guloader | b39eaec9267ce32916823eba57c71fbe321b9648cc8f50ee6d1a171800daa1e4

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20251016-en
resource tags

arch:x64arch:x86image:win10v2004-20251016-enlocale:en-usos:windows10-2004-x64system
submitted
11/11/2025, 08:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
New_Purchase_Order_PO-2025-01001481_pdf.exe
Size 601KB
Sample251111-kxt83ssmcs
SHA256 b39eaec9267ce32916823eba57c71fbe321b9648cc8f50ee6d1a171800daa1e4
MD5 e6b2cc822ad480918e97070a62643b90
SHA1 bac01f415ab5e6e43b1fd2a6b3713bf7adb1ab1e
SHA512 4fef18ab040665cc816c570b1adf1e9bd42bf378db5d2b2aa73bc286681bd4109a823bb44f84f763279356c443d8267dcd1afa868a7a32524d62ea68545d5da3
SSDEEP 12288:OMweUzNb/QMy+P1NyRJwonnb1UB57NlBPrjkGWl:OMweUzNb/QMTtNyRJwEnh07RzjBY
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

collection discovery downloader guloader phantom_stealer persistence spyware stealer

Malware Config

Extracted

Family

phantom_stealer

Version

v3.5.0

https://api.telegram.org/bot8317489635:AAGuFwSA514jDG7Cd5CK-sE8t4UmJmEBquY/sendMessage?chat_id=6897585916

Mutex

UMVOXDP0B66F4QG3YYYK

Attributes

anti_analysis
0
cb_enables_ssl
0
debug
0
keylogger
1
start_delay
0
startup
0

Signatures

Detects PhantomStealer payload 2 IoCs

resource	yara_rule
behavioral1/memory/2744-39-0x0000000000490000-0x00000000016E4000-memory.dmp	family_phantomstealer
behavioral1/memory/2744-40-0x0000000000490000-0x000000000054E000-memory.dmp	family_phantomstealer

Guloader family
guloader
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader
PhantomStealer
Phantom Stealer is a stealer written in C#, forked from the Stealerium family.
stealer phantom_stealer
Phantom_stealer family
phantom_stealer

Loads dropped DLL 1 IoCs

pid	Process
1884	New_Purchase_Order_PO-2025-01001481_pdf.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1919182765-2457925700-1517026611-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	New_Purchase_Order_PO-2025-01001481_pdf.exe
Key opened	\REGISTRY\USER\S-1-5-21-1919182765-2457925700-1517026611-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	New_Purchase_Order_PO-2025-01001481_pdf.exe
Key opened	\REGISTRY\USER\S-1-5-21-1919182765-2457925700-1517026611-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	New_Purchase_Order_PO-2025-01001481_pdf.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
61	drive.google.com
62	drive.google.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
401	icanhazip.com

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
2744	New_Purchase_Order_PO-2025-01001481_pdf.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
1884	New_Purchase_Order_PO-2025-01001481_pdf.exe
2744	New_Purchase_Order_PO-2025-01001481_pdf.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	New_Purchase_Order_PO-2025-01001481_pdf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	New_Purchase_Order_PO-2025-01001481_pdf.exe

Checks processor information in registry 2 TTPs 46 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	New_Purchase_Order_PO-2025-01001481_pdf.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	New_Purchase_Order_PO-2025-01001481_pdf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Enumerates system info in registry 2 TTPs 12 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1919182765-2457925700-1517026611-1000\{02D65FA8-5221-4132-AD70-40316993BCBC}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1919182765-2457925700-1517026611-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-1919182765-2457925700-1517026611-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2744	New_Purchase_Order_PO-2025-01001481_pdf.exe
2744	New_Purchase_Order_PO-2025-01001481_pdf.exe
2744	New_Purchase_Order_PO-2025-01001481_pdf.exe
3400	chrome.exe
3400	chrome.exe
2744	New_Purchase_Order_PO-2025-01001481_pdf.exe
2744	New_Purchase_Order_PO-2025-01001481_pdf.exe
2744	New_Purchase_Order_PO-2025-01001481_pdf.exe
2744	New_Purchase_Order_PO-2025-01001481_pdf.exe
2744	New_Purchase_Order_PO-2025-01001481_pdf.exe
2744	New_Purchase_Order_PO-2025-01001481_pdf.exe
2744	New_Purchase_Order_PO-2025-01001481_pdf.exe
2744	New_Purchase_Order_PO-2025-01001481_pdf.exe
4956	firefox.exe
4956	firefox.exe
4956	firefox.exe
4956	firefox.exe
4956	firefox.exe
4956	firefox.exe
4956	firefox.exe
4956	firefox.exe
4956	firefox.exe
4956	firefox.exe
4956	firefox.exe
4956	firefox.exe
4956	firefox.exe
4956	firefox.exe
4956	firefox.exe
4956	firefox.exe
4956	firefox.exe
4956	firefox.exe
4956	firefox.exe
4956	firefox.exe
4956	firefox.exe
4956	firefox.exe
4956	firefox.exe
4956	firefox.exe
2744	New_Purchase_Order_PO-2025-01001481_pdf.exe
2744	New_Purchase_Order_PO-2025-01001481_pdf.exe
2744	New_Purchase_Order_PO-2025-01001481_pdf.exe
2744	New_Purchase_Order_PO-2025-01001481_pdf.exe
2744	New_Purchase_Order_PO-2025-01001481_pdf.exe
2744	New_Purchase_Order_PO-2025-01001481_pdf.exe
2744	New_Purchase_Order_PO-2025-01001481_pdf.exe
2744	New_Purchase_Order_PO-2025-01001481_pdf.exe
2744	New_Purchase_Order_PO-2025-01001481_pdf.exe
2744	New_Purchase_Order_PO-2025-01001481_pdf.exe
2744	New_Purchase_Order_PO-2025-01001481_pdf.exe
2744	New_Purchase_Order_PO-2025-01001481_pdf.exe
2744	New_Purchase_Order_PO-2025-01001481_pdf.exe
2744	New_Purchase_Order_PO-2025-01001481_pdf.exe
2744	New_Purchase_Order_PO-2025-01001481_pdf.exe
2744	New_Purchase_Order_PO-2025-01001481_pdf.exe
2744	New_Purchase_Order_PO-2025-01001481_pdf.exe
2744	New_Purchase_Order_PO-2025-01001481_pdf.exe
2744	New_Purchase_Order_PO-2025-01001481_pdf.exe
2744	New_Purchase_Order_PO-2025-01001481_pdf.exe
7000	firefox.exe
7000	firefox.exe
7000	firefox.exe
7000	firefox.exe
7000	firefox.exe
7000	firefox.exe
7000	firefox.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1884	New_Purchase_Order_PO-2025-01001481_pdf.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeDebugPrivilege	2744	New_Purchase_Order_PO-2025-01001481_pdf.exe
Token: SeShutdownPrivilege	3400	chrome.exe
Token: SeCreatePagefilePrivilege	3400	chrome.exe
Token: SeShutdownPrivilege	3400	chrome.exe
Token: SeCreatePagefilePrivilege	3400	chrome.exe
Token: SeShutdownPrivilege	3400	chrome.exe
Token: SeCreatePagefilePrivilege	3400	chrome.exe
Token: SeShutdownPrivilege	5216	chrome.exe
Token: SeCreatePagefilePrivilege	5216	chrome.exe
Token: SeShutdownPrivilege	5216	chrome.exe
Token: SeCreatePagefilePrivilege	5216	chrome.exe

Suspicious use of FindShellTrayWindow 46 IoCs

pid	Process
3400	chrome.exe
3400	chrome.exe
4956	firefox.exe
4956	firefox.exe
4956	firefox.exe
4956	firefox.exe
4956	firefox.exe
4956	firefox.exe
4956	firefox.exe
4956	firefox.exe
4956	firefox.exe
4956	firefox.exe
4956	firefox.exe
4956	firefox.exe
4956	firefox.exe
4956	firefox.exe
4956	firefox.exe
4956	firefox.exe
4956	firefox.exe
4956	firefox.exe
4956	firefox.exe
4956	firefox.exe
5184	msedge.exe
628	msedge.exe
7000	firefox.exe
7000	firefox.exe
7000	firefox.exe
7000	firefox.exe
7000	firefox.exe
7000	firefox.exe
7000	firefox.exe
7000	firefox.exe
7000	firefox.exe
7000	firefox.exe
7000	firefox.exe
7000	firefox.exe
7000	firefox.exe
7000	firefox.exe
7000	firefox.exe
7000	firefox.exe
7000	firefox.exe
7000	firefox.exe
7000	firefox.exe
7000	firefox.exe
5216	chrome.exe
5216	chrome.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4956	firefox.exe
7000	firefox.exe
2744	New_Purchase_Order_PO-2025-01001481_pdf.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1884 wrote to memory of 2744	1884	New_Purchase_Order_PO-2025-01001481_pdf.exe	98
PID 1884 wrote to memory of 2744	1884	New_Purchase_Order_PO-2025-01001481_pdf.exe	98
PID 1884 wrote to memory of 2744	1884	New_Purchase_Order_PO-2025-01001481_pdf.exe	98
PID 1884 wrote to memory of 2744	1884	New_Purchase_Order_PO-2025-01001481_pdf.exe	98
PID 1884 wrote to memory of 2744	1884	New_Purchase_Order_PO-2025-01001481_pdf.exe	98
PID 2744 wrote to memory of 3400	2744	New_Purchase_Order_PO-2025-01001481_pdf.exe	101
PID 2744 wrote to memory of 3400	2744	New_Purchase_Order_PO-2025-01001481_pdf.exe	101
PID 3400 wrote to memory of 2056	3400	chrome.exe	102
PID 3400 wrote to memory of 2056	3400	chrome.exe	102
PID 2744 wrote to memory of 2056	2744	New_Purchase_Order_PO-2025-01001481_pdf.exe	102
PID 2744 wrote to memory of 2056	2744	New_Purchase_Order_PO-2025-01001481_pdf.exe	102
PID 3400 wrote to memory of 2908	3400	chrome.exe	103
PID 3400 wrote to memory of 2908	3400	chrome.exe	103
PID 3400 wrote to memory of 1624	3400	chrome.exe	104
PID 3400 wrote to memory of 1624	3400	chrome.exe	104
PID 3400 wrote to memory of 5024	3400	chrome.exe	105
PID 3400 wrote to memory of 5024	3400	chrome.exe	105
PID 2744 wrote to memory of 3400	2744	New_Purchase_Order_PO-2025-01001481_pdf.exe	101
PID 2744 wrote to memory of 3400	2744	New_Purchase_Order_PO-2025-01001481_pdf.exe	101
PID 3400 wrote to memory of 2528	3400	chrome.exe	106
PID 3400 wrote to memory of 2528	3400	chrome.exe	106
PID 3400 wrote to memory of 2456	3400	chrome.exe	107
PID 3400 wrote to memory of 2456	3400	chrome.exe	107
PID 2744 wrote to memory of 1624	2744	New_Purchase_Order_PO-2025-01001481_pdf.exe	104
PID 2744 wrote to memory of 1624	2744	New_Purchase_Order_PO-2025-01001481_pdf.exe	104
PID 3400 wrote to memory of 4956	3400	chrome.exe	120
PID 3400 wrote to memory of 4956	3400	chrome.exe	120
PID 3400 wrote to memory of 5240	3400	chrome.exe	109
PID 3400 wrote to memory of 5240	3400	chrome.exe	109
PID 3400 wrote to memory of 3796	3400	chrome.exe	110
PID 3400 wrote to memory of 3796	3400	chrome.exe	110
PID 3400 wrote to memory of 2944	3400	chrome.exe	111
PID 3400 wrote to memory of 2944	3400	chrome.exe	111
PID 2744 wrote to memory of 2908	2744	New_Purchase_Order_PO-2025-01001481_pdf.exe	103
PID 2744 wrote to memory of 2908	2744	New_Purchase_Order_PO-2025-01001481_pdf.exe	103
PID 3400 wrote to memory of 3924	3400	chrome.exe	112
PID 3400 wrote to memory of 3924	3400	chrome.exe	112
PID 2744 wrote to memory of 5024	2744	New_Purchase_Order_PO-2025-01001481_pdf.exe	105
PID 2744 wrote to memory of 5024	2744	New_Purchase_Order_PO-2025-01001481_pdf.exe	105
PID 2744 wrote to memory of 2056	2744	New_Purchase_Order_PO-2025-01001481_pdf.exe	102
PID 2744 wrote to memory of 2056	2744	New_Purchase_Order_PO-2025-01001481_pdf.exe	102
PID 2744 wrote to memory of 3400	2744	New_Purchase_Order_PO-2025-01001481_pdf.exe	101
PID 2744 wrote to memory of 3400	2744	New_Purchase_Order_PO-2025-01001481_pdf.exe	101
PID 3400 wrote to memory of 6124	3400	chrome.exe	113
PID 3400 wrote to memory of 6124	3400	chrome.exe	113
PID 2744 wrote to memory of 1624	2744	New_Purchase_Order_PO-2025-01001481_pdf.exe	104
PID 2744 wrote to memory of 1624	2744	New_Purchase_Order_PO-2025-01001481_pdf.exe	104
PID 2744 wrote to memory of 2944	2744	New_Purchase_Order_PO-2025-01001481_pdf.exe	111
PID 2744 wrote to memory of 2944	2744	New_Purchase_Order_PO-2025-01001481_pdf.exe	111
PID 2744 wrote to memory of 3924	2744	New_Purchase_Order_PO-2025-01001481_pdf.exe	112
PID 2744 wrote to memory of 3924	2744	New_Purchase_Order_PO-2025-01001481_pdf.exe	112
PID 2744 wrote to memory of 2908	2744	New_Purchase_Order_PO-2025-01001481_pdf.exe	103
PID 2744 wrote to memory of 2908	2744	New_Purchase_Order_PO-2025-01001481_pdf.exe	103
PID 2744 wrote to memory of 2456	2744	New_Purchase_Order_PO-2025-01001481_pdf.exe	107
PID 2744 wrote to memory of 2456	2744	New_Purchase_Order_PO-2025-01001481_pdf.exe	107
PID 2744 wrote to memory of 5240	2744	New_Purchase_Order_PO-2025-01001481_pdf.exe	109
PID 2744 wrote to memory of 5240	2744	New_Purchase_Order_PO-2025-01001481_pdf.exe	109
PID 2744 wrote to memory of 5024	2744	New_Purchase_Order_PO-2025-01001481_pdf.exe	105
PID 2744 wrote to memory of 5024	2744	New_Purchase_Order_PO-2025-01001481_pdf.exe	105
PID 2744 wrote to memory of 2056	2744	New_Purchase_Order_PO-2025-01001481_pdf.exe	102
PID 2744 wrote to memory of 2056	2744	New_Purchase_Order_PO-2025-01001481_pdf.exe	102
PID 2744 wrote to memory of 3400	2744	New_Purchase_Order_PO-2025-01001481_pdf.exe	101
PID 2744 wrote to memory of 3400	2744	New_Purchase_Order_PO-2025-01001481_pdf.exe	101
PID 2744 wrote to memory of 3796	2744	New_Purchase_Order_PO-2025-01001481_pdf.exe	110

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1919182765-2457925700-1517026611-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	New_Purchase_Order_PO-2025-01001481_pdf.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1919182765-2457925700-1517026611-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	New_Purchase_Order_PO-2025-01001481_pdf.exe

C:\Users\Admin\AppData\Local\Temp\New_Purchase_Order_PO-2025-01001481_pdf.exe
"C:\Users\Admin\AppData\Local\Temp\New_Purchase_Order_PO-2025-01001481_pdf.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1884
- C:\Users\Admin\AppData\Local\Temp\New_Purchase_Order_PO-2025-01001481_pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\New_Purchase_Order_PO-2025-01001481_pdf.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - outlook_office_path
  - outlook_win_path
  PID:2744
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\thyhpqwb.gxz"
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3400
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\thyhpqwb.gxz /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\thyhpqwb.gxz\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\thyhpqwb.gxz --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fff560cdcf8,0x7fff560cdd04,0x7fff560cdd10
      4⤵
      PID:2056
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\thyhpqwb.gxz" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=1908,i,15687827236936973598,2821822675866809289,262144 --variations-seed-version --mojo-platform-channel-handle=1904 /prefetch:2
      4⤵
      PID:2908
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\thyhpqwb.gxz" --field-trial-handle=1956,i,15687827236936973598,2821822675866809289,262144 --variations-seed-version --mojo-platform-channel-handle=2008 /prefetch:3
      4⤵
      PID:1624
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\thyhpqwb.gxz" --field-trial-handle=2108,i,15687827236936973598,2821822675866809289,262144 --variations-seed-version --mojo-platform-channel-handle=2256 /prefetch:8
      4⤵
      PID:5024
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\thyhpqwb.gxz" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3116,i,15687827236936973598,2821822675866809289,262144 --variations-seed-version --mojo-platform-channel-handle=3160 /prefetch:1
      4⤵
      PID:2528
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\thyhpqwb.gxz" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3124,i,15687827236936973598,2821822675866809289,262144 --variations-seed-version --mojo-platform-channel-handle=3184 /prefetch:1
      4⤵
      PID:2456
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\thyhpqwb.gxz" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3572,i,15687827236936973598,2821822675866809289,262144 --variations-seed-version --mojo-platform-channel-handle=3684 /prefetch:1
      4⤵
      PID:4956
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\thyhpqwb.gxz" --extension-process --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=3524,i,15687827236936973598,2821822675866809289,262144 --variations-seed-version --mojo-platform-channel-handle=3712 /prefetch:2
      4⤵
      PID:5240
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\thyhpqwb.gxz" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=3084,i,15687827236936973598,2821822675866809289,262144 --variations-seed-version --mojo-platform-channel-handle=3720 /prefetch:1
      4⤵
      PID:3796
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\thyhpqwb.gxz" --extension-process --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=3592,i,15687827236936973598,2821822675866809289,262144 --variations-seed-version --mojo-platform-channel-handle=3748 /prefetch:2
      4⤵
      PID:2944
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\thyhpqwb.gxz" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=4316,i,15687827236936973598,2821822675866809289,262144 --variations-seed-version --mojo-platform-channel-handle=4348 /prefetch:1
      4⤵
      PID:3924
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\thyhpqwb.gxz" --field-trial-handle=4312,i,15687827236936973598,2821822675866809289,262144 --variations-seed-version --mojo-platform-channel-handle=4368 /prefetch:8
      4⤵
      PID:6124
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\thyhpqwb.gxz" --field-trial-handle=4964,i,15687827236936973598,2821822675866809289,262144 --variations-seed-version --mojo-platform-channel-handle=4980 /prefetch:8
      4⤵
      PID:3900
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\thyhpqwb.gxz" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=5064,i,15687827236936973598,2821822675866809289,262144 --variations-seed-version --mojo-platform-channel-handle=5104 /prefetch:1
      4⤵
      PID:4100
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\thyhpqwb.gxz" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=5116,i,15687827236936973598,2821822675866809289,262144 --variations-seed-version --mojo-platform-channel-handle=5076 /prefetch:1
      4⤵
      PID:4216
  - - C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
      4⤵
      PID:3248
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\y33dfftl.m15"
    3⤵
    PID:5568
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir=C:\Users\Admin\AppData\Local\Temp\y33dfftl.m15
      4⤵
      Checks processor information in registry
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:4956
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1984 -prefsLen 27099 -prefMapHandle 1988 -prefMapSize 270279 -ipcHandle 2076 -initialChannelId {207c03f6-85c7-4002-8e07-850fc2116af0} -parentPid 4956 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4956" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
        5⤵
        
        PID:4404
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2176 -prefsLen 27135 -prefMapHandle 2180 -prefMapSize 270279 -ipcHandle 2252 -initialChannelId {553db855-bb2e-4572-8079-d48dc5a25724} -parentPid 4956 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4956" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
        5⤵
        
        PID:5280
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\dba7eb47-4465-45a1-8e65-997e99f47f95.dmp"
        5⤵
        
        PID:4768
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2928 -prefsLen 27135 -prefMapHandle 2932 -prefMapSize 270279 -ipcHandle 2940 -initialChannelId {3bd60ef4-f97e-4177-b0c7-c5ed42e9ce34} -parentPid 4956 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4956" -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 gpu
        5⤵
        
        PID:972
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\d5d18ca9-bbd2-4faa-bd6d-ea7045ab4969.dmp"
        5⤵
        
        PID:4672
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1972 -prefsLen 27135 -prefMapHandle 2912 -prefMapSize 270279 -ipcHandle 3196 -initialChannelId {ebca1a2c-2391-4143-b44b-47cb0097ba68} -parentPid 4956 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4956" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 gpu
        5⤵
        
        PID:5940
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\06fa90b9-dda5-4241-a502-377a023ede73.dmp"
        5⤵
        
        PID:5292
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3192 -prefsLen 27200 -prefMapHandle 3216 -prefMapSize 270279 -ipcHandle 3484 -initialChannelId {f6785eac-0cec-4142-9a3d-52e6e9d702bd} -parentPid 4956 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4956" -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 gpu
        5⤵
        
        PID:1380
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\a6a225ed-ab87-443a-8c51-8d7d310e5560.dmp"
        5⤵
        
        PID:4356
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3484 -prefsLen 27200 -prefMapHandle 3296 -prefMapSize 270279 -ipcHandle 3204 -initialChannelId {5db306a1-f450-4687-be9c-bc6207eac968} -parentPid 4956 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4956" -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 gpu
        5⤵
        
        PID:320
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3580 -prefsLen 27325 -prefMapHandle 3564 -prefMapSize 270279 -jsInitHandle 3568 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3492 -initialChannelId {f02fb5d7-81b6-479d-8f15-fe23a9685a63} -parentPid 4956 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4956" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
        5⤵
        Checks processor information in registry
        
        PID:3480
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\376c90f8-9fe5-4651-9fe7-03e3d4f67bf1.dmp"
        5⤵
        
        PID:4000
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3528 -prefsLen 27325 -prefMapHandle 3540 -prefMapSize 270279 -ipcHandle 3288 -initialChannelId {ad89ad7b-387e-49cf-a3fd-df6c4cd7054c} -parentPid 4956 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4956" -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 gpu
        5⤵
        
        PID:3504
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\eaa71248-00c6-43c4-ac01-715e099f1b35.dmp"
        5⤵
        
        PID:824
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4240 -prefsLen 27325 -prefMapHandle 4244 -prefMapSize 270279 -ipcHandle 4252 -initialChannelId {540c7abc-29a8-49ec-9821-a0f6baf8842d} -parentPid 4956 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4956" -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 rdd
        5⤵
        
        PID:1500
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4556 -prefsLen 34878 -prefMapHandle 4560 -prefMapSize 270279 -jsInitHandle 4564 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4644 -initialChannelId {560192e7-3c6f-4b84-b045-3cb589fed301} -parentPid 4956 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4956" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
        5⤵
        Checks processor information in registry
        
        PID:4576
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 2800 -prefsLen 35012 -prefMapHandle 3808 -prefMapSize 270279 -ipcHandle 3064 -initialChannelId {347b8a40-3775-4b48-8da5-e1df6af889e9} -parentPid 4956 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4956" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 utility
        5⤵
        Checks processor information in registry
        
        PID:3248
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5144 -prefsLen 32900 -prefMapHandle 5148 -prefMapSize 270279 -jsInitHandle 5152 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5160 -initialChannelId {ee7a0c30-8ea0-4677-82b8-8ad9697719b1} -parentPid 4956 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4956" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
        5⤵
        Checks processor information in registry
        
        PID:5796
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5184 -prefsLen 32900 -prefMapHandle 5188 -prefMapSize 270279 -jsInitHandle 5192 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5200 -initialChannelId {ae8e346d-ac91-4b85-bb25-783ca196434e} -parentPid 4956 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4956" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab
        5⤵
        Checks processor information in registry
        
        PID:2296
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5560 -prefsLen 32952 -prefMapHandle 5656 -prefMapSize 270279 -jsInitHandle 5660 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5556 -initialChannelId {59db86ee-5632-4b95-91de-b77134781692} -parentPid 4956 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4956" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 14 tab
        5⤵
        Checks processor information in registry
        
        PID:1600
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nkbwyku3.uac"
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious use of FindShellTrayWindow
    PID:5184
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\nkbwyku3.uac /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\nkbwyku3.uac\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x238,0x23c,0x240,0x234,0x24c,0x7fff5302f208,0x7fff5302f214,0x7fff5302f220
      4⤵
      PID:2408
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nkbwyku3.uac" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --field-trial-handle=2196,i,3393714359047324922,11836525034762020300,262144 --variations-seed-version --mojo-platform-channel-handle=2192 /prefetch:2
      4⤵
      PID:5232
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nkbwyku3.uac" --always-read-main-dll --field-trial-handle=1908,i,3393714359047324922,11836525034762020300,262144 --variations-seed-version --mojo-platform-channel-handle=2208 /prefetch:3
      4⤵
      PID:4944
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nkbwyku3.uac" --always-read-main-dll --field-trial-handle=2348,i,3393714359047324922,11836525034762020300,262144 --variations-seed-version --mojo-platform-channel-handle=2492 /prefetch:8
      4⤵
      PID:4768
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nkbwyku3.uac" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3192,i,3393714359047324922,11836525034762020300,262144 --variations-seed-version --mojo-platform-channel-handle=3240 /prefetch:1
      4⤵
      PID:3024
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nkbwyku3.uac" --instant-process --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3212,i,3393714359047324922,11836525034762020300,262144 --variations-seed-version --mojo-platform-channel-handle=3268 /prefetch:1
      4⤵
      PID:1112
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nkbwyku3.uac" --always-read-main-dll --field-trial-handle=3604,i,3393714359047324922,11836525034762020300,262144 --variations-seed-version --mojo-platform-channel-handle=3696 /prefetch:8
      4⤵
      PID:3476
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nkbwyku3.uac" --always-read-main-dll --field-trial-handle=3612,i,3393714359047324922,11836525034762020300,262144 --variations-seed-version --mojo-platform-channel-handle=3160 /prefetch:8
      4⤵
      PID:2924
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nkbwyku3.uac" --always-read-main-dll --field-trial-handle=3624,i,3393714359047324922,11836525034762020300,262144 --variations-seed-version --mojo-platform-channel-handle=3744 /prefetch:8
      4⤵
      PID:3984
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nkbwyku3.uac" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --field-trial-handle=3724,i,3393714359047324922,11836525034762020300,262144 --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:1
      4⤵
      PID:5276
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nkbwyku3.uac" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --field-trial-handle=3732,i,3393714359047324922,11836525034762020300,262144 --variations-seed-version --mojo-platform-channel-handle=3820 /prefetch:2
      4⤵
      PID:3656
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nkbwyku3.uac" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --field-trial-handle=3764,i,3393714359047324922,11836525034762020300,262144 --variations-seed-version --mojo-platform-channel-handle=3852 /prefetch:1
      4⤵
      PID:100
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nkbwyku3.uac" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --field-trial-handle=3832,i,3393714359047324922,11836525034762020300,262144 --variations-seed-version --mojo-platform-channel-handle=3888 /prefetch:2
      4⤵
      PID:2516
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nkbwyku3.uac" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --field-trial-handle=3864,i,3393714359047324922,11836525034762020300,262144 --variations-seed-version --mojo-platform-channel-handle=3900 /prefetch:1
      4⤵
      PID:4776
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nkbwyku3.uac" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --field-trial-handle=3908,i,3393714359047324922,11836525034762020300,262144 --variations-seed-version --mojo-platform-channel-handle=3960 /prefetch:2
      4⤵
      PID:2192
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nkbwyku3.uac" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --field-trial-handle=3964,i,3393714359047324922,11836525034762020300,262144 --variations-seed-version --mojo-platform-channel-handle=3972 /prefetch:1
      4⤵
      PID:1752
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nkbwyku3.uac" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --field-trial-handle=3992,i,3393714359047324922,11836525034762020300,262144 --variations-seed-version --mojo-platform-channel-handle=3884 /prefetch:2
      4⤵
      PID:3756
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nkbwyku3.uac" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --field-trial-handle=4024,i,3393714359047324922,11836525034762020300,262144 --variations-seed-version --mojo-platform-channel-handle=4076 /prefetch:1
      4⤵
      PID:2180
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nkbwyku3.uac" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --field-trial-handle=4068,i,3393714359047324922,11836525034762020300,262144 --variations-seed-version --mojo-platform-channel-handle=3760 /prefetch:2
      4⤵
      PID:2848
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nkbwyku3.uac" --always-read-main-dll --field-trial-handle=5428,i,3393714359047324922,11836525034762020300,262144 --variations-seed-version --mojo-platform-channel-handle=3916 /prefetch:8
      4⤵
      PID:5340
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nkbwyku3.uac" --always-read-main-dll --field-trial-handle=5424,i,3393714359047324922,11836525034762020300,262144 --variations-seed-version --mojo-platform-channel-handle=5952 /prefetch:8
      4⤵
      PID:5308
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nkbwyku3.uac" --always-read-main-dll --field-trial-handle=5544,i,3393714359047324922,11836525034762020300,262144 --variations-seed-version --mojo-platform-channel-handle=5996 /prefetch:8
      4⤵
      PID:3084
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --no-sandbox --mute-audio --onnx-enabled-for-ee --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nkbwyku3.uac" --always-read-main-dll --field-trial-handle=5552,i,3393714359047324922,11836525034762020300,262144 --variations-seed-version --mojo-platform-channel-handle=6040 /prefetch:8
      4⤵
      PID:1120
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vaaxdam4.rsj"
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious use of FindShellTrayWindow
    PID:628
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\vaaxdam4.rsj /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\vaaxdam4.rsj\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7fff5302f208,0x7fff5302f214,0x7fff5302f220
      4⤵
      PID:3984
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vaaxdam4.rsj" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --field-trial-handle=2184,i,1695536494530146219,6216930683702889903,262144 --variations-seed-version --mojo-platform-channel-handle=2180 /prefetch:2
      4⤵
      PID:5624
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vaaxdam4.rsj" --always-read-main-dll --field-trial-handle=1864,i,1695536494530146219,6216930683702889903,262144 --variations-seed-version --mojo-platform-channel-handle=2188 /prefetch:3
      4⤵
      PID:4228
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vaaxdam4.rsj" --always-read-main-dll --field-trial-handle=2240,i,1695536494530146219,6216930683702889903,262144 --variations-seed-version --mojo-platform-channel-handle=2496 /prefetch:8
      4⤵
      PID:6080
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vaaxdam4.rsj" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3092,i,1695536494530146219,6216930683702889903,262144 --variations-seed-version --mojo-platform-channel-handle=3112 /prefetch:1
      4⤵
      PID:4048
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vaaxdam4.rsj" --instant-process --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3096,i,1695536494530146219,6216930683702889903,262144 --variations-seed-version --mojo-platform-channel-handle=3124 /prefetch:1
      4⤵
      PID:2916
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vaaxdam4.rsj" --always-read-main-dll --field-trial-handle=3516,i,1695536494530146219,6216930683702889903,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:8
      4⤵
      PID:2356
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vaaxdam4.rsj" --always-read-main-dll --field-trial-handle=3524,i,1695536494530146219,6216930683702889903,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:8
      4⤵
      PID:1028
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vaaxdam4.rsj" --always-read-main-dll --field-trial-handle=3532,i,1695536494530146219,6216930683702889903,262144 --variations-seed-version --mojo-platform-channel-handle=3044 /prefetch:8
      4⤵
      PID:2924
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vaaxdam4.rsj" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --field-trial-handle=3580,i,1695536494530146219,6216930683702889903,262144 --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:1
      4⤵
      PID:5724
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vaaxdam4.rsj" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --field-trial-handle=3560,i,1695536494530146219,6216930683702889903,262144 --variations-seed-version --mojo-platform-channel-handle=3724 /prefetch:2
      4⤵
      PID:3696
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vaaxdam4.rsj" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --field-trial-handle=3684,i,1695536494530146219,6216930683702889903,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:1
      4⤵
      PID:1712
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vaaxdam4.rsj" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --field-trial-handle=3716,i,1695536494530146219,6216930683702889903,262144 --variations-seed-version --mojo-platform-channel-handle=3804 /prefetch:2
      4⤵
      PID:1880
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vaaxdam4.rsj" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --field-trial-handle=3772,i,1695536494530146219,6216930683702889903,262144 --variations-seed-version --mojo-platform-channel-handle=3808 /prefetch:1
      4⤵
      PID:6124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vaaxdam4.rsj" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --field-trial-handle=3836,i,1695536494530146219,6216930683702889903,262144 --variations-seed-version --mojo-platform-channel-handle=3844 /prefetch:2
      4⤵
      PID:4376
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vaaxdam4.rsj" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --field-trial-handle=3676,i,1695536494530146219,6216930683702889903,262144 --variations-seed-version --mojo-platform-channel-handle=3884 /prefetch:1
      4⤵
      PID:4836
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vaaxdam4.rsj" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --field-trial-handle=3880,i,1695536494530146219,6216930683702889903,262144 --variations-seed-version --mojo-platform-channel-handle=3896 /prefetch:2
      4⤵
      PID:2008
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vaaxdam4.rsj" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --field-trial-handle=3912,i,1695536494530146219,6216930683702889903,262144 --variations-seed-version --mojo-platform-channel-handle=3920 /prefetch:1
      4⤵
      PID:2104
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vaaxdam4.rsj" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --field-trial-handle=3988,i,1695536494530146219,6216930683702889903,262144 --variations-seed-version --mojo-platform-channel-handle=3996 /prefetch:2
      4⤵
      PID:5708
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vaaxdam4.rsj" --always-read-main-dll --field-trial-handle=5092,i,1695536494530146219,6216930683702889903,262144 --variations-seed-version --mojo-platform-channel-handle=3884 /prefetch:8
      4⤵
      PID:6384
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vaaxdam4.rsj" --always-read-main-dll --field-trial-handle=5380,i,1695536494530146219,6216930683702889903,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:8
      4⤵
      PID:1388
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vaaxdam4.rsj" --always-read-main-dll --field-trial-handle=5484,i,1695536494530146219,6216930683702889903,262144 --variations-seed-version --mojo-platform-channel-handle=5524 /prefetch:8
      4⤵
      PID:6332
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --no-sandbox --mute-audio --onnx-enabled-for-ee --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vaaxdam4.rsj" --always-read-main-dll --field-trial-handle=5476,i,1695536494530146219,6216930683702889903,262144 --variations-seed-version --mojo-platform-channel-handle=5584 /prefetch:8
      4⤵
      PID:6340
  - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vaaxdam4.rsj" --always-read-main-dll --field-trial-handle=5968,i,1695536494530146219,6216930683702889903,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:8
      4⤵
      PID:5764
  - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vaaxdam4.rsj" --always-read-main-dll --field-trial-handle=5968,i,1695536494530146219,6216930683702889903,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:8
      4⤵
      PID:3572
  - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\Installer\setup.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
      4⤵
      PID:5212
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vaaxdam4.rsj" --always-read-main-dll --field-trial-handle=7008,i,1695536494530146219,6216930683702889903,262144 --variations-seed-version --mojo-platform-channel-handle=6984 /prefetch:8
      4⤵
      PID:6828
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\kj0bzqqo.emc"
    3⤵
    PID:5716
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir=C:\Users\Admin\AppData\Local\Temp\kj0bzqqo.emc
      4⤵
      Checks processor information in registry
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:7000
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1968 -prefsLen 27099 -prefMapHandle 1972 -prefMapSize 270331 -ipcHandle 2060 -initialChannelId {fa990598-1e70-4417-95b8-45751b0585cc} -parentPid 7000 -crashReporter "\\.\pipe\gecko-crash-server-pipe.7000" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
        5⤵
        
        PID:7104
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2256 -prefsLen 27135 -prefMapHandle 2268 -prefMapSize 270331 -ipcHandle 2108 -initialChannelId {ad437c21-af1d-4e51-a109-c724ffd3f202} -parentPid 7000 -crashReporter "\\.\pipe\gecko-crash-server-pipe.7000" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
        5⤵
        
        PID:6072
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\abdd3b29-1f32-4f88-b126-60459178a712.dmp"
        5⤵
        
        PID:4888
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2844 -prefsLen 27135 -prefMapHandle 2848 -prefMapSize 270331 -ipcHandle 2856 -initialChannelId {f8c2d6cb-6b34-40d4-9912-5e57fcd34f23} -parentPid 7000 -crashReporter "\\.\pipe\gecko-crash-server-pipe.7000" -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 gpu
        5⤵
        
        PID:1600
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\0ef26149-3802-4a7b-a93c-a322954515ca.dmp"
        5⤵
        
        PID:3928
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3216 -prefsLen 27135 -prefMapHandle 2856 -prefMapSize 270331 -ipcHandle 3276 -initialChannelId {98fa6999-22c1-44fc-bb05-68b7889a6f00} -parentPid 7000 -crashReporter "\\.\pipe\gecko-crash-server-pipe.7000" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 gpu
        5⤵
        
        PID:3484
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\3b04bd9a-1fd0-4081-9d9f-b3b88a3e48f3.dmp"
        5⤵
        
        PID:6476
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3276 -prefsLen 27200 -prefMapHandle 3488 -prefMapSize 270331 -ipcHandle 3320 -initialChannelId {2a668b02-4aa8-400e-83df-71bca78a26dd} -parentPid 7000 -crashReporter "\\.\pipe\gecko-crash-server-pipe.7000" -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 gpu
        5⤵
        
        PID:6496
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3852 -prefsLen 27325 -prefMapHandle 3856 -prefMapSize 270331 -jsInitHandle 3860 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3980 -initialChannelId {a102a98f-459a-4de6-9c78-9945d3ee321e} -parentPid 7000 -crashReporter "\\.\pipe\gecko-crash-server-pipe.7000" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 tab
        5⤵
        Checks processor information in registry
        
        PID:6616
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\f02621ee-520c-4309-99ab-3da19fa95862.dmp"
        5⤵
        
        PID:6516
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3320 -prefsLen 27325 -prefMapHandle 4176 -prefMapSize 270331 -ipcHandle 3952 -initialChannelId {4d08901e-c72f-458b-b5a4-2cb1487933e9} -parentPid 7000 -crashReporter "\\.\pipe\gecko-crash-server-pipe.7000" -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 gpu
        5⤵
        
        PID:6672
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\910a777f-3cea-4d0c-962c-de193cd917ca.dmp"
        5⤵
        
        PID:6904
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4460 -prefsLen 27325 -prefMapHandle 4464 -prefMapSize 270331 -ipcHandle 4484 -initialChannelId {8170d57a-5104-4a60-bf1f-c48bf0ef46f0} -parentPid 7000 -crashReporter "\\.\pipe\gecko-crash-server-pipe.7000" -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 rdd
        5⤵
        
        PID:4196
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4672 -prefsLen 34878 -prefMapHandle 4676 -prefMapSize 270331 -jsInitHandle 4680 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4716 -initialChannelId {12567c4d-78a7-41ff-bc87-d09ff07e5dc1} -parentPid 7000 -crashReporter "\\.\pipe\gecko-crash-server-pipe.7000" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
        5⤵
        Checks processor information in registry
        
        PID:6920
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4844 -prefsLen 34878 -prefMapHandle 2672 -prefMapSize 270331 -ipcHandle 4920 -initialChannelId {b4c99098-7a65-4bee-ac19-df60f76d383c} -parentPid 7000 -crashReporter "\\.\pipe\gecko-crash-server-pipe.7000" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 utility
        5⤵
        Checks processor information in registry
        
        PID:6256
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4736 -prefsLen 32766 -prefMapHandle 5140 -prefMapSize 270331 -jsInitHandle 5144 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5152 -initialChannelId {a14177f7-9252-4321-9a54-2b8ef7ea97a9} -parentPid 7000 -crashReporter "\\.\pipe\gecko-crash-server-pipe.7000" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
        5⤵
        Checks processor information in registry
        
        PID:3520
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5176 -prefsLen 32766 -prefMapHandle 5192 -prefMapSize 270331 -jsInitHandle 5196 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5208 -initialChannelId {6c882464-9c68-4c46-84e9-4cdeaf1f9b97} -parentPid 7000 -crashReporter "\\.\pipe\gecko-crash-server-pipe.7000" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
        5⤵
        Checks processor information in registry
        
        PID:6044
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5632 -prefsLen 32766 -prefMapHandle 5636 -prefMapSize 270331 -jsInitHandle 5640 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5648 -initialChannelId {0ad25828-70fa-4f20-b348-1ef0676e16c1} -parentPid 7000 -crashReporter "\\.\pipe\gecko-crash-server-pipe.7000" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab
        5⤵
        Checks processor information in registry
        
        PID:7012
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\myodptji.vhy"
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    PID:5216
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\myodptji.vhy /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\myodptji.vhy\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\myodptji.vhy --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fff55ccdcf8,0x7fff55ccdd04,0x7fff55ccdd10
      4⤵
      PID:6604
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\myodptji.vhy" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=2276,i,8525295338223089929,11170535041602723936,262144 --variations-seed-version --mojo-platform-channel-handle=2272 /prefetch:2
      4⤵
      PID:6772
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\myodptji.vhy" --field-trial-handle=1896,i,8525295338223089929,11170535041602723936,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:3
      4⤵
      PID:6812
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\myodptji.vhy" --field-trial-handle=2024,i,8525295338223089929,11170535041602723936,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:8
      4⤵
      PID:6792
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\myodptji.vhy" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3108,i,8525295338223089929,11170535041602723936,262144 --variations-seed-version --mojo-platform-channel-handle=3144 /prefetch:1
      4⤵
      PID:6520
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\myodptji.vhy" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3116,i,8525295338223089929,11170535041602723936,262144 --variations-seed-version --mojo-platform-channel-handle=3180 /prefetch:1
      4⤵
      PID:3456
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\myodptji.vhy" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3536,i,8525295338223089929,11170535041602723936,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
      4⤵
      PID:4280
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\myodptji.vhy" --extension-process --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=3528,i,8525295338223089929,11170535041602723936,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:2
      4⤵
      PID:6372
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\myodptji.vhy" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=3584,i,8525295338223089929,11170535041602723936,262144 --variations-seed-version --mojo-platform-channel-handle=3796 /prefetch:1
      4⤵
      PID:3716
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\myodptji.vhy" --extension-process --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=3596,i,8525295338223089929,11170535041602723936,262144 --variations-seed-version --mojo-platform-channel-handle=3000 /prefetch:2
      4⤵
      PID:6840
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\myodptji.vhy" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=4476,i,8525295338223089929,11170535041602723936,262144 --variations-seed-version --mojo-platform-channel-handle=3816 /prefetch:1
      4⤵
      PID:6336
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\myodptji.vhy" --field-trial-handle=4544,i,8525295338223089929,11170535041602723936,262144 --variations-seed-version --mojo-platform-channel-handle=4492 /prefetch:8
      4⤵
      PID:5756

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5992

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

activity-stream.contile.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3wiiokog.default-release\activity-stream.contile.json
Size 4KB
SHA256 b8827715ff97a6c28dbe781cce1925cb3e31def9bf4819c269ff741bc6dbb1db
MD5 89b056d73a75e247ea2482543b9b60ef
SHA1 6b3aa461cd6dfa123fa83852928ed04b8def9eff
SHA512 49f68b3d5f1a204bfa7f4e7ce8c9bdb2537024b8b4728c0ff70e5d25960b5610a3063aee9199447d801e47138795ad8c0f2aa259d9f1f714b24c182c6ca09e0e
SSDEEP 48:YdpUex5eDXp64gJQHTRdtVKvZdpB9oZ5eDXa0pG4hMz1WP+QwlpdWRhZ5eDXIpWH:KrutgJQz1VcZd/yzIvwlaUbDChh5M
MD5 SHA1 SHA512 SSDEEP

Submit Download

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3wiiokog.default-release\activity-stream.discovery_stream.json
Size 23KB
SHA256 63dcd09141370a614b0be93be95f4c0602b5a5346ac36b6aa53f4a875cbcba4b
MD5 ef59eff28c73160d7294f3c239ac878a
SHA1 42be1e441134f5dddb4156d1eba2255eb55f2a94
SHA512 3ffc401dbb244133ea2ad7df6787e4fd630cad2816bb933b1aa1aa0a2f0f3ad54e550e26c35c497f164521a691ed7e49303fb65e400d865165ab78469ab633f9
SSDEEP 384:5yaOdk+bCs/dSbfaFRM4kUsrT6mTKQySeGSH:5ytu+/Of8RM48re2o6m
MD5 SHA1 SHA512 SSDEEP

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3wiiokog.default-release\startupCache\webext.sc.lz4
Size 104KB
SHA256 9b29a78857771bf9e26c930b3485aa6959f3678508e9b6d7fe1cbc20bb931e4c
MD5 4f077accbe401915e9d670a4101f6a74
SHA1 7c96a988cf20debf307a97e1a81e62c820ff3c65
SHA512 c059906e1acca933a70989a652492f781408eb975231ad0d4f7fdba47e6433f75cf7ce0b1bbd308c3aa7e7675ee3aeed5c56298d866dc488bd749b09aeb82ef2
SSDEEP 1536:jTrliWA/DD3sT67U6AmhsbQAkLWETExSPf5S7a53K0oLkpsZw3OFhZ9UyXEjQv7b:j3l9T67UGt1VTEkxzpNOx9U70sqdJ3
MD5 SHA1 SHA512 SSDEEP

Submit Download

3d941141-e755-4009-b85b-d2ecf82d8da0.tmp

Path C:\Users\Admin\AppData\Local\Temp\3d941141-e755-4009-b85b-d2ecf82d8da0.tmp
Size 242KB
SHA256 81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82
MD5 541f52e24fe1ef9f8e12377a6ccae0c0
SHA1 189898bb2dcae7d5a6057bc2d98b8b450afaebb6
SHA512 d779d78a15c5efca51ebd6b96a7ccb6d718741bdf7d9a37f53b2eb4b98aa1a78bc4cfa57d6e763aab97276c8f9088940ac0476690d4d46023ff4bf52f3326c88
SSDEEP 3072:r+nmRykNgoldZ8GjJCiUXZSk+QSVh85PxEalRVHmcld9R6yYfEp4ABUGDcaKklrv:k3oF4Z4h45P99Fld9RBQYBVcaxlnfL
MD5 SHA1 SHA512 SSDEEP

Submit Download

b7b27220-0b91-4c85-a07b-2316d9d14a19.tmp

Path C:\Users\Admin\AppData\Local\Temp\b7b27220-0b91-4c85-a07b-2316d9d14a19.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

indpiskede.ini

Path C:\Users\Admin\AppData\Local\Temp\indpiskede.ini
Size 35B
SHA256 314eb960147da73582c302879a0ebccda1a32ed4bd1986c7517f89348cbb0abb
MD5 08eb4a4f1b2e51fa7baccea0bbd23d70
SHA1 d2a25e5416462e136fad16170e6a8efcc6c6c562
SHA512 dfcff3b98052d1276bf7a85f3d1d2757578bf7d59408fe3dc6784af57b292feec3a5425dc3b243dbefed5bbdb98dd4d9f3931a79b9913a7114157238b834e3dd
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\nkbwyku3.uac\Crashpad\settings.dat
Size 280B
SHA256 805083763d0a36e8b7b5ddaa85a62c25ceefe775c75b10054fb720f9d6e2a4f7
MD5 ce2d6c526a6227d654cca57dbc98a0df
SHA1 9001cd34ec644114637a6e575dc8797ad3be312f
SHA512 ae4392f2df7e636927f2632154a69afcef5768b5f22c8b398e3252cfa944bb99e650ea9097e6a9e7e8f15b1b9f1827bf44e456e3bc9607392fec463f98f88022
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\nkbwyku3.uac\Crashpad\settings.dat
Size 280B
SHA256 aa6f61bc4f44e660e2d2568124e3386c15b8edc1897186f3489cbbe91039675f
MD5 98c9448567c919efb9a03fda7e527d78
SHA1 c3eff0ee1ec3731b194e7038e70e67b32cf553d6
SHA512 dfdc2dc624c3cb9f377024e49c9d64828737250fc377f624725dab4b3828d7a7c80d1100982d252fcd1f704997e12bb069f938dbed7d9ff76ed21e664cef8b6a
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Temp\nkbwyku3.uac\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\nkbwyku3.uac\Default\Code Cache\js\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Temp\nkbwyku3.uac\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 192B
SHA256 7ed00ad059c60cd7fda9642c04f2c058c2f73fdfb943af26402508cd3e8fdc2e
MD5 49388e2569ea1a81a308ad51ba13a3a7
SHA1 b3e3359a5b3be11caee638c9b45157fd1708b960
SHA512 e156d567132d9dbd7887d41ac43f4d564b9a0ca4725c9958e4852409afa5c8ce42498492354e88b568ff694dc43b70f92816812e60d2506ccfea0f178ee141b9
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Temp\nkbwyku3.uac\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 257B
SHA256 4eeebcba09b1bbfff67a5de240baad723fec1df44953bacb1ea0bd1b60845fc0
MD5 cacba93c4979a2512d1508afe134d172
SHA1 93b090e23041d7ed5606f4e60719090900b4af5d
SHA512 afedf2b0699fef32aec2175bc03750ac7cd2cd26817e76eebd4a111c3ab8a5f369b2a43ceaafc599338eb8a56da4d22d4a19cfa6dc96249f33d2937cade2f35e
MD5 SHA1 SHA512

Submit Download

index.txt~RFe594174.TMP

Path C:\Users\Admin\AppData\Local\Temp\nkbwyku3.uac\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt~RFe594174.TMP
Size 119B
SHA256 70383f7d3af1727faa6255565dda737af386c6edf8edab35bed8b3803a16caa9
MD5 98d3b255186eb793e008c2b9e4639df7
SHA1 3efae65d7bc299ab2468d4245711bb519c166f81
SHA512 c2bd07113537a2be9322d6f27c129f60360a4aea62f7484e50072fd0c95a9e54d4d95b926e42e0017ae23b26a2f7df0b54234032df4e885d64b7d28e2f6a2649
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\nkbwyku3.uac\Local State
Size 3KB
SHA256 3566f658e3fa9bd597e12ebe03c0e587a30bc01ab90a1b2d5cfe46550cb4770b
MD5 a0eb39d37192a2f1f842b2f6a2dff8a5
SHA1 7210a1dd14f1dec9b71728ddc9ae423977a23c5f
SHA512 14df85c228c647cd3081ba041156a6e76f70e577ebac43a4ce04b7a679514a473fc8810ce25c5cd314b0afa8928ec1e6e1b26adc6966029322e83aff79070abe
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\nkbwyku3.uac\Local State
Size 4KB
SHA256 27c8d8699980085c979f1837492d63fe9ec58062aa1baea54f70cf540fceeb78
MD5 3b64ebef0ed6a3388068f05e26912444
SHA1 72a6eb00c9e8b1eef2993e12ad020bde5d43a592
SHA512 d1a493a46c9ce7dc3d17ac5a59db55843a8b66282af196781eb7f279dd16a652a54bbeca6a2cb296ae8ec41aaebf6aa4459eb35fa8ac19cc90c2bae0e04f94fb
SSDEEP 96:gqGNkCufgIrZ2P58Frh/cInURoDotovRGvDGBJDvmryb9JVNyuBwa:LGNbTIrlooDUwELWOkTVN3
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State~RFe593109.TMP

Path C:\Users\Admin\AppData\Local\Temp\nkbwyku3.uac\Local State~RFe593109.TMP
Size 1KB
SHA256 8fc62fc3f979624eb25fbafb799e3b1e617d269bfabd0cc4cc8af17c53877e2e
MD5 b54e66faaee3db046f76b4f8c2a3af23
SHA1 0b9edcf018f90dd912d5b8bbae7b0e4f65852d76
SHA512 70c5ea22e0aa009809a39c6a05e69f64a844cda1d0f314f82e216ab2669e4df275489b1453d61d35bbae5742ef88d2e88f4dda6e2cd3f4b3b4f7361b6c89bb35
MD5 SHA1 SHA512

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsvB8DC.tmp\System.dll
Size 12KB
SHA256 7a9ddee34562cd3703f1502b5c70e99cd5bba15de2b6845a3555033d7f6cb2a5
MD5 564bb0373067e1785cba7e4c24aab4bf
SHA1 7c9416a01d821b10b2eef97b80899d24014d6fc1
SHA512 22c61a323cb9293d7ec5c7e7e60674d0e2f7b29d55be25eb3c128ea2cd7440a1400cee17c43896b996278007c0d247f331a9b8964e3a40a0eb1404a9596c4472
SSDEEP 192:nenY0qWTlt70IAj/lQ0sEWc/wtYbBH2aDybC7y+XBDIwL:n8+Qlt70Fj/lQRY/9VjjfL
MD5 SHA1 SHA512 SSDEEP

Submit Download

fd4c3302-c77c-44ba-bc0c-abb236aa0d9c.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3400_1632572041\fd4c3302-c77c-44ba-bc0c-abb236aa0d9c.tmp
Size 154KB
SHA256 a468f5875b4e55ea732e3df283b4f4ea941be738b238122979ca5d8006a3a8fe
MD5 4ad81f6ccc657d1da582c75c5db037cb
SHA1 ab0370e7d32ebed71fe9787d3a4a2fc0c652a28e
SHA512 66461474f8b36d6d470797df9d4a3cc4698bceb7054c97166eed98b74def84f58486fdb909928aaeafee793799a436210b5d7091acce6232b23eb6ba926ad227
SSDEEP 3072:OqeD5sKZ7XcbMSqnDhcfXE0IfnpWpyKIrFn2wNkR7aUPuWm6u:yD5sIXcYSqDGc0kkpIZ2weeX6u
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\thyhpqwb.gxz\Default\Extension Rules\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\thyhpqwb.gxz\Default\Extension Scripts\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\thyhpqwb.gxz\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\thyhpqwb.gxz\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\thyhpqwb.gxz\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\thyhpqwb.gxz\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\thyhpqwb.gxz\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\vaaxdam4.rsj\Crashpad\settings.dat
Size 280B
SHA256 c66b6e0c3c3e2698c3eed8cccd762d9efc8f5e6b389b03d226d45b56195f7ecb
MD5 4b8a76c43d898f147c6c2db72d6e3874
SHA1 42ada0d16bdf988d773625f50fed1d5dfd43d766
SHA512 d0e60b1736247b1bca75577224a7f982b83c1e811afdf65ce7dbfa557f61b17df6aab10ae699b2887db3b440287cf0010559f5d98a87e1dbd659d304b610f7f0
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\vaaxdam4.rsj\Crashpad\settings.dat
Size 280B
SHA256 fcec2837516f150d0d6f626ad9e4fb55f65008b9598b29bad1f6bfa1f729f1ad
MD5 6b986bb9396893d4cc1a7ac2e7626bc7
SHA1 dbd4d6051aa0019c87d60029b295030d73e0b42a
SHA512 720c55188847230709a04ba0add381c2378c40d99c8318481783881035ac030015a536d24f30bbfe5479d2435add6548974e706258b12e466ce374ffdef0a647
MD5 SHA1 SHA512

Submit Download

f_000001

Path C:\Users\Admin\AppData\Local\Temp\vaaxdam4.rsj\Default\Cache\Cache_Data\f_000001
Size 34KB
SHA256 8c97e1a3437f857eb8a346a360274ea339a09eda1b965ee1445d870c09b066ca
MD5 4227139d34ecd3be139bf6c7d75fce5b
SHA1 0e984113aa96daf31d002392523ad0dfc9cc3870
SHA512 bdb38f430aa623a17b26044288841a07c82691ee858325b158423839fad99a75b192fe0df269898cd76e22a7e54250611f852ccb763ce82db2f7d1c4eb6fcb52
SSDEEP 768:iFPCuSWxAknP3gQlE3brX+48360GKKAC4FZ8ELh/SAE9gnmlV:iFPCuSonPJErr18ZGKK1oLQH95
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000002

Path C:\Users\Admin\AppData\Local\Temp\vaaxdam4.rsj\Default\Cache\Cache_Data\f_000002
Size 99KB
SHA256 cad25cfcc108f11e81cf1a339916e956b5ccd3ab3da38a3bd7a3a7a01adcd3f4
MD5 86e9c0ad8befdb46f1ecda1d3f2c70ad
SHA1 cf9520c235db04ac02e98a7f7c9f3d5d631d4199
SHA512 30a1265891f03df0c46d4f310d97ffa312b84d485a214d895a1c5e260474260d6637592b20d9cf4efa507c131694f63253577fdb352e8e0c46505e02183e0ab4
SSDEEP 1536:GAqrSnLU5BxYE4bP9zel9rbvjJvNCLtY25wJ0qPKldrT6LTMyT2ItH3RHTZ:GAqrSLSvYEwsVbrTfUPdqL4S2iTZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000003

Path C:\Users\Admin\AppData\Local\Temp\vaaxdam4.rsj\Default\Cache\Cache_Data\f_000003
Size 385KB
SHA256 68bc06731377ddfe4a1d322c32f5de4387ec60f448e25d626011a16fbacdcfa6
MD5 030f61744f5fdd93bca89b3c49fa874e
SHA1 0e272a34976e733277e0d89e81ad52af16c6cb19
SHA512 1aaaf1b94f138eb5e86cbdc1e177fe56578b5147435839eaecbdfe8f036a0ab09dc119d01a6104eb6673751c5aa6890990b26a3265b47e4e2d510f9004f7c20b
SSDEEP 6144:t/lK47F8MLnpaiGXVcouQZTix37/mP5YxI4Eo/8FXAIEskVvfA:DrB1VS1Tix373xI4//wNkZfA
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000004

Path C:\Users\Admin\AppData\Local\Temp\vaaxdam4.rsj\Default\Cache\Cache_Data\f_000004
Size 63KB
SHA256 e5b3cabbfc15c5e78b917226331d6cc791db56e237715607aab1f8698120ad55
MD5 c45e12f786e69db8556d2647efd849dd
SHA1 ee1d2f776871bc3494638948a6d3198cde95bdab
SHA512 db83cddb4e1019c58957b3e62b804def1f6aa3a27707c49050aba8693d23ad1e8ef5b1a087b659200c080fb00d081f0f1a3508cccd49c77fe3e48e48a1f4ee4f
SSDEEP 1536:8Z018aiybrXsGUNbgelr0LK2+VfpX6+BHZ7F+ZeexbFeyDr+/YZ+:8Z0SaikNUNrl0LJ+5pHZ72V7x+p
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00000a

Path C:\Users\Admin\AppData\Local\Temp\vaaxdam4.rsj\Default\Cache\Cache_Data\f_00000a
Size 73KB
SHA256 ee72002f20815f7600a0af904b11098abf7233a5c71f566930f4995c3669e83c
MD5 e5f6722dca4c31507d4cfdc5bbb95e53
SHA1 6eebc561e3334d3ba8106a028a12b94adab139a7
SHA512 794b228c2e318e782b4e3eaa76871978c79a10ddbcd4bfa1694af3e16796713395778cf85eb9520908019656f3f6a22902ee5ea7e6b67a1214ebd4fb73820f20
SSDEEP 1536:zDaUrYjm1q1wn5MtJuHxyTi6YbG2X5URa4yU3q2/ZlgSOL1D47c+deYVpJS3:zuUntHxciZG2eR32JD4dbS3
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00000b

Path C:\Users\Admin\AppData\Local\Temp\vaaxdam4.rsj\Default\Cache\Cache_Data\f_00000b
Size 28KB
SHA256 b421c05a340e40d4d4bd1831521268b6f0afd0461ec3991cfa8d5314bf3207b4
MD5 57f9a7c7e2be49102533a2ceb7a05e51
SHA1 850ab0a80577b7f7effe196cba037899e71594c5
SHA512 66406d54a1d1a44f30e19a9bff1242b50fdcfbf66c33e4c23daaa756c06f50a2e39c991e7a8dfd9a81184cc37c2062d0406070be132e28a22307896e63b55447
SSDEEP 768:dT+CJ4QL+F8S4bApn9Ua0ndjCaixJ/fVW2/AGYnS:TJ45F8SgjXnNCa4fVWVnS
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00000c

Path C:\Users\Admin\AppData\Local\Temp\vaaxdam4.rsj\Default\Cache\Cache_Data\f_00000c
Size 17KB
SHA256 252ca98cffdec1c6ec7604b72704d736d95d0a9643195d0a1bac3b1d9db01b7e
MD5 5942cee93487a49093faa631139784ea
SHA1 5723860b365df1ca84d69d7d6a06d4b224a97b51
SHA512 3c4a657db0abea8a7b64ab5ceeae4c26f26b4b11667b8118f141ae9985774ee2c6dd05f4659914005c4e1fc94de0683268037a71aabd82c885880235a7be86a2
SSDEEP 384:6pChsr03QM325DbpSWIC3N08ZNa8+CUFnlxAkt7Fmp4vrv7Y1EwL:6QWrSh325npHz90xCCrZxvrv7Y1Ea
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00000e

Path C:\Users\Admin\AppData\Local\Temp\vaaxdam4.rsj\Default\Cache\Cache_Data\f_00000e
Size 68KB
SHA256 26f2d056c43cc9d83e59c76d08a50092b7c546505ff5ccad5a2cd8cca61a4aef
MD5 06358bda6e5c43e7eb8610a3cae99bb9
SHA1 d941da5ea4fd37d27212d06aab764e844c65e742
SHA512 a3bfc5dfa155ae60fea32f82b0b60ff599ace12dc12d0d6cfe8cdc0f5adc9eb829d2bcfdabd7faf77e9cbe529770607e0d35039cac4fb5f20423321a750f1270
SSDEEP 1536:WCE4MCFi8pkFZLGftTXq+fvXZMEDu/Zg4IQLroZpZwtyF8PDxVSH:tRMKUZ5UJMZ/G4IQYpoBPD3M
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000014

Path C:\Users\Admin\AppData\Local\Temp\vaaxdam4.rsj\Default\Cache\Cache_Data\f_000014
Size 70KB
SHA256 42c629409cdb91fe048a591f990396258cb1bc076dde78008bd099050e012293
MD5 b5ea3dfcbc44075663320b28e7e9c20d
SHA1 2138d47decd4f679578b169b7dab0d2128ba8b98
SHA512 f1f9146821ea3fa84c7dcde9ef646dbaa5b8cccbd150f1f73eb280db2f8e80ce2f3df52370b02d8494da0989ad9373dc02a656b95ec5d5d59047fca854afcbee
SSDEEP 1536:n6dzyUMSNC+BG2/ia8SIinyLy512lau7GtsQqzMdfVaJkjrYGRS7pa:OyxJ+Bd8SE25clau2FqzMdf1kc
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00001a

Path C:\Users\Admin\AppData\Local\Temp\vaaxdam4.rsj\Default\Cache\Cache_Data\f_00001a
Size 18KB
SHA256 10ecd4dc162d2ac7d826b2dfa79e706dd852053d2bc5df5eda1433f2466547f6
MD5 1a4d4e9b989359f7fb708c51304434d8
SHA1 c711062c8eecbdc6a4d456dc09cc78e575f37c97
SHA512 c76aa1fae1adecd3ad2520dd2b27440003bcaa9eb85bf3e83a00c3a0974912c9e13e749a5ec4f883dd3ae00882ade2048464f2f6c43a4bcb6f1aad5d1b35de89
SSDEEP 384:3+YQ/TozCH1DqiTTMbL6t5Vzhrl7/nO/OfMfUi3GHZvntV:3W/U61DzY6//lTO/OUUiWHZftV
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00001f

Path C:\Users\Admin\AppData\Local\Temp\vaaxdam4.rsj\Default\Cache\Cache_Data\f_00001f
Size 16KB
SHA256 23cebdde3aa3c9b38e0647ae2bd6daedae2f62adee6521dbf726731d00bf14b5
MD5 fdbdb95b5ac5c4edecb625ceaccf87b5
SHA1 8da620668bc6b3ee6c2eac8c258d80afa06ead0c
SHA512 08c9c96ffa14e4be65c50bed0683a5d817ea190a493cca1119dbec30807a9e5846baa86c96dd97603620ee67c3acee2cda678cb246fdbd033aed1805aef1d2f1
SSDEEP 384:BhBYbM/UQhdWQz2xB4uINwHHKwq2Lx+J7Yj83GyEskVvyWpg5Fe:DqQUwWQz2xBrnnbNLUBYI2yEVVKWpn
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000021

Path C:\Users\Admin\AppData\Local\Temp\vaaxdam4.rsj\Default\Cache\Cache_Data\f_000021
Size 33KB
SHA256 3ff6fb4e850a17b9ed245cfd23e4354e00a96508560ecbff981fc5c54de7ecbe
MD5 a96c89b3b67e130169a6b851fafe7543
SHA1 32e302a5898b11f43a0822b33c9c5df1b980f4a5
SHA512 fd4507e0a7238622d50ecd772d89edd72eab17fac6ee36e5fc829a54fc97394e233ad219b21fe5b760a08483909b5e17445ff9d4d6f05db32d5588b53160b65c
SSDEEP 768:3y5Ihp54MtQQ0p4WJIYbl5LSTvEJlmU6Tw1yo1PL:3y5I1t0p4PYbl5GT81dyo1PL
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00002f

Path C:\Users\Admin\AppData\Local\Temp\vaaxdam4.rsj\Default\Cache\Cache_Data\f_00002f
Size 38KB
SHA256 ebde9a1ed1380e6655636a2d6d464187d73c7c13ce831f2e8dc348d23ffcbb62
MD5 597a265a2afc7b81d4af9d58aba61dfb
SHA1 a3103e1a28856bff31f2183a9191732ee82bcd89
SHA512 ed250869a406e1beee9b7b670e0f78180e27e5ab6d872f5b0553b439a7a539eede98b8f3a3dbfc9b216e22984741a9fd8381cd27f57782dc50b540fbd220b79a
SSDEEP 768:4ErfZoX1UuFAA6uRDe+cGHZcnzbWg4+r3tEQwYUDRFII:l11q6uRKrGHGzMiEQ3UDII
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000031

Path C:\Users\Admin\AppData\Local\Temp\vaaxdam4.rsj\Default\Cache\Cache_Data\f_000031
Size 17KB
SHA256 fe333faeae331924f55207e6eaded3ba32070f480e8154e169b09b84554ad6a0
MD5 fe1ea89caee6e626201ba413be6e58d2
SHA1 358679cf0518f3eac97f3221009dc49d68abdb8e
SHA512 35168fe5b0f4bca2bf61cd6e667f4c4010a58061b2a0acf8b36bc963310554c24d07496a1f926b24f18ad20361e9102e1dbf9646eabb52651ac44d1983e1edb9
SSDEEP 384:fnRfPuMBan/RZ4Nan/whU8qhRJw9mCL+1uyOCP8JyRmTgXndt:53rBan/RZ4N4/N8qmmCiPfP8JyRmTgX3
MD5 SHA1 SHA512 SSDEEP

Submit Download

Trust Tokens

Path C:\Users\Admin\AppData\Local\Temp\vaaxdam4.rsj\Default\Network\Trust Tokens
Size 4KB
SHA256 8c471cab38a1696289186d01b06ff6af2a888852dc18d6fb8d2a0e54898104ed
MD5 d25d5e1dc1d93430e64ee17e48ce442e
SHA1 d5c7ca9a57e6cc68927a249fe8e601d52680ac7a
SHA512 f4cff7510b4ad81090e0b1842652f8eb7995f7aefd0ce651151bc24ca3a4305d34ecae41cf193d9b846e8f6359ccf545e5d05e63e6e766fa9761ccebce620f6c
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Temp\vaaxdam4.rsj\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 192B
SHA256 3c801dbf26499b101134e2eafc70ce7a49f02584b9fe8c9d66a7afd28714af8f
MD5 1704afa749a3ab3f8646d78702137706
SHA1 2935029060b44b1b6367feccfb4a7686c68fc370
SHA512 611641f25d779610cf343148e9161f505a9f1ff68faebdc55eb6f3808a827209ca19123fe1a438f29e5680a5798df0feb729521138fe5b161dafae2d653cfac6
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Temp\vaaxdam4.rsj\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 257B
SHA256 14953be0a7a2cc9d8997a474ef481d52d66e2afc4f7bab115c2215657a58b383
MD5 44d3f98c26ae946d6aff46f1e643fea5
SHA1 5a57031a09624b6b055fc06225d111cca6314bb5
SHA512 ca80305fb8c3df6f5177250aef3deb1bac5f32579e411f56ddaa4e5788ecb87c4b7fb2e36d439d2135ae7dbe58bdf97d8b46ef427b9a46175a643b7dcc39a877
MD5 SHA1 SHA512

Submit Download

index.txt~RFe596008.TMP

Path C:\Users\Admin\AppData\Local\Temp\vaaxdam4.rsj\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt~RFe596008.TMP
Size 119B
SHA256 8928d938e7e29871992bf5e461fd49651ea9dae399a941356698422dc0b99108
MD5 1f5c91844d6f15db46d3e00fe6144e69
SHA1 9edfb4374390948e578c5945dacb6934cfe4da00
SHA512 1205341351488963e9049508a8c33392f435c435204e6bff793abaed7533083c47d78acaffc4e41e7656d0e5c027ac1050f08977b5a3901a9460a910491be740
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Temp\vaaxdam4.rsj\Default\Sync Data\Logs\sync_diagnostic.log
Size 2KB
SHA256 178686c11f4ea39e22151257d595689a50332d32a829aabcfdb4bbf332d419b9
MD5 7b398cbc7096020b788e7072ef75ae3b
SHA1 670884f55c49937b9bf0128e8040c735a7d26cea
SHA512 f024fef63311e5c9cf967b4aafc782374de6ec918049a649914e45c9ff4b397d6d6ea2be26ea9e4217db2fef2866b94b430b0bd9965c76574466b7ed701b2b76
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\vaaxdam4.rsj\Local State
Size 3KB
SHA256 78f20b79ac19e5dec05f162023e7ed64d69237e17a99d7af44cd76c455680437
MD5 62f62367fab40b02f4e488a24dbc980c
SHA1 652cc32c1a885a47e65ab98fb6829e22b9efa6e5
SHA512 eadf39af9d4b8a339637f33aa6a3b04f96f5330c4f85b151dcf0ae957e2bafd0aa2c76d79b4baf4c2fa52e0e1b8f40bf96e06ccbbded79cda0bf50d28f63e4ff
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\vaaxdam4.rsj\Local State
Size 4KB
SHA256 e66baec88dcad41eb94aacc3a95b3894711dc24f90c1fb9679d432eeb9669391
MD5 fd8833a03f2da9a47105ae622ec914ff
SHA1 6c55aa67a13f0721c5e224089342293d2c060ce7
SHA512 60842c5ba63b9d6646165259bd5d9244027be8a55c42a97351a57492fd70a583d9eb1ba8d14a911c59999f5278cd23bb775ea445e8aae65a46004adf15f28151
SSDEEP 96:WqGNkCufg8jP58Frh/cInURoDotov7dDHBBPUvebCIYgJVgEBpa:9GNbT8OooDUw5h5yIYQVY
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State~RFe59521e.TMP

Path C:\Users\Admin\AppData\Local\Temp\vaaxdam4.rsj\Local State~RFe59521e.TMP
Size 1KB
SHA256 3b0687bfba4c23a9d16cd0491032e9e85da72c52fff2de7056b02a1c446bb706
MD5 bfa952eed15a71880cb64db2d4db0087
SHA1 aa20afc4d25dc158bf5bdd3e05cdfd8142c226cd
SHA512 ef818be484380c8643e86f03d42018795751e0cb062d37ca80c9a62ae7b8506efe86855e35496e4c7575427a1e4b6f9dd97e90bff757d1783e64b07f09733fa1
MD5 SHA1 SHA512

Submit Download

454KZX1E7PB16FS73NHK.temp

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\454KZX1E7PB16FS73NHK.temp
Size 4KB
SHA256 c7e300f4f34c82127dc6bde9f33c8683a87c1fbdc087656a7727923c5fa70c4d
MD5 8c9146ad727ae80e9815534686856d04
SHA1 5d7e067904921573e2cb57522f4cb08e1f06abf8
SHA512 fef5cfc8db210a4e30dec69c3ffc3a10abb76432e85e53a97af0caf152b14ac54065cc6d953fab877be083e6791eac87d2ad0fff8d2e8bb1c7eca5bdc5b0599e
SSDEEP 48:BfINJdOedwQJJvOrJ9zUoYidLXuHEpn2fhNJdOedwQJJvOrJ9zvY3gdLXuHf2n+:+puNJUojukZEpuNJvYIu4+
MD5 SHA1 SHA512 SSDEEP

Submit Download

ccba5a5986c77e43.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Size 4KB
SHA256 81319c536e4c7559df967594f9fde9de081637efcaed1036cf2c682a6e521db5
MD5 230477b9db2a7f2e0738082b4853110f
SHA1 758b7e9aa077088fb25623f62293185e38e207d0
SHA512 0952be71c44bcfa1018d303d661e4cf877d70f1d76f9a48e6452fe1df9cc24e5f0f8a070784559707dd60edc8d412bb8d8aa40774df7e1445c9b7c3cd353283e
SSDEEP 48:JINJdOedwQJJvOrJ9zUoYHIdLXuHEpnShNJdOedwQJJvOrJ9zvYHdgdLXuHf2n+:GpuNJUotukZopuNJvyIu4+
MD5 SHA1 SHA512 SSDEEP

Submit Download

06fa90b9-dda5-4241-a502-377a023ede73.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\06fa90b9-dda5-4241-a502-377a023ede73.dmp
Size 63KB
SHA256 aad4a83d0a4931a653775026642a827463d4386bbc5d262160b0adfc65b300c0
MD5 9601b9b30ca5db17eb0a57987b0b9419
SHA1 d50357afba1249703388d746efea6a9708fc136e
SHA512 1851e2317042c7debf22ef3f7efef5013d2728952bf118cb46dc0db1ed4d7e24cc009b4f3d4ca1d143a12915b5729ba314adeb787b6f3e567a516b6e326ccd18
SSDEEP 384:zikwBBaLa1m0ha1m0Ma1m0vUI2utJVHfdlg3ANCaptIFAZvZbeUEHedV9L9ypb+X:zUBByVvdfdj3baAZvYuP9L9y9+0MP
MD5 SHA1 SHA512 SSDEEP

Submit Download

06fa90b9-dda5-4241-a502-377a023ede73.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\06fa90b9-dda5-4241-a502-377a023ede73.extra
Size 10KB
SHA256 59a58dc2554e112842d414f9dd01be3c991535b5096b795efee3c65d79c841f1
MD5 06d856017f0836cbc43325ceb61dad0c
SHA1 cd311f854fdd696796a341beaf64ac7cc739d955
SHA512 5f8af1fa0c3c7b912b378f888d7849c4d2ea748b60e5c25c6820d891f850f4f47adde66ff8ed7ca1093c8bff9b1cd8dc6a9d7ba26cb957e98d85bcf9a0d7efda
SSDEEP 96:S7WCcTV+Y6pw6FF29dW640Rh7CsevBb1d0pjMLlIrLlhTLlaXv7a8xcBvtILI5q9:ShQiYL/7uvZ8FLlxsPpwl7efoK
MD5 SHA1 SHA512 SSDEEP

Submit Download

06fa90b9-dda5-4241-a502-377a023ede73.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\06fa90b9-dda5-4241-a502-377a023ede73.extra
Size 10KB
SHA256 33bc0486868fc5dd500ee6939476baeb4cf69e375c9fefef81ae3a12b38166d0
MD5 927752fa26b690f48754126218c9b381
SHA1 5bef1b1a5f1612b8bff6b20880c616a319d8d1f5
SHA512 186a007f76486e87890b7e0a4fd52043b24f5dc074b0b122fcd5680c5ca6fef844868145248a74201ba5ede4fcc2cd7299e471766fbf4b0cc6a6cbf3fb8b54e7
SSDEEP 192:ShjcFaiR4MmnQYapdVxzPPWBH04TofKNdalzefoKbLcZZWFN1ftHfJtf:ejcFaiSI13WBH04T3a8AKcZZWFNJtHfX
MD5 SHA1 SHA512 SSDEEP

Submit Download

376c90f8-9fe5-4651-9fe7-03e3d4f67bf1.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\376c90f8-9fe5-4651-9fe7-03e3d4f67bf1.dmp
Size 64KB
SHA256 9b969da56d3565bdce0c31016e7b7dc9a28bc867111e84cd1af946f8bdacd192
MD5 6f27f4083463d6cb13456fe29bc477ae
SHA1 b36f7687fc86843c7fc7f118a23cdcdae65a900d
SHA512 0e9ab388cd32e42d7d17e20c1c99e48d17c5beee61a6eb5064bb660bba648bebf4ba74e98a7fa46a8931beffea42aacc54707465eed75fb20b69ea318f58715d
SSDEEP 384:KbJwBSuOmh90Lmh90Qmh90XUxZHFy6iHmsqJEkvDokKhlcb/l3D5pq/i9L9ypb+X:KaBSut3JHNqJygvpq/i9L9y9+0MP
MD5 SHA1 SHA512 SSDEEP

Submit Download

376c90f8-9fe5-4651-9fe7-03e3d4f67bf1.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\376c90f8-9fe5-4651-9fe7-03e3d4f67bf1.extra
Size 10KB
SHA256 31eae67ca4e27aa1d3e8667460ad5cf2213b74868c4078cf8c3d074cc9864a0e
MD5 9056339ffab988fbbab408ab342a0919
SHA1 b329d3b61abe40e2c2233ff2c8fddec46a587b14
SHA512 b5573473c42131fc9197db7b812e58de53f497e929626605d2e7d624ec31504e0719659e79e794b26cc19911907a9d6fd708fd09b7cb45add5d926f79e2f6436
SSDEEP 96:S7WCITV+Y6pw6FF29dW640Rh7CsevBb1d0pjMLlIrLlhTLlaXv7aWcBvtILI5qwS:Sh0iYL/7uvZ8FL9xsPpwlu4foj
MD5 SHA1 SHA512 SSDEEP

Submit Download

376c90f8-9fe5-4651-9fe7-03e3d4f67bf1.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\376c90f8-9fe5-4651-9fe7-03e3d4f67bf1.extra
Size 10KB
SHA256 ad5d14eabe4036940fc8cf41be1e6376421500bcdee91eb221d512d81a9db7e5
MD5 aac82fb719d3608712729dfd0c14a1ca
SHA1 0698568e01572d5f094401baa1339640edf70145
SHA512 c05b188bf96667f6107f764e2880c9c25e8bbad96905450fddd813be8ef4da5f44798f629dcf9a48f27a6461a00eba787425f4238abc107a1d056dfe3cb23dd7
SSDEEP 192:ShPcFaiR4MmnQYapdVxzPPWBHc4TofKNdalG4fovbLcZZWFN1ftHfJtf:ePcFaiSI13WBHc4T3aJAvcZZWFNJtHfX
MD5 SHA1 SHA512 SSDEEP

Submit Download

a6a225ed-ab87-443a-8c51-8d7d310e5560.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\a6a225ed-ab87-443a-8c51-8d7d310e5560.dmp
Size 62KB
SHA256 c0742de8e1984872901a32dbc2deb872bc52543cb0e5b2b392cfc14b7336c124
MD5 33fca0a2b598b119219def775e85123f
SHA1 268cd2c9e9697ec5a93ab74f3274a7df67545349
SHA512 3434040d004e14195912c095f854828161a9e8e8a6e9bd722c17113e199e679fae16d45f7b1ad5e223b193c9109e4706cbe905246942bb7efd3cf08107b9ac82
SSDEEP 384:owCa2Lio2H0wio2H08io2H06UlcYxfxWA6typ28BqVXqFlqlLPt79L9ypb+0MP:owCa20iu+219L9y9+0MP
MD5 SHA1 SHA512 SSDEEP

Submit Download

a6a225ed-ab87-443a-8c51-8d7d310e5560.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\a6a225ed-ab87-443a-8c51-8d7d310e5560.extra
Size 10KB
SHA256 68b60ffcc5782aa9eebcbe84133ee02fe5ca67a26c1b14179729185dcd4f7c68
MD5 8dcff5b5b3dc8a127e40a1b7cca02ac2
SHA1 6bc556552181f56addbcb4eb48a4b9f762bad063
SHA512 5310f8ac201f0ae6a5bd2f856f62c56c2df9d24a290d2badcdcabc718cb9c43e01194cc5bdec88a72d9d61ea8c470f2ead4d9e3ca2055d495f34524614c145c0
SSDEEP 96:S7WChTV+Y6pw6FF29dW640Rh7CsevBb1d0pjMLlIrLlhTLlaXv7aqcBvtILI5qwO:ShRiYL/7uvZ8FLZxsPpwlZAfos
MD5 SHA1 SHA512 SSDEEP

Submit Download

a6a225ed-ab87-443a-8c51-8d7d310e5560.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\a6a225ed-ab87-443a-8c51-8d7d310e5560.extra
Size 10KB
SHA256 a33ecc20b11e6f44f7092032f4adfed9910e67775ec6f7211ecdede67e1b163a
MD5 e5f8be8f65f2276dff18f39ccd47ef1a
SHA1 4323446759a99ff659bf98cfd58b58470dd85f80
SHA512 3a462dd49c380da9ddd9e6f3a98bef5cbea9f0b081e15aa059e3efb9e3ab2e62e766fdbe1b6840e8f819e72f58df11edd354deb8bf20d06e4142222f9d50b845
SSDEEP 192:Sh4cFaiR4MmnQYapdVxzPPWBH44TofKNdalhAfoEbLcZZWFN1ftHfJtf:e4cFaiSI13WBH44T3asAEcZZWFNJtHfX
MD5 SHA1 SHA512 SSDEEP

Submit Download

d5d18ca9-bbd2-4faa-bd6d-ea7045ab4969.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\d5d18ca9-bbd2-4faa-bd6d-ea7045ab4969.dmp
Size 64KB
SHA256 a1ed4c50d2ca07b69b118698c32dabd8dfe4f47389c82758cc5a09d71374e361
MD5 9ddb01607aa6f07ca7e81978118f96d6
SHA1 154a5869a3e82ec55d54be53575cce7523c3de72
SHA512 dff2d9c06fa4e1fe95a42d451bc92cb526e8b80c5c4a510b233d79ad8a02c9827290f8f7d67a774f031fa879164927dbfc294830cc2592f3d37b2b6e2a1a879f
SSDEEP 384:hfwBWKQ+lk02+lk0M+lk02UZPIshz0Fv97Imi3bMY4q9L9ypb+0MP:hoBpExywirMY4q9L9y9+0MP
MD5 SHA1 SHA512 SSDEEP

Submit Download

d5d18ca9-bbd2-4faa-bd6d-ea7045ab4969.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\d5d18ca9-bbd2-4faa-bd6d-ea7045ab4969.extra
Size 10KB
SHA256 cea083fee83f992efac0268a30543ef03b1c0d68e3ecfb9a7ccc5a135f348aa8
MD5 72c132e46ed28b811417183286b85543
SHA1 e2b28cdf211e376fd8941d9a1d2dbb1e9865337f
SHA512 b4adf324c5b462e1e2baf8a42d6bb144ab1336e9e524127f3ecc9911195e5f5fbaadc56d0afd32252113698e37ec4dffd644e5a3e471bfbac5c49fd5fa906675
SSDEEP 96:S7WCNTV+Y6pw6FF29dW640Rh7CTvBb1d0pjMLlIrLlhTLlaXv7avcBvtILI5qwvi:ShViYL/7WvZ8FLUxsPpwlvXfo7
MD5 SHA1 SHA512 SSDEEP

Submit Download

d5d18ca9-bbd2-4faa-bd6d-ea7045ab4969.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\d5d18ca9-bbd2-4faa-bd6d-ea7045ab4969.extra
Size 10KB
SHA256 5e2cdbd519fc8963b66e41cc54fd1de50ab051e96ab278f0a2194e6a9e69ee61
MD5 ad8e8231a0f39c9cd9bbfed6c18871a3
SHA1 3065c3bbe511b840194f63121aa326dc0381ff96
SHA512 6310dd164adc14357124249fb4690460018d46a6f8e7a31f329fe2d34a27fe8b80f17fbced5fcf32331f6f0553ad5e269ad78afdb40305d00dfeca7c4420720f
SSDEEP 192:ShkcFaiR4MmnQYaVdVxzPPWBHj4TofKNdalHXfo3bLcZZWFN1ftHfJtf:ekcFaiSW13WBHj4T3atA3cZZWFNJtHfX
MD5 SHA1 SHA512 SSDEEP

Submit Download

dba7eb47-4465-45a1-8e65-997e99f47f95.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\dba7eb47-4465-45a1-8e65-997e99f47f95.dmp
Size 65KB
SHA256 f60dd6a2c6b3347cb5cc199f24aff0d7558c520276c1c1f2d7380b945eb3e8e9
MD5 1e7a6f5f90f45068781eabc0b7ca8a65
SHA1 fde483dd4c32732b20f4df42298f452a9deaff87
SHA512 3fa25cf8ee38d57bf8209f8797eb90440543f46104996e29f7fad6e62e3deb1fa30930cc511d5a026b99c907ec51d5af69bc99c7f6629090d4939793267da565
SSDEEP 384:jQwBIdFEUBY4CaOpcJ9de1Mznt9L9ypb+0MP:j9BIdKi3dznt9L9y9+0MP
MD5 SHA1 SHA512 SSDEEP

Submit Download

dba7eb47-4465-45a1-8e65-997e99f47f95.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\dba7eb47-4465-45a1-8e65-997e99f47f95.extra
Size 1KB
SHA256 30b5c195384ff33f304f1c6e07d37897d527a61b970671da896bd51bf2cd52ce
MD5 4b8222bbc3f22cede072e9faa132ca63
SHA1 14a5cc0d82a138aaffed4250c59e41164e8ef845
SHA512 f5ad4913bf5b88bdc20f4168f152313e2a8b7983ec959620c9576c7ea6ce98b10e052c1481f7fd330074e4e96bf9b492f1f3c977a7404baf21504ebf4e7a1b03
MD5 SHA1 SHA512

Submit Download

dba7eb47-4465-45a1-8e65-997e99f47f95.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\dba7eb47-4465-45a1-8e65-997e99f47f95.extra
Size 3KB
SHA256 4035c428fa8c5890e6ba152430a2c6b15600efeca2885d349950b5d6d21ffb2e
MD5 cdfd876929574cfcc80ab47ff709a328
SHA1 f99818a4bfd9da17ddbb2ca0486eeeb59e11c6a5
SHA512 a4e5a1c07d03ac601eca55dea28b72a427aa2dda7046831b518c8f0548eb7192ac7172c8594ff775a035e8a2f6171ead9df15d8acaae64e50603370510499762
MD5 SHA1 SHA512

Submit Download

eaa71248-00c6-43c4-ac01-715e099f1b35.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\eaa71248-00c6-43c4-ac01-715e099f1b35.dmp
Size 63KB
SHA256 7173a772f2ab25db9c01956e4a3186baaff377978cb97467cf091358946b24db
MD5 179d4f866192161a2d8ed80c2638c17c
SHA1 e8c73f39aa1224291b258c3ac35fc04ab6496be5
SHA512 47ac55ba7d61b34ff6269f0e71864189930046f2aa2c5728460f432e4447c55c4c276c286780f439dd0b64b4b80226190e37cf0679ab07242d9a5043d7b63e2b
SSDEEP 384:X1wBsSMmPX5sP0Q5sP0N5sP06UA2sZjWcEwILucGLH+UcmhJ9L9ypb+0MP:XaBsSFPv8IjMLji+UcmX9L9y9+0MP
MD5 SHA1 SHA512 SSDEEP

Submit Download

eaa71248-00c6-43c4-ac01-715e099f1b35.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\eaa71248-00c6-43c4-ac01-715e099f1b35.extra
Size 10KB
SHA256 3948090915fc11b7bd0102e506bf06d1780cef00675b52896ffdb09357ca149d
MD5 f8e8d074a6964c6a208872520635d4ef
SHA1 9794ef855a21a7c4be4085e2d348af18fb834906
SHA512 158bb1b6da72a9a1502b4517e8f215862bbf2a41a848fb0a7b17c928fcda8106bae4181cdd4d1b53cba79ca8cba583b1df47845ea63a3e1021a3e4fb860cb49d
SSDEEP 96:S7WCHTTV+Y6pw6FF29dW640Rh7CsevBb1d0pjMLlIrLlhTLlaXv7aecBvtILI5qL:ShHHiYL/7uvZ8FLVxsPpwlkLfoA
MD5 SHA1 SHA512 SSDEEP

Submit Download

eaa71248-00c6-43c4-ac01-715e099f1b35.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\eaa71248-00c6-43c4-ac01-715e099f1b35.extra
Size 10KB
SHA256 e889dfe3480fb7e7df98b6189cd0db8d4530423a0812a2da90d458ed9ecb8108
MD5 b61aaf2b5953616ae3d6045df5dff9d5
SHA1 e1d1e7895793d2dbe4e8cbb7ab5217a63da68404
SHA512 8abdc7fe30c054587c50b84bdc77b7242131c1aa06428eba1f707fe701809edbcc8bb6b28d8dae2d91e960d853184854bce6400a6389b29f597161d70f8be3e5
SSDEEP 192:ShHGcFaiR4MmnQYapdVxzPPWBH04TofKNdalMLfoRubLcZZWFN1ftHfJtf:emcFaiSI13WBH04T3aEARucZZWFNJtH/
MD5 SHA1 SHA512 SSDEEP

Submit Download

compatibility.ini

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3wiiokog.default-release\compatibility.ini
Size 198B
SHA256 252b7fff962848c61092e82a3d87adca163849767713a93ab533bb397f1f53bb
MD5 ce9ef13caa8a74c25157b184aa038475
SHA1 db03a9935d8bb3ce6b120aca98feade536805160
SHA512 0f6f5053e78167ef5cc5fa70ed3a87dd116df0671a590299277a197341bed983e3d77e37ad2c33cd4afe880fab9ed1c7f7502210040617a01f97a81c1e1d4f29
MD5 SHA1 SHA512

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3wiiokog.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 cfae240eb38ecd17697f30bc99704669722d67d58f4c195acd5c9ab71b21f9ec
MD5 666c293d441f187a66d492701ba47818
SHA1 93c0ec1e1df330f3e871292fa925874c2a737b7f
SHA512 69730205d90f90e8aef6505c779841aeb6af70c7ddef26e9960c2ccd9b310e6a55aff82643c1cda000cf75d1ffdd882cf1fde8174fa22b6e9017c983c808952a
SSDEEP 192:HB1/66JozGzgCl6mSSdxOv5zboPTZChyjYmF:H//66JozGzgC1bYboLZChyjZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3wiiokog.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 c5fe1e1d008732907440ddbba1c46191b7cbd18b30914741d4a154d541ebe8e8
MD5 434ea0792e76d66cbce76262747c358a
SHA1 bd2794ebb10ed9d0291e003fd3dde2e689cb594c
SHA512 769b783b4d2fee12ac9c68db9dbf120e0a3ca91d2d3ed12736f0b15e3ab045465334e4a548fa47ae0a7de112866018de0f744fe38a2376e9a68f657a70b187dc
SSDEEP 192:H81/66JozGzgCl6mSSdKOv5zbowbChyjYm/:Hm/66JozGzgC1bbbowbChyjT
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3wiiokog.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 76a7f7855509cae877fd45f4ff9e11e141e2459ec12134f86fa691d1a8124cb4
MD5 25e3d40ea173b719e29a5a60d50aeacd
SHA1 630da5d4c887849aa9876383321c4baf73f97557
SHA512 83b74cca2fa76813bd70010f3b2fcc344150ab59c092a39d37afc7c27e6f8cfba51cdab74997c4abeefdfd801ce90f40e62ff9174c561858ba4c77b0db8b4329
SSDEEP 192:3l1/66JozGzgCl6mSSdpOv5zbowbChyjYmF:3j/66JozGzgC1bEbowbChyjZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3wiiokog.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 257a4f7ad7d5e0bb6563ba53be3f82caad42c3a240455ff10b4b59f0bb8f4e41
MD5 355eb3bd48f617920591da08d0ba91f0
SHA1 e4a654ef48ed2e8fe0c2abddc4cd6a2a945334f8
SHA512 2c6da7289c6565ec9c686063fb76620f31d5e131ab2d88061c5a82874a945ab1e95760ee35aecc99d2da3eb1ebbfe2fdb9bb6ce69b722964347db62bd31d0053
SSDEEP 192:FOv5zbo+bChyjYm3v1/66JozGzgCl6mSSdz:abo+bChyjr9/66JozGzgC1bd
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3wiiokog.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 9137d950b642b2c61012e3d124ac2339851fe4bc830208c297fef37cf759f02b
MD5 19f07ebdbdc69f1e24e5dbbe0e2b94a0
SHA1 9212a4ab3aac5b0b55ef0a2255215accf0907fea
SHA512 4d42d3a698a9f7cab9671aeb45e4dc6d8ddb37d77096243514e6f4ed68b08c82e04964c045099a345bd68269c3027d410cb1eacccacf9e7f3032e7b684710e4d
SSDEEP 192:AsE51/66JozGzgCl6mSSdxOv5zboPJZChyjYmF:A3/66JozGzgC1bYbohZChyjZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3wiiokog.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 d94b4485999b8708a244ac125194b222e7a834b336b3004644be1a9c20a95753
MD5 7e2d94447f1d0f2d4f6a03808456e0a6
SHA1 7ef4313b5021a9c840c6feca80cd433f14ccd3a4
SHA512 aee60f353333d2fa657e0b9c3d466bfa29d165bfd2148c97ad2b963be300cd10f51227c157aaffcf3faf66c6396c80b782c9347a55ff3c9d6b0f942cdb69bb45
SSDEEP 192:jOv5zboPJMChyjYmwsE51/66JozGzgCl6mSSdz:sbohMChyj83/66JozGzgC1bd
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3wiiokog.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 0bda8de336f1785085d3991d338949d65241ebb9aeb1453cbce9aa79597ee464
MD5 89e95ef66c3fd40a64c829194dd12112
SHA1 90a06477ac11701592c88d1a7ce5cd794690c72a
SHA512 5c87ee873cf6cb39dc955b384dca346eeb6a9504f1373d75cfa00efb9760b3e9b67cfc3da29ba36e74ac2f8110cf346c7bb4d21a196e54b8d50daf4a09b79d32
SSDEEP 192:AS1/66JozGzgCl6mSSdDOv5zboEbChyjYmF:Ac/66JozGzgC1biboEbChyjZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3wiiokog.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 2b10ff6b578485cfa5e09e41543ea6b7f894673092811bd554ed1b3b3b77a1b6
MD5 b17c8b7c042a67bccd3cabab357a3ec0
SHA1 aedd186f960ede2e6f323d61be1f883da2571b2a
SHA512 4a8b17a23b8195624cd43242ff613851d5ee34b447a8c0fd562794a342a8b1d50601d609b6b8bf17a5bab42abb5de1b78ea250a6dbc8b5e381b34754c69068a9
SSDEEP 192:Ax1/66JozGzgCl6mSSdxOv5zboPJZChyjYmF:Av/66JozGzgC1bYbohZChyjZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3wiiokog.default-release\datareporting\glean\events\events
Size 1KB
SHA256 d352d992f996b583098ecccef76b916adc40e2625370536ae4082995d93682a0
MD5 cbed3567481b2ab5bd8c1a3314252187
SHA1 3832e4df291d144d3beb852e717d8840d26638ab
SHA512 a8ac5f984be6e1bc234895d5f798f8cc86ce4c1487191bf618986f37f92a74de0944c4661221f30e3f00c8f026ef87ce3dfc76ac24e1bb115238e81414101140
MD5 SHA1 SHA512

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3wiiokog.default-release\datareporting\glean\events\events
Size 1KB
SHA256 5c0aa64447a6dc5cdd254aa1971d0994f2bc7b4c423de1e64a600f2e175c839e
MD5 f561ae59e3bfdf14e76d14ae1555d7e6
SHA1 8380d8c908858b1267305d8f74c872f887e9d5d4
SHA512 56fbea01f18d81e52f61a5691ee75ae226abb7dc4cde2ecc13fcc5f66972925393bc01f0da096d255b126be1c37af6dd45e5fbbbca6dba52c84094347ed0a4eb
MD5 SHA1 SHA512

Submit Download

047d7e2a-9356-4560-9800-058ade519393

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3wiiokog.default-release\datareporting\glean\pending_pings\047d7e2a-9356-4560-9800-058ade519393
Size 3KB
SHA256 139324d409c3cc28b7755def4ea1db21dad1794dacf1941e328922294176152d
MD5 e353428c9145cfd1828d6acd746975af
SHA1 608ba0da52423c3f4e02d0ea07e2b783ad7f3296
SHA512 65c95a5d417825a1210bcd6ba23e12a4305afc392714b18943625ae705df4c7a0db0da72a1a7b7c067d3fe09b435c455ebab9b95679bd6d2f4dfe2363b233625
MD5 SHA1 SHA512

Submit Download

05507aa1-8192-4614-a78e-d2656e8229fa

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3wiiokog.default-release\datareporting\glean\pending_pings\05507aa1-8192-4614-a78e-d2656e8229fa
Size 896B
SHA256 1fdfb9695ca1b2813c2ca1037d35f083ba7daa0214dca867002746ead94819fa
MD5 dd7d2fd57deea0b9719cc4a96e952fe5
SHA1 8e944edb15c90095be0f91fa5ce7369b01a2fd36
SHA512 3eb7d496379537da5578f815d50a7d77c58d892dd982e7b77b24ab79530407bfe92c13647789783bd5cef5ecf47adf39eb243759924819a5a340f34804c50c1d
MD5 SHA1 SHA512

Submit Download

131053ec-c684-479c-9c0c-e12b9aefd4d3

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3wiiokog.default-release\datareporting\glean\pending_pings\131053ec-c684-479c-9c0c-e12b9aefd4d3
Size 3KB
SHA256 4033949f7fddb1998ca83ee3dcd65471da8e84693e98f40b80dc244c75ccf820
MD5 25b9a45854785cab544720087679d3c3
SHA1 aca66b96acf874341e7884e4cc53ab4d722a2847
SHA512 73076e46ff610c4c115afdf2900537ca2b3dd69cb5fe9cbc90656d40c5a67566c0799911f2e4c9c5ade402c345d479ebf3133a3d4f32a01ae7c9be3b73b219ac
MD5 SHA1 SHA512

Submit Download

16137c49-e1ac-4618-8781-8a581bc0ca67

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3wiiokog.default-release\datareporting\glean\pending_pings\16137c49-e1ac-4618-8781-8a581bc0ca67
Size 3KB
SHA256 8deb1ecb3aea845dbf79bbb3772194a7aaf3acb0ba9e622a9eaa8f2d82bef929
MD5 43ebf32a4457ce161b6000f48292a8e8
SHA1 159742ba38193c0b32b1c8213273558a8bd86290
SHA512 f204863d626f7e6739199c62ce57db1671af9101d3d2bf5d873e1c61a83dcc373b4d977d11a3d53d19bba5d4db39c6b4e84d8f037f293f380bf5e66117037b62
MD5 SHA1 SHA512

Submit Download

18d724e8-5e01-481b-b98e-f770beaf35fa

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3wiiokog.default-release\datareporting\glean\pending_pings\18d724e8-5e01-481b-b98e-f770beaf35fa
Size 3KB
SHA256 ff3ceca848b9f9d6d788d32299daaa8937210be77a1a22c494dda3d271c104dd
MD5 d96b0ccd3a3ac1ada95b40efcafd47af
SHA1 26a420c1dfce2b0cebcdc2aecbe1223ac71a4411
SHA512 0477be2cd808794f677b433ac1b6e66a993cd60c2cb1798e5478b29db9118c66c955448f2c59267f7b5678aa9dcfabda27e74c2460ea5b8357c4f77172732061
MD5 SHA1 SHA512

Submit Download

1b81ff02-7f2c-457c-b84f-197791728d48

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3wiiokog.default-release\datareporting\glean\pending_pings\1b81ff02-7f2c-457c-b84f-197791728d48
Size 2KB
SHA256 5a84389b00bc2dd916426dffb9868b737bb35b2c52f13e332d544656d65054df
MD5 127748e620a83cbd27ec69226394300b
SHA1 5fc804a92139d7a5c857c4986a3b355259ca6698
SHA512 d22cf19469d641b1e727c96801093b529288bff1f154b91b81d47ac4af3ebcb3df1861300cc51fdb6da6c73f325490bd17214ebe7bdef5a74faee19846b4a2d4
MD5 SHA1 SHA512

Submit Download

23ae7cd5-ebc6-487c-a2be-9afd5a0be3f6

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3wiiokog.default-release\datareporting\glean\pending_pings\23ae7cd5-ebc6-487c-a2be-9afd5a0be3f6
Size 883B
SHA256 5c10a2e18e7851d4c5c52004cd9b2f090b45f59a495894f805b919408851340e
MD5 293d7657b36fe7e3129125000d040663
SHA1 f8440c664418ccb2ff3d801ff629cb3b1edf4dac
SHA512 02d12d67f77b91fc87f882da91a21ba574d05e0be83dfa0fa1465e3d05093359a8a168ac8fd68f63a88f8186d7d6568b006e8326d9b9439c01ef04a7ca96723b
MD5 SHA1 SHA512

Submit Download

25990f47-faee-4db2-b584-3e19cdb3f802

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3wiiokog.default-release\datareporting\glean\pending_pings\25990f47-faee-4db2-b584-3e19cdb3f802
Size 3KB
SHA256 41b633a487433c93a43018c6cc1b8a8c1f67888ed01a855a34278bdb93e2786d
MD5 e118f24d42398db42184c45d6820bbb6
SHA1 656a12fea44e8748ad3fc35fb074d9d6330965e7
SHA512 864cf390409055cbdac70f903fae9b00f9744451acf33f9df59b03b30481f4b9970c65f3cf0bb5c21557e60ef1fe03a34bff97ca95ef59ac721c91d1820db39e
MD5 SHA1 SHA512

Submit Download

286ed23a-8c20-4922-8c45-6271ffd8fd26

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3wiiokog.default-release\datareporting\glean\pending_pings\286ed23a-8c20-4922-8c45-6271ffd8fd26
Size 235B
SHA256 0b9478bf80c8212575f44b909b84584c6cb6375056445bd6e59078aaa2056d32
MD5 b3e01d161349e7f89db8f40006ba92b4
SHA1 a1cee9e146d64f8dc63ade4f9c37d8eb3ba64710
SHA512 189dc0420accf5d414f879f6c1a67d96fb16fa3205fbdedbf36865794a644a4acfead8af034992939e027a06ba7fcc9932e12dbc9e3cecdfde9ae9ce3256f361
MD5 SHA1 SHA512

Submit Download

3e22ed57-3b5c-41eb-9e1d-990f4a338730

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3wiiokog.default-release\datareporting\glean\pending_pings\3e22ed57-3b5c-41eb-9e1d-990f4a338730
Size 3KB
SHA256 bccf51887e8757a854d59205c7af211a2beade4d6653c57bd6ed271e4381a792
MD5 a80cc12f99a23a906c9260919a483705
SHA1 d8678f70317202a5307c46f7075c10c343e8c063
SHA512 1094987070e64516bac9387b6157691c4d9e8b54199b4465b6c6fccd355a4e73b3dc5f27cbea10c7ef6b3fbd124bc56aec60d661079184c4b20a08a6d5b2bcf1
MD5 SHA1 SHA512

Submit Download

51312d6a-372c-46a7-a36d-408689407b20

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3wiiokog.default-release\datareporting\glean\pending_pings\51312d6a-372c-46a7-a36d-408689407b20
Size 896B
SHA256 d2e4b5921600c60642d5b7466c78d9d4d03d2ac639a1abb8418a6fb3559af000
MD5 6e46df968b610333f923cc667aec31b5
SHA1 dab7453be5dab11c0677664ef3ca5dfffa0dfe87
SHA512 eca35069d53d94347002eee15ca244c744cd9112cc506673e883e01c77783d187a80d7e38334f01161785824d8351de6091cf8c176664b50ff3c7e2b0cb52b34
MD5 SHA1 SHA512

Submit Download

5dc0ba4e-b553-4027-ba8f-135c168bddbf

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3wiiokog.default-release\datareporting\glean\pending_pings\5dc0ba4e-b553-4027-ba8f-135c168bddbf
Size 3KB
SHA256 58bd9716c3789198204f79a81b4dc94fa40fc18c213fee897d0015d2183072b8
MD5 5e605c5c5cac369cb9e7bb9de86049fd
SHA1 06b85aec5bf6dc736035987d63a100a9badfc117
SHA512 1828cd74f9f7cf33ff633373f91b5698bf04523c50cf7ed029eb180b0e24061d9e879be5c0f1f0ba57f0709c8647e78f44774556788a2884d8f6f90df98b7cbc
MD5 SHA1 SHA512

Submit Download

6846d6a4-0cbd-4d94-b44f-8da1a22b5646

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3wiiokog.default-release\datareporting\glean\pending_pings\6846d6a4-0cbd-4d94-b44f-8da1a22b5646
Size 235B
SHA256 a1980aec10a80f862d3899a8f087bd6b92c8f967ffffeb619b21a07bed4e690d
MD5 19965c9b869b6e5fb626fcd22ccb5259
SHA1 98f67522081a26023b5c29048e021c367c44da41
SHA512 34953429e12c2e9fc87a066028725e7bdcf68b05ad0b9628c24d17a8e4a0e8d5a112e38a50076fd001510221865cd0744c6373419775afd0f3ef6d1127137578
MD5 SHA1 SHA512

Submit Download

945191d2-13be-44da-9dfc-26969d752f97

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3wiiokog.default-release\datareporting\glean\pending_pings\945191d2-13be-44da-9dfc-26969d752f97
Size 235B
SHA256 f749c7f92bab2131534a2c23333da9ac4dc8a50fcd064ccf91b30d87a3b109c2
MD5 e4b69df861899702b730ef0582981dd9
SHA1 83ce3aebca0773f180ae14999e2ee4bde61b714f
SHA512 e0b1d637e9e13ce7b1f5022400d91ab5ac9b334b7eee8d276a4d6d401bc015e8ead3438493161fc4a7c784f6586361f9f39b28f36c95fffdf959e12389b957dc
MD5 SHA1 SHA512

Submit Download

96d17f66-2cc7-45ea-9456-b085b37d980f

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3wiiokog.default-release\datareporting\glean\pending_pings\96d17f66-2cc7-45ea-9456-b085b37d980f
Size 2KB
SHA256 d760ae9193aa09620b3c02f58439718b302d480f0e3780a48e9e08765c2745b9
MD5 992c3297b39057f4b9493abaaf5e08f3
SHA1 d7d8bbfcd12bd41678513475071854cd2c226eda
SHA512 6722b1c0bd69339463695ec776f902da578338785da52a00108a0b0617dcf574782f716d5d122daafa00b9bc00df2702c604d4cafadf6a5da4229e4442d42c08
MD5 SHA1 SHA512

Submit Download

99712c55-64b4-441f-bd91-c2b2dcbcad98

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3wiiokog.default-release\datareporting\glean\pending_pings\99712c55-64b4-441f-bd91-c2b2dcbcad98
Size 235B
SHA256 5631ee28d535a4d7cea36fea08a96a29f678b95cf3898f528e4eb3ea8feb2e24
MD5 ec5c1e2dd0aee9d30d4ae7e01e158077
SHA1 1c5263948f35fcca45e39f6292db0ebb1bd184c6
SHA512 2195392735ba94793d95c02b8f2886a2a716f6050a479b0b330548a99441d5fe8b3ecde19fff47714246a4b4cffb6167950626a74e091df2a5fbb5270f281d96
MD5 SHA1 SHA512

Submit Download

b0bb4834-a656-471b-b634-2453ff9f9668

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3wiiokog.default-release\datareporting\glean\pending_pings\b0bb4834-a656-471b-b634-2453ff9f9668
Size 3KB
SHA256 221bfe33c1dc34238c10a1aaca2dfd9c21c74796d9a17ec80eef3b2b6d0e2d81
MD5 d84fe9cbaa6bda58ba6831dd75e06b5f
SHA1 68a8170c205a10824f6211be5b4ff1750a320358
SHA512 8ebbf1cb4d2351a2d3e6827511b6281fca80eb07e3b76d2e50c5f19d1125d39a8c02d2e96f4ad29fdc34d7701a68fced66f9a15f593a5b44e3240fd26870d540
MD5 SHA1 SHA512

Submit Download

b91a4db3-cb6b-4a84-9a9a-164e715c243e

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3wiiokog.default-release\datareporting\glean\pending_pings\b91a4db3-cb6b-4a84-9a9a-164e715c243e
Size 3KB
SHA256 7bf82bd0d8693112a476470de8c3a343cf0c9775441bf3c5a86b5298c39266c1
MD5 2e4c382fbab729e87999a8b479e783ac
SHA1 af32a05aabaf7d140b33bb6474abcc105eb75c32
SHA512 22d5e8ef05e4861206f345f351cb770a220c4852a31504e037cf4779aaf68cad10b3e93a78d3e7be81378d4c53b9ddac8ffc2d5a83d90784dcebb766824a514d
MD5 SHA1 SHA512

Submit Download

dd339f8a-3962-4010-a02d-250c098eae1d

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3wiiokog.default-release\datareporting\glean\pending_pings\dd339f8a-3962-4010-a02d-250c098eae1d
Size 3KB
SHA256 283ffec180b4d85813c72727bca6167b6c00eeec46ca33e76e75095106120e30
MD5 086ac566fae7459340636ccef2d3edd2
SHA1 60f37b106aa16f808c7cc647a7afecb27abe16ad
SHA512 ca502458eab774d7c84307e8a0a166faa321fe892d0b9a2971dbe331f3a42f3f86ced10e27ddf45cb4d639083aee25c67c6915c9863473c036dcecc559d23555
MD5 SHA1 SHA512

Submit Download

e5f667f5-3c21-4f07-a4b0-556e22096415

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3wiiokog.default-release\datareporting\glean\pending_pings\e5f667f5-3c21-4f07-a4b0-556e22096415
Size 3KB
SHA256 f9c280e7f63b909f7b6bb9be91f09f121136d57547053b409f6b0ca4ff153e20
MD5 fb42e3d70693f0ce4cfd7fc112b7d342
SHA1 f6a741a91cccbc298009830ce3f7292e152c4d13
SHA512 71ae217a358dd8897b6a6dd42f9da3894769ef1a7e4819fbc4ebc4940ceaa226767b3f11854382c63f0a31effea3a9f1c77db094ecfc947ae0267e2c90752981
MD5 SHA1 SHA512

Submit Download

f26423f9-d137-49d7-aa3f-ca1c0e087d54

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3wiiokog.default-release\datareporting\glean\pending_pings\f26423f9-d137-49d7-aa3f-ca1c0e087d54
Size 16KB
SHA256 216dbbb589365e685bbe098aaf6db1be2204616ee6fe5055d8fb494cb21c92c4
MD5 e046435152e75e927fd4a27edbab2fc4
SHA1 0c5c2282e14da95822d68208ad539088064ffad5
SHA512 5dc7b50199fc09567ad6021afa453fa0c1ef302b90682f36b2a1fe0720bd7b0cdf44c3b97deebf9604fe184c2e701f5a20f678228e86491c3239a4b2c66b180a
SSDEEP 192:mEN1xEMT35xXLDa45E81xE7dkdn5KLaK0sFKQ/weMGH935YSJEuXR8bScz5S3OYI:Jx7Ps0sFKsMe935YSNXR8bScM33iQDI
MD5 SHA1 SHA512 SSDEEP

Submit Download

fdda3443-5119-41c5-a9fb-1f82d812eee2

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3wiiokog.default-release\datareporting\glean\pending_pings\fdda3443-5119-41c5-a9fb-1f82d812eee2
Size 871B
SHA256 62eb36a03d72fe6366b5d128e2b4dea1770c2980cc8c1aaae6f41e82f42fd57e
MD5 8a76f4328ce1d7d4dfc5fb430ffa3811
SHA1 cab5d9ddb1ef2412ab45aabfbab07a7f4a4d6d88
SHA512 14f649e6c91bdbfe843e25129e6ad61b3bad66c5277ca625f48e1ab7aedca2ee408e4a0ab267d6874a8e8e4b74308cf23aac17cc288a57f46ffa513b8edd6e17
MD5 SHA1 SHA512

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3wiiokog.default-release\prefs-1.js
Size 6KB
SHA256 2754f5dc321127bed4414befe0fa3fbe30cc58271924c218fc8ea8b28dc65178
MD5 767dd11067a42d2c6e9e0061171c77d9
SHA1 d777b961b97f5f2d63df03d2e079f16738759539
SHA512 97d13e284d82b83b25c2deca82c88793c4158f0572b3b02eed0695b643e1851052be1e4ddc6c64f607d79ff4d97e66f77debda8b0610a7c295234a1a48a70e48
SSDEEP 96:xH/UTULqGqEqfdKlnZ1zSQSSlDsdv9jKnbHFnPyBw88n8L4cnrV10R:ZWREqfdGZtSStRlKBw886w
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3wiiokog.default-release\prefs-1.js
Size 6KB
SHA256 15f87ff60d34c2654283e2cbbbbefeaaf163dee16e0c9c218ec882d40be779f3
MD5 d290caf22cce2071e98702fe05207d73
SHA1 aeaf6671c115a241b3197374781210072aa48238
SHA512 e333a98f835e5a908827456bf60823451408b8929265781825dbe78da18e5977b11d23b63aad564d3a883a3126c459a517824f6f9fc429501098a7fa807dc11a
SSDEEP 96:xH/UTULqGqEqfdKlnZ1zSfSSlDsdv9jxznbHFnPyBw88n8L4cnrV10R:ZWREqfdGZySStqlKBw886w
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3wiiokog.default-release\prefs.js
Size 6KB
SHA256 726c7455d3648ea7a690d8b3b36eac13f4caa0b10e4f9b31e3f9a5967268cb6f
MD5 b87b7e214700dbcf83fd07e217dbb398
SHA1 3d1542a31c9d063cba4558cd994ecf2a6e1191e5
SHA512 72b8b5ce61f3ac7e82c1948f54691d96d82a918a1f0ae0d9eae724350b3607f122d599e28918d171f729f0e878bd922fe4e1f02176828664201d35008ed66274
SSDEEP 96:xH/UTULqGqEqfdKRn91zSiSSlDsdv9jWIAnbHFnPyBw88n8L4cnrVDR:ZWREqfdi9nSSt3lKBw886b
MD5 SHA1 SHA512 SSDEEP

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3wiiokog.default-release\sessionCheckpoints.json
Size 53B
SHA256 792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da
MD5 ea8b62857dfdbd3d0be7d7e4a954ec9a
SHA1 b43bc4b3ea206a02ef8f63d5bfad0c96bf2a3b2a
SHA512 076ee83534f42563046d25086166f82e1a3ec61840c113aec67abe2d8195daa247d827d0c54e7e8f8a1bbf2d082a3763577587e84342ec160ff97905243e6d19
MD5 SHA1 SHA512

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3wiiokog.default-release\sessionCheckpoints.json
Size 90B
SHA256 00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2
MD5 c4ab2ee59ca41b6d6a6ea911f35bdc00
SHA1 5942cd6505fc8a9daba403b082067e1cdefdfbc4
SHA512 71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2
MD5 SHA1 SHA512

Submit Download

memory/1884-29-0x00000000049B0000-0x0000000007A42000-memory.dmp

Download

memory/1884-28-0x00000000747E5000-0x00000000747E6000-memory.dmp

Download

memory/1884-27-0x00000000049B0000-0x0000000007A42000-memory.dmp

Download

memory/2056-62-0x00000252A46E0000-0x00000252A4767000-memory.dmp

Download

memory/2744-45-0x0000000037EB0000-0x0000000037F62000-memory.dmp

Download

memory/2744-40-0x0000000000490000-0x000000000054E000-memory.dmp

Download

memory/2744-42-0x0000000037D70000-0x0000000037DD6000-memory.dmp

Download

memory/2744-46-0x0000000037F70000-0x0000000038132000-memory.dmp

Download

memory/2744-47-0x00000000381C0000-0x0000000038236000-memory.dmp

Download

memory/2744-49-0x0000000038240000-0x000000003876C000-memory.dmp

Download

memory/2744-48-0x0000000038160000-0x00000000381B0000-memory.dmp

Download

memory/2744-50-0x0000000037BC0000-0x0000000037BDE000-memory.dmp

Download

memory/2744-41-0x00000000374B0000-0x0000000037A54000-memory.dmp

Download

memory/2744-44-0x00000000016F0000-0x0000000004782000-memory.dmp

Download

memory/2744-39-0x0000000000490000-0x00000000016E4000-memory.dmp

Download

memory/2744-3438-0x0000000039B20000-0x0000000039B2A000-memory.dmp

Download

memory/2744-3437-0x0000000039A50000-0x0000000039AE2000-memory.dmp

Download

memory/2744-3431-0x0000000034C60000-0x0000000034C82000-memory.dmp

Download

memory/2744-3432-0x0000000038BF0000-0x0000000038F44000-memory.dmp

Download

memory/3572-2727-0x000001A900000000-0x000001A901000000-memory.dmp

Download

memory/3572-2665-0x0000000000240000-0x0000000000241000-memory.dmp

Download