df3889d8
SHA1 1a859f2be1a236a0f5fd5806b222fb97c3c0321e
SHA512 b2d36433dfb1aa3c8711a78e826aba4d3c1061983a7ea0c663c46ee5f766789ac5844919613cd80c995489c05806c08b00192c2f9672035afb8922f642463d37
SSDEEP 192:627Ov5zboPHZkM3yj7dSa91/66JozGzgCl6mSSdz:6bo/ZL3yjz/66JozGzgC1bd
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1akhe1kg.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 2bd65ab5bc2156eeeb2b8093c053a8e09f099ab6360b73583389172370759368
MD5 5835af3b82bfca2b35cd5f7b9d44003c
SHA1 a348155ea43190e2e54e50dcd38dcc4cf6c4611e
SHA512 cb4fa4b045b17bb10a752b3307bd2bc00da4b21a8fb6048444269d47da41e5238c93a4d302b017543407a11ce3fec74ec0ebf575828550e78f3edb4edb639d7d
SSDEEP 192:Mel91/66JozGzgCl6mSSdP27Ov5zboPHZkM3yj7dS:MeB/66JozGzgC1bdbo/ZL3yj
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1akhe1kg.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 1080d48456a3b6c5f382476484798017fc31c52e0c5e41d7f0d9797e5d3673cf
MD5 debabd7ddb1a889ad71cfa2f3b5c7ddf
SHA1 b8a98aac134b1f7cd181079370f4fcf4309b0e08
SHA512 70be8cfbff7513d6cdc74de57397c8e969a81b8a6d131bd1c14de84af27fbfa9b78a1a09601ff0e6034ba8bf68cebd4dc45bc731326a68e68ee613442fe64388
SSDEEP 192:gzD91/66JozGzgCl6mSSdd27Ov5zbowMkM3yj7dS:gzX/66JozGzgC1bvbowML3yj
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1akhe1kg.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 e1893b03b5693fe801e1e331777fbfc1869058aff7d9407d593152101210504a
MD5 6438f31057e6404a3adf2d3fbc9db790
SHA1 289db00eff9b0d5b7c0fefd5ccdfd7b87d903a67
SHA512 2ff32d1ed4a6a32711f3ddc7894b225b5b62eff7213fd5e49b0357a32a77ffbb354f9c9e076ef5c95bed1ff72a1cd2a80186825ff1cbbb9e94d98757f17f3b36
SSDEEP 192:f6D91/66JozGzgCl6mSSdo27Ov5zboPGkM3yj7dSV:f6X/66JozGzgC1b2bo+L3yjq
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1akhe1kg.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 10489ad5f272dd2aed64b7a815477720da4499c5c8ee38d822b9ff89c7c11a4f
MD5 2dbe5ec22ca19b19b7de6809bacbcfc6
SHA1 707d1c4f231c8a8e4aec89abcaaef162ef43f923
SHA512 30fc0c0cfe3cecaa8c36f6c86edb872069957c3bf6047318c8d76a7fd439946dd81e6f853e15075edc646723b3a4d917b57fc41f34c46144385020190ba8c577
SSDEEP 192:MQQ91/66JozGzgCl6mSSdP27Ov5zboPHZkM3yj7dS:MQg/66JozGzgC1bdbo/ZL3yj
MD5 SHA1 SHA512 SSDEEP

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1akhe1kg.default-release\datareporting\glean\events\events
Size 1KB
SHA256 c842d6a0e3fc0df9cee528be2341c40dfe8773ecdfa62746676602feac6e8199
MD5 cbe0d1234c54854ca292ba5be46458f7
SHA1 20a7aa6141e6280666198ab0a3bcb0ac40c3cbb3
SHA512 da336cd1c428e56c7967e4787d6ee914046bf4744ab7b057a7f70437d62e6d64de2bceb0b7aaf1ba954fb45b57020738f799a7c42d30f91d3a4088d3c84ed7d7
MD5 SHA1 SHA512

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1akhe1kg.default-release\datareporting\glean\events\events
Size 1KB
SHA256 74e4bb5d41c22ed1f362f32b140c1d3b2bf5e1288ef47160d3b40f66dd4202fa
MD5 7dddea3cd39f6f263636c92d1feb18c0
SHA1 a7df6f841b415ea246e732f56f3fa744cfbb94f3
SHA512 06cd98c1ab9d9782991bece2e0760ceef459cefc9c57ccd95eb65af5955485e4c1e09bee6d860676c741a38ffc65d05c5bc2acd612c9925122553debd3b29080
MD5 SHA1 SHA512

Submit Download

0638e817-abe5-47eb-b1fe-f1a7ea3ed4a9

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1akhe1kg.default-release\datareporting\glean\pending_pings\0638e817-abe5-47eb-b1fe-f1a7ea3ed4a9
Size 3KB
SHA256 31d91f85bd6886a000471c3c29614d22e0831fd104e87c5066b50a0214258962
MD5 9c4bb8d677726539828eccaef3e77a69
SHA1 402ce36199067214faa78177199ef619ea07b9e7
SHA512 c58ff4b658b83e31dc57090da938f43683278fd4d665ecb078f0d9ee653012d66c46898d38ef4368c12e343f5fa21a5d96d1e4be807c39b8453edff90687873c
MD5 SHA1 SHA512

Submit Download

2789d1eb-f64f-4e1b-be1d-ef4dc87de983

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1akhe1kg.default-release\datareporting\glean\pending_pings\2789d1eb-f64f-4e1b-be1d-ef4dc87de983
Size 886B
SHA256 3f271a0ccb2c1794499f79e8736eb9f0ebf12c29dc0f00de30cefd8d3946182c
MD5 c8deffc0ba2ebc96e75f618c6d274733
SHA1 bf4550d6c86460a7af11341463e136dd00cabdd8
SHA512 04967fbf7591a7d3d63cdc80d9fac15c22720463df63a8b57b4693027712fcea1f76a70ce0190604e7e1c260a041c80095b0a5640e947a16b0d909c4ab0c536e
MD5 SHA1 SHA512

Submit Download

39ddb77c-484b-4d1b-9cd4-9c91708de3fc

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1akhe1kg.default-release\datareporting\glean\pending_pings\39ddb77c-484b-4d1b-9cd4-9c91708de3fc
Size 2KB
SHA256 89c7c7a8aecf5c8ea7b09cbd6416b65d6a950fdbbc48336984d731f1efca1849
MD5 a2d05d07df0e06eb1f5588d5c3236b59
SHA1 18a94c1a5363c3bb0322ff0058d6680e160c1782
SHA512 0ad28eeb1534d0f62718aeeb9afa3b0ee022e8cd6e2838de3d938e530cdcec93c94b1abf9e1cdabb55a1349db816b85120b268d06892b309198aaeb557e4b60a
MD5 SHA1 SHA512

Submit Download

462b839b-c291-4b6e-8e6f-9e673df0cda8

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1akhe1kg.default-release\datareporting\glean\pending_pings\462b839b-c291-4b6e-8e6f-9e673df0cda8
Size 896B
SHA256 dcafad6caff93e16ab8f15ddbb3bba5a05fabf48e1f9f55def7ae2b6fe973a0d
MD5 f47305b18052a5bafec33a603a383cf9
SHA1 d478c6163190a481f65fdd9df6e19f87540d0660
SHA512 0808ec2e6d10dc5bf020c1695a9177c4935e9fb9f60148838335dbb3fbdcac8421e774f50dee0bb1c01a02c96a6e5f09508dcdca52468732ac7a82cbf79bf118
MD5 SHA1 SHA512

Submit Download

4ec3ea8b-5ec2-45be-8656-be1db48d3f30

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1akhe1kg.default-release\datareporting\glean\pending_pings\4ec3ea8b-5ec2-45be-8656-be1db48d3f30
Size 871B
SHA256 8154d9406d798f2d598d1d11bb4712e62921431fa0b1cbf2b38c306abf9dbd86
MD5 85b67422b391b46eb7f5910e240c9e28
SHA1 120ac04c5f93f92a0d04e225af37fac459ac64f6
SHA512 6ec4d5b34e433c46cece8f1059d33354ec973f6462d530fccfb8f22ee191da2e1b7f77026ddcfab2bb8df2dfbedcc777ba62351dfc36e65582d207221d6a7524
MD5 SHA1 SHA512

Submit Download

5768b98d-4134-471f-a89c-2e554edf25be

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1akhe1kg.default-release\datareporting\glean\pending_pings\5768b98d-4134-471f-a89c-2e554edf25be
Size 3KB
SHA256 74efd929f91e14c06321d01a80b56b488946428d25728a183d337a39ce301a35
MD5 0b8aeebb3963236852d2cce754a731ad
SHA1 1cfc4e3362c2f8c1fa8bee93f23ed63364d4013f
SHA512 a8ed9ffca17c6d1f6e8b9fb20d96eb8ce7d2f30a14d736fcf3c9e9f2106c82ad13d0e3a28a568b73be8955e9e52e74c28b9ea3b32ce51e4846dcc862e3c2d39c
MD5 SHA1 SHA512

Submit Download

6edd9354-bd86-4ac0-baf1-4e60998cef16

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1akhe1kg.default-release\datareporting\glean\pending_pings\6edd9354-bd86-4ac0-baf1-4e60998cef16
Size 16KB
SHA256 d5452d643b865fae30b13e4b33ff1393a5dbda6661e7a976045cf6b999cec41f
MD5 3cf66a5216c736678f9ce33c61fe929c
SHA1 f2f6825b93155b11589c8df113592e1a7dc15792
SHA512 57f065daca16fdebc5395de9a60b84b8e46f300255f8968c0edd1413b561f4801b84efd06279935fdb72f15f0446514151250aa8eb2ba91d0e0429624903faa0
SSDEEP 192:xeSzxN7ic5OYGsajzUgfkIbvMi21aw1fR8lm2df9iFlDDRW2yhu9PY7Y4e19B3AE:ISlN7ic5OOe1v7qFwY4wVQdv+hlr9
MD5 SHA1 SHA512 SSDEEP

Submit Download

6fe9a58c-9f9e-41b0-ba55-9ad63725c3bc

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1akhe1kg.default-release\datareporting\glean\pending_pings\6fe9a58c-9f9e-41b0-ba55-9ad63725c3bc
Size 2KB
SHA256 78565f919bbd5e0bc71d6d83bd359f39b310b1b49c041d87da425e27c7c6addc
MD5 a605cc41d8bc6457ba4f55b7e0cb77b4
SHA1 56d7fee80ecb5b1f57e07c97f8a4962913e6c303
SHA512 b30eaab4a5b64811b4d451ff15ce7b5f2e1b4f89454dc3bfd6f551565f5c8517c11b1ce7582bc6c588f4da4003de17608f3de13ca923be94391d06a75b71c1c1
MD5 SHA1 SHA512

Submit Download

7c9c1fd7-0581-438c-8c8b-35fdf847a857

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1akhe1kg.default-release\datareporting\glean\pending_pings\7c9c1fd7-0581-438c-8c8b-35fdf847a857
Size 3KB
SHA256 075ffdf3ccea9b310a68b6850dc3a9dfe53ba6cb819eca4739e3989d1f5633ab
MD5 11911d2fdbae63e47ed2c931559e989d
SHA1 c880d0951bb9cc16ba698ec521ba08eb3114ef2b
SHA512 ea442b6390e5d6cf569a65f5c0660e694ed8fc0f60708516aad93c16a1900ddaf9c11722eded8f063c5c1ff956ef766883339a3261a339064a22d022b6035710
MD5 SHA1 SHA512

Submit Download

94566453-6e57-407a-abb5-94172687c6e0

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1akhe1kg.default-release\datareporting\glean\pending_pings\94566453-6e57-407a-abb5-94172687c6e0
Size 3KB
SHA256 14cc5010ce5804de6a1c0965691238e2d78af220f52e24b2b21eb93e172d161d
MD5 98563e79fd2457739fe1fb97996dd45e
SHA1 19699fd06d8a3a3419b17ac803ce7192f383cf38
SHA512 b3726b33a01493e5498a73bce8ae02391cfe59f14abe5a400edb7e3325c75766257dcc07e10f6e56a2b982737d0e2d5e0b1495bee6944b7ff7a2790b75a670e6
MD5 SHA1 SHA512

Submit Download

b87a697e-4d21-4f57-9c57-8fec262d90b6

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1akhe1kg.default-release\datareporting\glean\pending_pings\b87a697e-4d21-4f57-9c57-8fec262d90b6
Size 235B
SHA256 07368ccffec1f8a58a0f99a8f17122c77844e2d1c0465b0efb76604b10aa6645
MD5 90e1379b6690369fa0e6e2adee329b85
SHA1 163db7a128e57f88d86ee5238a123d60d6613367
SHA512 6d60dc5df0323c8aed98b5181e06e1ca034ba899fe04c0efbdc40a00dc00bf50f822a8c972ecfa6fdaf91da98fade6e20a77ac9d8d96ea89fdd8406ecbbd8922
MD5 SHA1 SHA512

Submit Download

b9b841c2-52d4-49d2-8932-95702ccc86a4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1akhe1kg.default-release\datareporting\glean\pending_pings\b9b841c2-52d4-49d2-8932-95702ccc86a4
Size 3KB
SHA256 d894c7636fb04ec2d9c326e5d7d64b25e364b246ca85f86da554b40b2021e85a
MD5 5ba0a3a4f4c9aeb923e227ac9dcd1b6c
SHA1 0cb5c644dfd4400f838ac5d85199af139d07b296
SHA512 cffebcf66e542880e4659c9886b07bb4d9df2d4626e83963f482591e3570d463fa45c8c9e4bd630c80ee5e800faca4b83cecd0a9acf1172bfb9e32a2eb47d888
MD5 SHA1 SHA512

Submit Download

ca02ce17-2a24-4d3e-9403-0ee924c6acf7

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1akhe1kg.default-release\datareporting\glean\pending_pings\ca02ce17-2a24-4d3e-9403-0ee924c6acf7
Size 235B
SHA256 46e1331ffba22c42ac8bfc6dc97ec2fdfc9e477cbde811b30e241dd44afb60fa
MD5 89817838544dec5e8f101b64243a4c39
SHA1 450e3660d254ce376b420aec481d00ca8771c621
SHA512 c84f6249c7dc5fc62ddab699e302bd649d479a979e428b8966a1ade8fb45877338f1f5ddd759268e7a0d15101282f91848863fca1ab3eb53cf93933c38c58604
MD5 SHA1 SHA512

Submit Download

cce798bf-b749-4e21-86f1-531e58e3ae1e

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1akhe1kg.default-release\datareporting\glean\pending_pings\cce798bf-b749-4e21-86f1-531e58e3ae1e
Size 883B
SHA256 84bc6a9d2becae97aba89864693bfead73e33b45780ab59093e3941d73cde31e
MD5 9da687aa6018ec863da92bff0d4094e1
SHA1 009343d3121429685ac1adbf5a32fa69fb0ad2b0
SHA512 17f32bb73b87113ca4c2778535c01b47fbb35d4dce668b7fd72bd8a71e1ac0da442b21d077c71b1e34b799c7152728938be1f61c3a6c81a8dfa7dba8e35ded76
MD5 SHA1 SHA512

Submit Download

e4af4d2d-a504-4379-ae9f-ca06c91ec39d

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1akhe1kg.default-release\datareporting\glean\pending_pings\e4af4d2d-a504-4379-ae9f-ca06c91ec39d
Size 235B
SHA256 ccea4411a24648e9e07adef5f3e958d8b01426f1741798caf11cd394abf6b65b
MD5 6a67c9ca825c9f45e4252b2f4a8780d8
SHA1 71f146b25785df254619ae140df155b14a45dcb4
SHA512 c55cfcd7279787c5dff09af98c474237716a47bd4ab40008b8184b45afa4af25d1f119ed2d44af8809498b3be6f004756c29592be2191f6910d16ffae7b34b94
MD5 SHA1 SHA512

Submit Download

e9756090-62bb-4118-8de9-195e2ae32bba

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1akhe1kg.default-release\datareporting\glean\pending_pings\e9756090-62bb-4118-8de9-195e2ae32bba
Size 3KB
SHA256 4be7a4ac4ce7b42793a64215f822bd3068980d2bf2e46b918e4b152efc43b1b5
MD5 c2eda7a3544571bc550dbaf219d2d86d
SHA1 c8c317d4126e6b8f57558ab270c3f09509a31ba3
SHA512 22a097567162b73b763a9d16ec5ed92e18db9b4dd63507dfcc518a8fb477d76f639cbd00ab935dffbf5acb3fdb5ba824a4ad8982f246646a4d999679eb09326b
MD5 SHA1 SHA512

Submit Download

ea0e48ba-0aa6-4da7-8b05-3197f67ae19d

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1akhe1kg.default-release\datareporting\glean\pending_pings\ea0e48ba-0aa6-4da7-8b05-3197f67ae19d
Size 3KB
SHA256 ad0f800114f3b0bd69b2b3ed102dcb8e6d219bbc0a06f0a38f558d4526eb172f
MD5 1e1fd70207b6e2c2a2a359908b91e4f3
SHA1 c7c3bcad8a8a507fd8b6d12a8da8959ae376a003
SHA512 62005a9f3a10829b8998077b726c1f0ff4913c0e54def33619a2e3e963238a39702be584828363f6cf5b7a7ba2a2d1728d648da44afaac437dfd9196adaa3d02
MD5 SHA1 SHA512

Submit Download

eb0c9ffe-3a81-4d10-a359-04e795ed8fc4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1akhe1kg.default-release\datareporting\glean\pending_pings\eb0c9ffe-3a81-4d10-a359-04e795ed8fc4
Size 3KB
SHA256 16e4178f42bbfb76e0d7f229349e68de203696053b4831b6bcc17964dbe2f26c
MD5 5c14479b580d501633fe831dbd07c21e
SHA1 2c989d59bbf1e8a1bee23193f52916dc264c3542
SHA512 fc322a06a14d1410ec17db6d37cb03929c0de4ecbb803057606da27b71f774f376f513c92449577c75af11a820dbb0b2ba805fd5ee1549897700acfd9ed3deeb
MD5 SHA1 SHA512

Submit Download

f30b465b-51e5-43d7-b7f2-f07d2d0edd34

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1akhe1kg.default-release\datareporting\glean\pending_pings\f30b465b-51e5-43d7-b7f2-f07d2d0edd34
Size 235B
SHA256 e21e287cb7ebb43379bc1a670273a34436d18d4b66d58099e2c009ca76be9c2d
MD5 8e63370b1c95995debcfd518a75fb66e
SHA1 b3bc96e2e5654b21a255eef0b1a95e48ea9fc0cd
SHA512 bd4d71136818ef6ed4d82799fb93d0cd23971cc881f605fab4dc81b218fad558a0d05f0ff654ce302b2ad00dc595c47f0660a347019ffd4beae7e05c731357ce
MD5 SHA1 SHA512

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1akhe1kg.default-release\prefs-1.js
Size 6KB
SHA256 2ca58736cb9e894d55a190f31627c515dc595b66ce679be968e49f3ab8b92d74
MD5 6e7f33e5d4684f218b94aae9e1facd27
SHA1 c93dd2f1346dda19e3361b5b125c21f82978147c
SHA512 3bc477eb7eb257cc3fbcb645c324bd8b57e089e357aac01d25f5a0071ba108705e0e1797a60ddde7c02c92335b299213fa2f81e3201c3d9354cb8651bea55645
SSDEEP 96:xHQUTUYqGqNzfrK00n41zSRIvSSlDsdv9jfnnrH8WBw88n8L4cnyHhu0n:KjRNzfr+4nSStM8WBw88cO
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1akhe1kg.default-release\prefs.js
Size 6KB
SHA256 98d4ab6c72a8cfd621addc931e0e96c47225f6ba7b70788685bba21d14514979
MD5 a06a564a29d188e8d70f55e5ffcf7cca
SHA1 01b878b67775c23bca345623b5207f88f078856a
SHA512 c4fc7590b7d1159aed754772b6d162ece446caf1cc41b9676d4b83fea1878f8113cac46dfcea60e471b064211ad23774776178f48848f1b2ccfa356f5cddee6d
SSDEEP 96:xHQUTUYqGqNzfrKynU1zS7SSlDsdv9j4TnrH8WBw88n8L4cnyHZ0n:KjRNzfrVUGSStJf8WBw88pO
MD5 SHA1 SHA512 SSDEEP

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1akhe1kg.default-release\sessionCheckpoints.json
Size 53B
SHA256 792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da
MD5 ea8b62857dfdbd3d0be7d7e4a954ec9a
SHA1 b43bc4b3ea206a02ef8f63d5bfad0c96bf2a3b2a
SHA512 076ee83534f42563046d25086166f82e1a3ec61840c113aec67abe2d8195daa247d827d0c54e7e8f8a1bbf2d082a3763577587e84342ec160ff97905243e6d19
MD5 SHA1 SHA512

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1akhe1kg.default-release\sessionCheckpoints.json
Size 90B
SHA256 00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2
MD5 c4ab2ee59ca41b6d6a6ea911f35bdc00
SHA1 5942cd6505fc8a9daba403b082067e1cdefdfbc4
SHA512 71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2
MD5 SHA1 SHA512

Submit Download

Poleremid.Ter

Path C:\Users\Admin\AppData\Roaming\Poleremid.Ter
Size 319KB
SHA256 f770df24653b700b7f77b15cb265c7e6922a2f91dac6ae857d02b7a71e842956
MD5 146ff651f5bdbabc11e50ea407763806
SHA1 529045e5ea34e49a48b45c25bef3daecc987d0cc
SHA512 7a2f4702b0a0c802750851d0d743029c64211ed3b5b64b524a1986323c60dd6379ece7b4d8206a60c9d6abbe8c6eacf2f2623cb03e6013944995af49a65f97f1
SSDEEP 6144:W6z0bemofaiBDwi5JNambsF3poQljSvzn4flidNcBNwXzY0kGzLwOV:fzhZfaEwC2F3+USz4fSN2UkGAOV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Tich

Path C:\Users\Admin\AppData\Roaming\Tich
Size 4KB
SHA256 a936b47fffa65e2104403df60f294f41b188d78e6a2972155a4eb838421e7c44
MD5 fb65a750f0fe80f18d923cb16169fef8
SHA1 60e298f4fcb77d44447c746bf16a6983f67ca76b
SHA512 02a900250bb5c9d621bfe093d805b0acf0c2d83d65e6edee0a84e30d320f37f02c676f167423dfb6b8d675cb2ac536ebec103efb3fdbe8cddefb3ad3b3d555c9
SSDEEP 96:wXC5nJIVxE1w0te+Pxl8jiQeI1ePhJWHgEwOrlKcMCQd3/8:D5WbEDeS8dGTcst/8
MD5 SHA1 SHA512 SSDEEP

Submit Download

msiexec.exe

Path C:\Users\Admin\AppData\Roaming\msiexec.exe
Size 58KB
SHA256 3a90ede157d40a4db7859158c826f7b4d0f19a5768f6483c9be6ee481c6e1af7
MD5 9d09dc1eda745a5f87553048e57620cf
SHA1 1d0c7cfca8104d06de1f08b97f28b3520c246cd7
SHA512 2be940f0468f77792c6e1b593376900c24ff0b0fae8dc2e57b05596506789aa76119f8be780c57252f74cd1f0c2fa7223fe44ae4fa3643c26df00dd42bd4c016
SSDEEP 768:uo8HL2TB4LHLbo77Q2d9xSDvYD07BOUp8VKfTKznHVXq6ayYf3:vTB4LG7B8jY4XprIHw62
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/760-1751-0x0000000000A30000-0x0000000000A31000-memory.dmp

Download

memory/992-64-0x0000000021280000-0x00000000212D0000-memory.dmp

Download

memory/992-66-0x000000001E910000-0x000000001E92E000-memory.dmp

Download

memory/992-52-0x0000000001020000-0x0000000002274000-memory.dmp

Download

memory/992-50-0x0000000001020000-0x0000000002274000-memory.dmp

Download

memory/992-3626-0x0000000022C90000-0x0000000022C9A000-memory.dmp

Download

memory/992-59-0x00000000210D0000-0x0000000021182000-memory.dmp

Download

memory/992-3625-0x0000000022D20000-0x0000000022DB2000-memory.dmp

Download

memory/992-62-0x0000000021A20000-0x0000000021BE2000-memory.dmp

Download

memory/992-3619-0x0000000022650000-0x00000000229A4000-memory.dmp

Download

memory/992-63-0x0000000021200000-0x0000000021276000-memory.dmp

Download

memory/992-53-0x0000000001020000-0x00000000010DE000-memory.dmp

Download

memory/992-65-0x0000000022120000-0x000000002264C000-memory.dmp

Download

memory/1884-269-0x0000020F9DF70000-0x0000020F9DF82000-memory.dmp

Download

memory/2164-34-0x0000000006D10000-0x0000000006DA6000-memory.dmp

Download

memory/2164-21-0x00000000055C0000-0x0000000005626000-memory.dmp

Download

memory/2164-38-0x0000000007F90000-0x000000000860A000-memory.dmp

Download

memory/2164-37-0x0000000007360000-0x0000000007904000-memory.dmp

Download

memory/2164-35-0x0000000006160000-0x000000000617A000-memory.dmp

Download

memory/2164-33-0x0000000005CF0000-0x0000000005D3C000-memory.dmp

Download

memory/2164-40-0x0000000008610000-0x0000000009235000-memory.dmp

Download

memory/2164-32-0x0000000005C50000-0x0000000005C6E000-memory.dmp

Download

memory/2164-18-0x0000000002360000-0x0000000002396000-memory.dmp

Download

memory/2164-19-0x0000000004DE0000-0x0000000005408000-memory.dmp

Download

memory/2164-20-0x0000000004CC0000-0x0000000004CE2000-memory.dmp

Download

memory/2164-30-0x00000000056A0000-0x00000000059F4000-memory.dmp

Download

memory/2164-36-0x00000000061B0000-0x00000000061D2000-memory.dmp

Download

memory/2164-22-0x0000000005630000-0x0000000005696000-memory.dmp

Download

memory/2364-1723-0x0000021E784A0000-0x0000021E784B2000-memory.dmp

Download

memory/2364-1584-0x0000021E77DB0000-0x0000021E77DC2000-memory.dmp

Download

memory/2388-2450-0x00000239FC240000-0x00000239FC252000-memory.dmp

Download

memory/2408-3424-0x00000283A2970000-0x00000283A2982000-memory.dmp

Download

memory/2776-1164-0x000001B6CBF80000-0x000001B6CBF92000-memory.dmp

Download

memory/3592-192-0x000001C30FD80000-0x000001C30FD92000-memory.dmp

Download

memory/3680-3317-0x00000279961F0000-0x0000027996202000-memory.dmp

Download

memory/4692-3338-0x000001DB8ACD0000-0x000001DB8ACE2000-memory.dmp

Download

memory/4692-3377-0x000001DB8ACD0000-0x000001DB8ACE2000-memory.dmp

Download

memory/5388-250-0x00000285FA130000-0x00000285FA142000-memory.dmp

Download

memory/5388-212-0x00000285FA130000-0x00000285FA142000-memory.dmp

Download

memory/5388-350-0x00000285FA130000-0x00000285FA142000-memory.dmp

Download

memory/5388-319-0x00000285FA130000-0x00000285FA142000-memory.dmp

Download

memory/5388-287-0x00000285FA130000-0x00000285FA142000-memory.dmp

Download

memory/5424-222-0x0000016830F20000-0x0000016830F32000-memory.dmp

Download

memory/5444-259-0x000001B5A0AD0000-0x000001B5A0AE2000-memory.dmp

Download

memory/5444-184-0x000001B5A0A70000-0x000001B5A0A82000-memory.dmp

Download

memory/5788-2042-0x000002673E4D0000-0x000002673E4E2000-memory.dmp

Download

memory/5788-2007-0x000002673E4D0000-0x000002673E4E2000-memory.dmp

Download

memory/5820-1765-0x00000000003F0000-0x00000000003F1000-memory.dmp

Download

memory/5896-3478-0x0000029C686E0000-0x0000029C686F2000-memory.dmp

Download

memory/6008-10-0x000001C12F290000-0x000001C12F2B2000-memory.dmp

Download

memory/6468-3334-0x0000018D88E50000-0x0000018D88E62000-memory.dmp

Download

memory/6468-3373-0x0000018D88E50000-0x0000018D88E62000-memory.dmp

Download