phantomstealer | 095dd3ed90661edc100fd8fbaabcfe0b855b308c51df390bb666622368a2c095

Analysis

max time kernel
149s
max time network
152s
platform
windows11-21h2_x64
resource
win11-20251015-en
resource tags

arch:x64arch:x86image:win11-20251015-enlocale:en-usos:windows11-21h2-x64system
submitted
31/10/2025, 17:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
_095dd3ed90661edc100fd8fbaabcfe0b855b308c51df390bb666622368a2c095.js
Size 1013KB
Sample251031-vj2fca1jht
SHA256 095dd3ed90661edc100fd8fbaabcfe0b855b308c51df390bb666622368a2c095
MD5 01d50097956726966151f342e7b55471
SHA1 2742082bde0127e0427612cd63bc48c5563b8a82
SHA512 66463470ed571554c8ab616b0fca82fb2b80d617537884d92a12e4295dca53f17568ef0ce2be68c429ffaec0bc383eb3ec19acb6b822fc98795d846e12126f10
SSDEEP 6144:CfYcJfYF6f+fYR2226fYA2222222226l226fB226fYcB22222226fYO226fY+22B:qgPF
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

adware collection discovery execution phantomstealer persistence spyware

Malware Config

Extracted

Family

phantomstealer

Version

v3.5.0

https://api.telegram.org/bot8458785334:AAGBvJVivkLeP9vHbvOWzZxBtCUpCFVEdvs/sendMessage?chat_id=1934716051

Mutex

O2HTXNUBRZ5JIT6443GD

Attributes

anti_analysis
0
cb_enables_ssl
0
debug
0
keylogger
1
start_delay
1
startup
1

Signatures

Phantomstealer family
phantomstealer

Badlisted process makes network request 10 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	3336	wscript.exe
3	3076	powershell.exe
4	3076	powershell.exe
5	4908	msiexec.exe
6	4908	msiexec.exe
7	4908	msiexec.exe
8	4908	msiexec.exe
295	4908	msiexec.exe
298	4908	msiexec.exe
299	4908	msiexec.exe

Executes dropped EXE 1 IoCs

pid	Process
4432	msiexec.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1912098173-3310702793-1420386224-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	msiexec.exe
Key opened	\REGISTRY\USER\S-1-5-21-1912098173-3310702793-1420386224-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	msiexec.exe
Key opened	\REGISTRY\USER\S-1-5-21-1912098173-3310702793-1420386224-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	msiexec.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1912098173-3310702793-1420386224-1000\Software\Microsoft\Windows\CurrentVersion\Run\msiexec = "C:\\Users\\Admin\\AppData\\Roaming\\msiexec.exe"	msiexec.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	explorer.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
1	drive.google.com
3	drive.google.com
5	drive.google.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
24	icanhazip.com

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
4908	msiexec.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
5104	powershell.exe
4908	msiexec.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe

Checks processor information in registry 2 TTPs 28 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	msiexec.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	msiexec.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Enumerates system info in registry 2 TTPs 12 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1912098173-3310702793-1420386224-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1912098173-3310702793-1420386224-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1912098173-3310702793-1420386224-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1912098173-3310702793-1420386224-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe

Modifies registry class 24 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1912098173-3310702793-1420386224-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1912098173-3310702793-1420386224-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1912098173-3310702793-1420386224-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	explorer.exe
Key created	\Registry\User\S-1-5-21-1912098173-3310702793-1420386224-1000_Classes\NotificationData	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1912098173-3310702793-1420386224-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1912098173-3310702793-1420386224-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1912098173-3310702793-1420386224-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1912098173-3310702793-1420386224-1000\{D0FA10AF-DF23-4D4B-9C5A-680E0867CA63}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1912098173-3310702793-1420386224-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1912098173-3310702793-1420386224-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1912098173-3310702793-1420386224-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1912098173-3310702793-1420386224-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1912098173-3310702793-1420386224-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1912098173-3310702793-1420386224-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1912098173-3310702793-1420386224-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1912098173-3310702793-1420386224-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1912098173-3310702793-1420386224-1000_Classes\Local Settings	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1912098173-3310702793-1420386224-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1912098173-3310702793-1420386224-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1912098173-3310702793-1420386224-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e80922b16d365937a46956b92703aca08af0000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1912098173-3310702793-1420386224-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	explorer.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
5448	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3076	powershell.exe
3076	powershell.exe
5104	powershell.exe
5104	powershell.exe
5104	powershell.exe
4908	msiexec.exe
4908	msiexec.exe
1908	chrome.exe
1908	chrome.exe
4908	msiexec.exe
4908	msiexec.exe
4908	msiexec.exe
4908	msiexec.exe
4908	msiexec.exe
4908	msiexec.exe
4908	msiexec.exe
4908	msiexec.exe
4908	msiexec.exe
1688	firefox.exe
1688	firefox.exe
1688	firefox.exe
1688	firefox.exe
1688	firefox.exe
1688	firefox.exe
1688	firefox.exe
1688	firefox.exe
1688	firefox.exe
1688	firefox.exe
1688	firefox.exe
1688	firefox.exe
1688	firefox.exe
1688	firefox.exe
1688	firefox.exe
1688	firefox.exe
1688	firefox.exe
1688	firefox.exe
1688	firefox.exe
1688	firefox.exe
4908	msiexec.exe
4908	msiexec.exe
4908	msiexec.exe
4908	msiexec.exe
4908	msiexec.exe
4908	msiexec.exe
4908	msiexec.exe
4908	msiexec.exe
4908	msiexec.exe
4908	msiexec.exe
4908	msiexec.exe
4908	msiexec.exe
4908	msiexec.exe
4908	msiexec.exe
4908	msiexec.exe
4908	msiexec.exe
4908	msiexec.exe
4908	msiexec.exe
4908	msiexec.exe
4908	msiexec.exe
5972	firefox.exe
5972	firefox.exe
5972	firefox.exe
5972	firefox.exe
5972	firefox.exe
5972	firefox.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
5104	powershell.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeDebugPrivilege	3076	powershell.exe
Token: SeDebugPrivilege	5104	powershell.exe
Token: SeDebugPrivilege	4908	msiexec.exe
Token: SeShutdownPrivilege	1908	chrome.exe
Token: SeCreatePagefilePrivilege	1908	chrome.exe
Token: SeShutdownPrivilege	1908	chrome.exe
Token: SeCreatePagefilePrivilege	1908	chrome.exe
Token: SeShutdownPrivilege	3944	chrome.exe
Token: SeCreatePagefilePrivilege	3944	chrome.exe
Token: SeShutdownPrivilege	3944	chrome.exe
Token: SeCreatePagefilePrivilege	3944	chrome.exe

Suspicious use of FindShellTrayWindow 46 IoCs

pid	Process
1908	chrome.exe
1908	chrome.exe
1688	firefox.exe
1688	firefox.exe
1688	firefox.exe
1688	firefox.exe
1688	firefox.exe
1688	firefox.exe
1688	firefox.exe
1688	firefox.exe
1688	firefox.exe
1688	firefox.exe
1688	firefox.exe
1688	firefox.exe
1688	firefox.exe
1688	firefox.exe
1688	firefox.exe
1688	firefox.exe
1688	firefox.exe
1688	firefox.exe
1688	firefox.exe
1688	firefox.exe
6000	msedge.exe
2388	msedge.exe
5972	firefox.exe
5972	firefox.exe
5972	firefox.exe
5972	firefox.exe
5972	firefox.exe
5972	firefox.exe
5972	firefox.exe
5972	firefox.exe
5972	firefox.exe
5972	firefox.exe
5972	firefox.exe
5972	firefox.exe
5972	firefox.exe
5972	firefox.exe
5972	firefox.exe
5972	firefox.exe
5972	firefox.exe
5972	firefox.exe
5972	firefox.exe
5972	firefox.exe
3944	chrome.exe
3944	chrome.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
5448	explorer.exe
5448	explorer.exe
1688	firefox.exe
5972	firefox.exe
4908	msiexec.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3336 wrote to memory of 4220	3336	wscript.exe	78
PID 3336 wrote to memory of 4220	3336	wscript.exe	78
PID 5448 wrote to memory of 3076	5448	explorer.exe	80
PID 5448 wrote to memory of 3076	5448	explorer.exe	80
PID 5104 wrote to memory of 4908	5104	powershell.exe	85
PID 5104 wrote to memory of 4908	5104	powershell.exe	85
PID 5104 wrote to memory of 4908	5104	powershell.exe	85
PID 5104 wrote to memory of 4908	5104	powershell.exe	85
PID 4908 wrote to memory of 1908	4908	msiexec.exe	88
PID 4908 wrote to memory of 1908	4908	msiexec.exe	88
PID 1908 wrote to memory of 4636	1908	chrome.exe	89
PID 1908 wrote to memory of 4636	1908	chrome.exe	89
PID 1908 wrote to memory of 5808	1908	chrome.exe	90
PID 1908 wrote to memory of 5808	1908	chrome.exe	90
PID 1908 wrote to memory of 4108	1908	chrome.exe	91
PID 1908 wrote to memory of 4108	1908	chrome.exe	91
PID 1908 wrote to memory of 2120	1908	chrome.exe	92
PID 1908 wrote to memory of 2120	1908	chrome.exe	92
PID 1908 wrote to memory of 1204	1908	chrome.exe	93
PID 1908 wrote to memory of 1204	1908	chrome.exe	93
PID 1908 wrote to memory of 848	1908	chrome.exe	94
PID 1908 wrote to memory of 848	1908	chrome.exe	94
PID 1908 wrote to memory of 3716	1908	chrome.exe	95
PID 1908 wrote to memory of 3716	1908	chrome.exe	95
PID 1908 wrote to memory of 4768	1908	chrome.exe	96
PID 1908 wrote to memory of 4768	1908	chrome.exe	96
PID 1908 wrote to memory of 6132	1908	chrome.exe	97
PID 1908 wrote to memory of 6132	1908	chrome.exe	97
PID 1908 wrote to memory of 2900	1908	chrome.exe	98
PID 1908 wrote to memory of 2900	1908	chrome.exe	98
PID 1908 wrote to memory of 3000	1908	chrome.exe	99
PID 1908 wrote to memory of 3000	1908	chrome.exe	99
PID 4908 wrote to memory of 4108	4908	msiexec.exe	91
PID 4908 wrote to memory of 4108	4908	msiexec.exe	91
PID 4908 wrote to memory of 2120	4908	msiexec.exe	92
PID 4908 wrote to memory of 2120	4908	msiexec.exe	92
PID 4908 wrote to memory of 1908	4908	msiexec.exe	88
PID 4908 wrote to memory of 1908	4908	msiexec.exe	88
PID 4908 wrote to memory of 4636	4908	msiexec.exe	89
PID 4908 wrote to memory of 4636	4908	msiexec.exe	89
PID 1908 wrote to memory of 5900	1908	chrome.exe	100
PID 1908 wrote to memory of 5900	1908	chrome.exe	100
PID 4908 wrote to memory of 5808	4908	msiexec.exe	90
PID 4908 wrote to memory of 5808	4908	msiexec.exe	90
PID 1908 wrote to memory of 4056	1908	chrome.exe	101
PID 1908 wrote to memory of 4056	1908	chrome.exe	101
PID 1908 wrote to memory of 5124	1908	chrome.exe	102
PID 1908 wrote to memory of 5124	1908	chrome.exe	102
PID 4908 wrote to memory of 4108	4908	msiexec.exe	91
PID 4908 wrote to memory of 4108	4908	msiexec.exe	91
PID 4908 wrote to memory of 2120	4908	msiexec.exe	92
PID 4908 wrote to memory of 2120	4908	msiexec.exe	92
PID 4908 wrote to memory of 2900	4908	msiexec.exe	98
PID 4908 wrote to memory of 2900	4908	msiexec.exe	98
PID 4908 wrote to memory of 1908	4908	msiexec.exe	88
PID 4908 wrote to memory of 1908	4908	msiexec.exe	88
PID 4908 wrote to memory of 4636	4908	msiexec.exe	89
PID 4908 wrote to memory of 4636	4908	msiexec.exe	89
PID 4908 wrote to memory of 5808	4908	msiexec.exe	90
PID 4908 wrote to memory of 5808	4908	msiexec.exe	90
PID 4908 wrote to memory of 848	4908	msiexec.exe	94
PID 4908 wrote to memory of 848	4908	msiexec.exe	94
PID 4908 wrote to memory of 4768	4908	msiexec.exe	96
PID 4908 wrote to memory of 4768	4908	msiexec.exe	96

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1912098173-3310702793-1420386224-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	msiexec.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1912098173-3310702793-1420386224-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	msiexec.exe

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\_095dd3ed90661edc100fd8fbaabcfe0b855b308c51df390bb666622368a2c095.js
1⤵
- Badlisted process makes network request
- Suspicious use of WriteProcessMemory
PID:3336
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe" B:windowssystem32cmd.exe
  2⤵
  - Enumerates connected drives
  PID:4220

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5448
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Recr=$env:appdata+'\Tich';$Grig=gc $Recr;$Shirtysepa=$Grig[4908..4910] -join '';.($Shirtysepa) $Grig"
  2⤵
  - Badlisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3076

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "$Recr=$env:appdata+'\Tich';$Grig=gc $Recr;$Shirtysepa=$Grig[4908..4910] -join '';.($Shirtysepa) $Grig"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5104
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\SysWOW64\msiexec.exe"
  2⤵
  - Badlisted process makes network request
  - Accesses Microsoft Outlook profiles
  - Adds Run key to start application
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - outlook_office_path
  - outlook_win_path
  PID:4908
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\jj5zcco5.d5h"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1908
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\jj5zcco5.d5h /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\jj5zcco5.d5h\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\jj5zcco5.d5h --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7fff3a60dcf8,0x7fff3a60dd04,0x7fff3a60dd10
      4⤵
      PID:4636
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\jj5zcco5.d5h" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=1900,i,12602338142204885772,9250050645421451125,262144 --variations-seed-version --mojo-platform-channel-handle=1896 /prefetch:2
      4⤵
      PID:5808
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\jj5zcco5.d5h" --field-trial-handle=1916,i,12602338142204885772,9250050645421451125,262144 --variations-seed-version --mojo-platform-channel-handle=1984 /prefetch:11
      4⤵
      PID:4108
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\jj5zcco5.d5h" --field-trial-handle=2132,i,12602338142204885772,9250050645421451125,262144 --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:13
      4⤵
      PID:2120
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\jj5zcco5.d5h" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=2848,i,12602338142204885772,9250050645421451125,262144 --variations-seed-version --mojo-platform-channel-handle=2880 /prefetch:1
      4⤵
      PID:1204
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\jj5zcco5.d5h" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=2860,i,12602338142204885772,9250050645421451125,262144 --variations-seed-version --mojo-platform-channel-handle=2916 /prefetch:1
      4⤵
      PID:848
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\jj5zcco5.d5h" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3260,i,12602338142204885772,9250050645421451125,262144 --variations-seed-version --mojo-platform-channel-handle=3300 /prefetch:1
      4⤵
      PID:3716
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\jj5zcco5.d5h" --extension-process --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=3256,i,12602338142204885772,9250050645421451125,262144 --variations-seed-version --mojo-platform-channel-handle=3304 /prefetch:9
      4⤵
      PID:4768
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\jj5zcco5.d5h" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=3332,i,12602338142204885772,9250050645421451125,262144 --variations-seed-version --mojo-platform-channel-handle=3356 /prefetch:1
      4⤵
      PID:6132
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\jj5zcco5.d5h" --extension-process --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=3360,i,12602338142204885772,9250050645421451125,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:9
      4⤵
      PID:2900
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\jj5zcco5.d5h" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=2804,i,12602338142204885772,9250050645421451125,262144 --variations-seed-version --mojo-platform-channel-handle=4036 /prefetch:1
      4⤵
      PID:3000
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\jj5zcco5.d5h" --field-trial-handle=4412,i,12602338142204885772,9250050645421451125,262144 --variations-seed-version --mojo-platform-channel-handle=4180 /prefetch:14
      4⤵
      PID:5900
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\jj5zcco5.d5h" --field-trial-handle=4460,i,12602338142204885772,9250050645421451125,262144 --variations-seed-version --mojo-platform-channel-handle=4476 /prefetch:14
      4⤵
      PID:4056
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\jj5zcco5.d5h" --field-trial-handle=4400,i,12602338142204885772,9250050645421451125,262144 --variations-seed-version --mojo-platform-channel-handle=4468 /prefetch:14
      4⤵
      PID:5124
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\jj5zcco5.d5h" --field-trial-handle=5072,i,12602338142204885772,9250050645421451125,262144 --variations-seed-version --mojo-platform-channel-handle=5080 /prefetch:14
      4⤵
      PID:5104
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\jj5zcco5.d5h" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=5136,i,12602338142204885772,9250050645421451125,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:1
      4⤵
      PID:3768
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\jj5zcco5.d5h" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=5164,i,12602338142204885772,9250050645421451125,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:1
      4⤵
      PID:5532
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\3nztyzal.kqk"
    3⤵
    PID:1072
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir=C:\Users\Admin\AppData\Local\Temp\3nztyzal.kqk
      4⤵
      Checks processor information in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:1688
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1964 -prefsLen 27097 -prefMapHandle 1968 -prefMapSize 270279 -ipcHandle 2056 -initialChannelId {b5b80fcc-8a5f-46c5-9453-15341f1b8c12} -parentPid 1688 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1688" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
        5⤵
        
        PID:2896
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2312 -prefsLen 27133 -prefMapHandle 2304 -prefMapSize 270279 -ipcHandle 2428 -initialChannelId {13eeadd3-ad49-4937-9c8e-b058e8c54fad} -parentPid 1688 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1688" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
        5⤵
        
        PID:2100
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\ac26ddd3-b009-434d-be70-cb51e951b624.dmp"
        5⤵
        
        PID:1820
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2624 -prefsLen 27133 -prefMapHandle 2280 -prefMapSize 270279 -ipcHandle 2852 -initialChannelId {b08130e0-b58a-4800-93ce-e3aa443ab34e} -parentPid 1688 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1688" -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 gpu
        5⤵
        
        PID:748
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\8b9e15b1-9e51-44d1-9d29-e42d4dd7eb46.dmp"
        5⤵
        
        PID:3584
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2856 -prefsLen 27133 -prefMapHandle 3004 -prefMapSize 270279 -ipcHandle 2992 -initialChannelId {3d2796f7-b557-4768-ae4c-e57170e5c685} -parentPid 1688 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1688" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 gpu
        5⤵
        
        PID:3204
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\edbce128-0683-494a-a4ca-01c64c46b2c1.dmp"
        5⤵
        
        PID:4468
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2996 -prefsLen 27198 -prefMapHandle 3504 -prefMapSize 270279 -ipcHandle 3524 -initialChannelId {04bf1da3-0684-40ab-886c-b381bc3bcf71} -parentPid 1688 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1688" -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 gpu
        5⤵
        
        PID:1164
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4008 -prefsLen 27323 -prefMapHandle 4012 -prefMapSize 270279 -jsInitHandle 4016 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4048 -initialChannelId {e547e61d-246d-41a7-a1c2-d142ca7870df} -parentPid 1688 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1688" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 tab
        5⤵
        Checks processor information in registry
        
        PID:1644
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\c7e7a1fe-f343-45c9-9e16-49eb394547cf.dmp"
        5⤵
        
        PID:4900
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3528 -prefsLen 27323 -prefMapHandle 3772 -prefMapSize 270279 -ipcHandle 3808 -initialChannelId {8bd749bb-6999-4208-9bf0-99e989f213f0} -parentPid 1688 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1688" -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 gpu
        5⤵
        
        PID:4968
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\76f8be77-038a-4cab-be30-1209eb0cec4f.dmp"
        5⤵
        
        PID:4980
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4388 -prefsLen 27323 -prefMapHandle 4384 -prefMapSize 270279 -ipcHandle 4420 -initialChannelId {51dfff8e-1818-4744-9e5c-c5c6d7c00b47} -parentPid 1688 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1688" -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 rdd
        5⤵
        
        PID:4832
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4700 -prefsLen 34822 -prefMapHandle 4704 -prefMapSize 270279 -jsInitHandle 4708 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4716 -initialChannelId {7ce64df8-db18-478d-b8ce-c8a28a5f391b} -parentPid 1688 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1688" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
        5⤵
        
        PID:5156
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 2784 -prefsLen 34929 -prefMapHandle 5228 -prefMapSize 270279 -ipcHandle 5240 -initialChannelId {5257d035-380a-449a-9635-3a7b6dbb90f7} -parentPid 1688 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1688" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 utility
        5⤵
        
        PID:5980
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ed0lbwzt.wei"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious use of FindShellTrayWindow
    PID:6000
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\ed0lbwzt.wei /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\ed0lbwzt.wei\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x23c,0x240,0x244,0x238,0x250,0x7fff385ff208,0x7fff385ff214,0x7fff385ff220
      4⤵
      PID:3240
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ed0lbwzt.wei" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --field-trial-handle=2040,i,13046255606443421214,5988084459901959429,262144 --variations-seed-version --mojo-platform-channel-handle=2060 /prefetch:2
      4⤵
      PID:5912
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ed0lbwzt.wei" --always-read-main-dll --field-trial-handle=1828,i,13046255606443421214,5988084459901959429,262144 --variations-seed-version --mojo-platform-channel-handle=2144 /prefetch:11
      4⤵
      PID:2392
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ed0lbwzt.wei" --always-read-main-dll --field-trial-handle=1864,i,13046255606443421214,5988084459901959429,262144 --variations-seed-version --mojo-platform-channel-handle=2396 /prefetch:13
      4⤵
      PID:716
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ed0lbwzt.wei" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3076,i,13046255606443421214,5988084459901959429,262144 --variations-seed-version --mojo-platform-channel-handle=3120 /prefetch:1
      4⤵
      PID:5456
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ed0lbwzt.wei" --instant-process --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3084,i,13046255606443421214,5988084459901959429,262144 --variations-seed-version --mojo-platform-channel-handle=3124 /prefetch:1
      4⤵
      PID:2628
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ed0lbwzt.wei" --always-read-main-dll --field-trial-handle=3296,i,13046255606443421214,5988084459901959429,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:14
      4⤵
      PID:5164
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ed0lbwzt.wei" --always-read-main-dll --field-trial-handle=3312,i,13046255606443421214,5988084459901959429,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:14
      4⤵
      PID:1748
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ed0lbwzt.wei" --always-read-main-dll --field-trial-handle=3320,i,13046255606443421214,5988084459901959429,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:14
      4⤵
      PID:4100
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ed0lbwzt.wei" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --field-trial-handle=3412,i,13046255606443421214,5988084459901959429,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
      4⤵
      PID:5580
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ed0lbwzt.wei" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --field-trial-handle=3428,i,13046255606443421214,5988084459901959429,262144 --variations-seed-version --mojo-platform-channel-handle=3700 /prefetch:9
      4⤵
      PID:1920
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ed0lbwzt.wei" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --field-trial-handle=3444,i,13046255606443421214,5988084459901959429,262144 --variations-seed-version --mojo-platform-channel-handle=3708 /prefetch:1
      4⤵
      PID:764
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ed0lbwzt.wei" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --field-trial-handle=3472,i,13046255606443421214,5988084459901959429,262144 --variations-seed-version --mojo-platform-channel-handle=3776 /prefetch:9
      4⤵
      PID:5244
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ed0lbwzt.wei" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --field-trial-handle=3408,i,13046255606443421214,5988084459901959429,262144 --variations-seed-version --mojo-platform-channel-handle=3796 /prefetch:1
      4⤵
      PID:5220
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ed0lbwzt.wei" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --field-trial-handle=3512,i,13046255606443421214,5988084459901959429,262144 --variations-seed-version --mojo-platform-channel-handle=3800 /prefetch:9
      4⤵
      PID:5908
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ed0lbwzt.wei" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --field-trial-handle=3516,i,13046255606443421214,5988084459901959429,262144 --variations-seed-version --mojo-platform-channel-handle=3824 /prefetch:1
      4⤵
      PID:5640
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ed0lbwzt.wei" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --field-trial-handle=3572,i,13046255606443421214,5988084459901959429,262144 --variations-seed-version --mojo-platform-channel-handle=3820 /prefetch:9
      4⤵
      PID:3560
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ed0lbwzt.wei" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --field-trial-handle=3604,i,13046255606443421214,5988084459901959429,262144 --variations-seed-version --mojo-platform-channel-handle=3844 /prefetch:1
      4⤵
      PID:3952
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ed0lbwzt.wei" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --field-trial-handle=3688,i,13046255606443421214,5988084459901959429,262144 --variations-seed-version --mojo-platform-channel-handle=3864 /prefetch:9
      4⤵
      PID:2344
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ed0lbwzt.wei" --always-read-main-dll --field-trial-handle=4928,i,13046255606443421214,5988084459901959429,262144 --variations-seed-version --mojo-platform-channel-handle=4916 /prefetch:14
      4⤵
      PID:3832
    - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=1128
        5⤵
        
        PID:1944
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ed0lbwzt.wei" --always-read-main-dll --field-trial-handle=5028,i,13046255606443421214,5988084459901959429,262144 --variations-seed-version --mojo-platform-channel-handle=5284 /prefetch:14
      4⤵
      PID:4428
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ed0lbwzt.wei" --always-read-main-dll --field-trial-handle=5328,i,13046255606443421214,5988084459901959429,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:14
      4⤵
      PID:4776
    - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=596
        5⤵
        
        PID:4832
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ed0lbwzt.wei" --always-read-main-dll --field-trial-handle=5420,i,13046255606443421214,5988084459901959429,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:14
      4⤵
      PID:3056
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ed0lbwzt.wei" --always-read-main-dll --field-trial-handle=5392,i,13046255606443421214,5988084459901959429,262144 --variations-seed-version --mojo-platform-channel-handle=3316 /prefetch:14
      4⤵
      PID:1052
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --no-sandbox --mute-audio --onnx-enabled-for-ee --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ed0lbwzt.wei" --always-read-main-dll --field-trial-handle=5332,i,13046255606443421214,5988084459901959429,262144 --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:14
      4⤵
      PID:6100
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\x1kwzxkp.zpp"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious use of FindShellTrayWindow
    PID:2388
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\x1kwzxkp.zpp /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\x1kwzxkp.zpp\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x23c,0x240,0x244,0x238,0x24c,0x7fff385ff208,0x7fff385ff214,0x7fff385ff220
      4⤵
      PID:1140
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\x1kwzxkp.zpp" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --field-trial-handle=2128,i,10091804049311470562,9160943703696613497,262144 --variations-seed-version --mojo-platform-channel-handle=2124 /prefetch:2
      4⤵
      PID:1548
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\x1kwzxkp.zpp" --always-read-main-dll --field-trial-handle=1792,i,10091804049311470562,9160943703696613497,262144 --variations-seed-version --mojo-platform-channel-handle=1940 /prefetch:11
      4⤵
      PID:5404
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\x1kwzxkp.zpp" --always-read-main-dll --field-trial-handle=2304,i,10091804049311470562,9160943703696613497,262144 --variations-seed-version --mojo-platform-channel-handle=2444 /prefetch:13
      4⤵
      PID:2892
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\x1kwzxkp.zpp" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3092,i,10091804049311470562,9160943703696613497,262144 --variations-seed-version --mojo-platform-channel-handle=3120 /prefetch:1
      4⤵
      PID:3536
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\x1kwzxkp.zpp" --instant-process --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3124,i,10091804049311470562,9160943703696613497,262144 --variations-seed-version --mojo-platform-channel-handle=3156 /prefetch:1
      4⤵
      PID:5132
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\x1kwzxkp.zpp" --always-read-main-dll --field-trial-handle=3420,i,10091804049311470562,9160943703696613497,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:14
      4⤵
      PID:5652
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\x1kwzxkp.zpp" --always-read-main-dll --field-trial-handle=3412,i,10091804049311470562,9160943703696613497,262144 --variations-seed-version --mojo-platform-channel-handle=3720 /prefetch:14
      4⤵
      PID:5392
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\x1kwzxkp.zpp" --always-read-main-dll --field-trial-handle=3468,i,10091804049311470562,9160943703696613497,262144 --variations-seed-version --mojo-platform-channel-handle=4412 /prefetch:14
      4⤵
      PID:4556
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\x1kwzxkp.zpp" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --field-trial-handle=3564,i,10091804049311470562,9160943703696613497,262144 --variations-seed-version --mojo-platform-channel-handle=4456 /prefetch:1
      4⤵
      PID:876
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\x1kwzxkp.zpp" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --field-trial-handle=3580,i,10091804049311470562,9160943703696613497,262144 --variations-seed-version --mojo-platform-channel-handle=4460 /prefetch:9
      4⤵
      PID:5544
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\x1kwzxkp.zpp" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --field-trial-handle=3620,i,10091804049311470562,9160943703696613497,262144 --variations-seed-version --mojo-platform-channel-handle=4496 /prefetch:1
      4⤵
      PID:968
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\x1kwzxkp.zpp" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --field-trial-handle=3680,i,10091804049311470562,9160943703696613497,262144 --variations-seed-version --mojo-platform-channel-handle=4500 /prefetch:9
      4⤵
      PID:1416
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\x1kwzxkp.zpp" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --field-trial-handle=3736,i,10091804049311470562,9160943703696613497,262144 --variations-seed-version --mojo-platform-channel-handle=4528 /prefetch:1
      4⤵
      PID:4796
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\x1kwzxkp.zpp" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --field-trial-handle=3772,i,10091804049311470562,9160943703696613497,262144 --variations-seed-version --mojo-platform-channel-handle=4536 /prefetch:9
      4⤵
      PID:1912
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\x1kwzxkp.zpp" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --field-trial-handle=3788,i,10091804049311470562,9160943703696613497,262144 --variations-seed-version --mojo-platform-channel-handle=4564 /prefetch:1
      4⤵
      PID:4824
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\x1kwzxkp.zpp" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --field-trial-handle=3828,i,10091804049311470562,9160943703696613497,262144 --variations-seed-version --mojo-platform-channel-handle=4600 /prefetch:9
      4⤵
      PID:5012
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\x1kwzxkp.zpp" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --field-trial-handle=3836,i,10091804049311470562,9160943703696613497,262144 --variations-seed-version --mojo-platform-channel-handle=4660 /prefetch:1
      4⤵
      PID:532
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\x1kwzxkp.zpp" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --field-trial-handle=3876,i,10091804049311470562,9160943703696613497,262144 --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:9
      4⤵
      PID:4056
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\x1kwzxkp.zpp" --always-read-main-dll --field-trial-handle=3924,i,10091804049311470562,9160943703696613497,262144 --variations-seed-version --mojo-platform-channel-handle=4656 /prefetch:14
      4⤵
      PID:3908
    - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=1140
        5⤵
        
        PID:2988
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\x1kwzxkp.zpp" --always-read-main-dll --field-trial-handle=3776,i,10091804049311470562,9160943703696613497,262144 --variations-seed-version --mojo-platform-channel-handle=4560 /prefetch:14
      4⤵
      PID:3420
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\x1kwzxkp.zpp" --always-read-main-dll --field-trial-handle=3756,i,10091804049311470562,9160943703696613497,262144 --variations-seed-version --mojo-platform-channel-handle=3080 /prefetch:14
      4⤵
      PID:4824
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\x1kwzxkp.zpp" --always-read-main-dll --field-trial-handle=4992,i,10091804049311470562,9160943703696613497,262144 --variations-seed-version --mojo-platform-channel-handle=4984 /prefetch:14
      4⤵
      PID:1420
    - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=592
        5⤵
        
        PID:5592
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\x1kwzxkp.zpp" --always-read-main-dll --field-trial-handle=5080,i,10091804049311470562,9160943703696613497,262144 --variations-seed-version --mojo-platform-channel-handle=5092 /prefetch:14
      4⤵
      PID:2780
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --no-sandbox --mute-audio --onnx-enabled-for-ee --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\x1kwzxkp.zpp" --always-read-main-dll --field-trial-handle=5112,i,10091804049311470562,9160943703696613497,262144 --variations-seed-version --mojo-platform-channel-handle=4432 /prefetch:14
      4⤵
      PID:2496
  - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\x1kwzxkp.zpp" --always-read-main-dll --field-trial-handle=6244,i,10091804049311470562,9160943703696613497,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:14
      4⤵
      PID:3080
  - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\x1kwzxkp.zpp" --always-read-main-dll --field-trial-handle=6244,i,10091804049311470562,9160943703696613497,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:14
      4⤵
      PID:5436
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\x1kwzxkp.zpp" --always-read-main-dll --field-trial-handle=6400,i,10091804049311470562,9160943703696613497,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:14
      4⤵
      PID:5832
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\yk2gfasy.rlw"
    3⤵
    PID:5540
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir=C:\Users\Admin\AppData\Local\Temp\yk2gfasy.rlw
      4⤵
      Checks processor information in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:5972
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1812 -prefsLen 27097 -prefMapHandle 1928 -prefMapSize 270331 -ipcHandle 2032 -initialChannelId {7faaf869-b0b1-44b5-b49a-e0a0013c6ba2} -parentPid 5972 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5972" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
        5⤵
        
        PID:5496
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2292 -prefsLen 27133 -prefMapHandle 2284 -prefMapSize 270331 -ipcHandle 2276 -initialChannelId {7ca4dafa-edb7-4232-a174-4a24254acc68} -parentPid 5972 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5972" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
        5⤵
        
        PID:5624
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\561e0330-5f61-4896-af6c-e505d7bfc73e.dmp"
        5⤵
        
        PID:5688
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2244 -prefsLen 27133 -prefMapHandle 2740 -prefMapSize 270331 -ipcHandle 2736 -initialChannelId {d4ddc9e6-3873-48a0-873a-2a71b1624d41} -parentPid 5972 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5972" -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 gpu
        5⤵
        
        PID:4968
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\5a5b5e84-44d1-4099-95f7-5554e2d022f8.dmp"
        5⤵
        
        PID:1956
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2736 -prefsLen 27133 -prefMapHandle 2872 -prefMapSize 270331 -ipcHandle 2964 -initialChannelId {c2205372-a81e-4668-9256-38f98b60e846} -parentPid 5972 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5972" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 gpu
        5⤵
        
        PID:2836
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3732 -prefsLen 27274 -prefMapHandle 3736 -prefMapSize 270331 -jsInitHandle 3740 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3748 -initialChannelId {1c91f8b2-1f7f-4a1d-a4a4-3ea8c1d59dae} -parentPid 5972 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5972" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
        5⤵
        Checks processor information in registry
        
        PID:876
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\c7d9fc2c-c3b0-4b32-8eba-39f86ff112e8.dmp"
        5⤵
        
        PID:2360
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2920 -prefsLen 27274 -prefMapHandle 2776 -prefMapSize 270331 -ipcHandle 3888 -initialChannelId {ef978813-694b-4aa8-8a33-5b87511dd5a0} -parentPid 5972 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5972" -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 gpu
        5⤵
        
        PID:3608
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\ca6dd935-13c1-449a-9f36-4037edda40c5.dmp"
        5⤵
        
        PID:3260
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4112 -prefsLen 27274 -prefMapHandle 4116 -prefMapSize 270331 -ipcHandle 4124 -initialChannelId {24765fa8-3dec-4737-8978-f04c3de78430} -parentPid 5972 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5972" -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 rdd
        5⤵
        
        PID:1540
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2396 -prefsLen 34827 -prefMapHandle 2804 -prefMapSize 270331 -jsInitHandle 924 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3004 -initialChannelId {cbbca1d1-2c31-45de-b5d2-0e1207e80981} -parentPid 5972 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5972" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
        5⤵
        Checks processor information in registry
        
        PID:3956
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4884 -prefsLen 34876 -prefMapHandle 4880 -prefMapSize 270331 -ipcHandle 4848 -initialChannelId {046c988c-b879-48c3-8446-71aa859f12c2} -parentPid 5972 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5972" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 utility
        5⤵
        Checks processor information in registry
        
        PID:5216
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 1948 -prefsLen 32818 -prefMapHandle 1932 -prefMapSize 270331 -jsInitHandle 2912 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2676 -initialChannelId {8e8c8528-3c33-4a12-8e66-72d08a4446d8} -parentPid 5972 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5972" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
        5⤵
        Checks processor information in registry
        
        PID:6636
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5504 -prefsLen 32818 -prefMapHandle 5508 -prefMapSize 270331 -jsInitHandle 5512 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5516 -initialChannelId {08904924-78a7-4087-a689-865367c132a1} -parentPid 5972 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5972" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
        5⤵
        Checks processor information in registry
        
        PID:6644
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5704 -prefsLen 32818 -prefMapHandle 5708 -prefMapSize 270331 -jsInitHandle 5712 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5720 -initialChannelId {43c15589-2f8b-4dcf-aa0d-d6ae322ec33e} -parentPid 5972 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5972" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
        5⤵
        Checks processor information in registry
        
        PID:6728
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\l5x5qosf.rtk"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    PID:3944
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\l5x5qosf.rtk /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\l5x5qosf.rtk\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\l5x5qosf.rtk --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7fff3a43dcf8,0x7fff3a43dd04,0x7fff3a43dd10
      4⤵
      PID:3784
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\l5x5qosf.rtk" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=2060,i,280199541205704328,3037107330333933810,262144 --variations-seed-version --mojo-platform-channel-handle=2056 /prefetch:2
      4⤵
      PID:3532
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\l5x5qosf.rtk" --field-trial-handle=1820,i,280199541205704328,3037107330333933810,262144 --variations-seed-version --mojo-platform-channel-handle=2072 /prefetch:11
      4⤵
      PID:2996
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\l5x5qosf.rtk" --field-trial-handle=2172,i,280199541205704328,3037107330333933810,262144 --variations-seed-version --mojo-platform-channel-handle=2188 /prefetch:13
      4⤵
      PID:744
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\l5x5qosf.rtk" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=2844,i,280199541205704328,3037107330333933810,262144 --variations-seed-version --mojo-platform-channel-handle=2728 /prefetch:1
      4⤵
      PID:1236
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\l5x5qosf.rtk" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=2852,i,280199541205704328,3037107330333933810,262144 --variations-seed-version --mojo-platform-channel-handle=2888 /prefetch:1
      4⤵
      PID:944
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\l5x5qosf.rtk" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3220,i,280199541205704328,3037107330333933810,262144 --variations-seed-version --mojo-platform-channel-handle=3324 /prefetch:1
      4⤵
      PID:6164
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\l5x5qosf.rtk" --extension-process --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=3312,i,280199541205704328,3037107330333933810,262144 --variations-seed-version --mojo-platform-channel-handle=3388 /prefetch:9
      4⤵
      PID:6172
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\l5x5qosf.rtk" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=3340,i,280199541205704328,3037107330333933810,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
      4⤵
      PID:6180
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\l5x5qosf.rtk" --extension-process --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=3400,i,280199541205704328,3037107330333933810,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:9
      4⤵
      PID:6208
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\l5x5qosf.rtk" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=3488,i,280199541205704328,3037107330333933810,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
      4⤵
      PID:6448
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\l5x5qosf.rtk" --field-trial-handle=4392,i,280199541205704328,3037107330333933810,262144 --variations-seed-version --mojo-platform-channel-handle=4404 /prefetch:14
      4⤵
      PID:7076
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\l5x5qosf.rtk" --field-trial-handle=4440,i,280199541205704328,3037107330333933810,262144 --variations-seed-version --mojo-platform-channel-handle=4444 /prefetch:14
      4⤵
      PID:2948
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\l5x5qosf.rtk" --field-trial-handle=4472,i,280199541205704328,3037107330333933810,262144 --variations-seed-version --mojo-platform-channel-handle=4396 /prefetch:14
      4⤵
      PID:5072

C:\Users\Admin\AppData\Roaming\msiexec.exe
C:\Users\Admin\AppData\Roaming\msiexec.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4432

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 0922a7d0b56e0c901a13d1617f99d752aa2abf5201089749005ecf7b413b4a91
MD5 e42748b8c5a22dfa1e01198891ce72ac
SHA1 c201063995355d307cc3916221eb9a0f10b5284f
SHA512 8be07fa5d55634cc5f7106eed3f78e5d0a21baf3bbedcfd79b55401d202a7e8d297f889d688ba0cf77a917632935bbccb43bb8c3622ff90dc4ab537ff840ad66
MD5 SHA1 SHA512

Submit Download

activity-stream.contile.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5rm9ff4w.default-release\activity-stream.contile.json
Size 5KB
SHA256 bc6829575cade8c38602e1b077fc626d2c0ac8bf09d63abc1169d86af128c0e6
MD5 f3329d5a2b0901b3a702961216abf112
SHA1 5d9dd0263a40327cf1c12bdc037ade5d7764ab35
SHA512 043bb9398b599cc512b277843af0110f4dc194c7ecff0a737baf23fa99cb104f3afbd0e766b8f51071617c2141eb92006d36500926aa7961dfe8d9e21eee04e5
SSDEEP 96:KjuJctv1iBd/bXdBs+M5Lap4rNojIz519pIAng6QakLl:Kj/tv0Bd/7dyplaOrNojIzT9eWQakLl
MD5 SHA1 SHA512 SSDEEP

Submit Download

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5rm9ff4w.default-release\activity-stream.discovery_stream.json
Size 24KB
SHA256 46ecb483621b8c9c84329dc48a033095452683d1d6f1446d65ff52fb61d9f7fb
MD5 9fbab40a3ce13b06844def044d0d3356
SHA1 84e80de437ce02624840664f7a5efd35d26da905
SHA512 685f3de4cf53c94584088cac13475e73591745a9927141d7bb26a39f00eae748a15c326c0360b20da39b8585afc73184ac4980c937e5c8fe70f47e4ce9ef8c0b
SSDEEP 384:pya6LlR5yRgE5kbRxtOh07IvfSnvyi1Hdnuu83Y4RtAsvhu1:pylh58072i11383Y+A
MD5 SHA1 SHA512 SSDEEP

Submit Download

577120C5183923526312DC856F6825FC1C7D072F

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5rm9ff4w.default-release\cache2\entries\577120C5183923526312DC856F6825FC1C7D072F
Size 14KB
SHA256 784bf634cda605f584536a7fcb4615ae428a533cca7dbf5b6f3e1db2dfc41394
MD5 2ca76e6e044857a2ed3f15be92b95fb2
SHA1 7de358da81d24f3091202dec7b49ed2caf504d89
SHA512 4b9344660d11e2982e40d2631a415b4212d29b7bd16849309a07c418e90e2bdae2567963d5818d45aa4895ed252904596dee533d18b944a4c9e0c207febf4eed
SSDEEP 384:HV9BpiO024YN7hSznZOML+CbcxDEclrIVy8eboCozi:1EZYN7hSz8MLPbcxDEcVIVy8+
MD5 SHA1 SHA512 SSDEEP

Submit Download

77e21b0f-0111-400f-9b4a-8b4928dd69ae.tmp

Path C:\Users\Admin\AppData\Local\Temp\77e21b0f-0111-400f-9b4a-8b4928dd69ae.tmp
Size 154KB
SHA256 a468f5875b4e55ea732e3df283b4f4ea941be738b238122979ca5d8006a3a8fe
MD5 4ad81f6ccc657d1da582c75c5db037cb
SHA1 ab0370e7d32ebed71fe9787d3a4a2fc0c652a28e
SHA512 66461474f8b36d6d470797df9d4a3cc4698bceb7054c97166eed98b74def84f58486fdb909928aaeafee793799a436210b5d7091acce6232b23eb6ba926ad227
SSDEEP 3072:OqeD5sKZ7XcbMSqnDhcfXE0IfnpWpyKIrFn2wNkR7aUPuWm6u:yD5sIXcYSqDGc0kkpIZ2weeX6u
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_oa4s0lsl.tji.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_oa4s0lsl.tji.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\ed0lbwzt.wei\Crashpad\settings.dat
Size 280B
SHA256 360fa118cc7cf8eac28f5163e86e6cd6be5949e4e91181712f8c370b068c6407
MD5 e6828341f1bc168cb16439e628b10749
SHA1 f958a3b55f396fa6d39dd0a96fd749d4ebdd2c6b
SHA512 b2e6bb565c1ab4de54172d5da97c237ed8c05d7970c004762489c5a1d66c378ed823a10631e76cb232bc1ecb53bfb18f98cc52c46f8b9b851cde9ac31ad848ff
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\ed0lbwzt.wei\Crashpad\settings.dat
Size 280B
SHA256 6d00879d9bbdd4b5d28defb5b33e292c86741ea06f463b34bd6667123b8a6feb
MD5 14268b28a67e6107bf42760d6f073a0b
SHA1 374f6fb9d9e56ac1c6300e00967428a47a227cd4
SHA512 6ae1ae4c4acb3a7f99c9e0e68491f87539fb6b1dba6f47b94d4f30a549cddbf41f6cfae8db8f911d14da31335bf46a5d79a7c941a299e866136086e02e3ae2ac
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Temp\ed0lbwzt.wei\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\ed0lbwzt.wei\Default\Code Cache\js\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Temp\ed0lbwzt.wei\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 192B
SHA256 dcc474f7a0f487b17a48e1833c1d5d3621f04cb513c681d8ef528cbe07dd932c
MD5 bc56aae347db0462b30fd144c024ef8d
SHA1 df5e635c119c76225d92cb3afe3059583dd392b1
SHA512 34c3f2c1258d07d3546eb611d74e83864e8a677cb7e94167854e3f9779c696b4885c30335dafbfcf27e15d0310076228397871f4fb8cf476abbf6dca417c3244
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Temp\ed0lbwzt.wei\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 257B
SHA256 74a46df3b46b521e68e54233688df2d83412e9fb4e403dabb37e56e0e04b1795
MD5 906b0e0aeca0ca4a01ddacacb8794833
SHA1 e5589d01df98b03a91605ad8e689a7bb20d12b87
SHA512 2a33dd20c3e55865478891aacbc5e37150a850ea56ce31ce157f7b31e4dccf895b64f6e81c2e4be4c9e44ff18f6c602efef05f2cffe0d36546c6bc9246401b5d
MD5 SHA1 SHA512

Submit Download

index.txt~RFe58724d.TMP

Path C:\Users\Admin\AppData\Local\Temp\ed0lbwzt.wei\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt~RFe58724d.TMP
Size 119B
SHA256 630f355cd03c74b3b244dfd7d20c4bba20dc92819647cc916ab7d584340ca4cc
MD5 5b59eb8c27dfc254c4013ec2474c501c
SHA1 271e498f6d9f2e9ba60861d12efade27740e6c81
SHA512 83b443d71ddd91789c4a794e82b7bdd7ddda59fdc61fd6e7202e161a032f4033e987f1d3df0a95286f02b3e3b08dd1cb0c7f85e0acf74bb21ca1c76dc3646d6c
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\ed0lbwzt.wei\Local State
Size 3KB
SHA256 8e9f385774e27cffedf5ee04cacbfc3f7269cf2036c226e66c6a18ae043ffda5
MD5 60ff50e31d9edd3df57d726e1cd3e4aa
SHA1 f5cc2ff90a464d196c7c22b66c05874ece78168d
SHA512 eebcd9147a4fcd50591ca5369c61ee6b9e51fcd548d45d6ec1245acbc183dfa07df7078a898035479ee850431a0a6e88b0250271995d94043f9ab3a8de8d1f68
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\ed0lbwzt.wei\Local State
Size 4KB
SHA256 a91c376ec1c80a7fbf0238ebcbb17fdb9ebcaee591f8aa960952a0d569d60ffa
MD5 309ab51de014ea156a0a44790b84dd79
SHA1 12357f2d71a653fe6c25f148c08e333b66e7325c
SHA512 890552e9fb740452cdd495bdbb65be0e512eec47cefcf148a24abcf482d0f073c44ef083ed69675343f097fd4a957a4d6fcd8b3cd6daaf3d7deada75c86ad61e
SSDEEP 96:rqGNkCufcNbE8ZC58Frh/cInURoDotovBxwDOBaYvjXcFCMGfJHbCU8Bwa:uGNbLHXooDUwGucFCMGxHmUq
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State~RFe586750.TMP

Path C:\Users\Admin\AppData\Local\Temp\ed0lbwzt.wei\Local State~RFe586750.TMP
Size 1KB
SHA256 90848dc20472e52539646e7f7403f3c01b57b8c03217c5ec754c5d59d762cb24
MD5 98cbd45e911d0b9bf978dada1242ff52
SHA1 cb9ddf4f6e5933bf5938c568aadfb7adf08a2639
SHA512 582bb7d2f3b4a5ae01fbf2a0bd1b1ed44bc7ab1c21bbdb2497f67c9f10be7fec81673811d4f87927bd39bd24a2188b800514ce420255ae096d61ffb31fa44410
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\jj5zcco5.d5h\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\jj5zcco5.d5h\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\jj5zcco5.d5h\Default\shared_proto_db\metadata\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\jj5zcco5.d5h\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\jj5zcco5.d5h\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\jj5zcco5.d5h\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\jj5zcco5.d5h\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

d4c6219f-6bdd-4041-b434-2f9c77c4b784.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2388_1547316916\d4c6219f-6bdd-4041-b434-2f9c77c4b784.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\x1kwzxkp.zpp\Crashpad\settings.dat
Size 280B
SHA256 5b25fdf65138fe8db836313f7bf7c6b03f34744334deea3cb1e4c00e3880b15c
MD5 ed988a8ba4ece5a503ce5bcd8716d356
SHA1 d83d0fa606b18c9d0c318623c75282d31c518f0b
SHA512 e954219058772bb4aa7842d5862698479ca6121525c38c10d57b8550580c27dbc6fa039f08b2bc421d5c972826f61f2f6005c947372896732de1fe22a17b1ab8
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\x1kwzxkp.zpp\Crashpad\settings.dat
Size 280B
SHA256 01d4287b6b914730d02925d17a9424ade0e1c24463b0f29ceeff6bb29ab832c5
MD5 69f612f6bf5082800c972084df07a8ca
SHA1 1206d81510dd041e60764e3beb25520621b7e587
SHA512 1285eb03c763006a784d9aeb23ab9c9c69f430f2c668ea0c3eba6c9bfe5a0fa17c4d7d8de153dc403a6d09df1265cbc4d3d2d18182c89f23b0bfdc35af256d01
MD5 SHA1 SHA512

Submit Download

70103ebf-bc8e-4478-a796-c1bbc9dcb132.tmp

Path C:\Users\Admin\AppData\Local\Temp\x1kwzxkp.zpp\Default\70103ebf-bc8e-4478-a796-c1bbc9dcb132.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

f_000001

Path C:\Users\Admin\AppData\Local\Temp\x1kwzxkp.zpp\Default\Cache\Cache_Data\f_000001
Size 99KB
SHA256 cad25cfcc108f11e81cf1a339916e956b5ccd3ab3da38a3bd7a3a7a01adcd3f4
MD5 86e9c0ad8befdb46f1ecda1d3f2c70ad
SHA1 cf9520c235db04ac02e98a7f7c9f3d5d631d4199
SHA512 30a1265891f03df0c46d4f310d97ffa312b84d485a214d895a1c5e260474260d6637592b20d9cf4efa507c131694f63253577fdb352e8e0c46505e02183e0ab4
SSDEEP 1536:GAqrSnLU5BxYE4bP9zel9rbvjJvNCLtY25wJ0qPKldrT6LTMyT2ItH3RHTZ:GAqrSLSvYEwsVbrTfUPdqL4S2iTZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000002

Path C:\Users\Admin\AppData\Local\Temp\x1kwzxkp.zpp\Default\Cache\Cache_Data\f_000002
Size 34KB
SHA256 8c97e1a3437f857eb8a346a360274ea339a09eda1b965ee1445d870c09b066ca
MD5 4227139d34ecd3be139bf6c7d75fce5b
SHA1 0e984113aa96daf31d002392523ad0dfc9cc3870
SHA512 bdb38f430aa623a17b26044288841a07c82691ee858325b158423839fad99a75b192fe0df269898cd76e22a7e54250611f852ccb763ce82db2f7d1c4eb6fcb52
SSDEEP 768:iFPCuSWxAknP3gQlE3brX+48360GKKAC4FZ8ELh/SAE9gnmlV:iFPCuSonPJErr18ZGKK1oLQH95
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000003

Path C:\Users\Admin\AppData\Local\Temp\x1kwzxkp.zpp\Default\Cache\Cache_Data\f_000003
Size 384KB
SHA256 a6c6aa996815cfbba8f68f289f1bfedef04c070a90be8477fcf0a2ebff83f014
MD5 732ec3e73c2fbd09ab329056045db82d
SHA1 41092a7a563735ca06bedefec8608c73211a876d
SHA512 c50417d4b8f314de8ce72cfd1831fcdfd6eef0e80e8d5eb3be7a3f41450c82c334825c05d0d2f694ef7d80d4dacd1c70fc47c69f1b10d15bdafa70ce2b4a0275
SSDEEP 12288:lakxulWoAq6wIY56RxdRheMchcNaiGKGB/B:lQlWoAKIY56HhkhcMtp5
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000004

Path C:\Users\Admin\AppData\Local\Temp\x1kwzxkp.zpp\Default\Cache\Cache_Data\f_000004
Size 63KB
SHA256 e4802c53b33c408c166435c771b044a85b5a2117c938cb18a1dcba0a4cb6c9f0
MD5 029f2c272cfb8ff949480df0e862a7bd
SHA1 693fe5eab5da743cbf4ff97a75130ed38401f914
SHA512 092c32978d113f6796ce261ba9bc02b64ccedf6493c66c2e7b8e0b8b420ead250c76b4eb83a15e4506870d00b9ffdcf27da6b4a95174b743cc5d205c62acad04
SSDEEP 1536:/kCVbNPAWQquXVNEug9RkthKuQfHiPLtvUFFJcPwngLCqp6:/kCdtAWQlPiMt60LtvUFFJJX
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00000b

Path C:\Users\Admin\AppData\Local\Temp\x1kwzxkp.zpp\Default\Cache\Cache_Data\f_00000b
Size 16KB
SHA256 283e231a1dedf20c3f98eb1452ec52d042179d31a6ee482e54b51066074faf42
MD5 46b49aad1412c12943384f8afb51204f
SHA1 e6a38f254f0681007745ededdde176ec64670723
SHA512 8b521405691a78c9f03740f2484f6f07ae881cb1ea5d18336fa44771ec025d1dab438c1a849c30a3b7fbabd9dc391fe4aff499a09de1af6391611d1752ee8d45
SSDEEP 384:iEEbbexRg+TpS0d0qXYsoXB+SBuqkXL214/R7MI7fm:WexRbw0/XYf+SBQ/xMD
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00000d

Path C:\Users\Admin\AppData\Local\Temp\x1kwzxkp.zpp\Default\Cache\Cache_Data\f_00000d
Size 28KB
SHA256 b421c05a340e40d4d4bd1831521268b6f0afd0461ec3991cfa8d5314bf3207b4
MD5 57f9a7c7e2be49102533a2ceb7a05e51
SHA1 850ab0a80577b7f7effe196cba037899e71594c5
SHA512 66406d54a1d1a44f30e19a9bff1242b50fdcfbf66c33e4c23daaa756c06f50a2e39c991e7a8dfd9a81184cc37c2062d0406070be132e28a22307896e63b55447
SSDEEP 768:dT+CJ4QL+F8S4bApn9Ua0ndjCaixJ/fVW2/AGYnS:TJ45F8SgjXnNCa4fVWVnS
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000010

Path C:\Users\Admin\AppData\Local\Temp\x1kwzxkp.zpp\Default\Cache\Cache_Data\f_000010
Size 72KB
SHA256 60263c7f2f418ebd47d8f654ff83fc7a85b5e4321e17d3f07725d81d09787e1c
MD5 f4a78ee2c4bcf1974ec8da85b17e62d6
SHA1 1adef41a1b6b79a42062cbd20c31af906c5a07dc
SHA512 8fd53cd1d3b220998ef74e7ad97c798e0dadbf47d4f03d70adfdb539a86e3781ecd9f4e4b108da5678d333bebc5db85795bc8e5c355912de4bed6e8c380598ee
SSDEEP 1536:eojWGWaffvHwRMAkgdswevDQ6yxccXu4rbmcf+E3FL/nMhA0Vn:0an+M0dqvcFccNmcfvd/pYn
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000012

Path C:\Users\Admin\AppData\Local\Temp\x1kwzxkp.zpp\Default\Cache\Cache_Data\f_000012
Size 70KB
SHA256 30b4527ac16dda6093c174e8e842c7208d6c1cc26693f6f1a849d52b17b41d37
MD5 362644b225a27e4a658d69e9b17a8d19
SHA1 99e0fd685d570022b40800612b5dd13b801044a8
SHA512 cf1122d85319b28c69ccdf3f12b7362ffde1cafe952edb0e4a40370d1fb80dc6f8ab70e50ae8f07166c29e254d5a138ad8fb346d796752efbd14642afe5905dc
SSDEEP 1536:SPD6v1B+LiVECo6I6hUr2ZEwVjnZefbudrSb3fFQ9RMVFO:SPD6v1B+kvfYWnP5Sb3fFQT
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000013

Path C:\Users\Admin\AppData\Local\Temp\x1kwzxkp.zpp\Default\Cache\Cache_Data\f_000013
Size 17KB
SHA256 5e41837a6aba4a285df072ad0290e7f9e1dc4682799f71e33222a3a0d6e5a082
MD5 9e6475d889c8916a680317ec48b212c1
SHA1 daea8c5b6cf03d05fb8ee7fcc18320eefd2ee0ca
SHA512 7c4f34e50b5bf4bc95d59a2ae648a673e4a7dbb9669f73d6512dd12521335297886168c5c00f60cca5f85a655265c49355c3ad113e62124577f75f45abaf534c
SSDEEP 384:DlDTvwo0JYeOCqDG+G8fPv4yDs3HsxaYprRr2y0BYi1n:BXwoy9OCHifts3HsYKroBpn
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000016

Path C:\Users\Admin\AppData\Local\Temp\x1kwzxkp.zpp\Default\Cache\Cache_Data\f_000016
Size 68KB
SHA256 fe2fbf50c33ae9e12935df44eb094e541236f27fbbd97ec1bdaec2bf03e69054
MD5 7f3bae3ddb127530a3b1ec2c8501a056
SHA1 3d2a9ec8ebda8961af05bd4f2fbe0aea180fa762
SHA512 e8a5c7cbb1081d5e229b231b3e50a2d0211082981a44628cb6e01dee18087b73240633f649fc1a0103f24613178973997d7a74961bd4ea7dbea49296c48b0e10
SSDEEP 1536:NupBZ1xSO3cQmUY/lbFBw70hbBD9AfA1pwdpPq3Yf3AZ:NunZ18O3NOlJpd+kpwdpi1
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00001b

Path C:\Users\Admin\AppData\Local\Temp\x1kwzxkp.zpp\Default\Cache\Cache_Data\f_00001b
Size 18KB
SHA256 cb78510332b46564f4369bf31ff85c1ab0016bbcef3110b9b9388b88f1cf4795
MD5 9e32121253edde20161adf93523eb060
SHA1 4b9267459ba3c68bd08e6492a270ccaefe2c2dbf
SHA512 7b5c22ac424e32122637c434f4a087b87ba43ac341c008a4df3d0f57f443e38c68f75ae6087e16cf3d7c651a8a35b80faaa8a28b866b1c0def48e3b6c451fae8
SSDEEP 384:USS65/+IiYmwVYkgDdUlzU7SjcKalWW4sIkb6d2e/Oc+C2kZu:lS64ZimDWz/jcK3WRIkMnmo2Su
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00002a

Path C:\Users\Admin\AppData\Local\Temp\x1kwzxkp.zpp\Default\Cache\Cache_Data\f_00002a
Size 16KB
SHA256 23cebdde3aa3c9b38e0647ae2bd6daedae2f62adee6521dbf726731d00bf14b5
MD5 fdbdb95b5ac5c4edecb625ceaccf87b5
SHA1 8da620668bc6b3ee6c2eac8c258d80afa06ead0c
SHA512 08c9c96ffa14e4be65c50bed0683a5d817ea190a493cca1119dbec30807a9e5846baa86c96dd97603620ee67c3acee2cda678cb246fdbd033aed1805aef1d2f1
SSDEEP 384:BhBYbM/UQhdWQz2xB4uINwHHKwq2Lx+J7Yj83GyEskVvyWpg5Fe:DqQUwWQz2xBrnnbNLUBYI2yEVVKWpn
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00002e

Path C:\Users\Admin\AppData\Local\Temp\x1kwzxkp.zpp\Default\Cache\Cache_Data\f_00002e
Size 33KB
SHA256 89ab09e7b2d516d5292607553dec92832148ab1a3c37529b7ae4a108477cc387
MD5 baebf31c834043f30f329f8105626445
SHA1 743c63a89cb813094b68af4b8bd2886624c1a08e
SHA512 c98727173145a6b93cb3c1790d9067503966ff617ca50201c68e60051269223cf728b65b439456bf197921324c3f133c057690e8ceaf3f899561def9dc41cf74
SSDEEP 768:AdkIw38+GJp0WyTh17LiGi3m6W2MNc+0lgntGsWEOn:AdzoApU2Gu7INc+0l0t0
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00002f

Path C:\Users\Admin\AppData\Local\Temp\x1kwzxkp.zpp\Default\Cache\Cache_Data\f_00002f
Size 37KB
SHA256 4e42b8daf8eb0fe44f7c90c2f8421d08bb4db41e57782368f26813154096fb8a
MD5 88ef70f726792e7c6cc0e8917af0347a
SHA1 7ce92a4ba552d92b17405a5db67b74994dd6a6c8
SHA512 76c254e1406554e0ffd684505e96c1fce532fa342a7538c3ee912bc8a8305f858c9ac9e04cc9576562a7d3c41809faa6e93d55ff5c2a2f556f899eb83b65cc8f
SSDEEP 768:2eNltzgHl3SFtVyUwMQrHs7pPoZFgIrXvNXXlS3gIES:5fhgHl3m+UurHguZFgIrXvVlSF
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000030

Path C:\Users\Admin\AppData\Local\Temp\x1kwzxkp.zpp\Default\Cache\Cache_Data\f_000030
Size 17KB
SHA256 129869a663855feceda858c947161e71ffbfc4c6b989af8c43660e064e3bdcb3
MD5 41f7733899baebd46ca67703ebaa77bc
SHA1 f337c055af531d4cc0fda456868bc89a841d8121
SHA512 57d866082bc507b88afbfa4fb5baa8df6f22537f9de4219736920c346fe7d12914d7e57a2f5890bfe6b4eb5b0c89f9a51f5e0a0a24c417dfd7062761c53a35bb
SSDEEP 384:KiAGf872QJNGMP13OFVfLuEtBFUCHkvQZITj4Z2YJEv8HIt2LF:0GEyqf9ezKEtBFUzv74o2HoY
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Action Predictor

Path C:\Users\Admin\AppData\Local\Temp\x1kwzxkp.zpp\Default\Network Action Predictor
Size 4KB
SHA256 8c471cab38a1696289186d01b06ff6af2a888852dc18d6fb8d2a0e54898104ed
MD5 d25d5e1dc1d93430e64ee17e48ce442e
SHA1 d5c7ca9a57e6cc68927a249fe8e601d52680ac7a
SHA512 f4cff7510b4ad81090e0b1842652f8eb7995f7aefd0ce651151bc24ca3a4305d34ecae41cf193d9b846e8f6359ccf545e5d05e63e6e766fa9761ccebce620f6c
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Temp\x1kwzxkp.zpp\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 257B
SHA256 5b268467d7abd49d3fb873d9de8a511120b184ea74363aa6c8e75172b18af8a3
MD5 b3e24dbdcda37407bc35cddb72c180ef
SHA1 992b46cb12c6f3b6281a4665fe544d8cceccb6dc
SHA512 9bd60861eb31d61fe63f3f2d1a0c0b20495c9444facd6b8b2eca98e4dc4dc631f1519d9cd1ef239e81514fc1d1790dbec940349e5c4d51da041905b5ab020c47
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Temp\x1kwzxkp.zpp\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 192B
SHA256 62ab16b65f68ce21fb8b6460b14016514c87a2f4a247f2d835c5f633efe0cc75
MD5 99ecd6513432a41e62a798c44cf00494
SHA1 29abdfce11143d1f1ef0b73978c4afaea1730faf
SHA512 731725773b1ca4a1c9ad8d2e110e85df5f6b59c02227024cc90b17ff4822354e4dd2c240c20046e008993d72f03d82f389c7bb7b5631f67816806e6dde50327c
MD5 SHA1 SHA512

Submit Download

index.txt~RFe58874c.TMP

Path C:\Users\Admin\AppData\Local\Temp\x1kwzxkp.zpp\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt~RFe58874c.TMP
Size 119B
SHA256 9183d2dc8456af524b1900d7e548c209189b19293479c19c287bed0cfa704c79
MD5 992659ba31a3c719ca591f57ecfb464b
SHA1 9bbfe4360f598da15dde671763ccbec766e2d380
SHA512 6892979a986759bb4b8f59328020c5f051f355ea330031a470ffeaafef267870b6650bb7f5266924d7b49750de1dc69acf295d6d6cd9050684535a5a0f7aa56d
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\x1kwzxkp.zpp\Local State
Size 3KB
SHA256 50e89f947ff10c4fb05b2748d8488775573ec9d1420c8e1c8efee55c4bdad1cf
MD5 68683a40c7e8972359ae475001c0cef7
SHA1 de4b12e936aaa54e36fd7ee01ad4486bea949984
SHA512 710d18106d7a633d549b7c11d1cf1239084b7c15c56bfba4b9c95f8aa66644d328d3afc75923eddbef984e7bddd1e8810d371477943bf785857a5ac6982318a3
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\x1kwzxkp.zpp\Local State
Size 4KB
SHA256 2ae3b7c102259d947c6ec9a7f64d0392f67e5b69950e1019fda3467963404669
MD5 603ef618c330cc5d9a6f7197a5a99482
SHA1 db434b955f7d92fe9d01dbe981ec70cdbd0952ee
SHA512 c42dd9d37f98b67b8983b82cb98b8b0e502e34207d727de45cf9ecc25d142b1ce5c4289c0d387b498d85fd4767ecb65e3ad4d218d45c6da5736bbac78ed92046
SSDEEP 96:kqGNkCufcDeIJiz58Frh/cInURoDotovAxmiBDbBXivjVHt2Z0DJH8CUyBTa:PGNbLDztooDUwkxlmt20VH9UN
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State~RFe587c40.TMP

Path C:\Users\Admin\AppData\Local\Temp\x1kwzxkp.zpp\Local State~RFe587c40.TMP
Size 1KB
SHA256 4f4716fc8c46483741801a94916b8e0d927f5dcc1b4b865d48c64601a7d3bba9
MD5 5fa9970b240d4b69df8070784a0ce32d
SHA1 b8c767b10b0f8d0e70d8a5f87f67ff911867f5ba
SHA512 b789ba42ee7415239457f96257a865b1c1369f7ecd1eb3014e39fc92899c6bfe1d6df09ab2ad39d2b2ebe187bd20796234624e90d9ec6cc906457efb7fc0eb9b
MD5 SHA1 SHA512

Submit Download

CN3RE8E7ASH1XCQFD3CZ.temp

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\CN3RE8E7ASH1XCQFD3CZ.temp
Size 4KB
SHA256 7be165c22047083c4b25d2b387438f0238eede25e40b3e1399cb4374f3df3516
MD5 178365537e227f9a93df750a9a189930
SHA1 50e501b904b2cc80dbbd4113d123cb7b6f7f1881
SHA512 765d2e790bbc37993283f8794d650bce7e9ee1bfa185911179bb0fddf5541cd8e93831d7b18bc1cfec210b04fd96cf49a3a207a3009049bf2c1724c3baa44955
SSDEEP 48:lHF8dOB1Ko8xTLORJ9zUoYRrdLXuHBpKWF8dOB1Ko8xTLORJ9zvYR+gdLXuHY2I:rAr+zJUoKuhZAr+zJv3Iu4
MD5 SHA1 SHA512 SSDEEP

Submit Download

ccba5a5986c77e43.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Size 4KB
SHA256 8ccdc4599a8038d4efef26c5af72fe01ebb5272a6662cbe75a487f8066346372
MD5 a21f649abff5b1a3fca734a7e4b69a65
SHA1 dbb5f59d6c9ed3dd7f91204889961a6ce24cc66d
SHA512 6d640f34e0b30c37a81eb45038444b0d0a3b2fd37ddebe470b482dcf47e4e0269e8e37fa51550eab4b7139241235a4698c35a599d6ad5d7126380bae7f8eda04
SSDEEP 48:VCF8dOB1Ko8xTLORJ9zUoYlUdLXuHBpsjF8dOB1Ko8xTLORJ9zvYlhngdLXuHY2I:WAr+zJUoHuhoAr+zJvkIu4
MD5 SHA1 SHA512 SSDEEP

Submit Download

76f8be77-038a-4cab-be30-1209eb0cec4f.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\76f8be77-038a-4cab-be30-1209eb0cec4f.dmp
Size 64KB
SHA256 534ff45dce2a60321459313f923cdcff05fb40d0ad4a3bae2df520cb8feedb69
MD5 a5501d97d3064e7f2da1fbb114c636d1
SHA1 bec0ec8137e071afa42bc298a8ceb43b590170d6
SHA512 73744aff31f2a7b013382a08653430dbc18330dd8757239e8b19d984eac77bea837bb3e649d4b7e8d2aa88c4894eefc8e49821d083ddc1fe321a28b3bff47dbc
SSDEEP 384:uU78jhlIenWyaIV5W82Ko+hzrazzYXtHWMZ4e8JPPfkEehEOzXpCSYx6mv:u2yhlfhRNZ4vPPfkEaHXpCSYx6
MD5 SHA1 SHA512 SSDEEP

Submit Download

76f8be77-038a-4cab-be30-1209eb0cec4f.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\76f8be77-038a-4cab-be30-1209eb0cec4f.extra
Size 10KB
SHA256 e36261168dc2d364262718631ee6897386b8cee5eb62e66097cd8182d264e93f
MD5 61ea8373178f7a610886ea97460c82e0
SHA1 a70e5e1296fb27448ef38153a57e6061424fac8b
SHA512 a538d5d4800a9d6149c12cb7549326419b8668252462312421aa0e01c0b59aa2631e5289461b71c12ed02193312709ea1f97931edd551020b5da5ef8ce040d63
SSDEEP 96:STWC2klvTZ1FY6pw6lF29dt40Rh7CsevBb1d0DjMLlIrLlhTLlaXv7alutILfcBC:S5rl7hYb/7uvZ8PLtxsP5wlQyfoi
MD5 SHA1 SHA512 SSDEEP

Submit Download

76f8be77-038a-4cab-be30-1209eb0cec4f.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\76f8be77-038a-4cab-be30-1209eb0cec4f.extra
Size 10KB
SHA256 9283b6ec3d2a9fdc7de9848c6c96ca255ac66e488ec031c1c444d0e2fd42bbb3
MD5 22645fdd56e422a1c096e40caa8a4845
SHA1 1b09b02378d3e04c531e63c29ed371a406fb2c2d
SHA512 55d849496ffbb49262317dcc1f9cc13ef773eeeaa95dc98b92dc6c8b0738685cde53eea02810d77dba6d0eeb0f180d192d56e3931e4f8cb8ee1317733fd197ad
SSDEEP 192:S5rljcFQiR4M4DnQYapdVxzPhWBH34T/fKNtalIyfoSbLzZ/X:irZcFQiUDI1JWBH34TmaNASNf
MD5 SHA1 SHA512 SSDEEP

Submit Download

8b9e15b1-9e51-44d1-9d29-e42d4dd7eb46.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\8b9e15b1-9e51-44d1-9d29-e42d4dd7eb46.dmp
Size 65KB
SHA256 b9d5495c85870f4a3391f7f6259c6d61147320ea959866b273a35d27a03cbce3
MD5 58e40e0fd86386e34a33e7154f1f991f
SHA1 7a89222a53057b0527ee247079a6dea00f0e69b7
SHA512 8f4e7e630a18f10b35758fd20315fedc31c71c680c2760309ee7300254be923ca935ba317e76404b4531f9dd8559e3aa25a54cafc63b500ed00957656a4ebc9f
SSDEEP 384:sVASm5LkbdSc68YYBuYtjHiuvS8LUkerAbpCSYx6mv:sZmAccTBuYtuudUkJbpCSYx6
MD5 SHA1 SHA512 SSDEEP

Submit Download

8b9e15b1-9e51-44d1-9d29-e42d4dd7eb46.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\8b9e15b1-9e51-44d1-9d29-e42d4dd7eb46.extra
Size 10KB
SHA256 d1d62df5d60b8516e3ba4a2f10e0c0c516a13ecb61e163d7fc128da799283604
MD5 448d9ca85887bba96e61505e6a2a87d2
SHA1 d31529ad5c5b30675fa260d8f51bd6fb73a79fff
SHA512 017420c453f0dd4fe057706b7aacfb75dc37a30373f5cd5335f792cb76896c777548332ea1c2f900e767f785f171579dbf22da8e41ac22f7c99188aeda71e3ed
SSDEEP 96:STWC2yTZ1FY6pw6lF29dt40Rh7CTvBb1d0DjMLlIrLlhTLlaXv7ahMutILfcBCqN:S5HhYb/7WvZ8PLgxsP5wlGPkfoV
MD5 SHA1 SHA512 SSDEEP

Submit Download

8b9e15b1-9e51-44d1-9d29-e42d4dd7eb46.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\8b9e15b1-9e51-44d1-9d29-e42d4dd7eb46.extra
Size 10KB
SHA256 f6ec3a3ce6f6152694cbe689d56e8c7088cd380334b7fbf0eff09ad85463d595
MD5 666acceb62b72c002da01488bc1d9761
SHA1 ced6aba7ce953d5064dbe8c328109a9d73c2d041
SHA512 13fcf24ce01c68934a58f116efb3a29bc85afcba96c9b830285bb35e9eadd423698eb57498a4d047504cc9a52337eb40542e2d65a58c9594b569e5c79c7ff6f8
SSDEEP 192:S5PcFQiR4M4DnQYaVdVxzPhWBHa4T/fKNtalePkfo5bLzZ/X:iPcFQiUDW1JWBHa4Tma8kA5Nf
MD5 SHA1 SHA512 SSDEEP

Submit Download

ac26ddd3-b009-434d-be70-cb51e951b624.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\ac26ddd3-b009-434d-be70-cb51e951b624.dmp
Size 63KB
SHA256 772778db82dac84840ce4d7f73d8ff8ce73aa11c81c8677545cbdda4e4407657
MD5 ec0bb6c903a65cff5441311216f6ccd4
SHA1 3db32ef1360d67a18e13b1afdc54f39a35883f1f
SHA512 68e9c4c70d8716750e17397bee383b1f42949bfce14a772645ae1097d65ae0bd0080afecd75b41ade43df39de36f0cc8c3d60b48f120bb335fdc50cb2a7002c4
SSDEEP 768:GtMRqz4A6vvs0Dmb8Nh1l9CyI8xF33pCSYx6:S4Dvvs0De8Nh7syI8xF3
MD5 SHA1 SHA512 SSDEEP

Submit Download

ac26ddd3-b009-434d-be70-cb51e951b624.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\ac26ddd3-b009-434d-be70-cb51e951b624.extra
Size 1KB
SHA256 7993d4d6470e94d351250c89d1288f19c681a7968bdaa4d2a69a6cef24c215f5
MD5 63a3e8fe7ec91edcab1d0e8cda95e608
SHA1 ef3a2c5cc8a71712c323367f309ea2ab480023c6
SHA512 da1911f8d7de23c38afe0f6db0f05cb536454642c03bf4bc390cf05e94e7f008105d5ac7ebda7830ded41a960cd0180e4da9e9100d5dbbec0992800d48b4f0ef
MD5 SHA1 SHA512

Submit Download

ac26ddd3-b009-434d-be70-cb51e951b624.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\ac26ddd3-b009-434d-be70-cb51e951b624.extra
Size 3KB
SHA256 a13802fa0b0cee046003d0c58b8e2d570777840a881a607fd2fdb9102630df46
MD5 c366f3948c667eadf62bfd0f5d8c5f5c
SHA1 d18607535f105aae571e56530a9399acf5f8223f
SHA512 03662302b048120314168b00fb538882097abacd35953164f4e5208b23dbec00d2d59e9cbdd726426a735ce40cdbd0b52ef0a206eb8ee58327b83c9986812061
MD5 SHA1 SHA512

Submit Download

c7e7a1fe-f343-45c9-9e16-49eb394547cf.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\c7e7a1fe-f343-45c9-9e16-49eb394547cf.dmp
Size 65KB
SHA256 8679f34bc72ce19156cbceb4226a4fedb1bf5cf103cd7605250ada1bf6deb196
MD5 f9c3bfac23aa4f2731940268587b9a71
SHA1 26a47080c5ab01a74b4af3f4acd3e42352fd5920
SHA512 1001a96af74fcefedd0105044f6debc357834e54aa89f0ca10960cb4c6dc5c4c376bd2965a2ca2d6f8016da2d5fcb05ed8d0221eb177d872b8824a41b8b0b46e
SSDEEP 384:w5dI6biEEvKHGXxuzKf0y891c0Q7T4pCSYx6mv:KREv4Gk5QgpCSYx6
MD5 SHA1 SHA512 SSDEEP

Submit Download

c7e7a1fe-f343-45c9-9e16-49eb394547cf.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\c7e7a1fe-f343-45c9-9e16-49eb394547cf.extra
Size 10KB
SHA256 6e0db6e0567c1dd612e2b18ebb54ae7b4920d59583691b761679f564028c5c95
MD5 863d8c5a182f2a1700a389f7b4b66189
SHA1 5047f0a90f8b4effb236a8010f2f3e2adc8d1ec3
SHA512 b067a23254c7d9dce11f8fec7a9169304c91676e3cc864a10a1ef0166416fb77ea15000e5b49603159ce00bda720252f4067adc93b43a1f5ba372f4fe96208aa
SSDEEP 96:STWC2kpTZ1FY6pw6lF29dt40Rh7CsevBb1d0DjMLlIrLlhTLlaXv7aLutILfcBCc:S5rZhYb/7uvZ8PLzxsP5wlDDfoJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

c7e7a1fe-f343-45c9-9e16-49eb394547cf.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\c7e7a1fe-f343-45c9-9e16-49eb394547cf.extra
Size 10KB
SHA256 bc8ba1c76a697cd49e9ab5e6ccc6ad6476a4c439ee26c09d541b1e9c526823f7
MD5 37797537c94b55d62db0a3c54fab2288
SHA1 4dbe22747afb4a2e69f280f2432a2f0afb8bca7d
SHA512 3d74257c4e351c7ce6766fb1e065cf594871b211da61db7beaecbb226f4aefa20675594e524dfffd6dc7e02ccb3ca0c2a1db9eef5857448cc5066a2f3330a728
SSDEEP 192:S5rBcFQiR4M4DnQYapdVxzPhWBHN4T/fKNtalrDfoFbLzZ/X:irBcFQiUDI1JWBHN4TmahAFNf
MD5 SHA1 SHA512 SSDEEP

Submit Download

edbce128-0683-494a-a4ca-01c64c46b2c1.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\edbce128-0683-494a-a4ca-01c64c46b2c1.dmp
Size 64KB
SHA256 dbed298b8668c3fdb283b6b731b62e544101db4f72f80eb117216f4008f44459
MD5 df97dd4d775d450110d381d8eb831a00
SHA1 8d90cece6a91846fbc8f8fc63ed7c4f8e338f81b
SHA512 350855d43487bbb1fc659bae078c0a6e817575dd8a6a5cc79c5b64ffb34b8c01369dfb0484f76a8604e2fd966499c855fd4dcb3050ae1f5f948c576f5f86b210
SSDEEP 384:GW3pKjj3wVy6ZgGoWq9ghqzlawfp27sDJgT68z3m1F/pCSYx6mv:GlYyUhAfgse9m1xpCSYx6
MD5 SHA1 SHA512 SSDEEP

Submit Download

edbce128-0683-494a-a4ca-01c64c46b2c1.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\edbce128-0683-494a-a4ca-01c64c46b2c1.extra
Size 10KB
SHA256 34feb20ce4838ce589aca6f6fbe0967a5b87c3fb96de3e4801c251230b60ace9
MD5 0458ec036d6b688713b60dbd169c963e
SHA1 b93c826e9109ad40275519f15114905c2b698962
SHA512 09b4a153ee7de1515589ec2dcc2674e941d4d411d4ccafe52425d51e3fb313e20dfc31dd4bdc380036e1462b990d294a869ba2a42d2f785b246e5005620ae5dd
SSDEEP 96:STWC20TZ1FY6pw6lF29dt40Rh7CsevBb1d0DjMLlIrLlhTLlaXv7aqutILfcBCqa:S5FhYb/7uvZ8PL4xsP5wlx0fox
MD5 SHA1 SHA512 SSDEEP

Submit Download

edbce128-0683-494a-a4ca-01c64c46b2c1.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\edbce128-0683-494a-a4ca-01c64c46b2c1.extra
Size 10KB
SHA256 8f46643d15cec0eec2de99b80224a7d2b08ba7e05ed0cd6d55104f4fcefe9a6b
MD5 f3de32d1912bd3a3efa2ae126aeecb73
SHA1 ba15725af82e00d05d3a4add18d51559710f7c21
SHA512 4b0a0b0339962f1f0d0032ec8d07f9d658b274c9bb8c4ae32675149551cb12f3e8590a7040170577acfc3b7e549ac99617776623ab711b7e7d04bdde52d860bf
SSDEEP 192:S5dcFQiR4M4DnQYapdVxzPhWBHy4T/fKNtalp0fo9bLzZ/X:idcFQiUDI1JWBHy4TmasA9Nf
MD5 SHA1 SHA512 SSDEEP

Submit Download

compatibility.ini

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5rm9ff4w.default-release\compatibility.ini
Size 198B
SHA256 252b7fff962848c61092e82a3d87adca163849767713a93ab533bb397f1f53bb
MD5 ce9ef13caa8a74c25157b184aa038475
SHA1 db03a9935d8bb3ce6b120aca98feade536805160
SHA512 0f6f5053e78167ef5cc5fa70ed3a87dd116df0671a590299277a197341bed983e3d77e37ad2c33cd4afe880fab9ed1c7f7502210040617a01f97a81c1e1d4f29
MD5 SHA1 SHA512

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5rm9ff4w.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 aacb8fc2cca161a44775e1fea9035c0a8bd5f99ca29486e8bdd52b525b3e766d
MD5 cf00d1046f567dc951ec5548e80a0778
SHA1 3e9a97f6a6baf1c5260c0fa61c9516a4e715d8ad
SHA512 7eb2cf3976a0005ad535d8f86fd4a811efe84fde032786c4b3e3b71ac6ed2bf6da02bd19e34e99cdb7c00075f4059ec86f90e0cd9cabc844cae4c954314e9833
SSDEEP 192:1kcOv5zbo5ZvGyyja+AucT1/66Joz0dzgCl6mSSdz:1kfbo5ZvGyyjaGcx/66JozQzgC1bd
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5rm9ff4w.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 7722317fbcd803bf9a99427c91b2520b076039768bf071b59ab2acde8224fbde
MD5 0e92b2af5806c1e3aebc474033e99ab2
SHA1 e7c15850f62c597cdfbabe24b2077016d33a9d2e
SHA512 67a93ffd3f3906f23997435f3e031b2b1bd03906defc49ff7e0528afb0e49c31d2a625f8037e43ed938d438493533b7459be0046531c2e90bd74d08d88964190
SSDEEP 192:ykcOv5zboHEZvGyyja+AugT1/66Joz0dzgCl6mSSdz:ykfbokZvGyyjaGgx/66JozQzgC1bd
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5rm9ff4w.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 ee624c38cdcfad65d1aafb8eb0b8b0b14687ad3f4db8c5e9067bbf5f25fd0757
MD5 fc14871e12ee4e8a4d2f17e49bfb5fb9
SHA1 4ef016ee54d027c1e954ef1274bd275204f1c8ed
SHA512 29301c41f6a3c780408899fa037dcd440baba7d3a431c9db7264bddb35848deb81d0aabdb12501adf32dbed893bf2db15b3a032a1a9893bf825654c2cd3f9c14
SSDEEP 192:BkcOv5zboHEZvGyyja+AlwT1/66Joz0dzgCl6mSSdz:BkfbokZvGyyjatwx/66JozQzgC1bd
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5rm9ff4w.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 2380b703711dddca75a85be878fa4858ada32ad9dfecbe130e64fe605548b842
MD5 8eb53e7821d9cdee4016fb8699c5be21
SHA1 ebe54041be661e3a44643c3bc3276437b9e73d25
SHA512 0cb169d37c5e92c60c9d343d89a2fedd530d96ad41a9ef8c9fd62e354e6b27f58c8c8c2c7171d449b4428e91cad181a7dc0d76848010b06e59f1b52f1f34c5af
SSDEEP 192:YT1/66Joz0dzgCl6mSSdUkcOv5zbooZvGyyja+SV:Yx/66JozQzgC1bKkfbooZvGyyjaL
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5rm9ff4w.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 3ffb5cec1c76f93f421580db626c434a8e63b5a5629e6aab0092b4a3e7e721b5
MD5 01835ee1471a7af00ce96dd68c7c87da
SHA1 5771685a4d990e456eff727953f9229988fb148b
SHA512 d289d1d543112b0e539896d2ee3cece700375715d2bc14d0e833d2efa4f71a97dc7cb4bee3c7ad37821998912a66bdc3e5eece7bf57dd0c76e9643b538e20826
SSDEEP 192:BkcOv5zboHLTZvGyyja+SN6T1/66Joz0dzgCl6mSSdz:Bkfbo/ZvGyyjaX6x/66JozQzgC1bd
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5rm9ff4w.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 d462c71d6f1aadec45edccb2fe81195936753f363f3fdabb7b3ebcc3595fdc7e
MD5 e9f7a51f2c438b1c623fe67bf0caf841
SHA1 36824b7af4472922ba55a4ec7c6cb65380f1e518
SHA512 373ff0f842cbe67bbc9b1e3a48f7d6d4928d1178624e97a46efeacc8e8682503ee04e6ab3506e5a3518ff8b1d7b07adec12ac713738de724c897500524de839f
SSDEEP 192:tgT1/66Joz0dzgCl6mSSd7kcOv5zboHLTZvGyyja+SV:tgx/66JozQzgC1bpkfbo/ZvGyyjaL
MD5 SHA1 SHA512 SSDEEP

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5rm9ff4w.default-release\datareporting\glean\events\events
Size 1KB
SHA256 1a6112e91a5053dc0fd0876cfe12b121fb0ecf0edf81816ccf1807d32495df5c
MD5 eccf14f711104e04f8d979abaa899ac6
SHA1 d67add6644c4536b17f5961ae69b31e2554f6bb2
SHA512 753ebbb54272525c95fdb1bedcdce22288b04bf6460bd06965e8510ce7aba05536ba2df375d655a54d2e6552cbc993c70e89c8c9ed1b6cd3fea1c7e5478c871b
MD5 SHA1 SHA512

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5rm9ff4w.default-release\datareporting\glean\events\events
Size 1KB
SHA256 8da81764bced37d59cd913a6316889ec7fe09448c894e8d52ae5890f58f982cd
MD5 148aec592fd50bc22638c8d2b7337f95
SHA1 4607537c8d004aa6c3452cd962a1f3f925387e95
SHA512 22284678926bec1136935cf32bf4b34563f16781e40beb99e21df27ce8925d2e4d53f59fd458b03dcfd972bf0321c67c2a26fa5473831156875df9883cae8f6e
MD5 SHA1 SHA512

Submit Download

01ccacbd-232a-4de7-b697-781a76249ade

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5rm9ff4w.default-release\datareporting\glean\pending_pings\01ccacbd-232a-4de7-b697-781a76249ade
Size 3KB
SHA256 3ad1151071a75d5d6879f60ea61752cfe474bfa03734c837b8b500a16b028165
MD5 cbce9d5b70f5aa0539a5699bc191d6dc
SHA1 964ba893e5f97ff29b125f69177857b578ec816e
SHA512 daa055bcaccb28bab0ce2392753785e943e0c55ed072c1271e1c723205c8f5ac7daf455521f893e6265dc9d396ddb944c7d0d17ee12fe97badd4c65a18d243d7
MD5 SHA1 SHA512

Submit Download

026421de-830a-49da-ad4b-4e46ecd0a1c9

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5rm9ff4w.default-release\datareporting\glean\pending_pings\026421de-830a-49da-ad4b-4e46ecd0a1c9
Size 2KB
SHA256 e61edff14ae619411ccfabcbfe48db424158a44c74fbc7f5052cd316f9d88b4d
MD5 5776355b33371e5df3950b8f4956efae
SHA1 520c2c55c99bfbb08bb3d3209a5477f6fac42bfb
SHA512 b03494b174d2ea81ca96754b18ffaaeee9ff113add875338a008d842a3846700b0f6a7a4d6c62af2e8d875ff88d5700592e294fa1e7ae1cf9eea7b9b4eeb8355
MD5 SHA1 SHA512

Submit Download

0a586a35-68de-4771-a5f9-059600de45f4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5rm9ff4w.default-release\datareporting\glean\pending_pings\0a586a35-68de-4771-a5f9-059600de45f4
Size 883B
SHA256 3c691182b1d9361a46f7d17e074ab423c51447f7d763f0a53eea1dbbebac5f91
MD5 0989b0a68a88615595ab487316785559
SHA1 5f6d1e615aa6d8d45c5687ea68ae110f50bb0ef1
SHA512 90840eb3a41e2cd11927c7976852915a434a1daef1827396775d83ed1b33fc4c418b1278e4f75f5a9569d845f5f6f24b165a5b64996de5920ee35c80f52f6c7c
MD5 SHA1 SHA512

Submit Download

1cb32d53-0e5c-40e8-a476-73a059cc5c58

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5rm9ff4w.default-release\datareporting\glean\pending_pings\1cb32d53-0e5c-40e8-a476-73a059cc5c58
Size 235B
SHA256 8f1b79b6f67d1868af3c1e7fdd2613d0ac4c40be1854dfe2af6d21c3ae436235
MD5 0b6d0756edfc7529404e3543de0e65ac
SHA1 a056f7fdb267f5196382001ee93c17de16285e89
SHA512 6211cacc64d2d8827cd820594f7bebec07998bc3faa5763efe8a60cd85b49e837939c30e84cef778c04962a15ffa389973caa7c6ab1d64367636819b5eece32d
MD5 SHA1 SHA512

Submit Download

22e1c708-1943-4072-ad68-9efe080bbc6e

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5rm9ff4w.default-release\datareporting\glean\pending_pings\22e1c708-1943-4072-ad68-9efe080bbc6e
Size 3KB
SHA256 c4b34578aa6ec563964d3fa5c51856fd1df8a52182bd8cff3efa3d86741f1dce
MD5 2d948a3a28f3d6a9318e07566bc28b96
SHA1 b55c59e2e6b9dc50793242efcd1566374f94e5e4
SHA512 6c4c3dc5bcdf1c844daa71f3b9e92cd282e2af9b567b36e127b5af8a50b733d48bed565c385afde70832553421b74a2d8634dc9c6b990eb1f6fe28441ee33824
MD5 SHA1 SHA512

Submit Download

262588c9-280f-479a-9503-2f757ed50f2f

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5rm9ff4w.default-release\datareporting\glean\pending_pings\262588c9-280f-479a-9503-2f757ed50f2f
Size 235B
SHA256 3d08e4ea3408353137d800bf870ba133392cb51aab21e4fec5c8eefb60e7502a
MD5 535b5c6140c7ca3d4147fc547f3d221f
SHA1 1f40643a162f371c684614bb6cd1223f324adab0
SHA512 dbc8e5efa14b3f94ba6e080074b88ce44608b274a20720351771c1d9f4313a84bae81440c0065e23b4f0056e3b43006fbbdf9a56557cc74185679b8bd19a55b8
MD5 SHA1 SHA512

Submit Download

2a90addf-ab44-45eb-a13c-077c7da1f2ef

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5rm9ff4w.default-release\datareporting\glean\pending_pings\2a90addf-ab44-45eb-a13c-077c7da1f2ef
Size 235B
SHA256 7475596c3aae62cdc475127bae1e33de0bcf06a873622b7512447fd36c7d8570
MD5 b045decd6e39cdfa36adcf3724ff325e
SHA1 0894ab51c6836c0aa12f452904f7dc527352c852
SHA512 2f3556b6356a9b2986a1e7c0bab5bcfb3c745fb1fdb4fb5d365753cd1021f9e849ab78574ed65e797afe675de1a6e45cc060ba5f53b1ef3e699e0923c57fc0bf
MD5 SHA1 SHA512

Submit Download

2b1a3827-8d81-477b-87b6-b14fd4555e46

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5rm9ff4w.default-release\datareporting\glean\pending_pings\2b1a3827-8d81-477b-87b6-b14fd4555e46
Size 16KB
SHA256 ab5fa7f2f51794ff320beba449eb5d367ed3bdb148449d250b1e8a54bc3c6103
MD5 529fa74470015610758a1a9efe2d899f
SHA1 a606de44bf7612c5c50800e98f3a1fdd66c3a615
SHA512 7f8956dce4a435b9b3059df778241d6e992ff911db686449dd7609a6896998a5f9f7bfc09be7a07ee3483e4edec611dda348a491962082abc1cfae74a980a593
SSDEEP 192:5mMkRYNBg1ufB6a69ovHFoEaOPzrFXjnsa04fGMFW/ShYClK7s7+SezxaO4nkU6Y:WRYZfXyksqS3ClK7++SelaFJ6pVqu446
MD5 SHA1 SHA512 SSDEEP

Submit Download

2b80e669-6802-4bc1-9eff-3b936531826b

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5rm9ff4w.default-release\datareporting\glean\pending_pings\2b80e669-6802-4bc1-9eff-3b936531826b
Size 3KB
SHA256 b0ddec31f07a84c564ff9d4b329be14143396f76fe097e49e5f843a641c558bf
MD5 a2a64d372787781c2a58a6ee81da1e70
SHA1 4e28ad9edfd1bb66452495d4156bddc37941951f
SHA512 02c3c75819f5f26691f7006c829ddf2c5a422064779ec7e13ade54b37ed14d466e500b5b86c8b4eda3a3e3148f5689512076a28e52d6f5432f397cad571b5258
MD5 SHA1 SHA512

Submit Download

2f43ae06-6e86-4ce2-9af6-bc9510635c45

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5rm9ff4w.default-release\datareporting\glean\pending_pings\2f43ae06-6e86-4ce2-9af6-bc9510635c45
Size 3KB
SHA256 bc16d3d2e67c64f26632459f4076cb69946788e5acf37e5efdaaec5ee5d833ab
MD5 25afae73a5eb4013d7b01bddf91dedff
SHA1 e9d65a40549b6b9193b52406d5fa619bf6207c14
SHA512 9836b9dc22c86502fd058499d21f3a8309f5c44e20deb86d2569bb444394c72ec883baf7af5a104a30b56fb65e4280f60b70613d8cdabc0436f19cde2c3b0dec
MD5 SHA1 SHA512

Submit Download

47112a4c-2821-491f-8ab9-c9e6fd5f1ad8

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5rm9ff4w.default-release\datareporting\glean\pending_pings\47112a4c-2821-491f-8ab9-c9e6fd5f1ad8
Size 871B
SHA256 809f423218ea8d821523bcfd32c16d05a791205a6fa2f722c5904a9362c32049
MD5 ae3ea01558127eefe814021cf9f0e339
SHA1 a1b9db82cc8f9bcb3a99c92fd4675000b83ddcd4
SHA512 a546b6d55e56b21d9f4a4b79aa273517e5beba1d104f309e98a72474bf6664d89b651b29bc6379b510d3ac17ebfd8167a2db257a7b03182efb3f158a7f877b14
MD5 SHA1 SHA512

Submit Download

5b7b4cdf-c64d-42f5-a152-36306c42efa5

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5rm9ff4w.default-release\datareporting\glean\pending_pings\5b7b4cdf-c64d-42f5-a152-36306c42efa5
Size 886B
SHA256 e97bc7cd1af52cbed70f798aef789b6178114ee523838b99da867f34bb12402f
MD5 ef8c7ae04dce33b241d6e41e44ddf9d0
SHA1 e73b425fec71f3fd91da1dec26fe77d6f118909e
SHA512 08f98d0e1fb7e3ab7169fcb4da036cc58af17eb80c9c2e6aabc42020f289bb89d71c1300eaf17c7842fe316df03d8a70fc8857a8d5bf481cf2c4f5d4e1a96284
MD5 SHA1 SHA512

Submit Download

83c6407a-a060-4d98-b129-dd53212ad1ca

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5rm9ff4w.default-release\datareporting\glean\pending_pings\83c6407a-a060-4d98-b129-dd53212ad1ca
Size 886B
SHA256 c33ada0819ac46fa87801061760eeb20d47e77ca94b4cea63f405c1a2bcfb68c
MD5 4cc70cc975141e47423b314a55136627
SHA1 44e9f6791a09adb7a2a43ff6502ccd365541c8ef
SHA512 6ab6624d4443d8fd3d69c13b5e6f13d64357c0101f7cbbd3df2abb0fc98dffa785f2e07499491039a8a1a70b9c4e89b0256249a6237c4adb5715ca3be3874132
MD5 SHA1 SHA512

Submit Download

8a736fef-103b-4fb7-ae3b-6455ec231c8a

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5rm9ff4w.default-release\datareporting\glean\pending_pings\8a736fef-103b-4fb7-ae3b-6455ec231c8a
Size 2KB
SHA256 73018c9abb5003422199b213281b2ad9bb45bb98aa5d3ab3ca08884b553d1edb
MD5 a261a07655c2f12bbcd5a86a90a8ffc4
SHA1 4ffae740cf3cba91af7c2bef1b817a1c532f9c8b
SHA512 770e8c05ace49610be24924ba374f0639fd305af0836b69e30e22b8607b74e0ee9992a518666d48b7466b356fcbda6684de25446a011b264b611d80253ad13c0
MD5 SHA1 SHA512

Submit Download

b2aff9bd-dc80-4901-b6af-ec056f6373cc

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5rm9ff4w.default-release\datareporting\glean\pending_pings\b2aff9bd-dc80-4901-b6af-ec056f6373cc
Size 3KB
SHA256 f10cc7fab2c948b6eb2f188dfeca1d75ddaa7da9eb5d2436bc4202b9eff71df9
MD5 a8a15deef609a492a8ccc209ca2285bc
SHA1 7b1c002ca8fc01e6af69ab4697f4c11f483c53d5
SHA512 7d1bad28c94014c1e9fdfae16c8c8120de09188afc45988c1cb419407494fafcdc003c2d38775fab60f503ee8e3adddf1b31b484ee75c706720ebfe96028477f
MD5 SHA1 SHA512

Submit Download

b780436a-d73c-47e6-b250-49115c7dcad4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5rm9ff4w.default-release\datareporting\glean\pending_pings\b780436a-d73c-47e6-b250-49115c7dcad4
Size 235B
SHA256 bcc703393480fb6c44c6d365d63c267762473262540785739e453b174bc123f4
MD5 ab088f8702e038719c227b893ceabcd0
SHA1 ddb198b880c2392158d6e4db61e004a0cc7fcfe8
SHA512 06cc96211c0256417d43294c85e06c947aa4c398b5a8c3932090fb28df31f7fabf642c969bcb3716889b6c9fdd7941d0cd25445e6b1b8af8360d096895409011
MD5 SHA1 SHA512

Submit Download

b9840e24-cdd3-4dd3-a33d-02171ae4a621

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5rm9ff4w.default-release\datareporting\glean\pending_pings\b9840e24-cdd3-4dd3-a33d-02171ae4a621
Size 3KB
SHA256 90a914d676b82efd22e052f238e81e25a75919c80c5e4f8bcc67092da2e9c79c
MD5 f519673d187ab19780540b0c181e1e42
SHA1 dba6a4e673cf633b05a6b9cdc2e5c0199d71d508
SHA512 9d766d450f977c4324e40d638ff3f427add3a10f156edfc39cd725dead693c9459074cb0b1f459c8c3446cbf1e79b97962b7d6f8aa64543dc85b93a06f24abc0
MD5 SHA1 SHA512

Submit Download

b9ef96cd-c99b-42e9-a416-c2def410f4e8

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5rm9ff4w.default-release\datareporting\glean\pending_pings\b9ef96cd-c99b-42e9-a416-c2def410f4e8
Size 3KB
SHA256 de52efd805be0f59ba402109e2c0ef392272a1a3d69574915f0652257554c570
MD5 10911dc63c1933b4e881c52d052d2a03
SHA1 ebe6924554af2a65606a730755f215bd93c0a729
SHA512 364b5db9e6607d5266b0eec3d0c762f3130bd2dd87c11a38c66e013426f5d29b395059439749771efdabd46e2ff60683a4b2f3b1a34b2f5f5686f84bd3df228b
MD5 SHA1 SHA512

Submit Download

cd5164c5-ad8e-48aa-ae3e-2efc18f4aaed

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5rm9ff4w.default-release\datareporting\glean\pending_pings\cd5164c5-ad8e-48aa-ae3e-2efc18f4aaed
Size 3KB
SHA256 23c26fbf24d01fa48800ce33ea26250ca6f5a637a89610e6f96c039008e01646
MD5 71edbb2f495ee35256626c480ca48ad6
SHA1 1b4bc13b55f489e7b049d448d11126fa18baffd5
SHA512 ac3de27cef819287c41ae0cae9c90ce632b0fa144f886fc4903da39c52f849e9b27e2420c1292a45d6117ea5e3f7998157bf597d278dfb3a81f023871f3638a8
MD5 SHA1 SHA512

Submit Download

f3f21c04-6cbf-44c1-b963-de7c7b48774c

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5rm9ff4w.default-release\datareporting\glean\pending_pings\f3f21c04-6cbf-44c1-b963-de7c7b48774c
Size 3KB
SHA256 9bda1099c610066832ba952bf0858d645fc86e376bb31e699dc6cc0fe7faf6b0
MD5 5af1d5ccb12c5b17e033c0a08a667e49
SHA1 5ea286054fe9d14dda6a6ab0d0f368ca3775800e
SHA512 43b29dae320c8be0c5dfa936677f2063530b16fc3437f718365ac433233ff214bec717ed8896afaf828a67dd83228fca04b6fa3973de2c71ea88c90a8f6e778b
MD5 SHA1 SHA512

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5rm9ff4w.default-release\prefs-1.js
Size 6KB
SHA256 e081a0522948fbff86172c29596d5a2ff97ce7638796bb7a94ef670e0c5a9a72
MD5 e920abdb1b3c0c49c46e58c64fadb235
SHA1 5e8dffa7e19965c229f8958b0e17f23c0fc11803
SHA512 389b3017a28e459ce1613f51ade0a99ae8d10db459a24f4e87ed9c5e2e7a06639476c777b612309fb0c8a0ebbcd50552f99576827de0b30c5dd0559c76ae7e62
SSDEEP 96:xH9UTUmqGqgfKK0kno1zSRvdSSlhdv9j5nJHMO9JBw88H8L4cnl8DJNFZ:XBRgfKeoGSSznHBw88ZZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5rm9ff4w.default-release\prefs-1.js
Size 6KB
SHA256 96167f8c9dee2b87eff4227e0f91ef5f30a454c80dcae53448b20cdd691a43d0
MD5 cb49c2e91afd4f84b07ae9f3c56da516
SHA1 01135aa39247f3494b03657cb596992e2d0f700b
SHA512 ddc8da18efbb4c56eaa139928a2264c8993231b14355bc02ddf798a92627c834011f7d6bd32c995509a2368019acf4aaae7a357c500063e058bad8f64780bae6
SSDEEP 96:xH9UTUmqGqgfKK0kno1zSRpxSSlhdv9jYnJHMO9JBw88H8L4cnl8DJNFZ:XBRgfKeoQSSunHBw88ZZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5rm9ff4w.default-release\prefs.js
Size 6KB
SHA256 8fdff397f7f46b5f20f589d9908b16d041838900815bb27218583d3717e8ae65
MD5 077bbef16e96d40a387fb6fd8b29776f
SHA1 05f75c45325f39e05caa6b4a2f477c7bd748dc5b
SHA512 bc1381dad270a3dd2478613f81a43c52b06e8e23e420017950afee74b6ce7b837dbdda8d0cb8b8d821237b1182cb483510bf74f26d27c9cc0916cf4e5d466ba5
SSDEEP 96:xH9UTUmqGqgfKKunZ1zSN7+SSlhdv9jynJHMO9JBw88H8L4cnl8wNFZ:XBRgfKxZ+7+SSQnHBw88MZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5rm9ff4w.default-release\sessionCheckpoints.json
Size 90B
SHA256 00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2
MD5 c4ab2ee59ca41b6d6a6ea911f35bdc00
SHA1 5942cd6505fc8a9daba403b082067e1cdefdfbc4
SHA512 71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2
MD5 SHA1 SHA512

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5rm9ff4w.default-release\sessionCheckpoints.json
Size 53B
SHA256 792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da
MD5 ea8b62857dfdbd3d0be7d7e4a954ec9a
SHA1 b43bc4b3ea206a02ef8f63d5bfad0c96bf2a3b2a
SHA512 076ee83534f42563046d25086166f82e1a3ec61840c113aec67abe2d8195daa247d827d0c54e7e8f8a1bbf2d082a3763577587e84342ec160ff97905243e6d19
MD5 SHA1 SHA512

Submit Download

Poleremid.Ter

Path C:\Users\Admin\AppData\Roaming\Poleremid.Ter
Size 319KB
SHA256 f770df24653b700b7f77b15cb265c7e6922a2f91dac6ae857d02b7a71e842956
MD5 146ff651f5bdbabc11e50ea407763806
SHA1 529045e5ea34e49a48b45c25bef3daecc987d0cc
SHA512 7a2f4702b0a0c802750851d0d743029c64211ed3b5b64b524a1986323c60dd6379ece7b4d8206a60c9d6abbe8c6eacf2f2623cb03e6013944995af49a65f97f1
SSDEEP 6144:W6z0bemofaiBDwi5JNambsF3poQljSvzn4flidNcBNwXzY0kGzLwOV:fzhZfaEwC2F3+USz4fSN2UkGAOV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Tich

Path C:\Users\Admin\AppData\Roaming\Tich
Size 4KB
SHA256 a936b47fffa65e2104403df60f294f41b188d78e6a2972155a4eb838421e7c44
MD5 fb65a750f0fe80f18d923cb16169fef8
SHA1 60e298f4fcb77d44447c746bf16a6983f67ca76b
SHA512 02a900250bb5c9d621bfe093d805b0acf0c2d83d65e6edee0a84e30d320f37f02c676f167423dfb6b8d675cb2ac536ebec103efb3fdbe8cddefb3ad3b3d555c9
SSDEEP 96:wXC5nJIVxE1w0te+Pxl8jiQeI1ePhJWHgEwOrlKcMCQd3/8:D5WbEDeS8dGTcst/8
MD5 SHA1 SHA512 SSDEEP

Submit Download

msiexec.exe

Path C:\Users\Admin\AppData\Roaming\msiexec.exe
Size 142KB
SHA256 5cb00963e6384b069b12ab560ea62dd22554c845fe007b8b198ea60ccf47d1c5
MD5 8ce3a261348c85c742c5b56818393339
SHA1 4260d9c5edf5418dba0800f9d9cd5f6e4be82cca
SHA512 a0974afc850024e13d22611c9f1a00eb97ad861d0497702bbd283bf2b80a7d7c5ecf281ed562371d008ee702e9f49a77b930d03b93fe2637e94161658085cd4e
SSDEEP 3072:xTB4LEUcTjqUmr6y13Ix3V8xOTIKOZDBZcBkr:FXTw6A3IkxsIKABZcyr
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3076-5-0x000002354CB60000-0x000002354CB82000-memory.dmp

Download

memory/4108-182-0x0000021483120000-0x0000021483148000-memory.dmp

Download

memory/4908-50-0x0000000000480000-0x0000000001797000-memory.dmp

Download

memory/4908-64-0x0000000021150000-0x000000002116E000-memory.dmp

Download

memory/4908-3324-0x0000000021B00000-0x0000000021E57000-memory.dmp

Download

memory/4908-63-0x00000000215D0000-0x0000000021AFC000-memory.dmp

Download

memory/4908-62-0x0000000020850000-0x00000000208A0000-memory.dmp

Download

memory/4908-61-0x00000000207D0000-0x0000000020846000-memory.dmp

Download

memory/4908-60-0x0000000020920000-0x0000000020AE2000-memory.dmp

Download

memory/4908-3329-0x0000000022480000-0x0000000022512000-memory.dmp

Download

memory/4908-3330-0x00000000223B0000-0x00000000223BA000-memory.dmp

Download

memory/4908-57-0x00000000206A0000-0x0000000020752000-memory.dmp

Download

memory/4908-51-0x0000000000480000-0x000000000053E000-memory.dmp

Download

memory/4908-48-0x0000000000480000-0x0000000001797000-memory.dmp

Download

memory/5104-20-0x0000000005490000-0x00000000054F6000-memory.dmp

Download

memory/5104-19-0x00000000053F0000-0x0000000005412000-memory.dmp

Download

memory/5104-17-0x0000000002AD0000-0x0000000002B06000-memory.dmp

Download

memory/5104-18-0x00000000055D0000-0x0000000005BFA000-memory.dmp

Download

memory/5104-36-0x0000000008550000-0x0000000008BCA000-memory.dmp

Download

memory/5104-33-0x00000000067E0000-0x00000000067FA000-memory.dmp

Download

memory/5104-35-0x0000000007920000-0x0000000007EC6000-memory.dmp

Download

memory/5104-38-0x0000000008BD0000-0x00000000097F5000-memory.dmp

Download

memory/5104-32-0x0000000007280000-0x0000000007316000-memory.dmp

Download

memory/5104-21-0x0000000005C00000-0x0000000005C66000-memory.dmp

Download

memory/5104-34-0x0000000006830000-0x0000000006852000-memory.dmp

Download

memory/5104-28-0x0000000005DB0000-0x0000000006107000-memory.dmp

Download

memory/5104-30-0x00000000062B0000-0x00000000062CE000-memory.dmp

Download

memory/5104-31-0x00000000062E0000-0x000000000632C000-memory.dmp

Download

memory/5404-1898-0x000002ABBD710000-0x000002ABBD738000-memory.dmp

Download

memory/5436-2600-0x00000000003B0000-0x00000000003B1000-memory.dmp

Download