guloader | b39eaec9267ce32916823eba57c71fbe321b9648cc8f50ee6d1a171800daa1e4

Analysis

max time kernel
149s
max time network
140s
platform
windows11-21h2_x64
resource
win11-20251015-en
resource tags

arch:x64arch:x86image:win11-20251015-enlocale:en-usos:windows11-21h2-x64system
submitted
11/11/2025, 08:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
New_Purchase_Order_PO-2025-01001481_pdf.exe
Size 601KB
Sample251111-kxt83ssmcs
SHA256 b39eaec9267ce32916823eba57c71fbe321b9648cc8f50ee6d1a171800daa1e4
MD5 e6b2cc822ad480918e97070a62643b90
SHA1 bac01f415ab5e6e43b1fd2a6b3713bf7adb1ab1e
SHA512 4fef18ab040665cc816c570b1adf1e9bd42bf378db5d2b2aa73bc286681bd4109a823bb44f84f763279356c443d8267dcd1afa868a7a32524d62ea68545d5da3
SSDEEP 12288:OMweUzNb/QMy+P1NyRJwonnb1UB57NlBPrjkGWl:OMweUzNb/QMTtNyRJwEnh07RzjBY
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

collection discovery downloader guloader phantom_stealer persistence spyware stealer

Malware Config

Extracted

Family

phantom_stealer

Version

v3.5.0

https://api.telegram.org/bot8317489635:AAGuFwSA514jDG7Cd5CK-sE8t4UmJmEBquY/sendMessage?chat_id=6897585916

Mutex

UMVOXDP0B66F4QG3YYYK

Attributes

anti_analysis
0
cb_enables_ssl
0
debug
0
keylogger
1
start_delay
0
startup
0

Signatures

Detects PhantomStealer payload 2 IoCs

resource	yara_rule
behavioral2/memory/5344-42-0x0000000000490000-0x00000000017A7000-memory.dmp	family_phantomstealer
behavioral2/memory/5344-43-0x0000000000490000-0x000000000054E000-memory.dmp	family_phantomstealer

Guloader family
guloader
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader
PhantomStealer
Phantom Stealer is a stealer written in C#, forked from the Stealerium family.
stealer phantom_stealer
Phantom_stealer family
phantom_stealer

Loads dropped DLL 1 IoCs

pid	Process
1984	New_Purchase_Order_PO-2025-01001481_pdf.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2318277690-2490144949-3346562762-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	New_Purchase_Order_PO-2025-01001481_pdf.exe
Key opened	\REGISTRY\USER\S-1-5-21-2318277690-2490144949-3346562762-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	New_Purchase_Order_PO-2025-01001481_pdf.exe
Key opened	\REGISTRY\USER\S-1-5-21-2318277690-2490144949-3346562762-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	New_Purchase_Order_PO-2025-01001481_pdf.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
1	drive.google.com
2	drive.google.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
90	icanhazip.com

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
5344	New_Purchase_Order_PO-2025-01001481_pdf.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
1984	New_Purchase_Order_PO-2025-01001481_pdf.exe
5344	New_Purchase_Order_PO-2025-01001481_pdf.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp\chrome_installer.log	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\metadata	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\chrome_installer.log	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\metadata	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\settings.dat	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\settings.dat	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	New_Purchase_Order_PO-2025-01001481_pdf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	New_Purchase_Order_PO-2025-01001481_pdf.exe

Checks processor information in registry 2 TTPs 38 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	New_Purchase_Order_PO-2025-01001481_pdf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	New_Purchase_Order_PO-2025-01001481_pdf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe

Enumerates system info in registry 2 TTPs 12 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134073251859784438"	chrome.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5344	New_Purchase_Order_PO-2025-01001481_pdf.exe
5344	New_Purchase_Order_PO-2025-01001481_pdf.exe
4692	chrome.exe
4692	chrome.exe
5344	New_Purchase_Order_PO-2025-01001481_pdf.exe
5344	New_Purchase_Order_PO-2025-01001481_pdf.exe
5344	New_Purchase_Order_PO-2025-01001481_pdf.exe
5344	New_Purchase_Order_PO-2025-01001481_pdf.exe
5344	New_Purchase_Order_PO-2025-01001481_pdf.exe
5344	New_Purchase_Order_PO-2025-01001481_pdf.exe
5344	New_Purchase_Order_PO-2025-01001481_pdf.exe
5344	New_Purchase_Order_PO-2025-01001481_pdf.exe
5344	New_Purchase_Order_PO-2025-01001481_pdf.exe
5344	New_Purchase_Order_PO-2025-01001481_pdf.exe
2924	firefox.exe
2924	firefox.exe
2924	firefox.exe
2924	firefox.exe
2924	firefox.exe
2924	firefox.exe
2924	firefox.exe
2924	firefox.exe
2924	firefox.exe
2924	firefox.exe
2924	firefox.exe
2924	firefox.exe
2924	firefox.exe
2924	firefox.exe
2924	firefox.exe
2924	firefox.exe
5344	New_Purchase_Order_PO-2025-01001481_pdf.exe
5344	New_Purchase_Order_PO-2025-01001481_pdf.exe
5344	New_Purchase_Order_PO-2025-01001481_pdf.exe
5344	New_Purchase_Order_PO-2025-01001481_pdf.exe
5344	New_Purchase_Order_PO-2025-01001481_pdf.exe
5344	New_Purchase_Order_PO-2025-01001481_pdf.exe
5344	New_Purchase_Order_PO-2025-01001481_pdf.exe
5344	New_Purchase_Order_PO-2025-01001481_pdf.exe
5344	New_Purchase_Order_PO-2025-01001481_pdf.exe
5344	New_Purchase_Order_PO-2025-01001481_pdf.exe
5344	New_Purchase_Order_PO-2025-01001481_pdf.exe
5344	New_Purchase_Order_PO-2025-01001481_pdf.exe
5344	New_Purchase_Order_PO-2025-01001481_pdf.exe
5344	New_Purchase_Order_PO-2025-01001481_pdf.exe
5344	New_Purchase_Order_PO-2025-01001481_pdf.exe
5344	New_Purchase_Order_PO-2025-01001481_pdf.exe
5344	New_Purchase_Order_PO-2025-01001481_pdf.exe
5344	New_Purchase_Order_PO-2025-01001481_pdf.exe
5344	New_Purchase_Order_PO-2025-01001481_pdf.exe
484	firefox.exe
484	firefox.exe
484	firefox.exe
484	firefox.exe
484	firefox.exe
484	firefox.exe
484	firefox.exe
484	firefox.exe
484	firefox.exe
484	firefox.exe
484	firefox.exe
484	firefox.exe
484	firefox.exe
484	firefox.exe
484	firefox.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1984	New_Purchase_Order_PO-2025-01001481_pdf.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeDebugPrivilege	5344	New_Purchase_Order_PO-2025-01001481_pdf.exe
Token: SeShutdownPrivilege	4692	chrome.exe
Token: SeCreatePagefilePrivilege	4692	chrome.exe
Token: SeShutdownPrivilege	4692	chrome.exe
Token: SeCreatePagefilePrivilege	4692	chrome.exe
Token: SeShutdownPrivilege	4692	chrome.exe
Token: SeCreatePagefilePrivilege	4692	chrome.exe
Token: SeShutdownPrivilege	6172	chrome.exe
Token: SeCreatePagefilePrivilege	6172	chrome.exe
Token: SeShutdownPrivilege	6172	chrome.exe
Token: SeCreatePagefilePrivilege	6172	chrome.exe

Suspicious use of FindShellTrayWindow 46 IoCs

pid	Process
4692	chrome.exe
4692	chrome.exe
2924	firefox.exe
2924	firefox.exe
2924	firefox.exe
2924	firefox.exe
2924	firefox.exe
2924	firefox.exe
2924	firefox.exe
2924	firefox.exe
2924	firefox.exe
2924	firefox.exe
2924	firefox.exe
2924	firefox.exe
2924	firefox.exe
2924	firefox.exe
2924	firefox.exe
2924	firefox.exe
2924	firefox.exe
2924	firefox.exe
2924	firefox.exe
2924	firefox.exe
3440	msedge.exe
2080	msedge.exe
484	firefox.exe
484	firefox.exe
484	firefox.exe
484	firefox.exe
484	firefox.exe
484	firefox.exe
484	firefox.exe
484	firefox.exe
484	firefox.exe
484	firefox.exe
484	firefox.exe
484	firefox.exe
484	firefox.exe
484	firefox.exe
484	firefox.exe
484	firefox.exe
484	firefox.exe
484	firefox.exe
484	firefox.exe
484	firefox.exe
6172	chrome.exe
6172	chrome.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2924	firefox.exe
484	firefox.exe
5344	New_Purchase_Order_PO-2025-01001481_pdf.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1984 wrote to memory of 5344	1984	New_Purchase_Order_PO-2025-01001481_pdf.exe	84
PID 1984 wrote to memory of 5344	1984	New_Purchase_Order_PO-2025-01001481_pdf.exe	84
PID 1984 wrote to memory of 5344	1984	New_Purchase_Order_PO-2025-01001481_pdf.exe	84
PID 1984 wrote to memory of 5344	1984	New_Purchase_Order_PO-2025-01001481_pdf.exe	84
PID 1984 wrote to memory of 5344	1984	New_Purchase_Order_PO-2025-01001481_pdf.exe	84
PID 5344 wrote to memory of 4692	5344	New_Purchase_Order_PO-2025-01001481_pdf.exe	86
PID 5344 wrote to memory of 4692	5344	New_Purchase_Order_PO-2025-01001481_pdf.exe	86
PID 4692 wrote to memory of 4616	4692	chrome.exe	87
PID 4692 wrote to memory of 4616	4692	chrome.exe	87
PID 4692 wrote to memory of 1952	4692	chrome.exe	88
PID 4692 wrote to memory of 1952	4692	chrome.exe	88
PID 4692 wrote to memory of 5772	4692	chrome.exe	89
PID 4692 wrote to memory of 5772	4692	chrome.exe	89
PID 4692 wrote to memory of 3156	4692	chrome.exe	90
PID 4692 wrote to memory of 3156	4692	chrome.exe	90
PID 5344 wrote to memory of 3156	5344	New_Purchase_Order_PO-2025-01001481_pdf.exe	90
PID 5344 wrote to memory of 4692	5344	New_Purchase_Order_PO-2025-01001481_pdf.exe	86
PID 5344 wrote to memory of 4692	5344	New_Purchase_Order_PO-2025-01001481_pdf.exe	86
PID 4692 wrote to memory of 4672	4692	chrome.exe	91
PID 4692 wrote to memory of 4672	4692	chrome.exe	91
PID 4692 wrote to memory of 5976	4692	chrome.exe	92
PID 4692 wrote to memory of 5976	4692	chrome.exe	92
PID 5344 wrote to memory of 1952	5344	New_Purchase_Order_PO-2025-01001481_pdf.exe	88
PID 5344 wrote to memory of 1952	5344	New_Purchase_Order_PO-2025-01001481_pdf.exe	88
PID 5344 wrote to memory of 5772	5344	New_Purchase_Order_PO-2025-01001481_pdf.exe	89
PID 4692 wrote to memory of 4752	4692	chrome.exe	93
PID 4692 wrote to memory of 4752	4692	chrome.exe	93
PID 4692 wrote to memory of 2712	4692	chrome.exe	94
PID 4692 wrote to memory of 2712	4692	chrome.exe	94
PID 4692 wrote to memory of 6088	4692	chrome.exe	95
PID 4692 wrote to memory of 6088	4692	chrome.exe	95
PID 4692 wrote to memory of 456	4692	chrome.exe	96
PID 4692 wrote to memory of 456	4692	chrome.exe	96
PID 5344 wrote to memory of 5772	5344	New_Purchase_Order_PO-2025-01001481_pdf.exe	89
PID 5344 wrote to memory of 4616	5344	New_Purchase_Order_PO-2025-01001481_pdf.exe	87
PID 5344 wrote to memory of 4616	5344	New_Purchase_Order_PO-2025-01001481_pdf.exe	87
PID 4692 wrote to memory of 5496	4692	chrome.exe	97
PID 4692 wrote to memory of 5496	4692	chrome.exe	97
PID 5344 wrote to memory of 3156	5344	New_Purchase_Order_PO-2025-01001481_pdf.exe	90
PID 5344 wrote to memory of 3156	5344	New_Purchase_Order_PO-2025-01001481_pdf.exe	90
PID 5344 wrote to memory of 6088	5344	New_Purchase_Order_PO-2025-01001481_pdf.exe	95
PID 5344 wrote to memory of 6088	5344	New_Purchase_Order_PO-2025-01001481_pdf.exe	95
PID 5344 wrote to memory of 5496	5344	New_Purchase_Order_PO-2025-01001481_pdf.exe	97
PID 5344 wrote to memory of 5496	5344	New_Purchase_Order_PO-2025-01001481_pdf.exe	97
PID 5344 wrote to memory of 4692	5344	New_Purchase_Order_PO-2025-01001481_pdf.exe	86
PID 5344 wrote to memory of 4692	5344	New_Purchase_Order_PO-2025-01001481_pdf.exe	86
PID 5344 wrote to memory of 2712	5344	New_Purchase_Order_PO-2025-01001481_pdf.exe	94
PID 5344 wrote to memory of 2712	5344	New_Purchase_Order_PO-2025-01001481_pdf.exe	94
PID 5344 wrote to memory of 1952	5344	New_Purchase_Order_PO-2025-01001481_pdf.exe	88
PID 5344 wrote to memory of 1952	5344	New_Purchase_Order_PO-2025-01001481_pdf.exe	88
PID 4692 wrote to memory of 1404	4692	chrome.exe	98
PID 4692 wrote to memory of 1404	4692	chrome.exe	98
PID 5344 wrote to memory of 5772	5344	New_Purchase_Order_PO-2025-01001481_pdf.exe	89
PID 5344 wrote to memory of 5772	5344	New_Purchase_Order_PO-2025-01001481_pdf.exe	89
PID 5344 wrote to memory of 456	5344	New_Purchase_Order_PO-2025-01001481_pdf.exe	96
PID 5344 wrote to memory of 456	5344	New_Purchase_Order_PO-2025-01001481_pdf.exe	96
PID 5344 wrote to memory of 5976	5344	New_Purchase_Order_PO-2025-01001481_pdf.exe	92
PID 5344 wrote to memory of 5976	5344	New_Purchase_Order_PO-2025-01001481_pdf.exe	92
PID 5344 wrote to memory of 4616	5344	New_Purchase_Order_PO-2025-01001481_pdf.exe	87
PID 5344 wrote to memory of 4616	5344	New_Purchase_Order_PO-2025-01001481_pdf.exe	87
PID 5344 wrote to memory of 3156	5344	New_Purchase_Order_PO-2025-01001481_pdf.exe	90
PID 5344 wrote to memory of 3156	5344	New_Purchase_Order_PO-2025-01001481_pdf.exe	90
PID 5344 wrote to memory of 6088	5344	New_Purchase_Order_PO-2025-01001481_pdf.exe	95
PID 5344 wrote to memory of 6088	5344	New_Purchase_Order_PO-2025-01001481_pdf.exe	95

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2318277690-2490144949-3346562762-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	New_Purchase_Order_PO-2025-01001481_pdf.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2318277690-2490144949-3346562762-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	New_Purchase_Order_PO-2025-01001481_pdf.exe

C:\Users\Admin\AppData\Local\Temp\New_Purchase_Order_PO-2025-01001481_pdf.exe
"C:\Users\Admin\AppData\Local\Temp\New_Purchase_Order_PO-2025-01001481_pdf.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1984
- C:\Users\Admin\AppData\Local\Temp\New_Purchase_Order_PO-2025-01001481_pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\New_Purchase_Order_PO-2025-01001481_pdf.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - outlook_office_path
  - outlook_win_path
  PID:5344
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vsqc1jnn.ygi"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4692
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\vsqc1jnn.ygi /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\vsqc1jnn.ygi\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\vsqc1jnn.ygi --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ffc54b7dcf8,0x7ffc54b7dd04,0x7ffc54b7dd10
      4⤵
      PID:4616
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vsqc1jnn.ygi" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=1888,i,16827451376630891058,16788815140090720510,262144 --variations-seed-version --mojo-platform-channel-handle=1884 /prefetch:2
      4⤵
      PID:1952
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vsqc1jnn.ygi" --field-trial-handle=1928,i,16827451376630891058,16788815140090720510,262144 --variations-seed-version --mojo-platform-channel-handle=1980 /prefetch:11
      4⤵
      PID:5772
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vsqc1jnn.ygi" --field-trial-handle=2148,i,16827451376630891058,16788815140090720510,262144 --variations-seed-version --mojo-platform-channel-handle=2336 /prefetch:13
      4⤵
      PID:3156
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vsqc1jnn.ygi" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=2720,i,16827451376630891058,16788815140090720510,262144 --variations-seed-version --mojo-platform-channel-handle=2740 /prefetch:1
      4⤵
      PID:4672
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vsqc1jnn.ygi" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=2728,i,16827451376630891058,16788815140090720510,262144 --variations-seed-version --mojo-platform-channel-handle=2908 /prefetch:1
      4⤵
      PID:5976
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vsqc1jnn.ygi" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=1968,i,16827451376630891058,16788815140090720510,262144 --variations-seed-version --mojo-platform-channel-handle=3256 /prefetch:1
      4⤵
      PID:4752
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vsqc1jnn.ygi" --extension-process --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=3268,i,16827451376630891058,16788815140090720510,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:9
      4⤵
      PID:2712
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vsqc1jnn.ygi" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=3304,i,16827451376630891058,16788815140090720510,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:1
      4⤵
      PID:6088
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vsqc1jnn.ygi" --extension-process --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=3320,i,16827451376630891058,16788815140090720510,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:9
      4⤵
      PID:456
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vsqc1jnn.ygi" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=2812,i,16827451376630891058,16788815140090720510,262144 --variations-seed-version --mojo-platform-channel-handle=3988 /prefetch:1
      4⤵
      PID:5496
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vsqc1jnn.ygi" --field-trial-handle=4404,i,16827451376630891058,16788815140090720510,262144 --variations-seed-version --mojo-platform-channel-handle=4180 /prefetch:14
      4⤵
      PID:1404
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vsqc1jnn.ygi" --field-trial-handle=4976,i,16827451376630891058,16788815140090720510,262144 --variations-seed-version --mojo-platform-channel-handle=4988 /prefetch:14
      4⤵
      PID:4996
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vsqc1jnn.ygi" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=5092,i,16827451376630891058,16788815140090720510,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:1
      4⤵
      PID:3832
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vsqc1jnn.ygi" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=5124,i,16827451376630891058,16788815140090720510,262144 --variations-seed-version --mojo-platform-channel-handle=5104 /prefetch:1
      4⤵
      PID:5264
  - - C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
      4⤵
      Drops file in Windows directory
      PID:5488
    - - C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x250,0x254,0x258,0x22c,0x25c,0x7ff6a4f11f58,0x7ff6a4f11f64,0x7ff6a4f11f70
        5⤵
        Drops file in Windows directory
        
        PID:1776
    - - C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\initial_preferences" --create-shortcuts=1 --install-level=0
        5⤵
        Drops file in Windows directory
        
        PID:3936
      - C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x244,0x248,0x24c,0x220,0x250,0x7ff6a4f11f58,0x7ff6a4f11f64,0x7ff6a4f11f70
        6⤵
        Drops file in Windows directory
        
        PID:2404
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\unope5tr.zp5"
    3⤵
    PID:3356
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir=C:\Users\Admin\AppData\Local\Temp\unope5tr.zp5
      4⤵
      Checks processor information in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:2924
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1964 -prefsLen 27097 -prefMapHandle 1968 -prefMapSize 270279 -ipcHandle 2056 -initialChannelId {a9248564-064f-4a24-97c5-5579f273573e} -parentPid 2924 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2924" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
        5⤵
        
        PID:1108
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2308 -prefsLen 27133 -prefMapHandle 2412 -prefMapSize 270279 -ipcHandle 2320 -initialChannelId {8447c12a-84ab-4611-972f-d1a117286b63} -parentPid 2924 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2924" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
        5⤵
        
        PID:4072
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\cf91fe20-4326-45ce-957a-3c21a7684295.dmp"
        5⤵
        
        PID:2136
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2276 -prefsLen 27133 -prefMapHandle 3004 -prefMapSize 270279 -ipcHandle 3024 -initialChannelId {02f850e2-f25f-4b19-9cca-da7faf7e11b6} -parentPid 2924 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2924" -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 gpu
        5⤵
        
        PID:2092
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\bbdfb3eb-a385-4aa9-a434-84db90bf1026.dmp"
        5⤵
        
        PID:5756
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3024 -prefsLen 27198 -prefMapHandle 3400 -prefMapSize 270279 -ipcHandle 3040 -initialChannelId {37a2d173-0bd3-499b-9a06-dd1ce641ec8f} -parentPid 2924 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2924" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 gpu
        5⤵
        
        PID:804
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4032 -prefsLen 27323 -prefMapHandle 4036 -prefMapSize 270279 -jsInitHandle 4040 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4048 -initialChannelId {57196059-fa1e-40b0-bd1a-dbef5dd71f95} -parentPid 2924 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2924" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
        5⤵
        Checks processor information in registry
        
        PID:4268
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\a29d3c53-4401-44a0-b211-a6aec1ba9ee8.dmp"
        5⤵
        
        PID:6096
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2636 -prefsLen 27323 -prefMapHandle 4200 -prefMapSize 270279 -ipcHandle 4036 -initialChannelId {6cc96d6d-6334-49f0-8bc3-0cb6e174de86} -parentPid 2924 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2924" -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 gpu
        5⤵
        
        PID:3336
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\c76867e3-8350-4c45-bfae-f71b1b62bc3c.dmp"
        5⤵
        
        PID:2340
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4432 -prefsLen 27323 -prefMapHandle 4436 -prefMapSize 270279 -ipcHandle 4028 -initialChannelId {559a4221-bf09-4a85-b3a7-5e94c3192256} -parentPid 2924 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2924" -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 rdd
        5⤵
        
        PID:1872
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2828 -prefsLen 34822 -prefMapHandle 2652 -prefMapSize 270279 -jsInitHandle 2768 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3232 -initialChannelId {11eb03e9-ee53-4049-b007-094bae8cc425} -parentPid 2924 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2924" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
        5⤵
        Checks processor information in registry
        
        PID:5520
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5176 -prefsLen 34929 -prefMapHandle 5180 -prefMapSize 270279 -ipcHandle 5204 -initialChannelId {ac130a02-cf73-415c-b031-4132b27d2187} -parentPid 2924 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2924" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 utility
        5⤵
        Checks processor information in registry
        
        PID:4384
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2912 -prefsLen 32900 -prefMapHandle 2524 -prefMapSize 270279 -jsInitHandle 2664 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2976 -initialChannelId {bd72cd9b-71bd-4f36-bef7-3b8ad93284c1} -parentPid 2924 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2924" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
        5⤵
        Checks processor information in registry
        
        PID:5552
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5576 -prefsLen 32952 -prefMapHandle 5580 -prefMapSize 270279 -jsInitHandle 5584 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2664 -initialChannelId {c1d143c5-5699-42bd-89ff-4f9a82b3b276} -parentPid 2924 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2924" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
        5⤵
        Checks processor information in registry
        
        PID:532
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5756 -prefsLen 32952 -prefMapHandle 5760 -prefMapSize 270279 -jsInitHandle 5764 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5772 -initialChannelId {9d2f3d1a-200f-435f-83e6-8de9a1250661} -parentPid 2924 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2924" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
        5⤵
        Checks processor information in registry
        
        PID:2248
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\c242kbhk.jjh"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious use of FindShellTrayWindow
    PID:3440
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\c242kbhk.jjh /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\c242kbhk.jjh\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x23c,0x240,0x244,0x238,0x24c,0x7ffc54b5f208,0x7ffc54b5f214,0x7ffc54b5f220
      4⤵
      PID:2176
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\c242kbhk.jjh" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --field-trial-handle=2108,i,844336453720864718,13691361471351938439,262144 --variations-seed-version --mojo-platform-channel-handle=2104 /prefetch:2
      4⤵
      PID:2208
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\c242kbhk.jjh" --always-read-main-dll --field-trial-handle=1812,i,844336453720864718,13691361471351938439,262144 --variations-seed-version --mojo-platform-channel-handle=2252 /prefetch:11
      4⤵
      PID:5652
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\c242kbhk.jjh" --always-read-main-dll --field-trial-handle=2296,i,844336453720864718,13691361471351938439,262144 --variations-seed-version --mojo-platform-channel-handle=2720 /prefetch:13
      4⤵
      PID:1400
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\c242kbhk.jjh" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3048,i,844336453720864718,13691361471351938439,262144 --variations-seed-version --mojo-platform-channel-handle=3116 /prefetch:1
      4⤵
      PID:4344
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\c242kbhk.jjh" --instant-process --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3056,i,844336453720864718,13691361471351938439,262144 --variations-seed-version --mojo-platform-channel-handle=3188 /prefetch:1
      4⤵
      PID:4396
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\c242kbhk.jjh" --always-read-main-dll --field-trial-handle=3452,i,844336453720864718,13691361471351938439,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:14
      4⤵
      PID:4780
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\c242kbhk.jjh" --always-read-main-dll --field-trial-handle=3456,i,844336453720864718,13691361471351938439,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:14
      4⤵
      PID:6092
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\c242kbhk.jjh" --always-read-main-dll --field-trial-handle=3464,i,844336453720864718,13691361471351938439,262144 --variations-seed-version --mojo-platform-channel-handle=4352 /prefetch:14
      4⤵
      PID:5592
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\c242kbhk.jjh" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --field-trial-handle=3440,i,844336453720864718,13691361471351938439,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:1
      4⤵
      PID:5996
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\c242kbhk.jjh" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --field-trial-handle=3516,i,844336453720864718,13691361471351938439,262144 --variations-seed-version --mojo-platform-channel-handle=4424 /prefetch:9
      4⤵
      PID:5712
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\c242kbhk.jjh" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --field-trial-handle=3556,i,844336453720864718,13691361471351938439,262144 --variations-seed-version --mojo-platform-channel-handle=4756 /prefetch:1
      4⤵
      PID:2232
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\c242kbhk.jjh" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --field-trial-handle=3592,i,844336453720864718,13691361471351938439,262144 --variations-seed-version --mojo-platform-channel-handle=4760 /prefetch:9
      4⤵
      PID:4180
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\c242kbhk.jjh" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --field-trial-handle=3628,i,844336453720864718,13691361471351938439,262144 --variations-seed-version --mojo-platform-channel-handle=4780 /prefetch:1
      4⤵
      PID:2432
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\c242kbhk.jjh" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --field-trial-handle=3652,i,844336453720864718,13691361471351938439,262144 --variations-seed-version --mojo-platform-channel-handle=4816 /prefetch:9
      4⤵
      PID:2184
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\c242kbhk.jjh" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --field-trial-handle=3676,i,844336453720864718,13691361471351938439,262144 --variations-seed-version --mojo-platform-channel-handle=3860 /prefetch:1
      4⤵
      PID:4060
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\c242kbhk.jjh" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --field-trial-handle=3704,i,844336453720864718,13691361471351938439,262144 --variations-seed-version --mojo-platform-channel-handle=4732 /prefetch:9
      4⤵
      PID:3724
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\c242kbhk.jjh" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --field-trial-handle=3616,i,844336453720864718,13691361471351938439,262144 --variations-seed-version --mojo-platform-channel-handle=4864 /prefetch:1
      4⤵
      PID:2544
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\c242kbhk.jjh" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --field-trial-handle=2300,i,844336453720864718,13691361471351938439,262144 --variations-seed-version --mojo-platform-channel-handle=4896 /prefetch:9
      4⤵
      PID:4052
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\c242kbhk.jjh" --always-read-main-dll --field-trial-handle=3864,i,844336453720864718,13691361471351938439,262144 --variations-seed-version --mojo-platform-channel-handle=4928 /prefetch:14
      4⤵
      PID:3344
    - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=1128
        5⤵
        
        PID:2280
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\c242kbhk.jjh" --always-read-main-dll --field-trial-handle=5096,i,844336453720864718,13691361471351938439,262144 --variations-seed-version --mojo-platform-channel-handle=4820 /prefetch:14
      4⤵
      PID:2564
    - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=596
        5⤵
        
        PID:3552
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\c242kbhk.jjh" --always-read-main-dll --field-trial-handle=5092,i,844336453720864718,13691361471351938439,262144 --variations-seed-version --mojo-platform-channel-handle=4752 /prefetch:14
      4⤵
      PID:5320
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\c242kbhk.jjh" --always-read-main-dll --field-trial-handle=4780,i,844336453720864718,13691361471351938439,262144 --variations-seed-version --mojo-platform-channel-handle=4756 /prefetch:14
      4⤵
      PID:5280
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\c242kbhk.jjh" --always-read-main-dll --field-trial-handle=3520,i,844336453720864718,13691361471351938439,262144 --variations-seed-version --mojo-platform-channel-handle=4372 /prefetch:14
      4⤵
      PID:1980
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --no-sandbox --mute-audio --onnx-enabled-for-ee --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\c242kbhk.jjh" --always-read-main-dll --field-trial-handle=3528,i,844336453720864718,13691361471351938439,262144 --variations-seed-version --mojo-platform-channel-handle=4920 /prefetch:14
      4⤵
      PID:3104
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\yr4psb1h.f1b"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious use of FindShellTrayWindow
    PID:2080
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\yr4psb1h.f1b /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\yr4psb1h.f1b\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x23c,0x240,0x244,0x238,0x260,0x7ffc54b5f208,0x7ffc54b5f214,0x7ffc54b5f220
      4⤵
      PID:5168
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\yr4psb1h.f1b" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --field-trial-handle=2136,i,7769122499885142119,6424238885299938234,262144 --variations-seed-version --mojo-platform-channel-handle=2128 /prefetch:2
      4⤵
      PID:1912
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\yr4psb1h.f1b" --always-read-main-dll --field-trial-handle=1792,i,7769122499885142119,6424238885299938234,262144 --variations-seed-version --mojo-platform-channel-handle=2188 /prefetch:11
      4⤵
      PID:6008
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\yr4psb1h.f1b" --always-read-main-dll --field-trial-handle=1876,i,7769122499885142119,6424238885299938234,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:13
      4⤵
      PID:3492
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\yr4psb1h.f1b" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3096,i,7769122499885142119,6424238885299938234,262144 --variations-seed-version --mojo-platform-channel-handle=3116 /prefetch:1
      4⤵
      PID:5504
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\yr4psb1h.f1b" --instant-process --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3100,i,7769122499885142119,6424238885299938234,262144 --variations-seed-version --mojo-platform-channel-handle=3348 /prefetch:1
      4⤵
      PID:5320
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\yr4psb1h.f1b" --always-read-main-dll --field-trial-handle=3432,i,7769122499885142119,6424238885299938234,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:14
      4⤵
      PID:1036
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\yr4psb1h.f1b" --always-read-main-dll --field-trial-handle=3436,i,7769122499885142119,6424238885299938234,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:14
      4⤵
      PID:3136
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\yr4psb1h.f1b" --always-read-main-dll --field-trial-handle=3472,i,7769122499885142119,6424238885299938234,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:14
      4⤵
      PID:2028
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\yr4psb1h.f1b" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --field-trial-handle=3476,i,7769122499885142119,6424238885299938234,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:1
      4⤵
      PID:1052
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\yr4psb1h.f1b" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --field-trial-handle=3580,i,7769122499885142119,6424238885299938234,262144 --variations-seed-version --mojo-platform-channel-handle=4352 /prefetch:9
      4⤵
      PID:4328
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\yr4psb1h.f1b" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --field-trial-handle=3612,i,7769122499885142119,6424238885299938234,262144 --variations-seed-version --mojo-platform-channel-handle=4388 /prefetch:1
      4⤵
      PID:5704
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\yr4psb1h.f1b" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --field-trial-handle=3656,i,7769122499885142119,6424238885299938234,262144 --variations-seed-version --mojo-platform-channel-handle=4400 /prefetch:9
      4⤵
      PID:1548
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\yr4psb1h.f1b" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --field-trial-handle=3668,i,7769122499885142119,6424238885299938234,262144 --variations-seed-version --mojo-platform-channel-handle=3824 /prefetch:1
      4⤵
      PID:1944
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\yr4psb1h.f1b" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --field-trial-handle=3692,i,7769122499885142119,6424238885299938234,262144 --variations-seed-version --mojo-platform-channel-handle=4480 /prefetch:9
      4⤵
      PID:3832
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\yr4psb1h.f1b" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --field-trial-handle=3712,i,7769122499885142119,6424238885299938234,262144 --variations-seed-version --mojo-platform-channel-handle=4804 /prefetch:1
      4⤵
      PID:2864
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\yr4psb1h.f1b" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --field-trial-handle=3728,i,7769122499885142119,6424238885299938234,262144 --variations-seed-version --mojo-platform-channel-handle=4784 /prefetch:9
      4⤵
      PID:1460
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\yr4psb1h.f1b" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --field-trial-handle=3680,i,7769122499885142119,6424238885299938234,262144 --variations-seed-version --mojo-platform-channel-handle=4372 /prefetch:1
      4⤵
      PID:3852
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\yr4psb1h.f1b" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --field-trial-handle=3764,i,7769122499885142119,6424238885299938234,262144 --variations-seed-version --mojo-platform-channel-handle=4872 /prefetch:9
      4⤵
      PID:4076
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\yr4psb1h.f1b" --always-read-main-dll --field-trial-handle=5064,i,7769122499885142119,6424238885299938234,262144 --variations-seed-version --mojo-platform-channel-handle=4768 /prefetch:14
      4⤵
      PID:5252
    - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=1128
        5⤵
        
        PID:4552
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\yr4psb1h.f1b" --always-read-main-dll --field-trial-handle=5228,i,7769122499885142119,6424238885299938234,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:14
      4⤵
      PID:5676
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\yr4psb1h.f1b" --always-read-main-dll --field-trial-handle=4412,i,7769122499885142119,6424238885299938234,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:14
      4⤵
      PID:3084
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\yr4psb1h.f1b" --always-read-main-dll --field-trial-handle=4316,i,7769122499885142119,6424238885299938234,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:14
      4⤵
      PID:3728
    - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=592
        5⤵
        
        PID:1844
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\yr4psb1h.f1b" --always-read-main-dll --field-trial-handle=5408,i,7769122499885142119,6424238885299938234,262144 --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:14
      4⤵
      PID:1052
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --no-sandbox --mute-audio --onnx-enabled-for-ee --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\yr4psb1h.f1b" --always-read-main-dll --field-trial-handle=5416,i,7769122499885142119,6424238885299938234,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:14
      4⤵
      PID:2272
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tk2junjw.5f3"
    3⤵
    PID:5244
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir=C:\Users\Admin\AppData\Local\Temp\tk2junjw.5f3
      4⤵
      Checks processor information in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:484
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1924 -prefsLen 27097 -prefMapHandle 1936 -prefMapSize 270331 -ipcHandle 2020 -initialChannelId {15aec87c-5b38-41eb-86d1-eb06d1351114} -parentPid 484 -crashReporter "\\.\pipe\gecko-crash-server-pipe.484" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
        5⤵
        
        PID:5204
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2304 -prefsLen 27133 -prefMapHandle 2308 -prefMapSize 270331 -ipcHandle 2316 -initialChannelId {10545af7-3beb-4931-9db4-02a844cd4b4b} -parentPid 484 -crashReporter "\\.\pipe\gecko-crash-server-pipe.484" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
        5⤵
        
        PID:4552
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\5585fb02-515f-4794-a263-f89ae29accd3.dmp"
        5⤵
        
        PID:1984
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2316 -prefsLen 27133 -prefMapHandle 2328 -prefMapSize 270331 -ipcHandle 3056 -initialChannelId {d3d7f767-1ed5-42a2-911e-1cb0555ad4d9} -parentPid 484 -crashReporter "\\.\pipe\gecko-crash-server-pipe.484" -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 gpu
        5⤵
        
        PID:1584
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\cc18a393-502f-49c5-896a-d05d774bfaf9.dmp"
        5⤵
        
        PID:5220
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3120 -prefsLen 27198 -prefMapHandle 3276 -prefMapSize 270331 -ipcHandle 3356 -initialChannelId {bc923355-52d2-4a1d-a5dd-5eafc0a095fd} -parentPid 484 -crashReporter "\\.\pipe\gecko-crash-server-pipe.484" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 gpu
        5⤵
        
        PID:5232
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3564 -prefsLen 27323 -prefMapHandle 3568 -prefMapSize 270331 -jsInitHandle 3572 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3624 -initialChannelId {314a17cd-e54a-438f-8001-796f661b2aa0} -parentPid 484 -crashReporter "\\.\pipe\gecko-crash-server-pipe.484" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
        5⤵
        Checks processor information in registry
        
        PID:5560
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\4cf95005-b8c6-417a-9210-74554285353d.dmp"
        5⤵
        
        PID:5104
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3356 -prefsLen 27323 -prefMapHandle 2352 -prefMapSize 270331 -ipcHandle 3344 -initialChannelId {45396c69-ae57-431b-8215-ba3e4ff7c735} -parentPid 484 -crashReporter "\\.\pipe\gecko-crash-server-pipe.484" -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 gpu
        5⤵
        
        PID:3512
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\bfd2c7b7-0f51-4209-ad90-76aad6801e68.dmp"
        5⤵
        
        PID:2456
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4140 -prefsLen 27323 -prefMapHandle 4224 -prefMapSize 270331 -ipcHandle 4232 -initialChannelId {73543da8-d107-423a-be7c-a8345fe1cf80} -parentPid 484 -crashReporter "\\.\pipe\gecko-crash-server-pipe.484" -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 rdd
        5⤵
        
        PID:2768
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4624 -prefsLen 34876 -prefMapHandle 4628 -prefMapSize 270331 -jsInitHandle 4632 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4640 -initialChannelId {06d5bcb1-749f-4aff-aed7-5f47eac1d21c} -parentPid 484 -crashReporter "\\.\pipe\gecko-crash-server-pipe.484" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
        5⤵
        Checks processor information in registry
        
        PID:1804
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5088 -prefsLen 34876 -prefMapHandle 5092 -prefMapSize 270331 -ipcHandle 2908 -initialChannelId {7fa43c35-f4ae-4f7c-8ca8-291e6e5868cf} -parentPid 484 -crashReporter "\\.\pipe\gecko-crash-server-pipe.484" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 utility
        5⤵
        Checks processor information in registry
        
        PID:6784
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4760 -prefsLen 32818 -prefMapHandle 4660 -prefMapSize 270331 -jsInitHandle 4672 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3428 -initialChannelId {8d488f13-399c-4a8d-853c-8fbca4a28353} -parentPid 484 -crashReporter "\\.\pipe\gecko-crash-server-pipe.484" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
        5⤵
        Checks processor information in registry
        
        PID:968
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5020 -prefsLen 32818 -prefMapHandle 5008 -prefMapSize 270331 -jsInitHandle 2704 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5392 -initialChannelId {aa224b34-c27d-4615-a630-82cb3a16eca9} -parentPid 484 -crashReporter "\\.\pipe\gecko-crash-server-pipe.484" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
        5⤵
        Checks processor information in registry
        
        PID:1584
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5640 -prefsLen 32818 -prefMapHandle 5644 -prefMapSize 270331 -jsInitHandle 5648 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5660 -initialChannelId {fcc70924-7e1f-40aa-a38b-74f3620e5ce7} -parentPid 484 -crashReporter "\\.\pipe\gecko-crash-server-pipe.484" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
        5⤵
        Checks processor information in registry
        
        PID:5600
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\srso0rai.h1m"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    PID:6172
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\srso0rai.h1m /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\srso0rai.h1m\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\srso0rai.h1m --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ffc54b7dcf8,0x7ffc54b7dd04,0x7ffc54b7dd10
      4⤵
      PID:6192
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\srso0rai.h1m" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=2544,i,6039245359584251474,9302252687360234998,262144 --variations-seed-version --mojo-platform-channel-handle=2540 /prefetch:2
      4⤵
      PID:6436
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\srso0rai.h1m" --field-trial-handle=1876,i,6039245359584251474,9302252687360234998,262144 --variations-seed-version --mojo-platform-channel-handle=2644 /prefetch:11
      4⤵
      PID:6444
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\srso0rai.h1m" --field-trial-handle=2320,i,6039245359584251474,9302252687360234998,262144 --variations-seed-version --mojo-platform-channel-handle=2684 /prefetch:13
      4⤵
      PID:6448
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\srso0rai.h1m" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3080,i,6039245359584251474,9302252687360234998,262144 --variations-seed-version --mojo-platform-channel-handle=3144 /prefetch:1
      4⤵
      PID:6520
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\srso0rai.h1m" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3088,i,6039245359584251474,9302252687360234998,262144 --variations-seed-version --mojo-platform-channel-handle=3148 /prefetch:1
      4⤵
      PID:6536
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\srso0rai.h1m" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3544,i,6039245359584251474,9302252687360234998,262144 --variations-seed-version --mojo-platform-channel-handle=3992 /prefetch:1
      4⤵
      PID:2724
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\srso0rai.h1m" --extension-process --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=3484,i,6039245359584251474,9302252687360234998,262144 --variations-seed-version --mojo-platform-channel-handle=4032 /prefetch:9
      4⤵
      PID:1140
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\srso0rai.h1m" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=3576,i,6039245359584251474,9302252687360234998,262144 --variations-seed-version --mojo-platform-channel-handle=4132 /prefetch:1
      4⤵
      PID:6728
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\srso0rai.h1m" --extension-process --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=3592,i,6039245359584251474,9302252687360234998,262144 --variations-seed-version --mojo-platform-channel-handle=4152 /prefetch:9
      4⤵
      PID:6096
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\srso0rai.h1m" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=4084,i,6039245359584251474,9302252687360234998,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:1
      4⤵
      PID:5448
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\srso0rai.h1m" --field-trial-handle=4416,i,6039245359584251474,9302252687360234998,262144 --variations-seed-version --mojo-platform-channel-handle=4428 /prefetch:14
      4⤵
      PID:1712

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5912

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

activity-stream.contile.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5rm9ff4w.default-release\activity-stream.contile.json
Size 4KB
SHA256 b8827715ff97a6c28dbe781cce1925cb3e31def9bf4819c269ff741bc6dbb1db
MD5 89b056d73a75e247ea2482543b9b60ef
SHA1 6b3aa461cd6dfa123fa83852928ed04b8def9eff
SHA512 49f68b3d5f1a204bfa7f4e7ce8c9bdb2537024b8b4728c0ff70e5d25960b5610a3063aee9199447d801e47138795ad8c0f2aa259d9f1f714b24c182c6ca09e0e
SSDEEP 48:YdpUex5eDXp64gJQHTRdtVKvZdpB9oZ5eDXa0pG4hMz1WP+QwlpdWRhZ5eDXIpWH:KrutgJQz1VcZd/yzIvwlaUbDChh5M
MD5 SHA1 SHA512 SSDEEP

Submit Download

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5rm9ff4w.default-release\activity-stream.discovery_stream.json
Size 23KB
SHA256 4bcf9fb90cbd6833faf40963b4d7fde938f905954023998f50ba8be6c8daebc5
MD5 d8ed9d1c9468e533f4e9cad85bdb1a5e
SHA1 bea4f2999a8526382e7d0a52194e037a79b210e5
SHA512 2238fa46a03cb89ab87b2089f23aaef156c85052a7c2af218e92688aa05b9fe0be4a1b7773d61e04e532b0e3ea429f00d5948c40781d6438106001bacc632088
SSDEEP 384:fyaGB0dwrTGQ7aFEd4HpCBwmmySeG1UvK2n3:fyVOeraQ78y4CwC6YT3
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\c242kbhk.jjh\Crashpad\settings.dat
Size 280B
SHA256 3c72772942b29695b0fcbe90d58ec732ee50425f9c2d050e847609286edb7296
MD5 fb94f499ddf1edb8312649df1927376f
SHA1 7d699af6191f77c9e9ff0d4467542d7d65dc6698
SHA512 6dd26c5d37cba7b91944aab2016890b6672666b26fac36454bfc4b9d9d2df1cebd0414fe2e680f24d2f42541e4799b2a7aae803293c07c3e3830329e0896ca8f
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\c242kbhk.jjh\Crashpad\settings.dat
Size 280B
SHA256 7ec7de4fc6a7da5f21e704fede31f92e00b3f17b62912b76a3e8d037dced4dec
MD5 7d36449b0639e528bcd70f00a4b40382
SHA1 f9a8c86c72ca5c6d2e57edae6b56d3a855a74af8
SHA512 13a6891ba2d794a80e1ba21a08341d3ed4079d7e6c6683520b2eb155b434442dcf7f6ef0c2f3d44ae01409692d58734023e6de1beae7cf10edfb167d3b232330
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Temp\c242kbhk.jjh\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\c242kbhk.jjh\Default\Code Cache\js\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\c242kbhk.jjh\Default\GPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Temp\c242kbhk.jjh\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 259B
SHA256 30b39bf3d1d19d26d723a99cce4925194380c218b2251a67ecba7349f5a10936
MD5 338c9ed1020b4cae634197eeb6869333
SHA1 295a1be6b848ccdd01aa02386273c9c3abd63730
SHA512 b59bf8620f5f551eb1412e1d8906ca3f24a44247d841773082ab3e47f3c5c5a5fb59e0b79f28ff8eef40943f106ab124b2a08b7d548646a74f21b20fcbf883a8
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Temp\c242kbhk.jjh\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 324B
SHA256 193b0fb4643b88c40f9bb03c2dd93846f786680b774a7936e2caba884fd6bf4b
MD5 65c21bb1d9a56efde395017c791b18ce
SHA1 4bf318e2f1e43e57a37743fb876a2d565bd23eab
SHA512 9a17bc82b24e0358fb98d93ddab4ed53f6ab46a0391b514f6736276741d6a44714db0e682860211e6080b1bb64523ceee48c206967994b696ad08ec9eac7a5e4
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Temp\c242kbhk.jjh\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 186B
SHA256 0d40c53480fd2836285c13c1957d01161f12076c70605363fea17dd55ad18a03
MD5 490df2d7f9bd9c4de96fa07c860e796b
SHA1 76d3c1c91410395fbfc07799ef8891055741a9da
SHA512 dded0abc2f069000f8c3f6faa1afa3590f8feb7778574a041675bddb6790e53b27fd1b14051cfb7395beab0dff877e39b79bc83f74ebaf11d34137b47b999630
MD5 SHA1 SHA512

Submit Download

index.txt~RFe57f52d.TMP

Path C:\Users\Admin\AppData\Local\Temp\c242kbhk.jjh\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt~RFe57f52d.TMP
Size 120B
SHA256 b0bc4ff6f3061989393f4ac962abab2ee78335b418767c3a82a438d89050a368
MD5 31ba9791377ad00b6f20c19bcbf7162e
SHA1 20bc4e4e57315b59e38b4f01768e2100a0871d41
SHA512 cea15740675912267b5e6687813a53715cc41e8ce49f26dc285b0979a7cb4913138a09b02199f97b641ee0b68afef7a17482e660c1b0bcb5a2d6e86114a667e7
MD5 SHA1 SHA512

Submit Download

d3c1c829-28f5-426b-9e3f-3d13a499a0f0.tmp

Path C:\Users\Admin\AppData\Local\Temp\c242kbhk.jjh\Default\d3c1c829-28f5-426b-9e3f-3d13a499a0f0.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\c242kbhk.jjh\Local State
Size 3KB
SHA256 8b577558ef903c11c9954a5b3730b57cc6dd253c9516b91401ecdf033ab8017b
MD5 9f17bd5c154475ec06ce0afeee90a29e
SHA1 ff8358734a80aec5d35772cf42d00e84cc79f07e
SHA512 14897c2f029602d9f5c9e994e07788443f242d573f88aec7e844c5599115e71cf476d66d73cf8c1378652afa8a4d5bcd5a577cc6aee83c329a621c403a96bfba
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\c242kbhk.jjh\Local State
Size 4KB
SHA256 048cd3d77f73c820d6ee06192e5377486912b167036ddd15599ec89ed036c8d9
MD5 9e6ebf98e14be9f83a8a9805e70ad0ae
SHA1 565be3f777b39bb3daa2566b570c73ed72a9ff4b
SHA512 ca5c2c511e99d65e089ae8d6cb0f93e7894439a9bc3cfcc741b6c1287edf3ae5e971422be51a7c90b5321f525a89d39819d9c6a89e4c7b26ac9b51e4cffc67d6
SSDEEP 96:YqGNkCufRn+zBK58Frh/cInURoDotovpLDjBmAvYLSdBsJJH+HqUBaa:DGNbWnwHooDUwl9zdOJHbI
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State~RFe57e947.TMP

Path C:\Users\Admin\AppData\Local\Temp\c242kbhk.jjh\Local State~RFe57e947.TMP
Size 1KB
SHA256 c01b29fe1c32c865045a76c899a7aa83eab14c4ffe84f792d26d4b9bb29af8af
MD5 6123c7369eccce93b302055c0daf2350
SHA1 59dc12088393979c930e55116b92ad8c4b1d976e
SHA512 244d46dcf53bc448808162385da8c94fec150f0948ebdb0c05a0948d2ab784f6c17ae5cecb59af7b4195bec1988380eed316fecbcc60e300d2edd001a065188e
MD5 SHA1 SHA512

Submit Download

f6615230-6ab1-4fdc-b200-88ee8a216d0e.tmp

Path C:\Users\Admin\AppData\Local\Temp\f6615230-6ab1-4fdc-b200-88ee8a216d0e.tmp
Size 154KB
SHA256 a468f5875b4e55ea732e3df283b4f4ea941be738b238122979ca5d8006a3a8fe
MD5 4ad81f6ccc657d1da582c75c5db037cb
SHA1 ab0370e7d32ebed71fe9787d3a4a2fc0c652a28e
SHA512 66461474f8b36d6d470797df9d4a3cc4698bceb7054c97166eed98b74def84f58486fdb909928aaeafee793799a436210b5d7091acce6232b23eb6ba926ad227
SSDEEP 3072:OqeD5sKZ7XcbMSqnDhcfXE0IfnpWpyKIrFn2wNkR7aUPuWm6u:yD5sIXcYSqDGc0kkpIZ2weeX6u
MD5 SHA1 SHA512 SSDEEP

Submit Download

indpiskede.ini

Path C:\Users\Admin\AppData\Local\Temp\indpiskede.ini
Size 35B
SHA256 314eb960147da73582c302879a0ebccda1a32ed4bd1986c7517f89348cbb0abb
MD5 08eb4a4f1b2e51fa7baccea0bbd23d70
SHA1 d2a25e5416462e136fad16170e6a8efcc6c6c562
SHA512 dfcff3b98052d1276bf7a85f3d1d2757578bf7d59408fe3dc6784af57b292feec3a5425dc3b243dbefed5bbdb98dd4d9f3931a79b9913a7114157238b834e3dd
MD5 SHA1 SHA512

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsk85CB.tmp\System.dll
Size 12KB
SHA256 7a9ddee34562cd3703f1502b5c70e99cd5bba15de2b6845a3555033d7f6cb2a5
MD5 564bb0373067e1785cba7e4c24aab4bf
SHA1 7c9416a01d821b10b2eef97b80899d24014d6fc1
SHA512 22c61a323cb9293d7ec5c7e7e60674d0e2f7b29d55be25eb3c128ea2cd7440a1400cee17c43896b996278007c0d247f331a9b8964e3a40a0eb1404a9596c4472
SSDEEP 192:nenY0qWTlt70IAj/lQ0sEWc/wtYbBH2aDybC7y+XBDIwL:n8+Qlt70Fj/lQRY/9VjjfL
MD5 SHA1 SHA512 SSDEEP

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\vsqc1jnn.ygi\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\vsqc1jnn.ygi\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\vsqc1jnn.ygi\Default\Site Characteristics Database\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

32.png

Path C:\Users\Admin\AppData\Local\Temp\vsqc1jnn.ygi\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\32.png
Size 1KB
SHA256 3197a2ac164c5bacb65f02fd9a6eb9c0a533fdf3b24f43043bbe9af65ed6608a
MD5 60953b3aca67505c2c7ea1a902e84d51
SHA1 5e6a8e04a96e36306c66409edd4775a606f13f54
SHA512 2e65ec84471c3f703617171aa32f1a0d6c57d73e1d5c074b92d20d580df78e7ac4eef5ce54ab7defd0027bb38e33c44a6602d3e123a2fd310e514af0f5b38086
MD5 SHA1 SHA512

Submit Download

48.png

Path C:\Users\Admin\AppData\Local\Temp\vsqc1jnn.ygi\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\48.png
Size 2KB
SHA256 9bdfc3aa03d4e41b0d83862ce02f9fe7fdb55a492280d86d551b91a24efd47ca
MD5 1625c1dd7bab831d8ab5308a1a71d525
SHA1 f1c145985a7c8c18891caaba0f46729bcbd1f63b
SHA512 75079bcb02482abd10b121d81fe39607dcac17bb3107ca274c549b570bb473260dfdbdd13df769b1745425ac5433a22fd392a2a1d815897e0c2091b787bada8e
MD5 SHA1 SHA512

Submit Download

64.png

Path C:\Users\Admin\AppData\Local\Temp\vsqc1jnn.ygi\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\64.png
Size 2KB
SHA256 57d5cd9fa59f944ffc78ec2a12633a79e2f923124fc50676ffbecaef5021b4a9
MD5 e6671b804d6013a6706ea598e2d854c5
SHA1 40e4f401fe4afbf7bda49a02fe94f5308868460e
SHA512 7b11a47497ae5810ec4c7038ebf8358f03d79126886feb6daffd92d116fd606f530ecced9c3d635c0f57b9f9eb80ed9e8fa4eb98b029f9fd798d9b89ccd279a8
MD5 SHA1 SHA512

Submit Download

32.png

Path C:\Users\Admin\AppData\Local\Temp\vsqc1jnn.ygi\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\32.png
Size 927B
SHA256 af50d64bd3cc7c3d201cb5abf0d76f44737e2a4040741ce178d9765fe440bcc5
MD5 26496798ba29a454042d60c9633c1e72
SHA1 65977f9cc15dd73026c91b479f1bc678050c8c45
SHA512 a4a61f66c712fcd27681073c2f30fda3a98fb6348ac4451d8a8e181e525f4ad8491a09d19c17dfb8f01a53eecbfc3ba25f370afd9df5b2ecb9b613236ecdd3cd
MD5 SHA1 SHA512

Submit Download

48.png

Path C:\Users\Admin\AppData\Local\Temp\vsqc1jnn.ygi\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\48.png
Size 1KB
SHA256 3339af4538fdfa40bb438469e35f6b7668d5c5ac93db0ef4a9e2fbf9ae884446
MD5 815ddced6b03c8a62cb590ea4585fcba
SHA1 9f7e8cce2319b15ec63d89f837a173bd247e6998
SHA512 ec7069b51959572c40dfa02f380b081912053898b4d4f86166b90bd277f9e8271d0fb3f0627e82645052ebe021c2e24698785e5214e82190a2298f32dd879b3d
MD5 SHA1 SHA512

Submit Download

64.png

Path C:\Users\Admin\AppData\Local\Temp\vsqc1jnn.ygi\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\64.png
Size 1KB
SHA256 e895cbcc424d6000a15b21d7cc9dec96deb2403a1469761ba3d9f11528c215b1
MD5 f2222b9d8dea52f5ce7d75378de76037
SHA1 e3b266fca2e5bf8bd82a62791902e879af7ff6fd
SHA512 74b947bc915c89f27954b5d0c8c790316ace581a20f7031aa91af3d95303ff0dd8cb4c87d3746ef2b13f76e0e8bba1b5b4a6916f3230c0514164fb1700640f66
MD5 SHA1 SHA512

Submit Download

128.png

Path C:\Users\Admin\AppData\Local\Temp\vsqc1jnn.ygi\Default\Web Applications\Temp\scoped_dir4692_1593251151\Icons\128.png
Size 5KB
SHA256 99b19cf47ea4e47b933229e92b87a474fbd5af7936bdf885c2240d0e6f4bdaaa
MD5 6a371e7bbf132a71f031772845249b9c
SHA1 36f499f3a2e2bf885019d914a0cc6e8b3e035a79
SHA512 b1fdcd5af84fa476808b8e89794d9df9f8e48b3e7c1a2239deae10832834d01bf311803ac95b3774d781be791b47389310ca866e1a6b497925ca6e2f004555a6
SSDEEP 96:n0NgAMSinf795k4ITgiEAyaD39SOOcqS+e60qq/zsB:n0Ngpf795k4CwG9ST3S0wzsB
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\vsqc1jnn.ygi\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\vsqc1jnn.ygi\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\vsqc1jnn.ygi\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\yr4psb1h.f1b\Crashpad\settings.dat
Size 280B
SHA256 ed393d0da46c89b749e17dacfb5bfb1fcf73c286504fb2c69f3e151f6e7af712
MD5 ca5d25eae2fbe1805aab8715dbe0caec
SHA1 067290c6e09371280371ea32f68d3032cd2ba3a0
SHA512 f7e4ceb2c91439175b048c8be29c14ea11ced3780b63ea9412b702876ca0ed1c7f91b2601616569b4a423d6581b6b4f332510e60cd6745e795740032ea1ee39e
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\yr4psb1h.f1b\Crashpad\settings.dat
Size 280B
SHA256 0a73a2565d225c01c364befb873ce4c4aca2bd262337b8cb9713fbda5023a6c0
MD5 0c911870be2164c8fe1e3a7cfa3005d4
SHA1 c0c634d6cbe618b81751e8afae863eb7485be493
SHA512 a1ce076282ae93918ef1db5bf3f509a8bba385752dfd7ff12014031193f1196c2bd33ee3505f41293b742786d7c8d402cb86defac6af0439849880a4a113e3be
MD5 SHA1 SHA512

Submit Download

f_000002

Path C:\Users\Admin\AppData\Local\Temp\yr4psb1h.f1b\Default\Cache\Cache_Data\f_000002
Size 99KB
SHA256 cad25cfcc108f11e81cf1a339916e956b5ccd3ab3da38a3bd7a3a7a01adcd3f4
MD5 86e9c0ad8befdb46f1ecda1d3f2c70ad
SHA1 cf9520c235db04ac02e98a7f7c9f3d5d631d4199
SHA512 30a1265891f03df0c46d4f310d97ffa312b84d485a214d895a1c5e260474260d6637592b20d9cf4efa507c131694f63253577fdb352e8e0c46505e02183e0ab4
SSDEEP 1536:GAqrSnLU5BxYE4bP9zel9rbvjJvNCLtY25wJ0qPKldrT6LTMyT2ItH3RHTZ:GAqrSLSvYEwsVbrTfUPdqL4S2iTZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000003

Path C:\Users\Admin\AppData\Local\Temp\yr4psb1h.f1b\Default\Cache\Cache_Data\f_000003
Size 385KB
SHA256 68bc06731377ddfe4a1d322c32f5de4387ec60f448e25d626011a16fbacdcfa6
MD5 030f61744f5fdd93bca89b3c49fa874e
SHA1 0e272a34976e733277e0d89e81ad52af16c6cb19
SHA512 1aaaf1b94f138eb5e86cbdc1e177fe56578b5147435839eaecbdfe8f036a0ab09dc119d01a6104eb6673751c5aa6890990b26a3265b47e4e2d510f9004f7c20b
SSDEEP 6144:t/lK47F8MLnpaiGXVcouQZTix37/mP5YxI4Eo/8FXAIEskVvfA:DrB1VS1Tix373xI4//wNkZfA
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000004

Path C:\Users\Admin\AppData\Local\Temp\yr4psb1h.f1b\Default\Cache\Cache_Data\f_000004
Size 63KB
SHA256 e5b3cabbfc15c5e78b917226331d6cc791db56e237715607aab1f8698120ad55
MD5 c45e12f786e69db8556d2647efd849dd
SHA1 ee1d2f776871bc3494638948a6d3198cde95bdab
SHA512 db83cddb4e1019c58957b3e62b804def1f6aa3a27707c49050aba8693d23ad1e8ef5b1a087b659200c080fb00d081f0f1a3508cccd49c77fe3e48e48a1f4ee4f
SSDEEP 1536:8Z018aiybrXsGUNbgelr0LK2+VfpX6+BHZ7F+ZeexbFeyDr+/YZ+:8Z0SaikNUNrl0LJ+5pHZ72V7x+p
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00000f

Path C:\Users\Admin\AppData\Local\Temp\yr4psb1h.f1b\Default\Cache\Cache_Data\f_00000f
Size 73KB
SHA256 ee72002f20815f7600a0af904b11098abf7233a5c71f566930f4995c3669e83c
MD5 e5f6722dca4c31507d4cfdc5bbb95e53
SHA1 6eebc561e3334d3ba8106a028a12b94adab139a7
SHA512 794b228c2e318e782b4e3eaa76871978c79a10ddbcd4bfa1694af3e16796713395778cf85eb9520908019656f3f6a22902ee5ea7e6b67a1214ebd4fb73820f20
SSDEEP 1536:zDaUrYjm1q1wn5MtJuHxyTi6YbG2X5URa4yU3q2/ZlgSOL1D47c+deYVpJS3:zuUntHxciZG2eR32JD4dbS3
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000010

Path C:\Users\Admin\AppData\Local\Temp\yr4psb1h.f1b\Default\Cache\Cache_Data\f_000010
Size 28KB
SHA256 b421c05a340e40d4d4bd1831521268b6f0afd0461ec3991cfa8d5314bf3207b4
MD5 57f9a7c7e2be49102533a2ceb7a05e51
SHA1 850ab0a80577b7f7effe196cba037899e71594c5
SHA512 66406d54a1d1a44f30e19a9bff1242b50fdcfbf66c33e4c23daaa756c06f50a2e39c991e7a8dfd9a81184cc37c2062d0406070be132e28a22307896e63b55447
SSDEEP 768:dT+CJ4QL+F8S4bApn9Ua0ndjCaixJ/fVW2/AGYnS:TJ45F8SgjXnNCa4fVWVnS
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000013

Path C:\Users\Admin\AppData\Local\Temp\yr4psb1h.f1b\Default\Cache\Cache_Data\f_000013
Size 68KB
SHA256 26f2d056c43cc9d83e59c76d08a50092b7c546505ff5ccad5a2cd8cca61a4aef
MD5 06358bda6e5c43e7eb8610a3cae99bb9
SHA1 d941da5ea4fd37d27212d06aab764e844c65e742
SHA512 a3bfc5dfa155ae60fea32f82b0b60ff599ace12dc12d0d6cfe8cdc0f5adc9eb829d2bcfdabd7faf77e9cbe529770607e0d35039cac4fb5f20423321a750f1270
SSDEEP 1536:WCE4MCFi8pkFZLGftTXq+fvXZMEDu/Zg4IQLroZpZwtyF8PDxVSH:tRMKUZ5UJMZ/G4IQYpoBPD3M
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000015

Path C:\Users\Admin\AppData\Local\Temp\yr4psb1h.f1b\Default\Cache\Cache_Data\f_000015
Size 17KB
SHA256 252ca98cffdec1c6ec7604b72704d736d95d0a9643195d0a1bac3b1d9db01b7e
MD5 5942cee93487a49093faa631139784ea
SHA1 5723860b365df1ca84d69d7d6a06d4b224a97b51
SHA512 3c4a657db0abea8a7b64ab5ceeae4c26f26b4b11667b8118f141ae9985774ee2c6dd05f4659914005c4e1fc94de0683268037a71aabd82c885880235a7be86a2
SSDEEP 384:6pChsr03QM325DbpSWIC3N08ZNa8+CUFnlxAkt7Fmp4vrv7Y1EwL:6QWrSh325npHz90xCCrZxvrv7Y1Ea
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000016

Path C:\Users\Admin\AppData\Local\Temp\yr4psb1h.f1b\Default\Cache\Cache_Data\f_000016
Size 70KB
SHA256 42c629409cdb91fe048a591f990396258cb1bc076dde78008bd099050e012293
MD5 b5ea3dfcbc44075663320b28e7e9c20d
SHA1 2138d47decd4f679578b169b7dab0d2128ba8b98
SHA512 f1f9146821ea3fa84c7dcde9ef646dbaa5b8cccbd150f1f73eb280db2f8e80ce2f3df52370b02d8494da0989ad9373dc02a656b95ec5d5d59047fca854afcbee
SSDEEP 1536:n6dzyUMSNC+BG2/ia8SIinyLy512lau7GtsQqzMdfVaJkjrYGRS7pa:OyxJ+Bd8SE25clau2FqzMdf1kc
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000026

Path C:\Users\Admin\AppData\Local\Temp\yr4psb1h.f1b\Default\Cache\Cache_Data\f_000026
Size 16KB
SHA256 23cebdde3aa3c9b38e0647ae2bd6daedae2f62adee6521dbf726731d00bf14b5
MD5 fdbdb95b5ac5c4edecb625ceaccf87b5
SHA1 8da620668bc6b3ee6c2eac8c258d80afa06ead0c
SHA512 08c9c96ffa14e4be65c50bed0683a5d817ea190a493cca1119dbec30807a9e5846baa86c96dd97603620ee67c3acee2cda678cb246fdbd033aed1805aef1d2f1
SSDEEP 384:BhBYbM/UQhdWQz2xB4uINwHHKwq2Lx+J7Yj83GyEskVvyWpg5Fe:DqQUwWQz2xBrnnbNLUBYI2yEVVKWpn
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000029

Path C:\Users\Admin\AppData\Local\Temp\yr4psb1h.f1b\Default\Cache\Cache_Data\f_000029
Size 33KB
SHA256 3ff6fb4e850a17b9ed245cfd23e4354e00a96508560ecbff981fc5c54de7ecbe
MD5 a96c89b3b67e130169a6b851fafe7543
SHA1 32e302a5898b11f43a0822b33c9c5df1b980f4a5
SHA512 fd4507e0a7238622d50ecd772d89edd72eab17fac6ee36e5fc829a54fc97394e233ad219b21fe5b760a08483909b5e17445ff9d4d6f05db32d5588b53160b65c
SSDEEP 768:3y5Ihp54MtQQ0p4WJIYbl5LSTvEJlmU6Tw1yo1PL:3y5I1t0p4PYbl5GT81dyo1PL
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000036

Path C:\Users\Admin\AppData\Local\Temp\yr4psb1h.f1b\Default\Cache\Cache_Data\f_000036
Size 17KB
SHA256 fe333faeae331924f55207e6eaded3ba32070f480e8154e169b09b84554ad6a0
MD5 fe1ea89caee6e626201ba413be6e58d2
SHA1 358679cf0518f3eac97f3221009dc49d68abdb8e
SHA512 35168fe5b0f4bca2bf61cd6e667f4c4010a58061b2a0acf8b36bc963310554c24d07496a1f926b24f18ad20361e9102e1dbf9646eabb52651ac44d1983e1edb9
SSDEEP 384:fnRfPuMBan/RZ4Nan/whU8qhRJw9mCL+1uyOCP8JyRmTgXndt:53rBan/RZ4N4/N8qmmCiPfP8JyRmTgX3
MD5 SHA1 SHA512 SSDEEP

Submit Download

ExtensionActivityComp

Path C:\Users\Admin\AppData\Local\Temp\yr4psb1h.f1b\Default\ExtensionActivityComp
Size 4KB
SHA256 8c471cab38a1696289186d01b06ff6af2a888852dc18d6fb8d2a0e54898104ed
MD5 d25d5e1dc1d93430e64ee17e48ce442e
SHA1 d5c7ca9a57e6cc68927a249fe8e601d52680ac7a
SHA512 f4cff7510b4ad81090e0b1842652f8eb7995f7aefd0ce651151bc24ca3a4305d34ecae41cf193d9b846e8f6359ccf545e5d05e63e6e766fa9761ccebce620f6c
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Temp\yr4psb1h.f1b\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 186B
SHA256 18e7df7fb1440397be49b21b914a4a79a7c3f5184004bcf19aef6c73f122d6ab
MD5 932e8457da4e04e908993deeff7c81c4
SHA1 4cdc6bef3fa9bf2aaf79a2f397ea00b811079fa7
SHA512 d6428fc1e51c524455ebe7f314d3b1b058ab0f4eae6cecec4429aca1366d119b2334a4fe63a8b711e8255fe9aff770bffea1d14039d4088ac9a725be88ba32d1
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Temp\yr4psb1h.f1b\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 259B
SHA256 bfa3df593c132df801025b59137649f5139e6a3a850ceabcefcd5d54e2529eaa
MD5 b39b4fbb5b2c797377800b6c029b2f6f
SHA1 4c46e479ed24b24d228768147d42198a32c72ca7
SHA512 797e6b1e3a5254c76aa2dab22c578ebe7cde672883516ff3857c02e6d6cae4ddca5d2ffe51a68eef6e2ca8ce869de9b2ab6e91d17942b19bf43dee5cc126a42b
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Temp\yr4psb1h.f1b\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 324B
SHA256 6ddc66ea225527efa0349d4d8223f3cec817dfe17f1d61e3ef46ff97905a1eb9
MD5 c9f0c1f6a979cb2bfcb44dfc366a9906
SHA1 c2dd994e6951a708c98ecfcad6b69d317c001977
SHA512 e933863ae7af288a6f63de51ed2195944c3221cb527ec22301b1987560465efcce74ba097db4966483a5b4a10adb0a7dce1a05161f7149ef15dc4ee81d705622
MD5 SHA1 SHA512

Submit Download

index.txt~RFe5812a8.TMP

Path C:\Users\Admin\AppData\Local\Temp\yr4psb1h.f1b\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt~RFe5812a8.TMP
Size 120B
SHA256 7348b935fc77e94088f4f256416b939765ff7f665779f80da37cffefdb3c5ec2
MD5 2ad960b7f562c4c478a39bc86d2b3f65
SHA1 53a617fd2fd8c7f470a63344fc0375459b71b9dd
SHA512 0b0a79e086576c7d2bcf482aa52c478834281ba67d8f04a01e5c5358e2da1cd3374b50ed9f95c7f523c6b2ec6c3a3ae4d13c13e9dd76b5b187c54f95c8d1d7ea
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\yr4psb1h.f1b\Local State
Size 3KB
SHA256 b28e20ce2659ee0180d21ae62ab50698e73bde98ea15a44c717e577a7158d761
MD5 f72e77eb8eefe4afa594d0910ac0cbc2
SHA1 3c9fcbbfde541fb6b55335aa2b237654298ea25c
SHA512 a3e84c3ae9bf5a3f8e2966117ebae7356eb796ca41b50f60afb775fd8d8e8c33b7090bf565223b6051465a4d7bd9dcd1d20949621de4ab08c2091548ccaaf91e
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\yr4psb1h.f1b\Local State
Size 4KB
SHA256 d3463752e53ff366bb9e357e732a8a430c754c817572ed9b4b1997b79ab2883b
MD5 c107ddb9276fd82385a8038878a89ecb
SHA1 0b28e71255b33d5b1c4f5bbf81601bac0fa7d7a1
SHA512 489f06d2928c10f6fe247bb56e66acaa9026da0f26ce84acaa4bdc81641e87dbdc535786683b4d3e41e9ec6a72384bf64bdd083f3a633ab8a11f4a4e30ab5a75
SSDEEP 96:1qGNkCufRJtH58Frh/cInURoDotovRx55DOBEP1vGuM8uJJUZc3Bfa:MGNbWJgooDUwLPuOQ8KJBg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State~RFe5801ff.TMP

Path C:\Users\Admin\AppData\Local\Temp\yr4psb1h.f1b\Local State~RFe5801ff.TMP
Size 1KB
SHA256 968b7cc8609ac9b214bc39fcf42d829c2223fecf82acbde1ab83d07b30c6c8ca
MD5 89e300bdb986c3f556eb0ead0ada502a
SHA1 c6908b6d42b84c839c9ec1ace804780351d709ef
SHA512 b8cf5dd56d9b17f77572ad438a9c9076a53449b310a3bf7143e1f9ed7522377d9c3eef244994651b96a8ac95b21daa908a91b5a3eb65f82d50bdaf5c768f27b8
MD5 SHA1 SHA512

Submit Download

PMS6A730B4EP5FZBLNT4.temp

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\PMS6A730B4EP5FZBLNT4.temp
Size 4KB
SHA256 0a7f3ad168f2d9f3829f78a3c47ac04d33a921bae596171618f43cd9f172e88d
MD5 6ea9429e8b9f1b5904bf79fc9647fd29
SHA1 6474dc2ccf56752a2ea776e8d88093448a753c0f
SHA512 97d8781f5abac017abfc0191f304f048d378231371f386f4d77f30285490f871eda8faeed98bc9f805e1cff84c0f2e7c83c99ccd0d42e860e29fe18f956af309
SSDEEP 48:XKd5dOlcO9ZJ9zUoYcCPigdLXuHp9p17d5dOlcO9ZJ9zvYcCPggdLXuHps25:/JUoMPbuJ9KJvMPgIuJt
MD5 SHA1 SHA512 SSDEEP

Submit Download

ccba5a5986c77e43.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Size 4KB
SHA256 152ecfd12ddfa6b1d6a119740793a8867ccf6796899b24c2f497e4869c650424
MD5 da14d4e60ea89a2807473c39e7659f78
SHA1 999cc8ac409896b9dbb38e848cf17f78ecc7f294
SHA512 152c7f8d76b29e0c323eebef148b2573beef2dc2b24593d471ed2112ec00d326b713fe494e9215131b55facf899ab8262fe0b023b7af0874c27b177395011fe9
SSDEEP 48:pK95dOxex34x9ZJ9zUoYOxdLXuHp9pv7d5dOlcO9ZJ9zvYOkgdLXuHps25:dJUoPuJ9YJv8IuJt
MD5 SHA1 SHA512 SSDEEP

Submit Download

a29d3c53-4401-44a0-b211-a6aec1ba9ee8.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\a29d3c53-4401-44a0-b211-a6aec1ba9ee8.dmp
Size 59KB
SHA256 a4b2f56dfa7fac8ab7fc2aa4e2242690ea6e76675b180cbea546c4822731318f
MD5 b58e446925c181ea0ddaba232fba44fe
SHA1 e8608d6d2389ebba28f168295304a53566a16c32
SHA512 8edece0e9fb53787aa2f1593d7d0b4e6859d737010608e04c9bdd4fe6c0a05d5a3d19a40fc68611ce4322b105e0d9dd576d08a19c13e9b795b898a49077151ff
SSDEEP 384:+7qUJr1/Sp+W+p2++rF+GOnFlSKy82OIOImYRpK4vCadyn+PG:+Fq4B7EFKiKy8pIjL5J
MD5 SHA1 SHA512 SSDEEP

Submit Download

a29d3c53-4401-44a0-b211-a6aec1ba9ee8.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\a29d3c53-4401-44a0-b211-a6aec1ba9ee8.extra
Size 10KB
SHA256 4c3398a06005d9ee6517be3f4a569fd49726cb3a25d12e21df7043e3cd4f2b77
MD5 4f2f03f50e1cc3160fb54093ba2cb2db
SHA1 ebe04d95d2bc48f404dc1ef3f620092ece8bfaaa
SHA512 999a5df459170f210f3f3b6d659b95b5ebb545e77d5d280b8d72e48993386ae8a4db7f5ed60188d20465406a6a2a97eb1e01dd5385c8634fee13855369266afc
SSDEEP 96:STWCqTZzY6pw6lF29dt40Rh7CsevBb1d0DjMLlIrLlhTLlaXv7awutILfcBCqwv7:S56ZYb/7uvZ8PLWxsP5wlYAfoq
MD5 SHA1 SHA512 SSDEEP

Submit Download

a29d3c53-4401-44a0-b211-a6aec1ba9ee8.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\a29d3c53-4401-44a0-b211-a6aec1ba9ee8.extra
Size 10KB
SHA256 9aa01680262dd42427a8ebd69f1375756503d8a8c8f970022200bc243385fd1b
MD5 71d2868db861ada16b7055fa10288462
SHA1 f83bc3b65ed87a5edd7b698d0f78b92525b8c713
SHA512 4b3697c68cd87bae16039c746ec19c8b5056da0cf83abbc94f5abb8e5500a9f36d1a5df624442e7b94decf6247f0e874c81c588b6d4fd47248c5d8f95b524f44
SSDEEP 192:S5ccFQiR4M4DnQYapdVxzPhWBHe4T/fKNtalAAfoqbLbt9:iccFQiUDI1JWBHe4TmaXAqP
MD5 SHA1 SHA512 SSDEEP

Submit Download

bbdfb3eb-a385-4aa9-a434-84db90bf1026.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\bbdfb3eb-a385-4aa9-a434-84db90bf1026.dmp
Size 67KB
SHA256 68731f86a0b31236ffb65a870f055db60b460f71fe60f86f333bc32598932281
MD5 115500f47bfdcacfeb0e51f0aa096be3
SHA1 86e60c510b706264780a15ad25e983b83c198b1e
SHA512 88d33ad6685fc1aada83807ef325d5b027ee0049ff672fa85e46176656f2e0a433f57aa4cbd18c5015ece909bbd123259d1751d40593edfcb87a023b551e2cfb
SSDEEP 384:ujq5M07nD7JDVDSDEhgTfpKb7ZXAeQVhqbnIs2YFz4fX79dyn+PG:u4M0bnBNCSMetlQI3G/79
MD5 SHA1 SHA512 SSDEEP

Submit Download

bbdfb3eb-a385-4aa9-a434-84db90bf1026.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\bbdfb3eb-a385-4aa9-a434-84db90bf1026.extra
Size 10KB
SHA256 5f6886a27d116c6beb9768a5f8f2c0af085e4a3969afc9c454c299ebb3cd2d2c
MD5 cbf9f47aeeb9e4ad380fe1df3f756857
SHA1 f6042fbd014415c4599e9881e0eb46ec2b02ab2f
SHA512 fc04784c0aac5761c2b5d1e278acc7ccb2996ff3311a8e500e2e3bfcb8b88a66861c1671465d10ba0fb3aa47c06d6db629f4ea28fafde1b6dd622cef0458f5a2
SSDEEP 96:STWCeTZzY6pw6lF29dt40Rh7CsevBb1d0DjMLlIrLlhTLlaXv7axutILfcBCqwv6:S5mZYb/7uvZ8PLxxsP5wlLCfoe
MD5 SHA1 SHA512 SSDEEP

Submit Download

bbdfb3eb-a385-4aa9-a434-84db90bf1026.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\bbdfb3eb-a385-4aa9-a434-84db90bf1026.extra
Size 10KB
SHA256 cbcfc131e50e84f29d7ede2adceaff9da35c161941076981b0c315be8ce0f2f5
MD5 3d09395346764c30573191171f28fdb4
SHA1 50cde420490b859f6ad2b9d90526542ffce72cbd
SHA512 af287747b267d7546b0ff8f32abfe6578bad8a0a2f3cb182012960ff3acb2430cb9198dab2ff446c41096ebeec863ada2a6af71601d37904f44867a66ed259a4
SSDEEP 192:S5wcFQiR4M4DnQYapdVxzPhWBHp4T/fKNtalDCfoGbLbt9:iwcFQiUDI1JWBHp4TmaUAGP
MD5 SHA1 SHA512 SSDEEP

Submit Download

c76867e3-8350-4c45-bfae-f71b1b62bc3c.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\c76867e3-8350-4c45-bfae-f71b1b62bc3c.dmp
Size 66KB
SHA256 38f5eb03446963718cbdcc5be9e1e3ad1cac1140dbdbc6fdafcebecc106857bc
MD5 3d1634c9d63958019023240101e3e82b
SHA1 2bfd70ee01f31f7166b2e8d77afa698f2bd375bd
SHA512 e367270203e22b08f9b18963965f92737868821f1d3453563530e67195e0bbc54e15ac4b371edcd57db32e856c5f3d7647f6b02555c7164175ae173ad362bfc1
SSDEEP 384:qVe0L2FtDTsQVfpm+fn2+1OF9IfFfKmKJPrtOH38PRPiWIYw6IMmdyn+PG:qaTDTsSpmjFMwJBOXeJiWBvm
MD5 SHA1 SHA512 SSDEEP

Submit Download

c76867e3-8350-4c45-bfae-f71b1b62bc3c.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\c76867e3-8350-4c45-bfae-f71b1b62bc3c.extra
Size 10KB
SHA256 c551b1a5f89ca1d277b647790af69df268d864d3c4de624d2ae4817ab22b2fab
MD5 ab649dcefa6acb66c01d8b9fa6e46869
SHA1 1625656851a7f9dcd2412924af98d63839808dd5
SHA512 968b9231d09456db86a9e73f32f1999e18827bcad51e8f5d5b2da1f1d54ae3800e43117f5a5ebedc1a68bafc50873d55f2b34f5ebcc73902bdabcfdc98033e83
SSDEEP 96:STWCBJLTZzY6pw6lF29dt40Rh7CsevBb1d0DjMLlIrLlhTLlaXv7aXutILfcBCqm:S5BJfZYb/7uvZ8PL3xsP5wl0ofoo
MD5 SHA1 SHA512 SSDEEP

Submit Download

c76867e3-8350-4c45-bfae-f71b1b62bc3c.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\c76867e3-8350-4c45-bfae-f71b1b62bc3c.extra
Size 10KB
SHA256 89c6499ec87893dc5447c940d432191453451cf0e4476a997f2bb75a1b6cd2d0
MD5 ec072da667b13b052db1c5181d251779
SHA1 d33213f10a94a5fddcdface3f3f21da8c88153fb
SHA512 dd691bae52f9006c9cd635e8615eb60c921db23ddba66d91c2988b526ece1f82691a91831134ceee720daffd3a8e57d3e9480ca940bf03e6b4a5bdf6f5d3df12
SSDEEP 192:S5BJvcFQiR4M4DnQYapdVxzPhWBHB4T/fKNtalsofoYbLbt9:iB9cFQiUDI1JWBHB4TmajAYP
MD5 SHA1 SHA512 SSDEEP

Submit Download

cf91fe20-4326-45ce-957a-3c21a7684295.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\cf91fe20-4326-45ce-957a-3c21a7684295.dmp
Size 65KB
SHA256 54b2043ff58bea11762e83a71ba45098509d5a7ab5ea3529a958d568fdf984bb
MD5 2dd3524d3fb7bcda9fd4006822295880
SHA1 5746a34382041ad1919af44088e8bf99a51c59fe
SHA512 d31bb5ebaac18568b5ccfa822af1640713a9a2175e94a02f311055f1fa9792fd21227f50aecd0f243deeefdaa6145a3ea14baf9815eb05a5ed46b130c3892525
SSDEEP 384:kPJJQjviSCNwhODd0fxsKO5bJNvMHy4XBT+Nl9XpA6kyzp3hdyn+PG:kx2LhCTDdnf34Xt+NfpA4h
MD5 SHA1 SHA512 SSDEEP

Submit Download

cf91fe20-4326-45ce-957a-3c21a7684295.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\cf91fe20-4326-45ce-957a-3c21a7684295.extra
Size 1KB
SHA256 b57e0ee1ae2f4befa36098e117425d66ad53076550267d20062146f83859b1bf
MD5 8a65f5e4a2d617279e46ed0331f378a6
SHA1 18ba36dde2ff9da535f2984368214b15f97ea2b1
SHA512 6ee6965f08af659cd1ac33f20d2bf7daa642af3dca099040a7a1585149af803a54843d973c1d10d706cbd853afb08a563cac8f9ad9f3ee73827fa9f3ce6258f9
MD5 SHA1 SHA512

Submit Download

cf91fe20-4326-45ce-957a-3c21a7684295.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\cf91fe20-4326-45ce-957a-3c21a7684295.extra
Size 3KB
SHA256 100f2d382170adb0c4059d594f413c74204e154f72d898167a605f4085f572f9
MD5 ea5af7b5eeff4b75f4eb7661a33b1d0e
SHA1 2903b6c720b86f48b67df88bdd43beb106151876
SHA512 b7f1c9b5462d45e016867073a790683ff1170782980f9ddb01593c95363a75b6801d830a4a582453055530afda3339372ab60446de0d0106df17475fc4fe989c
MD5 SHA1 SHA512

Submit Download

compatibility.ini

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5rm9ff4w.default-release\compatibility.ini
Size 198B
SHA256 252b7fff962848c61092e82a3d87adca163849767713a93ab533bb397f1f53bb
MD5 ce9ef13caa8a74c25157b184aa038475
SHA1 db03a9935d8bb3ce6b120aca98feade536805160
SHA512 0f6f5053e78167ef5cc5fa70ed3a87dd116df0671a590299277a197341bed983e3d77e37ad2c33cd4afe880fab9ed1c7f7502210040617a01f97a81c1e1d4f29
MD5 SHA1 SHA512

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5rm9ff4w.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 8d040a80bf9cf6c66537bd7dc2428cf54c135226f56fb0718bccd502bb1f7477
MD5 2ce11091e5970288d31e34041ccbbabe
SHA1 a7f6e19ddd731b60d77fcf79079234f60a0cb9fe
SHA512 0e4804f955c6dbc405c270bd376bb62a346be3bf32d354c0c272487c9a9b73d3699584efbeb4fb0890808d9db93377659761c390cecd23c44fbeea47e14a0f38
SSDEEP 192:1fVf7Ov5zboobffCyOyjKfdbS1/66Joz0dzgCl6mSSd:1fVfkboobffBOyjKfq/66JozQzgC1b
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5rm9ff4w.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 ed5a1fad185ccc6619f933a3a82f8c2f7a38dea213558c28de2d61ef42571787
MD5 bf918e29694a3ed1d845294c6a17be72
SHA1 56e68470c4788920dbf041fa16c9c7b717ea0b36
SHA512 6489efb2851757d81ac85736e72e295a8eda34367d52fc8f9ec718e967126c0fde5b9207b9a7e32727c1f48bd3a7c85553007ce2e485e4f329599afce4e6c691
SSDEEP 192:xfVf7Ov5zbo5ZffCyOyjKfdg5S1/66Joz0dzgCl6mSSdz:xfVfkbo5ZffBOyjKfN/66JozQzgC1bd
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5rm9ff4w.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 0c0f537566afd59e7f9b4b2828d879cce7b25baebf7724e76a5a8af9627e7184
MD5 d9762cffe649bf817347ba9264fc7316
SHA1 62c1860244691f7d60f45185b3e5c29ee9d65f3e
SHA512 0f978b66c357896aff71871edd390b4536bb966c475f7165cabff02e1a1fa6d01592a91e38bcd64b21684403decfbc7cd7702eda1a194279c561a2419b66921a
SSDEEP 192:l2M1/66Joz0dzgCl6mSSdDfVf7Ov5zboHAZffCyOyjKfdgE:w2/66JozQzgC1bVfVfkbogZffBOyjKfp
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5rm9ff4w.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 b5c65ded38b9e495af83578b178fcff0cda0f86eca5724780775a1a2ddba201e
MD5 e216746da38d13a21a3e09d3f922c687
SHA1 86342f226e0b47a0e223b516cc5ced274c85d17f
SHA512 bb9d8dfd432693671dfae37d0acbb17dcd6fa35c2e792dbb01ee0ec01e3d2deb248e8f91223a47054798d48f4fa19fe2fd92528e24864a9d87c1041ce8b7bb7a
SSDEEP 192:CfVf7Ov5zboHAZffCyOyjKfdgz281/66Joz0dzgCl6mSSdz:CfVfkbogZffBOyjKfPm/66JozQzgC1bd
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5rm9ff4w.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 f1b2b53b5e0e3e3b3fab1e1d556eb3e776293beb6f24f7692c1559c34a03ac71
MD5 b6e0734a262e7471a4c6ae10e54c124e
SHA1 7d3e8ef5f5ff9b83502a852d602954e248207896
SHA512 33bb1813c73d6fdc5cf3cdb9787440ba0d21b2f9a05d69c6bff50021caab7f175faec8190e43307f00b89197ece29fdb551d88d541850a6af575d2d53cf7fe44
SSDEEP 192:vfVf7Ov5zbooMffCyOyjKfdgwo41/66Joz0dzgCl6mSSdz:vfVfkbooMffBOyjKfmS/66JozQzgC1bd
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5rm9ff4w.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 ccd6b454f852138b62592a42751bc7166abef0696e35857c18a201a4a65dd704
MD5 2268588d283fb0c6dca554c0e85e6301
SHA1 fd7d6df458428a7819021a4a2a5d70df2462b90e
SHA512 71c52d620cbdfec4900a470daa575700f290b4ce3ac942dcc8fc4164dd0a1a7b1f2c55f05faa223b38cd4aad4737d4afbf36ecfb3fbb7e2a5c6259cf5f60ab10
SSDEEP 192:GoMt1/66Joz0dzgCl6mSSdufVf7Ov5zboH1ZffCyOyjKfdgE:ju/66JozQzgC1b0fVfkboVZffBOyjKfp
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5rm9ff4w.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 c4b18bc0ab990ac85c49d408a108cda3ada07fa4f75ab086a07559d07f60e0fa
MD5 16f9185c500526e5d76d1ecee646013b
SHA1 d95c98dc8735581b8adcee1ce756f7c302c73b09
SHA512 12b5e3c6b40d370e46fbc4a966fd9b39e5a274c0c73534b38d202e99aa48aa0ec2c3ee7d6945497415030f04776d6afd0d76f94455c88b90044db7467caec74f
SSDEEP 192:tfVf7Ov5zboH1ZffCyOyjKfdgwoR1/66Joz0dzgCl6mSSdz:tfVfkboVZffBOyjKfmP/66JozQzgC1bd
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5rm9ff4w.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 6d33f19ce484b304b01499482fb77de9c13368ac40344ec265a62487bac3d4db
MD5 200be53fd16d7335acbf1ce96055c77d
SHA1 5359f3d1eb51b2fcba0c0de45eb4029a2d5e5c9f
SHA512 f0a4b1556918fe3c539cc4c2ff8630ce45a923bf847161172c2160842e64de886dbf31ef8e2dbc93a68da9975e297cfafa68884c43f5a9a9547b57700b1e62b9
SSDEEP 192:log1/66Joz0dzgCl6mSSdDfVf7Ov5zboH1ZffCyOyjKfdgE:aa/66JozQzgC1bVfVfkboVZffBOyjKfp
MD5 SHA1 SHA512 SSDEEP

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5rm9ff4w.default-release\datareporting\glean\events\events
Size 1KB
SHA256 baec93def710dc02109291d498f660af7aab1fd2825066c5118ef70842bd2b25
MD5 8cde7f8b3a352929960d7132837a0911
SHA1 21fb3e616b6271b13655708086cbee011d841ab0
SHA512 9341858b0b6671c584460d807c8e03f0eb4e58b40c47e3e57480d0f56812e6822c08c80836d41ff94ed240ed75e4227ed6962d5222392165ad12d750162da0b9
MD5 SHA1 SHA512

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5rm9ff4w.default-release\datareporting\glean\events\events
Size 1KB
SHA256 cf2d310aa589d70c7cabc6390bc99f786eef40c43b7735f544891b3ce12308ce
MD5 a8007d349b633b13c13be15b58068752
SHA1 19c53b41349d9e1f839bf43614cf34ce6bb2f27c
SHA512 3d73ca06361a10a7aba3413b7145b8e6f9b26d4036862d3e256cdf14a88e26b918548a07243a3a5bbf25c29fa33ae1f45330dc3e26020f5046cca396f7ec96ba
MD5 SHA1 SHA512

Submit Download

00c68eb3-d58a-4d8a-b676-2a9cce952b7e

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5rm9ff4w.default-release\datareporting\glean\pending_pings\00c68eb3-d58a-4d8a-b676-2a9cce952b7e
Size 16KB
SHA256 95d5bdde35c2894f2c42201fadbcdfe76b911414eeb65694c5f0a5f885b9a8b5
MD5 3df74b4e5a76c7cdaae482297f8a6460
SHA1 cac27367c545735194ea448284f1b394d5c911d9
SHA512 a858a5159c25edac43ecb6784c59f603bc44031a030a3856efc3680dc152f99c0f994fa7d81c78d7f2765429aa7f187b58b5033066b9953f09556e246ad8b828
SSDEEP 192:qPuSzxE9i0fDvA21en9BwrA6WSjqLC4h99j+uURtiD4ktMZ1jXPzKfvd7F8sr4Eu:qPuSlai0fDYFOnPWLIl4ZK+NhH8T
MD5 SHA1 SHA512 SSDEEP

Submit Download

0433e5c3-d724-47a9-8e60-8c198966f2c3

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5rm9ff4w.default-release\datareporting\glean\pending_pings\0433e5c3-d724-47a9-8e60-8c198966f2c3
Size 3KB
SHA256 6607b7f8367ce8000af66eb979fd4b31e5e9c4db8c91769bb01fe35a0ef684d0
MD5 233f648a3d3a36ed2aee8c5d7bbd9e7d
SHA1 e37db4c3e9ab99f22a2b92d0c0151e5dca2003da
SHA512 7e9ea2bf639891d41b4396e88542d16eae4b23275b91b054fee8c66555aa82f638c7e6407a1ae68d92556ca1043268f35b34ae6973c7f6d6b40d52af25e241e9
MD5 SHA1 SHA512

Submit Download

1d66a9b5-6495-4b7c-9b03-107962b65d11

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5rm9ff4w.default-release\datareporting\glean\pending_pings\1d66a9b5-6495-4b7c-9b03-107962b65d11
Size 235B
SHA256 f84d733387d67111d987adf85e252ed2463eaba7ea7201c77cf7d7536e5da487
MD5 715f18ba9f98e43ca6bca03d5e6e0f91
SHA1 4a7b77c9d1df269ce756089bfdea9966263e8dc5
SHA512 7b24c0edc2a05884bee82f9a24e14316bda5e0f428353bcdd28cf681f9d3bce69bf3a37ff988244344c17cd769dfc5844483526e0caa3d819f4385e08213966a
MD5 SHA1 SHA512

Submit Download

21b29605-086d-4302-bd8f-f4d54c734b1c

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5rm9ff4w.default-release\datareporting\glean\pending_pings\21b29605-086d-4302-bd8f-f4d54c734b1c
Size 3KB
SHA256 83a266848a594726245ee051ae426e4470671565dde0fe04eefa36196afda3b0
MD5 fe059941048e4c3c1f9c9c2f093f2e9e
SHA1 3b17fa1b9f66baae6f8d477e12ea52e5159fa79a
SHA512 2ac573d8c3bbbe5b50940664e5255daf2a6e0bf506e9f000fe16b1f9cdca1182b35970f867fce46597dfd1d54b40d136d0319a801389beca03b257f298a51b4e
MD5 SHA1 SHA512

Submit Download

2c7e670e-59de-4766-9bc1-8cd7b14ea637

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5rm9ff4w.default-release\datareporting\glean\pending_pings\2c7e670e-59de-4766-9bc1-8cd7b14ea637
Size 235B
SHA256 5e02db01621b3b89be4704ae16c740d32bac2bdcf6714d57200e195ac1b75b7e
MD5 1d5fce6a781d14e3ee83f4006fa5348e
SHA1 d6181eb36f72de5507e457f3b83ac4ad4a595088
SHA512 ce336e8f59ab65f148a3169ff73896ae6377c236959ebeeeae70a3180851c04c136a5edd49721e90696fc1a9639a2846c14686e6e4630746ae30eab6a35a7b6d
MD5 SHA1 SHA512

Submit Download

2f478a6f-ae2f-4936-af13-ba0e90ed86b3

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5rm9ff4w.default-release\datareporting\glean\pending_pings\2f478a6f-ae2f-4936-af13-ba0e90ed86b3
Size 2KB
SHA256 d1851f71634a71b7ea62d57e59bf1c22353b448580ec406232a5f77501cef16c
MD5 db137ea851e42eec06097d60af57d531
SHA1 474e396b8aa52e3675f421338bd839310f81f778
SHA512 fba7ca1ab432f6b3ddff18ceea69032df0d66ed26092b6e9eaf2e5bb5ddc677b75762c0d10306de1e822b39a0d94efbe4f9ae82584ed6a7737d68d7db65cec6b
MD5 SHA1 SHA512

Submit Download

35eedfe1-5c16-4cab-9ecf-8ed535558655

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5rm9ff4w.default-release\datareporting\glean\pending_pings\35eedfe1-5c16-4cab-9ecf-8ed535558655
Size 886B
SHA256 07d951d4625096ee408d73183dfdc610100b0c3fa5967a25b0d42255ea6dd47f
MD5 2ab31c6d0028f5827f2ca5697a5db701
SHA1 b86d77e71c5f45161d07555c7d38809321d24d7e
SHA512 830fa8f7db38263f8acd58ae3798fbb25172bc9b340bda9b1aac2734672580424d734f5ccfe6905ab31eb73b364665831de539615b30e57a2cabdf2e2845552e
MD5 SHA1 SHA512

Submit Download

39b95875-6fa1-463a-93de-d78d4724f3f9

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5rm9ff4w.default-release\datareporting\glean\pending_pings\39b95875-6fa1-463a-93de-d78d4724f3f9
Size 3KB
SHA256 2ee31f8a181b5e698efc0bec7165c3aef17eab55dddf62f5006a44f13a852a62
MD5 6ddaeb7dbc640d2d20d5a4d0d8d31fa9
SHA1 856cb059715631d137545faaa92a43f49861286e
SHA512 e1103a932195884592728e2b65001cab3a841e48b9fac3a63d3ef9af23a0c35f3c33624f941a8e8b04f20015cb7414049cd7a3e5df9f68ef446590aa21d1311f
MD5 SHA1 SHA512

Submit Download

4ae580c1-ffd3-4f35-af5f-d8db49489915

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5rm9ff4w.default-release\datareporting\glean\pending_pings\4ae580c1-ffd3-4f35-af5f-d8db49489915
Size 886B
SHA256 2b979ac9daea3d9a579f6adabee61bdfdbc7449528d1547df8a5fea3780bfe08
MD5 7ed7c83e83c122dcd98d7e2cd8c87c92
SHA1 29636362b308e911a43bb73a26f8861e3596abcf
SHA512 189202cc759d24a44815b408506cf5d7072cbda6078d81a9d9d79f2d0b5f0eee5584553cde0f510a66b9eecdf66f1ff79b6809d007604b755368d58c890dc68e
MD5 SHA1 SHA512

Submit Download

5b8053ce-ef81-4064-9232-10e19f518def

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5rm9ff4w.default-release\datareporting\glean\pending_pings\5b8053ce-ef81-4064-9232-10e19f518def
Size 3KB
SHA256 0709cac76d17d136625bc50c902fff8b6414b6010a1329f97ddb569947c13436
MD5 9a55d86cb21ea6c2cf3028a574213518
SHA1 3fb9a70ba71aff9ab9f5eb929f0038fab299914e
SHA512 7801c9cd22e9597a2fe403a2775f3159a25091ce2c169e615e579f791de7edade3904d886b25bb922c3b8142bb2ccb3cd388fe5b5a5095df11d0522f8b8c6a67
MD5 SHA1 SHA512

Submit Download

60452d3e-8f8b-4919-8eb5-318c61a5485c

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5rm9ff4w.default-release\datareporting\glean\pending_pings\60452d3e-8f8b-4919-8eb5-318c61a5485c
Size 2KB
SHA256 83c860e399b53e64cc8a932a3bb5a79d266d00bb27729427c402c1ddad08679e
MD5 4900081252ae074a1fd5a9b7fb80b469
SHA1 5e3972e40264e7fc4bd1d71792149c5b13238093
SHA512 b19dbcdc22872f32b791c9fd3ca4bf719d8c11e69f37ea2c6501349732d39dfd72f60558e4f764721246f31437c8abad36f5dd864700a91e67461384f25efc69
MD5 SHA1 SHA512

Submit Download

6709dba9-d1d8-4723-b33a-46d544e24d58

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5rm9ff4w.default-release\datareporting\glean\pending_pings\6709dba9-d1d8-4723-b33a-46d544e24d58
Size 871B
SHA256 70f59ac6681da779b2bf683456ced6d579db2528792bf4907585872054eb563c
MD5 48ed30f52648be54e18878ee65fc835f
SHA1 b62a7c4f760afc29a69641918cac67c73a8d85a8
SHA512 8c997389db665e2018cd657439c8fa9de256b9ca4cbddbd7ac30f4499dc0de9eef2f9b0b6b5c62c588d6f61f06a7df7d4d21d7809d197caed5e4792aaccffbb6
MD5 SHA1 SHA512

Submit Download

777abcf2-73bc-4275-ab13-c78c41c5be4e

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5rm9ff4w.default-release\datareporting\glean\pending_pings\777abcf2-73bc-4275-ab13-c78c41c5be4e
Size 235B
SHA256 83e7be8a2ed8068528628745a689e302c2384905c7a2797b1a32d17a066d892d
MD5 a2638ded5f915760ff2268ff98b54368
SHA1 97e3bd1be08523a5c52c9cb9eaf2cf1adfa15b8c
SHA512 c6d73ed76c982e03903d1c2b0ad947043688840059908c7f95f8c8ae084c45c02e6105ba51ae93de134b1087017e00b502fb4eecbdd546f8444b8b1c42f27229
MD5 SHA1 SHA512

Submit Download

90c6394f-27b2-476c-a419-88428cdcbf07

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5rm9ff4w.default-release\datareporting\glean\pending_pings\90c6394f-27b2-476c-a419-88428cdcbf07
Size 3KB
SHA256 dd3706c2c715f561a7e90e7f3ed2ae9ce41aabc0e8cf23db91d5144b7c11f440
MD5 db19bad832ea01607a4d6fd0ac6347c6
SHA1 d3ecb417cf7876be9b9d9d6974a3ced478c359ac
SHA512 05f561ad268018170965b194738a1457a1543df088a2eaebe2527690433a1aa0ea43d1fa6e3eae597a429358973e3837d35ef37f446e118b9ec99d6ec7bb0120
MD5 SHA1 SHA512

Submit Download

a6e6f9e8-f7e9-4545-8e57-95744e7bb089

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5rm9ff4w.default-release\datareporting\glean\pending_pings\a6e6f9e8-f7e9-4545-8e57-95744e7bb089
Size 3KB
SHA256 e07f97a35803539f5d20d2de24f550ea414d23d893537fd0132cfb8250c5f170
MD5 3481b6839a03a5ff9093604ba067396c
SHA1 8f55c8428355174f0a17e7cf7027c02fb0ef98d5
SHA512 6663c3aec756a0b48c5c187883e8a080e8c4dbb2074b60ef92df46764b783b973108b0038d23c61a1ecb703e86ef92cbfa79b3d49a912b5cff90556b7512eb9c
MD5 SHA1 SHA512

Submit Download

ae72c3a1-5d75-47f2-b794-200fa32cac86

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5rm9ff4w.default-release\datareporting\glean\pending_pings\ae72c3a1-5d75-47f2-b794-200fa32cac86
Size 883B
SHA256 a6289af0570f52fc051433fc488efc1fc3f4fe589971223fc6364b4175174a81
MD5 a7aa4249fd6fdea5146b025fd593fad1
SHA1 33112bb22f3e52ab2a761afe331836f755955ceb
SHA512 42e4b8e8195a061584abdf07da8cb0a8d1e68282048899395c9c55c7f45cde9914582ad4a2f958451d9343f7cc9ea17292bb6caf6d59c4f6d879648526007e52
MD5 SHA1 SHA512

Submit Download

b4138caa-a35d-4e65-a0bf-1297caeb939a

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5rm9ff4w.default-release\datareporting\glean\pending_pings\b4138caa-a35d-4e65-a0bf-1297caeb939a
Size 3KB
SHA256 70207be55409f0b4ce20ef35e2c59d33308c5fdf3e427ef177dc34eebc379e63
MD5 6af62e4752972d0cdb5f2730571d1d4c
SHA1 e365d265bcd0f9a46835c010ef9fe6971f27eff1
SHA512 309dadf09a9b02f9342f22851211af7b9f1c6e770da632e2e25268e2bcfb103e4ec8ce3bcc8df2b6ec9ec2bfcaff45f6c19fe984db9e9b0badb8aa64806c77d4
MD5 SHA1 SHA512

Submit Download

f76d7f77-8b9d-4ea0-902d-1486c77e1935

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5rm9ff4w.default-release\datareporting\glean\pending_pings\f76d7f77-8b9d-4ea0-902d-1486c77e1935
Size 235B
SHA256 6c83122e9fabccdee146d8b62086eb0e2365942aaa175a62b0c34a1bd12722da
MD5 9b5a4765fab5045f255cb61f0566b856
SHA1 59e2440e63358520049cab752010d594f2ccddd3
SHA512 3e0b1140780986dc2e2fada728acf1c9bf040187463c8f287a4c0af2ea7fced0d3fe485971fb17c9595b794dc66fa5537945ee891781ba3e7d4f6eb432ef1ae3
MD5 SHA1 SHA512

Submit Download

fa09b1fc-c0cb-444f-a7e6-cb0b10fde52e

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5rm9ff4w.default-release\datareporting\glean\pending_pings\fa09b1fc-c0cb-444f-a7e6-cb0b10fde52e
Size 3KB
SHA256 f35f0c35892d6882433631627175e70112e3f93e1bbccc361f3b2e2fcecac33a
MD5 b101ea4ab9b4b650e7752e7f810c1583
SHA1 fa5b62fbb6e4fafb6d5de82462557ce067d5f6da
SHA512 42c58c230324f8b7b425d86ed83f9fb6a95c94856adc206dd1c58d0b95b63c6f75641fd195c8ebc865116da218bc5826eef4f10299d579b56494f535434623e6
MD5 SHA1 SHA512

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5rm9ff4w.default-release\prefs-1.js
Size 6KB
SHA256 ce08ed879cda5c9b80e9ee3dab3b11c4f1ce60a4ca38e89b8c8da04b6586fca0
MD5 c21bfc522807f3d6b64a4612806091b8
SHA1 13ebe6cdaa3385269985b99e7aae4d56464074cd
SHA512 e6a176dec714dfe2a95cbb267c25f8997590ab9dcef8080aa48ce4e16fda3a7c84bd010e03abfe4c4217cd61146c591632b7ab4ad5ff6dac44087757ba20d96f
SSDEEP 96:xHpUTUJqGqXfKK2n+l1zSESSlhdv9jjnivH9NEBw88H8L4cnZctW:vkRXfK9+lZSSK/EBw883w
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5rm9ff4w.default-release\prefs.js
Size 6KB
SHA256 483c880581b89b9db0ce2a6a0560603725567339ad547031fd72d14ff6e392c1
MD5 7e4055044f550c11b1812386221ef8d1
SHA1 148bc19776f14a90049e5fe510a5d9d6cdea5edf
SHA512 ee8b12385f41b0703bd208b2062d03415518fffa5be13d3c4ef544741f1007ed7cef956a9b0c4ba62e100197f3f44920d1a633e1c52ad40710eea651169ad177
SSDEEP 96:xHpUTUJqGqXfKKwn71zS7SSlhdv9janivH9NEBw88H8L4cnZctW:vkRXfKL7CSSR/EBw883w
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5rm9ff4w.default-release\prefs.js
Size 6KB
SHA256 9cb38b12e56e353d2d5cc46d51f7c9d206409b8112ac41a98e2c4d06e05ea7b4
MD5 47fa329e601cb925607a3d9be29f2f96
SHA1 b455ae62a722cbdfed564764bae9ceea465fcb7e
SHA512 a3e9e8a035a540f83bb221b2df1997cdcba0f6ad2643ceb6bcdcd56b1d1ae9c0c5cbb9c80e830230f94a5a46df614205d44dcbe6ffdff248e889e051ba56a416
SSDEEP 96:xHpUTUJqGqXfKK2n+l1zSlSSlhdv9jjnivH9NEBw88H8L4cnZDRtW:vkRXfK9+lESSK/EBw88sw
MD5 SHA1 SHA512 SSDEEP

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5rm9ff4w.default-release\sessionCheckpoints.json
Size 90B
SHA256 00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2
MD5 c4ab2ee59ca41b6d6a6ea911f35bdc00
SHA1 5942cd6505fc8a9daba403b082067e1cdefdfbc4
SHA512 71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2
MD5 SHA1 SHA512

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5rm9ff4w.default-release\sessionCheckpoints.json
Size 53B
SHA256 792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da
MD5 ea8b62857dfdbd3d0be7d7e4a954ec9a
SHA1 b43bc4b3ea206a02ef8f63d5bfad0c96bf2a3b2a
SHA512 076ee83534f42563046d25086166f82e1a3ec61840c113aec67abe2d8195daa247d827d0c54e7e8f8a1bbf2d082a3763577587e84342ec160ff97905243e6d19
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Windows\SystemTemp\Crashpad\settings.dat
Size 40B
SHA256 10c73c0c440d9aec61e479047157ca3437249a9b3f1e91e0ed83d462a8599902
MD5 f124d6cc2d8ca6ae6e6dd7021cc72057
SHA1 9ea480542443ae78f5f100e44eb29dc15b9ed498
SHA512 f3f1f1821eaac3f71fda213d2617cc29b2c2f9a6bf89c051c116ecefbb83d3b1fee75a7b28d25b60828d1105b3dd1b52c45be34eccd0a039a5f400cd72a6d124
MD5 SHA1 SHA512

Submit Download

chrome_installer.log

Path C:\Windows\SystemTemp\chrome_installer.log
Size 7KB
SHA256 2c77531d55130beb637416ff2a01e62d702b703b8cf6e758c3ce74678cbdefe6
MD5 26dd39715c6fe084bb6e71230cb8a97d
SHA1 a229826b846ce89320a14f49533c49fd9e66feb4
SHA512 d23414a834a8a6a7d590fb0e69c595bcdad92e1b513bf6f59d431f2da63c62080c2becc67389e0fc0b40c4ce769bd1161d3669c5c57352cdfecac8bc6fa9fbde
SSDEEP 192:iiHOWWphph2i6IWtqs7xql6xCY3r7vP7X4X4bcd1RKa:iiHOWWvv2i6IWtbxql6xCY3r7vP7IIbM
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1984-27-0x0000000004AA0000-0x0000000007B32000-memory.dmp

Download

memory/1984-28-0x0000000074375000-0x0000000074376000-memory.dmp

Download

memory/1984-29-0x0000000004AA0000-0x0000000007B32000-memory.dmp

Download

memory/4692-75-0x000001990AE80000-0x000001990AF07000-memory.dmp

Download

memory/5344-49-0x0000000038210000-0x0000000038286000-memory.dmp

Download

memory/5344-50-0x00000000381B0000-0x0000000038200000-memory.dmp

Download

memory/5344-44-0x00000000376E0000-0x0000000037C86000-memory.dmp

Download

memory/5344-45-0x0000000037E10000-0x0000000037E76000-memory.dmp

Download

memory/5344-46-0x0000000037F10000-0x0000000037FC2000-memory.dmp

Download

memory/5344-48-0x0000000037FC0000-0x0000000038182000-memory.dmp

Download

memory/5344-42-0x0000000000490000-0x00000000017A7000-memory.dmp

Download

memory/5344-43-0x0000000000490000-0x000000000054E000-memory.dmp

Download

memory/5344-51-0x0000000038290000-0x00000000387BC000-memory.dmp

Download

memory/5344-52-0x0000000038920000-0x000000003893E000-memory.dmp

Download

memory/5344-30-0x00000000017B0000-0x0000000004842000-memory.dmp

Download

memory/5344-145-0x00000000017B0000-0x0000000004842000-memory.dmp

Download

memory/5344-3177-0x0000000034E20000-0x0000000034E42000-memory.dmp

Download

memory/5344-3178-0x0000000038E60000-0x00000000391B7000-memory.dmp

Download

memory/5344-3183-0x0000000039C50000-0x0000000039CE2000-memory.dmp

Download

memory/5344-3184-0x0000000038970000-0x000000003897A000-memory.dmp

Download