phantom_stealer | 68358632af8885e3e550eb075c1bc1b2f38e2366fc8e2c19c8fb065865b174c3

Analysis

max time kernel
148s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20251016-en
resource tags

arch:x64arch:x86image:win10v2004-20251016-enlocale:en-usos:windows10-2004-x64system
submitted
01/12/2025, 16:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
comprobante-swift.0078-887.001_pdf.exe
Size 1.2MB
Sample251201-vgxpdatlcr
SHA256 68358632af8885e3e550eb075c1bc1b2f38e2366fc8e2c19c8fb065865b174c3
MD5 a848d737c34fc0a40696347089efa6ce
SHA1 0735cd36b4f17312b8ad79d06f0cd9cfafa5aa5e
SHA512 301442b013e21f23b0e793eb1d9e8536853a5c9ad4ae6c783b6b6aca60626f20a2736eed8819a8b850ee83ecb976793e2519118a825de8fccfda4c798e78e341
SSDEEP 24576:ZDC6EZ2f1j42HTb94t3KsM58SqMhbjVUYoSSMVgf/TV+L:Zf19dI3K4SqMBjtSQs/TgL
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

collection discovery phantom_stealer persistence stealer

Malware Config

Extracted

Family

phantom_stealer

Version

v3.5.0

https://api.telegram.org/bot8072853303:AAGghafG-r5USRhbAxPCKYRIj0BdxMT-V8E/sendMessage?chat_id=7899117178

Mutex

KILRDF9ZMHFX38W2R8IE

Attributes

anti_analysis
0
cb_enables_ssl
0
debug
0
keylogger
1
start_delay
0
startup
0

Signatures

Detects PhantomStealer payload 1 IoCs

resource	yara_rule
behavioral1/memory/4384-9-0x0000000000400000-0x00000000004BE000-memory.dmp	family_phantomstealer

PhantomStealer
Phantom Stealer is a stealer written in C#, forked from the Stealerium family.
stealer phantom_stealer
Phantom_stealer family
phantom_stealer

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-139171303-3954714288-23435696-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-139171303-3954714288-23435696-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-139171303-3954714288-23435696-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
332	icanhazip.com

SmartAssembly .NET packer 1 IoCs

Detects SmartAssembly .NET packer.

resource	yara_rule
behavioral1/memory/2152-6-0x0000000005DE0000-0x0000000005DEE000-memory.dmp	SmartAssembly

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2152 set thread context of 4384	2152	comprobante-swift.0078-887.001_pdf.exe	90

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Crashpad\settings.dat	chrmstp.exe
File opened for modification	C:\Program Files\chrome_installer.log	chrmstp.exe
File opened for modification	C:\Program Files\Crashpad\metadata	chrmstp.exe
File opened for modification	C:\Program Files\Crashpad\settings.dat	chrmstp.exe
File opened for modification	C:\Program Files\chrome_installer.log	chrmstp.exe
File opened for modification	C:\Program Files\Crashpad\metadata	chrmstp.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	comprobante-swift.0078-887.001_pdf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe

Checks processor information in registry 2 TTPs 44 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	RegSvcs.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	RegSvcs.exe

Enumerates system info in registry 2 TTPs 12 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134090819255818672"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	chrmstp.exe
Key created	\REGISTRY\USER\S-1-5-21-139171303-3954714288-23435696-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-139171303-3954714288-23435696-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2152	comprobante-swift.0078-887.001_pdf.exe
2152	comprobante-swift.0078-887.001_pdf.exe
4384	RegSvcs.exe
4384	RegSvcs.exe
2364	chrome.exe
2364	chrome.exe
4384	RegSvcs.exe
4384	RegSvcs.exe
4384	RegSvcs.exe
4384	RegSvcs.exe
4384	RegSvcs.exe
4384	RegSvcs.exe
4384	RegSvcs.exe
4384	RegSvcs.exe
4384	RegSvcs.exe
4384	RegSvcs.exe
5272	firefox.exe
5272	firefox.exe
5272	firefox.exe
5272	firefox.exe
5272	firefox.exe
5272	firefox.exe
5272	firefox.exe
5272	firefox.exe
5272	firefox.exe
5272	firefox.exe
5272	firefox.exe
5272	firefox.exe
5272	firefox.exe
5272	firefox.exe
5272	firefox.exe
5272	firefox.exe
5272	firefox.exe
4384	RegSvcs.exe
4384	RegSvcs.exe
4384	RegSvcs.exe
4384	RegSvcs.exe
4384	RegSvcs.exe
4384	RegSvcs.exe
4384	RegSvcs.exe
4384	RegSvcs.exe
4384	RegSvcs.exe
4384	RegSvcs.exe
4384	RegSvcs.exe
4384	RegSvcs.exe
4384	RegSvcs.exe
4384	RegSvcs.exe
4384	RegSvcs.exe
4384	RegSvcs.exe
4384	RegSvcs.exe
4384	RegSvcs.exe
4384	RegSvcs.exe
6404	firefox.exe
6404	firefox.exe
6404	firefox.exe
6404	firefox.exe
6404	firefox.exe
6404	firefox.exe
6404	firefox.exe
6404	firefox.exe
6404	firefox.exe
6404	firefox.exe
6404	firefox.exe
6404	firefox.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeDebugPrivilege	2152	comprobante-swift.0078-887.001_pdf.exe
Token: SeDebugPrivilege	4384	RegSvcs.exe
Token: SeShutdownPrivilege	2364	chrome.exe
Token: SeCreatePagefilePrivilege	2364	chrome.exe
Token: SeShutdownPrivilege	2364	chrome.exe
Token: SeCreatePagefilePrivilege	2364	chrome.exe
Token: SeShutdownPrivilege	2364	chrome.exe
Token: SeCreatePagefilePrivilege	2364	chrome.exe
Token: SeShutdownPrivilege	2364	chrome.exe
Token: SeCreatePagefilePrivilege	2364	chrome.exe
Token: SeShutdownPrivilege	6140	chrome.exe
Token: SeCreatePagefilePrivilege	6140	chrome.exe

Suspicious use of FindShellTrayWindow 47 IoCs

pid	Process
2364	chrome.exe
2364	chrome.exe
5308	chrmstp.exe
5272	firefox.exe
5272	firefox.exe
5272	firefox.exe
5272	firefox.exe
5272	firefox.exe
5272	firefox.exe
5272	firefox.exe
5272	firefox.exe
5272	firefox.exe
5272	firefox.exe
5272	firefox.exe
5272	firefox.exe
5272	firefox.exe
5272	firefox.exe
5272	firefox.exe
5272	firefox.exe
5272	firefox.exe
5272	firefox.exe
5272	firefox.exe
5272	firefox.exe
3780	msedge.exe
2468	msedge.exe
6404	firefox.exe
6404	firefox.exe
6404	firefox.exe
6404	firefox.exe
6404	firefox.exe
6404	firefox.exe
6404	firefox.exe
6404	firefox.exe
6404	firefox.exe
6404	firefox.exe
6404	firefox.exe
6404	firefox.exe
6404	firefox.exe
6404	firefox.exe
6404	firefox.exe
6404	firefox.exe
6404	firefox.exe
6404	firefox.exe
6404	firefox.exe
6404	firefox.exe
6140	chrome.exe
6140	chrome.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
5272	firefox.exe
6404	firefox.exe
4384	RegSvcs.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2152 wrote to memory of 4384	2152	comprobante-swift.0078-887.001_pdf.exe	90
PID 2152 wrote to memory of 4384	2152	comprobante-swift.0078-887.001_pdf.exe	90
PID 2152 wrote to memory of 4384	2152	comprobante-swift.0078-887.001_pdf.exe	90
PID 2152 wrote to memory of 4384	2152	comprobante-swift.0078-887.001_pdf.exe	90
PID 2152 wrote to memory of 4384	2152	comprobante-swift.0078-887.001_pdf.exe	90
PID 4384 wrote to memory of 2364	4384	RegSvcs.exe	91
PID 2364 wrote to memory of 4064	2364	chrome.exe	92
PID 2364 wrote to memory of 4672	2364	chrome.exe	93
PID 2364 wrote to memory of 5476	2364	chrome.exe	94
PID 2364 wrote to memory of 4736	2364	chrome.exe	95
PID 2364 wrote to memory of 1464	2364	chrome.exe	96
PID 2364 wrote to memory of 1668	2364	chrome.exe	97
PID 2364 wrote to memory of 2588	2364	chrome.exe	98
PID 2364 wrote to memory of 2640	2364	chrome.exe	99
PID 2364 wrote to memory of 552	2364	chrome.exe	100
PID 2364 wrote to memory of 3892	2364	chrome.exe	101
PID 2364 wrote to memory of 2492	2364	chrome.exe	102
PID 4384 wrote to memory of 5476	4384	RegSvcs.exe	94
PID 4384 wrote to memory of 5476	4384	RegSvcs.exe	94
PID 2364 wrote to memory of 3620	2364	chrome.exe	103
PID 4384 wrote to memory of 4672	4384	RegSvcs.exe	93
PID 4384 wrote to memory of 4672	4384	RegSvcs.exe	93
PID 4384 wrote to memory of 4064	4384	RegSvcs.exe	92
PID 4384 wrote to memory of 4064	4384	RegSvcs.exe	92
PID 4384 wrote to memory of 4736	4384	RegSvcs.exe	95
PID 4384 wrote to memory of 4736	4384	RegSvcs.exe	95
PID 4384 wrote to memory of 1668	4384	RegSvcs.exe	97
PID 4384 wrote to memory of 1668	4384	RegSvcs.exe	97
PID 4384 wrote to memory of 2364	4384	RegSvcs.exe	91
PID 4384 wrote to memory of 2364	4384	RegSvcs.exe	91
PID 4384 wrote to memory of 2640	4384	RegSvcs.exe	99
PID 4384 wrote to memory of 2640	4384	RegSvcs.exe	99
PID 4384 wrote to memory of 552	4384	RegSvcs.exe	100
PID 4384 wrote to memory of 552	4384	RegSvcs.exe	100
PID 4384 wrote to memory of 5476	4384	RegSvcs.exe	94
PID 4384 wrote to memory of 5476	4384	RegSvcs.exe	94
PID 4384 wrote to memory of 3892	4384	RegSvcs.exe	101
PID 4384 wrote to memory of 3892	4384	RegSvcs.exe	101
PID 4384 wrote to memory of 4672	4384	RegSvcs.exe	93
PID 4384 wrote to memory of 4672	4384	RegSvcs.exe	93
PID 4384 wrote to memory of 4064	4384	RegSvcs.exe	92
PID 4384 wrote to memory of 4064	4384	RegSvcs.exe	92
PID 4384 wrote to memory of 4736	4384	RegSvcs.exe	95
PID 4384 wrote to memory of 4736	4384	RegSvcs.exe	95
PID 4384 wrote to memory of 2492	4384	RegSvcs.exe	102
PID 4384 wrote to memory of 2492	4384	RegSvcs.exe	102
PID 4384 wrote to memory of 1668	4384	RegSvcs.exe	97
PID 4384 wrote to memory of 1668	4384	RegSvcs.exe	97
PID 4384 wrote to memory of 2364	4384	RegSvcs.exe	91
PID 4384 wrote to memory of 2364	4384	RegSvcs.exe	91
PID 4384 wrote to memory of 2640	4384	RegSvcs.exe	99
PID 4384 wrote to memory of 2640	4384	RegSvcs.exe	99
PID 4384 wrote to memory of 552	4384	RegSvcs.exe	100
PID 4384 wrote to memory of 552	4384	RegSvcs.exe	100
PID 4384 wrote to memory of 5476	4384	RegSvcs.exe	94
PID 4384 wrote to memory of 5476	4384	RegSvcs.exe	94
PID 4384 wrote to memory of 3892	4384	RegSvcs.exe	101
PID 4384 wrote to memory of 3892	4384	RegSvcs.exe	101
PID 4384 wrote to memory of 4672	4384	RegSvcs.exe	93
PID 4384 wrote to memory of 4672	4384	RegSvcs.exe	93
PID 4384 wrote to memory of 4064	4384	RegSvcs.exe	92
PID 4384 wrote to memory of 4064	4384	RegSvcs.exe	92
PID 4384 wrote to memory of 4736	4384	RegSvcs.exe	95
PID 4384 wrote to memory of 4736	4384	RegSvcs.exe	95

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-139171303-3954714288-23435696-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-139171303-3954714288-23435696-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\comprobante-swift.0078-887.001_pdf.exe
"C:\Users\Admin\AppData\Local\Temp\comprobante-swift.0078-887.001_pdf.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2152
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - outlook_office_path
  - outlook_win_path
  PID:4384
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\edgct5eo.ab0"
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2364
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\edgct5eo.ab0 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\edgct5eo.ab0\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\edgct5eo.ab0 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffc6081dcf8,0x7ffc6081dd04,0x7ffc6081dd10
      4⤵
      PID:4064
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\edgct5eo.ab0" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=1976,i,12812595739393100975,17965014675537378076,262144 --variations-seed-version --mojo-platform-channel-handle=1972 /prefetch:2
      4⤵
      PID:4672
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\edgct5eo.ab0" --field-trial-handle=2000,i,12812595739393100975,17965014675537378076,262144 --variations-seed-version --mojo-platform-channel-handle=2040 /prefetch:3
      4⤵
      PID:5476
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\edgct5eo.ab0" --field-trial-handle=2152,i,12812595739393100975,17965014675537378076,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:8
      4⤵
      PID:4736
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\edgct5eo.ab0" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=2764,i,12812595739393100975,17965014675537378076,262144 --variations-seed-version --mojo-platform-channel-handle=2776 /prefetch:1
      4⤵
      PID:1464
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\edgct5eo.ab0" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=2780,i,12812595739393100975,17965014675537378076,262144 --variations-seed-version --mojo-platform-channel-handle=2808 /prefetch:1
      4⤵
      PID:1668
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\edgct5eo.ab0" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3340,i,12812595739393100975,17965014675537378076,262144 --variations-seed-version --mojo-platform-channel-handle=3348 /prefetch:1
      4⤵
      PID:2588
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\edgct5eo.ab0" --extension-process --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=3376,i,12812595739393100975,17965014675537378076,262144 --variations-seed-version --mojo-platform-channel-handle=3380 /prefetch:2
      4⤵
      PID:2640
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\edgct5eo.ab0" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=3408,i,12812595739393100975,17965014675537378076,262144 --variations-seed-version --mojo-platform-channel-handle=3388 /prefetch:1
      4⤵
      PID:552
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\edgct5eo.ab0" --extension-process --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=3436,i,12812595739393100975,17965014675537378076,262144 --variations-seed-version --mojo-platform-channel-handle=3416 /prefetch:2
      4⤵
      PID:3892
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\edgct5eo.ab0" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=4076,i,12812595739393100975,17965014675537378076,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:1
      4⤵
      PID:2492
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\edgct5eo.ab0" --field-trial-handle=4192,i,12812595739393100975,17965014675537378076,262144 --variations-seed-version --mojo-platform-channel-handle=4208 /prefetch:8
      4⤵
      PID:3620
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\edgct5eo.ab0" --field-trial-handle=4904,i,12812595739393100975,17965014675537378076,262144 --variations-seed-version --mojo-platform-channel-handle=4864 /prefetch:8
      4⤵
      PID:5852
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\edgct5eo.ab0" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=4972,i,12812595739393100975,17965014675537378076,262144 --variations-seed-version --mojo-platform-channel-handle=4948 /prefetch:1
      4⤵
      PID:5496
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\edgct5eo.ab0" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=4996,i,12812595739393100975,17965014675537378076,262144 --variations-seed-version --mojo-platform-channel-handle=4980 /prefetch:1
      4⤵
      PID:5400
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\edgct5eo.ab0" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=5016,i,12812595739393100975,17965014675537378076,262144 --variations-seed-version --mojo-platform-channel-handle=5060 /prefetch:1
      4⤵
      PID:5996
  - - C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
      4⤵
      Drops file in Program Files directory
      PID:2568
    - - C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x268,0x26c,0x270,0x244,0x274,0x7ff789021f58,0x7ff789021f64,0x7ff789021f70
        5⤵
        Drops file in Program Files directory
        
        PID:1444
    - - C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\initial_preferences" --create-shortcuts=1 --install-level=0
        5⤵
        Drops file in Program Files directory
        Modifies registry class
        Suspicious use of FindShellTrayWindow
        
        PID:5308
      - C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x26c,0x270,0x274,0x248,0x278,0x7ff789021f58,0x7ff789021f64,0x7ff789021f70
        6⤵
        Drops file in Program Files directory
        
        PID:4888
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\xpqte3ft.abm"
    3⤵
    PID:4440
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir=C:\Users\Admin\AppData\Local\Temp\xpqte3ft.abm
      4⤵
      Checks processor information in registry
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:5272
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2012 -prefsLen 27099 -prefMapHandle 2016 -prefMapSize 270279 -ipcHandle 2092 -initialChannelId {c43a5081-1e5c-4c9d-8f41-8524061f07cf} -parentPid 5272 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5272" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
        5⤵
        
        PID:452
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2360 -prefsLen 27135 -prefMapHandle 1968 -prefMapSize 270279 -ipcHandle 2572 -initialChannelId {92b1b787-b029-4f1e-8a6f-2926d9092f82} -parentPid 5272 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5272" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
        5⤵
        
        PID:5132
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\178bd046-6f43-42e7-b7c8-a795eabe70bb.dmp"
        5⤵
        
        PID:2908
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2312 -prefsLen 27135 -prefMapHandle 2868 -prefMapSize 270279 -ipcHandle 2872 -initialChannelId {55bf9576-2757-4b17-8863-36e092c5704f} -parentPid 5272 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5272" -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 gpu
        5⤵
        
        PID:4024
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\77586556-3b78-469e-a88a-d1f70b222760.dmp"
        5⤵
        
        PID:1596
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2872 -prefsLen 27135 -prefMapHandle 2952 -prefMapSize 270279 -ipcHandle 2000 -initialChannelId {d3b08f70-23bc-459d-8bcb-55e1e18f7a4d} -parentPid 5272 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5272" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 gpu
        5⤵
        
        PID:5032
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 1520 -prefsLen 27325 -prefMapHandle 3712 -prefMapSize 270279 -jsInitHandle 3716 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3724 -initialChannelId {1b7eeb2d-f9be-4b6e-b6aa-9ed00df60282} -parentPid 5272 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5272" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
        5⤵
        Checks processor information in registry
        
        PID:4572
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\1aa689fc-375f-4e2b-a45c-b03c35acb4c3.dmp"
        5⤵
        
        PID:376
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2000 -prefsLen 27325 -prefMapHandle 3776 -prefMapSize 270279 -ipcHandle 3800 -initialChannelId {82bdf8fa-cfd2-402a-a5bb-74ca692b5e4a} -parentPid 5272 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5272" -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 gpu
        5⤵
        
        PID:3316
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\d9b69427-c333-473b-80b2-fc42bb7ec4ad.dmp"
        5⤵
        
        PID:2468
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4288 -prefsLen 27325 -prefMapHandle 4284 -prefMapSize 270279 -ipcHandle 4276 -initialChannelId {5e121496-7069-4ed7-b9e0-38566170f605} -parentPid 5272 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5272" -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 rdd
        5⤵
        
        PID:5560
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 1676 -prefsLen 34824 -prefMapHandle 3228 -prefMapSize 270279 -jsInitHandle 1672 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2804 -initialChannelId {53c84700-f0ed-47ea-8324-11912c308b1b} -parentPid 5272 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5272" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
        5⤵
        Checks processor information in registry
        
        PID:2672
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4880 -prefsLen 35012 -prefMapHandle 4884 -prefMapSize 270279 -ipcHandle 5052 -initialChannelId {24cfbd47-5210-4a70-832f-f19d6d79f559} -parentPid 5272 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5272" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 utility
        5⤵
        Checks processor information in registry
        
        PID:3456
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2712 -prefsLen 32900 -prefMapHandle 2768 -prefMapSize 270279 -jsInitHandle 5240 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5248 -initialChannelId {d7a44b58-f341-4119-ab72-b29e6bc2041e} -parentPid 5272 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5272" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
        5⤵
        Checks processor information in registry
        
        PID:6140
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5268 -prefsLen 32900 -prefMapHandle 5272 -prefMapSize 270279 -jsInitHandle 5276 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5284 -initialChannelId {262aabc2-5981-46ae-bd05-889b30f62cf8} -parentPid 5272 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5272" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
        5⤵
        Checks processor information in registry
        
        PID:5056
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5652 -prefsLen 32900 -prefMapHandle 5656 -prefMapSize 270279 -jsInitHandle 5660 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5680 -initialChannelId {a10f2a3d-870e-4ae7-85f2-86eebddd7a17} -parentPid 5272 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5272" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
        5⤵
        Checks processor information in registry
        
        PID:4836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cictlipj.b0m"
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious use of FindShellTrayWindow
    PID:3780
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\cictlipj.b0m /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\cictlipj.b0m\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x238,0x23c,0x240,0x234,0x24c,0x7ffc5eb1f208,0x7ffc5eb1f214,0x7ffc5eb1f220
      4⤵
      PID:2160
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cictlipj.b0m" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --field-trial-handle=2160,i,16497925658053289392,3319245787824993573,262144 --variations-seed-version --mojo-platform-channel-handle=2156 /prefetch:2
      4⤵
      PID:6048
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cictlipj.b0m" --always-read-main-dll --field-trial-handle=1856,i,16497925658053289392,3319245787824993573,262144 --variations-seed-version --mojo-platform-channel-handle=2164 /prefetch:3
      4⤵
      PID:3100
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cictlipj.b0m" --always-read-main-dll --field-trial-handle=2284,i,16497925658053289392,3319245787824993573,262144 --variations-seed-version --mojo-platform-channel-handle=2224 /prefetch:8
      4⤵
      PID:2392
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cictlipj.b0m" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3168,i,16497925658053289392,3319245787824993573,262144 --variations-seed-version --mojo-platform-channel-handle=3204 /prefetch:1
      4⤵
      PID:1400
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cictlipj.b0m" --instant-process --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3164,i,16497925658053289392,3319245787824993573,262144 --variations-seed-version --mojo-platform-channel-handle=3252 /prefetch:1
      4⤵
      PID:2016
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cictlipj.b0m" --always-read-main-dll --field-trial-handle=3460,i,16497925658053289392,3319245787824993573,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:8
      4⤵
      PID:2340
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cictlipj.b0m" --always-read-main-dll --field-trial-handle=3468,i,16497925658053289392,3319245787824993573,262144 --variations-seed-version --mojo-platform-channel-handle=3132 /prefetch:8
      4⤵
      PID:5892
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cictlipj.b0m" --always-read-main-dll --field-trial-handle=3484,i,16497925658053289392,3319245787824993573,262144 --variations-seed-version --mojo-platform-channel-handle=3820 /prefetch:8
      4⤵
      PID:4656
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cictlipj.b0m" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --field-trial-handle=3588,i,16497925658053289392,3319245787824993573,262144 --variations-seed-version --mojo-platform-channel-handle=3856 /prefetch:1
      4⤵
      PID:3008
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cictlipj.b0m" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --field-trial-handle=3604,i,16497925658053289392,3319245787824993573,262144 --variations-seed-version --mojo-platform-channel-handle=3708 /prefetch:2
      4⤵
      PID:1644
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cictlipj.b0m" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --field-trial-handle=3664,i,16497925658053289392,3319245787824993573,262144 --variations-seed-version --mojo-platform-channel-handle=3884 /prefetch:1
      4⤵
      PID:5080
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cictlipj.b0m" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --field-trial-handle=3712,i,16497925658053289392,3319245787824993573,262144 --variations-seed-version --mojo-platform-channel-handle=3904 /prefetch:2
      4⤵
      PID:4060
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cictlipj.b0m" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --field-trial-handle=3724,i,16497925658053289392,3319245787824993573,262144 --variations-seed-version --mojo-platform-channel-handle=3960 /prefetch:1
      4⤵
      PID:5112
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cictlipj.b0m" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --field-trial-handle=3752,i,16497925658053289392,3319245787824993573,262144 --variations-seed-version --mojo-platform-channel-handle=3980 /prefetch:2
      4⤵
      PID:4208
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cictlipj.b0m" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --field-trial-handle=3796,i,16497925658053289392,3319245787824993573,262144 --variations-seed-version --mojo-platform-channel-handle=3988 /prefetch:1
      4⤵
      PID:2680
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cictlipj.b0m" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --field-trial-handle=3848,i,16497925658053289392,3319245787824993573,262144 --variations-seed-version --mojo-platform-channel-handle=4028 /prefetch:2
      4⤵
      PID:5484
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cictlipj.b0m" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --field-trial-handle=3828,i,16497925658053289392,3319245787824993573,262144 --variations-seed-version --mojo-platform-channel-handle=4036 /prefetch:1
      4⤵
      PID:4724
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cictlipj.b0m" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --field-trial-handle=3876,i,16497925658053289392,3319245787824993573,262144 --variations-seed-version --mojo-platform-channel-handle=3152 /prefetch:2
      4⤵
      PID:3480
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cictlipj.b0m" --always-read-main-dll --field-trial-handle=5032,i,16497925658053289392,3319245787824993573,262144 --variations-seed-version --mojo-platform-channel-handle=5044 /prefetch:8
      4⤵
      PID:2256
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cictlipj.b0m" --always-read-main-dll --field-trial-handle=5324,i,16497925658053289392,3319245787824993573,262144 --variations-seed-version --mojo-platform-channel-handle=4552 /prefetch:8
      4⤵
      PID:1296
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cictlipj.b0m" --always-read-main-dll --field-trial-handle=5440,i,16497925658053289392,3319245787824993573,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:8
      4⤵
      PID:1220
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --no-sandbox --mute-audio --onnx-enabled-for-ee --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cictlipj.b0m" --always-read-main-dll --field-trial-handle=5460,i,16497925658053289392,3319245787824993573,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:8
      4⤵
      PID:1308
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rvhbc0wl.ysf"
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious use of FindShellTrayWindow
    PID:2468
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\rvhbc0wl.ysf /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\rvhbc0wl.ysf\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffc5eb1f208,0x7ffc5eb1f214,0x7ffc5eb1f220
      4⤵
      PID:4604
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rvhbc0wl.ysf" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --field-trial-handle=2424,i,2698423600938450119,9967042237411811984,262144 --variations-seed-version --mojo-platform-channel-handle=2420 /prefetch:2
      4⤵
      PID:2316
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rvhbc0wl.ysf" --always-read-main-dll --field-trial-handle=1852,i,2698423600938450119,9967042237411811984,262144 --variations-seed-version --mojo-platform-channel-handle=2428 /prefetch:3
      4⤵
      PID:516
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rvhbc0wl.ysf" --always-read-main-dll --field-trial-handle=1928,i,2698423600938450119,9967042237411811984,262144 --variations-seed-version --mojo-platform-channel-handle=2464 /prefetch:8
      4⤵
      PID:2476
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rvhbc0wl.ysf" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3048,i,2698423600938450119,9967042237411811984,262144 --variations-seed-version --mojo-platform-channel-handle=3008 /prefetch:1
      4⤵
      PID:3700
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rvhbc0wl.ysf" --instant-process --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3060,i,2698423600938450119,9967042237411811984,262144 --variations-seed-version --mojo-platform-channel-handle=3056 /prefetch:1
      4⤵
      PID:3500
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rvhbc0wl.ysf" --always-read-main-dll --field-trial-handle=3496,i,2698423600938450119,9967042237411811984,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:8
      4⤵
      PID:3156
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rvhbc0wl.ysf" --always-read-main-dll --field-trial-handle=3492,i,2698423600938450119,9967042237411811984,262144 --variations-seed-version --mojo-platform-channel-handle=3016 /prefetch:8
      4⤵
      PID:2628
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rvhbc0wl.ysf" --always-read-main-dll --field-trial-handle=3536,i,2698423600938450119,9967042237411811984,262144 --variations-seed-version --mojo-platform-channel-handle=3692 /prefetch:8
      4⤵
      PID:900
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rvhbc0wl.ysf" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --field-trial-handle=3552,i,2698423600938450119,9967042237411811984,262144 --variations-seed-version --mojo-platform-channel-handle=3720 /prefetch:1
      4⤵
      PID:1112
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rvhbc0wl.ysf" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --field-trial-handle=3664,i,2698423600938450119,9967042237411811984,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:2
      4⤵
      PID:4940
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rvhbc0wl.ysf" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --field-trial-handle=3548,i,2698423600938450119,9967042237411811984,262144 --variations-seed-version --mojo-platform-channel-handle=3788 /prefetch:1
      4⤵
      PID:3760
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rvhbc0wl.ysf" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --field-trial-handle=3696,i,2698423600938450119,9967042237411811984,262144 --variations-seed-version --mojo-platform-channel-handle=3680 /prefetch:2
      4⤵
      PID:1596
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rvhbc0wl.ysf" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --field-trial-handle=3740,i,2698423600938450119,9967042237411811984,262144 --variations-seed-version --mojo-platform-channel-handle=3860 /prefetch:1
      4⤵
      PID:1688
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rvhbc0wl.ysf" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --field-trial-handle=3760,i,2698423600938450119,9967042237411811984,262144 --variations-seed-version --mojo-platform-channel-handle=3868 /prefetch:2
      4⤵
      PID:2908
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rvhbc0wl.ysf" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --field-trial-handle=3776,i,2698423600938450119,9967042237411811984,262144 --variations-seed-version --mojo-platform-channel-handle=3896 /prefetch:1
      4⤵
      PID:3968
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rvhbc0wl.ysf" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --field-trial-handle=3912,i,2698423600938450119,9967042237411811984,262144 --variations-seed-version --mojo-platform-channel-handle=3752 /prefetch:2
      4⤵
      PID:6024
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rvhbc0wl.ysf" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --field-trial-handle=3908,i,2698423600938450119,9967042237411811984,262144 --variations-seed-version --mojo-platform-channel-handle=3972 /prefetch:1
      4⤵
      PID:548
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rvhbc0wl.ysf" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --field-trial-handle=3976,i,2698423600938450119,9967042237411811984,262144 --variations-seed-version --mojo-platform-channel-handle=3984 /prefetch:2
      4⤵
      PID:3896
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rvhbc0wl.ysf" --always-read-main-dll --field-trial-handle=4044,i,2698423600938450119,9967042237411811984,262144 --variations-seed-version --mojo-platform-channel-handle=2904 /prefetch:8
      4⤵
      PID:4580
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rvhbc0wl.ysf" --always-read-main-dll --field-trial-handle=3692,i,2698423600938450119,9967042237411811984,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:8
      4⤵
      PID:3096
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rvhbc0wl.ysf" --always-read-main-dll --field-trial-handle=4264,i,2698423600938450119,9967042237411811984,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:8
      4⤵
      PID:3688
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --no-sandbox --mute-audio --onnx-enabled-for-ee --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rvhbc0wl.ysf" --always-read-main-dll --field-trial-handle=3532,i,2698423600938450119,9967042237411811984,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:8
      4⤵
      PID:3092
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\v1a5lije.03x"
    3⤵
    PID:6384
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir=C:\Users\Admin\AppData\Local\Temp\v1a5lije.03x
      4⤵
      Checks processor information in registry
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:6404
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1984 -prefsLen 27099 -prefMapHandle 1988 -prefMapSize 270331 -ipcHandle 2076 -initialChannelId {e3b52554-c138-438d-bc3e-fc74f67bd428} -parentPid 6404 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6404" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
        5⤵
        
        PID:6620
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2080 -prefsLen 27135 -prefMapHandle 2324 -prefMapSize 270331 -ipcHandle 2440 -initialChannelId {99f6b117-3664-4d9c-9feb-656f065c8d52} -parentPid 6404 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6404" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
        5⤵
        
        PID:6680
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\a231622c-2183-4656-9493-0d6357e572a9.dmp"
        5⤵
        
        PID:6740
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2332 -prefsLen 27135 -prefMapHandle 2872 -prefMapSize 270331 -ipcHandle 2912 -initialChannelId {900125da-b8f0-4067-b4de-7498639ba102} -parentPid 6404 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6404" -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 gpu
        5⤵
        
        PID:6760
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\0a3b2a9b-4beb-4e6a-ae9f-ec6f0992f27a.dmp"
        5⤵
        
        PID:6928
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2928 -prefsLen 27135 -prefMapHandle 2876 -prefMapSize 270331 -ipcHandle 2912 -initialChannelId {0657b5a1-c4e9-4835-9fea-19e2ad7655c4} -parentPid 6404 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6404" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 gpu
        5⤵
        
        PID:6932
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\d9fcf1f6-3efe-41e1-9f77-07352e4efc2e.dmp"
        5⤵
        
        PID:7092
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3068 -prefsLen 27249 -prefMapHandle 3392 -prefMapSize 270331 -ipcHandle 2720 -initialChannelId {2ca915af-57c9-4df1-b70b-8d96daa2712a} -parentPid 6404 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6404" -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 gpu
        5⤵
        
        PID:7104
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3904 -prefsLen 27325 -prefMapHandle 3908 -prefMapSize 270331 -jsInitHandle 3912 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3920 -initialChannelId {41832f18-0d75-4d9b-913e-f5bc3627a92d} -parentPid 6404 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6404" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 tab
        5⤵
        Checks processor information in registry
        
        PID:3316
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\db8d309b-29e4-49d2-9fb0-bdc768c20fb1.dmp"
        5⤵
        
        PID:6060
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3580 -prefsLen 27325 -prefMapHandle 4324 -prefMapSize 270331 -ipcHandle 3992 -initialChannelId {b8d0009a-7c91-4300-80e3-ad11c9a2d115} -parentPid 6404 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6404" -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 gpu
        5⤵
        
        PID:5448
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\e3d773f3-925d-46ed-b6c4-0f112449d0b0.dmp"
        5⤵
        
        PID:6244
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4500 -prefsLen 27325 -prefMapHandle 4504 -prefMapSize 270331 -ipcHandle 4524 -initialChannelId {8dd5096d-29cc-4e83-a924-20d781a7a827} -parentPid 6404 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6404" -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 rdd
        5⤵
        
        PID:6300
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3044 -prefsLen 34878 -prefMapHandle 2736 -prefMapSize 270331 -jsInitHandle 2740 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4716 -initialChannelId {03f9c78e-5baa-4ad4-bac7-6ff2a6fe70bd} -parentPid 6404 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6404" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
        5⤵
        Checks processor information in registry
        
        PID:2296
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 3252 -prefsLen 34878 -prefMapHandle 2948 -prefMapSize 270331 -ipcHandle 3392 -initialChannelId {7dda40c3-746c-41e3-a84a-d382104a3de9} -parentPid 6404 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6404" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 utility
        5⤵
        Checks processor information in registry
        
        PID:6976
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4452 -prefsLen 32766 -prefMapHandle 5208 -prefMapSize 270331 -jsInitHandle 5212 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5224 -initialChannelId {dee6c366-8a4a-42e6-a6c1-f4f815cadd9e} -parentPid 6404 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6404" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
        5⤵
        Checks processor information in registry
        
        PID:6752
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5264 -prefsLen 32766 -prefMapHandle 5268 -prefMapSize 270331 -jsInitHandle 5272 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5280 -initialChannelId {06875321-85bf-43da-ae48-3fb8935e5c51} -parentPid 6404 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6404" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
        5⤵
        Checks processor information in registry
        
        PID:388
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5608 -prefsLen 32766 -prefMapHandle 5612 -prefMapSize 270331 -jsInitHandle 5616 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5624 -initialChannelId {d80d38e8-c501-4e27-9b33-97f8400615e4} -parentPid 6404 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6404" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab
        5⤵
        Checks processor information in registry
        
        PID:7004
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\gax3w3oo.y4f"
    3⤵
    - Enumerates system info in registry
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    PID:6140
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\gax3w3oo.y4f /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\gax3w3oo.y4f\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\gax3w3oo.y4f --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffc6081dcf8,0x7ffc6081dd04,0x7ffc6081dd10
      4⤵
      PID:5164
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\gax3w3oo.y4f" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=2080,i,5584530933118188930,6882919976988342573,262144 --variations-seed-version --mojo-platform-channel-handle=2076 /prefetch:2
      4⤵
      PID:6580
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\gax3w3oo.y4f" --field-trial-handle=1948,i,5584530933118188930,6882919976988342573,262144 --variations-seed-version --mojo-platform-channel-handle=2092 /prefetch:3
      4⤵
      PID:6608
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\gax3w3oo.y4f" --field-trial-handle=2108,i,5584530933118188930,6882919976988342573,262144 --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:8
      4⤵
      PID:6652
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\gax3w3oo.y4f" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=2892,i,5584530933118188930,6882919976988342573,262144 --variations-seed-version --mojo-platform-channel-handle=2964 /prefetch:1
      4⤵
      PID:5084
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\gax3w3oo.y4f" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=2900,i,5584530933118188930,6882919976988342573,262144 --variations-seed-version --mojo-platform-channel-handle=2972 /prefetch:1
      4⤵
      PID:5112
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\gax3w3oo.y4f" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3332,i,5584530933118188930,6882919976988342573,262144 --variations-seed-version --mojo-platform-channel-handle=3356 /prefetch:1
      4⤵
      PID:4680
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\gax3w3oo.y4f" --extension-process --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=3372,i,5584530933118188930,6882919976988342573,262144 --variations-seed-version --mojo-platform-channel-handle=3388 /prefetch:2
      4⤵
      PID:6368
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\gax3w3oo.y4f" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=3380,i,5584530933118188930,6882919976988342573,262144 --variations-seed-version --mojo-platform-channel-handle=3424 /prefetch:1
      4⤵
      PID:6820
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\gax3w3oo.y4f" --extension-process --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=3408,i,5584530933118188930,6882919976988342573,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:2
      4⤵
      PID:6376
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\gax3w3oo.y4f" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=3500,i,5584530933118188930,6882919976988342573,262144 --variations-seed-version --mojo-platform-channel-handle=4364 /prefetch:1
      4⤵
      PID:1076
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\gax3w3oo.y4f" --field-trial-handle=3364,i,5584530933118188930,6882919976988342573,262144 --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:8
      4⤵
      PID:6416

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4676

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s camsvc
1⤵
PID:2672

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Program Files\Crashpad\settings.dat
Size 40B
SHA256 174306d5a165ea0b5aca16d486f4558ad6975a78d6fc040f6feac0722661507c
MD5 b89d40979ef0302e4ebb6042b71245bd
SHA1 130939c7fe5d3b278fca04cab062a1504e52c7ca
SHA512 47a9328326493d146925a359d599f2d77baec60d21a82b630e413ba9a4e10ca9da199ded1b228def5372ee5835dbb027afc2f4cfa6311aba841aa22826ef24c8
MD5 SHA1 SHA512

Submit Download

2568_13409081925919488.pma

Path C:\Program Files\Google\Chrome\Application\SetupMetrics\2568_13409081925919488.pma
Size 344B
SHA256 fd668d6edcf6b6cc176edd9bf7b0d7f1881fe2f0d94ebae656127c27a359550e
MD5 1b7cdddfb06152ae01f12d9f253237d6
SHA1 1ef358781a086a0727f4fa95cd53510eb328bc52
SHA512 4705c93b233be92dd2d04649d404b538bc76607bbe655d5e35a739653ac1af776ecdd12ec1cbf81476070ec5bae633f891817155014730a06939efb21bd132ea
MD5 SHA1 SHA512

Submit Download

5308_13409081925872723.pma

Path C:\Program Files\Google\Chrome\Application\SetupMetrics\5308_13409081925872723.pma
Size 696B
SHA256 da9a8ae0c04da6ceae900796a026f4777895bf149eed2c495fbdae098362f596
MD5 3f5af086a83b749aa34a3aac1b986a0a
SHA1 0e67e17122beec914722d98cef0e669541560ff3
SHA512 0a12749b3971d0023cc1dd4f87113c94cc2c961ef824009c89a32ba24fe51de83357bb0757af7612ffb3a638302f5a298a2fc823dec8d117cf27255d2996191b
MD5 SHA1 SHA512

Submit Download

chrome_installer.log

Path C:\Program Files\chrome_installer.log
Size 7KB
SHA256 6c45a962a178a0c8f3d289aa08641639474e3994f53e6764f817d1e0e2547e25
MD5 38f8bceb1445dbb524618dee56dd68b0
SHA1 ad28bb97662c9bd414c9d809780822225c0f3173
SHA512 5bf0cd3466f04313d55f0e1173897abbce4b399bf4f48c59e549080d68c7db649eba2c95521978aa5bea8be55a011e946fceb6f7b4d1554492d551ae2b89c03c
SSDEEP 192:FHIplcmn3BiBiH6rGPTeM/BgdWnXWxnejWnGI64:FoiyImXwe4Z/
MD5 SHA1 SHA512 SSDEEP

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 c89795cc143598cce431b4023c0f20f51b8ab4a9bcefa7bd8ee921f6378970b4
MD5 67576a2b68f9d0dc7b5305e35e477b9f
SHA1 de4432fe266c0f78408778758e2e31b8ae59a1d6
SHA512 016bf5768c483b1b6d086a0c05d27f5af1c980d07871bf4e33148329b6c8e5cb7355cd6f899779adf7256a0c3f368278d975a13a2c05889b0a352189297ccaf0
MD5 SHA1 SHA512

Submit Download

activity-stream.contile.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1w73z9rk.default-release\activity-stream.contile.json
Size 4KB
SHA256 bbb0d8de45b320be14649da367e0e9238b42b3e46e4894d88b78bed01585f0d9
MD5 784b441ef905f4a192cf09a1ef9cda4f
SHA1 d0b9779ddf8cbee081c07db1d2eb983089f615c8
SHA512 e4fac4e29c170ab52aa8fe167d56cba4e96485ab0fd56e3469662dc5b7f89c0aa2e98c1ff3f1ea02cffa777dc55c456034ea0e4ba560cb60547b9d0cbd9c5bda
SSDEEP 96:36SGtLMCndJYKYXQ5Es6DBlOoLrtl3ZoqQRol:ktLMCdJ6Qqsw/hLrxIGl
MD5 SHA1 SHA512 SSDEEP

Submit Download

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1w73z9rk.default-release\activity-stream.discovery_stream.json
Size 23KB
SHA256 ea237266c8b7ac7a60a110ec264cfc22778ea663457f0f102103c702042f2c2c
MD5 2c84c13adb97795e63e38e2993549c8a
SHA1 5e2a7fca43c2a7a47f3106534f8d2303c49f5f59
SHA512 617fa501c89eb913821f6dc926d33984f09cd24182a8f72058ba1f7f1f1cdbabc2a7bf2b4eb11e97ec976519b4d30de00d5e6916fd240be9d81bfb9bc4d72718
SSDEEP 384:qyawwUCTdM8eEt1oJ5qc9wLf3U3jEYSBuPCr:qyNwROuDhTbUTEnQE
MD5 SHA1 SHA512 SSDEEP

Submit Download

7DA1EAB87BEA9BEBEBABCAC30A570208E2B830C2

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1w73z9rk.default-release\cache2\entries\7DA1EAB87BEA9BEBEBABCAC30A570208E2B830C2
Size 14KB
SHA256 3f2cb1fb69c817f0408935d43089ac4ed799c07102688c50b0cc0d67f515127b
MD5 058db1ec2cda1feece02a655bfec0163
SHA1 67ac9005673760a505808c68248fa8948e13eb27
SHA512 682225f15366ec8092797f841612823ea67d790db7c83375a5ab3fd3f11dd125c6d88d6f6ff3997608d984951c51efa167d611d5244c9aeb23db45dda848b222
SSDEEP 384:H3LfiO024Y47hSznZOML+CbcxDEclrIVy8e6Gh:X+ZY47hSz8MLPbcxDEcVIVy8+
MD5 SHA1 SHA512 SSDEEP

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1w73z9rk.default-release\startupCache\webext.sc.lz4
Size 104KB
SHA256 bf1176befba2aad8b6937cf5f53ec7a01889a3d6a02156d4b1dea87e1e90f6cb
MD5 6633ba595b023d3ea89c0af8b5739f06
SHA1 3a14302d4402be7247f410619c999e65121d0b30
SHA512 efb654b5771fa16c716b4b79fc7cbed38e798d0b225a39da8e94eeb20519683a80907e21db58e7a48c74804f3bc8c17610661e503825cee0f817abd973e04d84
SSDEEP 1536:jTrli6e/DDHBg6M4JOmVEai0kLWETE0fif5S7a53K0oLkpsZw3OFhZ9UyXEjQv7b:j3lOg6M4nahVTEzxzpNOx9U70sqdJ3
MD5 SHA1 SHA512 SSDEEP

Submit Download

2de29533-9623-46b6-87bc-d5e2a2210fba.tmp

Path C:\Users\Admin\AppData\Local\Temp\2de29533-9623-46b6-87bc-d5e2a2210fba.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

371405fb-4dbd-43dd-99ca-146ad71ff48f.tmp

Path C:\Users\Admin\AppData\Local\Temp\371405fb-4dbd-43dd-99ca-146ad71ff48f.tmp
Size 242KB
SHA256 81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82
MD5 541f52e24fe1ef9f8e12377a6ccae0c0
SHA1 189898bb2dcae7d5a6057bc2d98b8b450afaebb6
SHA512 d779d78a15c5efca51ebd6b96a7ccb6d718741bdf7d9a37f53b2eb4b98aa1a78bc4cfa57d6e763aab97276c8f9088940ac0476690d4d46023ff4bf52f3326c88
SSDEEP 3072:r+nmRykNgoldZ8GjJCiUXZSk+QSVh85PxEalRVHmcld9R6yYfEp4ABUGDcaKklrv:k3oF4Z4h45P99Fld9RBQYBVcaxlnfL
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\cictlipj.b0m\Crashpad\settings.dat
Size 280B
SHA256 48adfd246e461f3119e8bd5edb9f1a3223c3fc0d27c3f1664119ff2d246d4d65
MD5 f6ef8995c03eaebee53417cbe6800918
SHA1 fa09c60c09abce18f3bbb37d9ac1cca4b1af9585
SHA512 9fb500980e6f3dfc70ca73040031f9666f86a379a2893ffc38823f8c411588864617c8b2a5ae4e4f5d72d9211b86758ec7f075af861af98a3a9600b424d0741a
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\cictlipj.b0m\Crashpad\settings.dat
Size 280B
SHA256 6bafe1a38ddd8e9d4bcbfce1bf57c2630805871618d1ca731b991c9b415d4d18
MD5 c1f76a013c0f1c2eac6c3ceeaedaf226
SHA1 3c0b01033178254c15606b7f9800fd2d1acde540
SHA512 5e6038ed378ee7e8c17568de6f6f88170fd56f8d68b2c65978de8baeae53d7a8cd927f3e51d9acef8e36634bc986bd73c58701d33fdd546c2f80643fdcd25810
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Temp\cictlipj.b0m\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\cictlipj.b0m\Default\Code Cache\js\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Temp\cictlipj.b0m\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 192B
SHA256 33e4178e23afc91648eab59ea6a73eb06730803f5eb7aeb2adc0e00009fadb2e
MD5 e9d21075ee8ff88544bb86ab79a68e5e
SHA1 0b60c6289af58c3535d37e6750e049e5766c686d
SHA512 a3093c7ccf7bba21bb6a69c12c196db52a545adfaf5691c6e061671190637343a5cad541e01be45c003f447d165cb6eb4e0c451295252213a0f7fb479c4062ea
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Temp\cictlipj.b0m\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 257B
SHA256 4c3ee97e768f160cc904f5fea2a02190f720c4bae55f3f9c40d7594d852901f6
MD5 cdc57d49934644d00c64fe8e1c82fb6e
SHA1 32a0f8de907b8dbac57e2c4db2cba3a3c7868ea3
SHA512 62fb154f83ca7455312ae8dec6589164da152f344c9a7139a9a5851d903a4248ce73b8ac7f0c8303a2082f3586c5fe9b29e43c2fd9f8dab7e771f67a03d3cc90
MD5 SHA1 SHA512

Submit Download

index.txt~RFe582229.TMP

Path C:\Users\Admin\AppData\Local\Temp\cictlipj.b0m\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt~RFe582229.TMP
Size 119B
SHA256 0bcdf406807183ec293c670650d334279d6a0cf9fbb6ca3116b7fbc6df13f8b7
MD5 f869d44d8dd5d740118815b8ef3e75af
SHA1 8e5090143b78a6f5c519889949787afb150107e1
SHA512 db31a0fd6846bed3b77fc842b82c5926f942b2b09529c328699da7f643bcd4eaf9337a119869173b21e5cb6b33f28911146018ada14a5430bc43fb0236eb0bba
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\cictlipj.b0m\Local State
Size 3KB
SHA256 8118d77c7c12ef7cf5f0817e6ec69c9f77bf6cbd5aff0d247fd8c36dcd331355
MD5 49225454e38946b44d78ea6811ae281f
SHA1 b8ea8a8583de641ea80c8e201f543691ebbe90f3
SHA512 10a8413bb2f99d08b693ef45fbf8c46fbe2c60ae0dfb42c6ade0bc4f1c78a226ca81c46c3966f72f2f61e6e6286a8561e18592198938c711a7925c99db94d6cc
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\cictlipj.b0m\Local State
Size 4KB
SHA256 ba32792414a8cf90be5c68d8baf244646b249079bb52fcfb32c85b7e58da6473
MD5 78046344aad555d0442b60e023016a26
SHA1 a152ecda618ab7c834b402a3f44d80f2327d5a8f
SHA512 39f1c8239ca17cecba6ce27321ffb84478371881bb44b35edfeea964cd457f28c4e2e772bd547a3ea594148ed92ebe6f8c2489e4a9651511ee31be8aff9862c4
SSDEEP 96:vqGNkCufXdIdQY58Frh/cInURoDotovywDfBPPe8v2EdZEKJgPCUXBsa:yGNbYd/ooDUw1pXZHEGgaUV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State~RFe581633.TMP

Path C:\Users\Admin\AppData\Local\Temp\cictlipj.b0m\Local State~RFe581633.TMP
Size 1KB
SHA256 db1ef4167a8abce73543d0c93d3fa4d0f3149f39b1739ad1226c956a75fd5d8e
MD5 f5b7c9117f6db50510cac7424daea49c
SHA1 6d48e3c59e24fd5189e294a38668b0310eba22f6
SHA512 d07fd9349f9acb1090c1f169b9b48e12f9dcc7f02bac41c78c675bcfd77a355c5f21134db43eb48b89fa4219458bd3c07607af2a00c63320becf0da812b99a87
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\edgct5eo.ab0\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\edgct5eo.ab0\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\edgct5eo.ab0\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\edgct5eo.ab0\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\edgct5eo.ab0\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\edgct5eo.ab0\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\edgct5eo.ab0\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\rvhbc0wl.ysf\Crashpad\settings.dat
Size 280B
SHA256 a3bcffa3be4b4f874f0d1727c8965dc24599db48752fc5d358fa4bbfa3f915e2
MD5 d2b1c48d3043e698b3452c653a49b710
SHA1 336480198a351ec9c11a896bbf9a2b4e6cf456fa
SHA512 9314c0d1dabbd944b83c6c39f1ad27148be630f90893d1febc4d34fdad73e9279ce3eae1d1d2c9d0b79901e744f5ced986a98469d6c9fa9b82cd6eb926d1eb9d
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\rvhbc0wl.ysf\Crashpad\settings.dat
Size 280B
SHA256 b06d1d83b294907719f6e805d7efcfbe5bd88523fb826d8cad2c3041faf20eb9
MD5 92ff3f9f8b26b2995dd568b96e97526d
SHA1 5026a1d38381f8a87ea7912614cc3ab3a09fba5b
SHA512 86444dc56b7e352d0d3cf6b56638d8397073c820113d008baac07c010dcb64a235302a72e9025ff9356967822b8f184312d6afea2a427305f46f093378dc78f4
MD5 SHA1 SHA512

Submit Download

f_000002

Path C:\Users\Admin\AppData\Local\Temp\rvhbc0wl.ysf\Default\Cache\Cache_Data\f_000002
Size 99KB
SHA256 cad25cfcc108f11e81cf1a339916e956b5ccd3ab3da38a3bd7a3a7a01adcd3f4
MD5 86e9c0ad8befdb46f1ecda1d3f2c70ad
SHA1 cf9520c235db04ac02e98a7f7c9f3d5d631d4199
SHA512 30a1265891f03df0c46d4f310d97ffa312b84d485a214d895a1c5e260474260d6637592b20d9cf4efa507c131694f63253577fdb352e8e0c46505e02183e0ab4
SSDEEP 1536:GAqrSnLU5BxYE4bP9zel9rbvjJvNCLtY25wJ0qPKldrT6LTMyT2ItH3RHTZ:GAqrSLSvYEwsVbrTfUPdqL4S2iTZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000003

Path C:\Users\Admin\AppData\Local\Temp\rvhbc0wl.ysf\Default\Cache\Cache_Data\f_000003
Size 63KB
SHA256 2e658acaca7b2c85b7f4c09e5386d3beabe7b844b92092087e656a2e3e6f0cdc
MD5 09184d5ee71cd76b732f47380326136c
SHA1 67301fa8271973b13286ed7c075c11bb47e892f1
SHA512 a3caaddc5bdd37860ee78df3fb5b419141c511d0383c12f032af4ded36a09842649e9b665386ede3d39b6081e802fb8d6d7a7f7b3956af3532f821cbea2514d7
SSDEEP 1536:mYxXjqdG6h++cRCSnL59Q4Wb7wgi6Y/59Pho/jckj8:zhUJyC69KMh6a5hi7g
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000004

Path C:\Users\Admin\AppData\Local\Temp\rvhbc0wl.ysf\Default\Cache\Cache_Data\f_000004
Size 385KB
SHA256 7d31137eab39fec968ae9ad5a74678d50df76f86a0599d897eb24e6a79131df3
MD5 f80a9eb3ff483f5253c2ced62a9b965d
SHA1 face1085ace0c530d9449bb1ed81ff51cdd455c2
SHA512 7c0d4f831111feaaac4be3f6acadc3db589ebf22276d87a192f0e58818e724b0da4dd98a98a44c65b75499310ca6cde652d59e3196f50bf964a12129f5f9f293
SSDEEP 6144:5JfkKJz6MG1P3fzlobNqyKjdKpIp4guqlaoqiy8ix/5zeFjA1iE0Uv1Saj0cxo:5ukzVqvzwNGqqgyjix/0JYi56SuPi
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00000a

Path C:\Users\Admin\AppData\Local\Temp\rvhbc0wl.ysf\Default\Cache\Cache_Data\f_00000a
Size 74KB
SHA256 7f676f82c934683511eadf35d3e1f4a8c3b78c9fb88f5f6893bbdcb573b21dff
MD5 d26baf80c387db15fb535968604be9a8
SHA1 5f238ffbd5c46f1016655f481679dc8a3e13804a
SHA512 b7c83ad18ed1fdb4c030bcf2c7e46c987a4a5d308ce140133d09e49e9c0b61e9d5580000c7c3372161d5a499d92e036266816655ad8a8e63c11c97e894321e52
SSDEEP 1536:N6TA7WUrE18cAeZzatg73ajfBQUKgvKHOKBSZmOChp2:vaH3AQX73ajfBDvKvqmO2k
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00000b

Path C:\Users\Admin\AppData\Local\Temp\rvhbc0wl.ysf\Default\Cache\Cache_Data\f_00000b
Size 28KB
SHA256 b421c05a340e40d4d4bd1831521268b6f0afd0461ec3991cfa8d5314bf3207b4
MD5 57f9a7c7e2be49102533a2ceb7a05e51
SHA1 850ab0a80577b7f7effe196cba037899e71594c5
SHA512 66406d54a1d1a44f30e19a9bff1242b50fdcfbf66c33e4c23daaa756c06f50a2e39c991e7a8dfd9a81184cc37c2062d0406070be132e28a22307896e63b55447
SSDEEP 768:dT+CJ4QL+F8S4bApn9Ua0ndjCaixJ/fVW2/AGYnS:TJ45F8SgjXnNCa4fVWVnS
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00000d

Path C:\Users\Admin\AppData\Local\Temp\rvhbc0wl.ysf\Default\Cache\Cache_Data\f_00000d
Size 17KB
SHA256 875b5ce3dd35af59a423d06a9fb97dbd99a871bd4b3ce372a37331110011bdc0
MD5 e81abc69da48a9bee78a68e1adb94c9b
SHA1 8142284bf2d7d2e6ff566aff7a0fa3c90ed6b0c5
SHA512 185308fc7266fb1241c5482dbe45882f627fc3dda28af36363b2488eef1fc8903bcbece63de676e24a0ac10f0024602c1d0c706601e242af01fe8eaf3c044a3a
SSDEEP 384:KnRczo7MjPnsVdtpcVwnZcc31kEUugD+LHLf///odQ:KnGrnMpcVwZcO19UTKLL//odQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000015

Path C:\Users\Admin\AppData\Local\Temp\rvhbc0wl.ysf\Default\Cache\Cache_Data\f_000015
Size 70KB
SHA256 c9abc85e9b1a1925d53f2eae62eea27177ea02653dbc6b513e78eb18cd917e7f
MD5 c9df0b9efe2539b3fea52fcfd607a77b
SHA1 ce990abfb5a9815edb5f4408003baa87dde96372
SHA512 008cce1c525464097450e94a789167b1b3e32f1c556b8becb1d643ef803234f959be87e955373210ad184afe34e61f388ef9aa6d4b824273e1cbc68706fe6978
SSDEEP 1536:WYTJEpFqHNfGXFs+Sm1YCH4pr8zB2vCf8g2OINa9OcGBxUwB:WY+pFq2/jYQ4pwF6Cfa3NaMxNB
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000017

Path C:\Users\Admin\AppData\Local\Temp\rvhbc0wl.ysf\Default\Cache\Cache_Data\f_000017
Size 68KB
SHA256 6424376fd4478e683f49d743ef1e4a02319b9b23bc744c18a0df31d8a6249659
MD5 d952fb4836e6f5258a9a1c91ff0ee4f4
SHA1 bfc8c98fe33303c5c8ee47ed203c56bf76ad1be2
SHA512 680600a0028c3f3825b63ec92598d1d8863e47e34c47628b4d09e67fd69351e3828ee817739c2ac65eaf3b23e1cb9bdca393c5af6ca84fccf6e1839c5e6eed05
SSDEEP 1536:m95v4bGImBp83ZUFzxS2ZE+GvKJ0FySUKTBT4roo2iP/PBUjLrFq:6tVSRsr+KJ0wUBT4rJbUHrFq
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00001b

Path C:\Users\Admin\AppData\Local\Temp\rvhbc0wl.ysf\Default\Cache\Cache_Data\f_00001b
Size 17KB
SHA256 5efafb283e6accc0ec96d76602e5314d9e470264beff7e712410dc2621717da8
MD5 6af65d6430c0914bb510c23cc0f42b0a
SHA1 74f41b81bd8f288d7635eb4cf9b2f66afe3e106c
SHA512 0c2fc27d92e74ada1beae64c69aed3653906489d75d7eee207319da4e6cd480116be39600b42088bf537ffb4e11871717617ac5eb44d3d41a1355f504d79d9b4
SSDEEP 384:dKQb/SUCy97aLPyxCxIXyrAjROvgSWCfvTiRHJZu4iVUJVvCSFRf:Xbdl92YGsyrng7ZRDlJVa0Rf
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000020

Path C:\Users\Admin\AppData\Local\Temp\rvhbc0wl.ysf\Default\Cache\Cache_Data\f_000020
Size 16KB
SHA256 ea5b658e470a98a8628375ec4a700938330e9c0cb45d08e4b89e5698b200f2df
MD5 9628ed30a3cb6f6ca5ec1faa75b3d9be
SHA1 696611cb9d9cfa5f2ccccfb6f4cdc1a816bfc908
SHA512 8fa833b989f417cd0c780963e01e1db654c03adcca85ce0231857c07042052db3fc563f9abdf3047ec7b2fef099b2e70e699464041bda55ca0778ce4ed9c28bf
SSDEEP 384:FfktxDpLOpGRWSVKzyxNl31A0vH/56J8L52FRTL+2QC:9ktZp6wRpKkl3fpeiyR/+y
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000022

Path C:\Users\Admin\AppData\Local\Temp\rvhbc0wl.ysf\Default\Cache\Cache_Data\f_000022
Size 33KB
SHA256 cd75bc10f52a588a2854eeae979b370c6b461adc913a2066931b7988afad1dad
MD5 3a233d4387edc22e015d08793b27c51e
SHA1 38f29a5205517a673951a1c6884122822019c5a8
SHA512 e26c2b1a101322d7d15f8bb9adc9ae7ca2ff1f023605c5d0a93db1fd14d4465c439c59df6e5b033734d19067b22bdb8352dcc042403a35dabfc1d61bae3b9b0d
SSDEEP 768:Ou+yqTtzMQUNtJp+ZUQjwTHLTsZeBrrT0dmvj:N+1CzNVgZjgLTskDvj
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000031

Path C:\Users\Admin\AppData\Local\Temp\rvhbc0wl.ysf\Default\Cache\Cache_Data\f_000031
Size 38KB
SHA256 ee4ada6fc766f864f1a41a22669fb77c54be92b8dafef1972af4a24bf4e32ff1
MD5 99f8003b861516ea3157d0e00aa0d39d
SHA1 87393d762e8ae2b192dd8780340cc3e57299ffd4
SHA512 2def8f49240e6c1089544930007cafa85dd11696634ef6e83faf134bf4a3be11a3e6b479306e1d72da8a94a4fdaf0e5a911c3f28059416dbcf92d4df0d2e8696
SSDEEP 768:aEy534vqCB3nX8BlzQAwGGNrFS1+gQCzbnhYYZ8LTRluRn/bTD:I5oCCB3XiVlwGlEgJn9Wfq/HD
MD5 SHA1 SHA512 SSDEEP

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Temp\rvhbc0wl.ysf\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 192B
SHA256 84ac221518c164ca8a8baab5dc33a5dae13c768eb41107cb5a5857ae3714fa08
MD5 049c808c23ff15e206ddfa7bfe346c39
SHA1 1d956999b8f71cbf919f30e65cf73c0838f2b901
SHA512 c6f103c5b29bdfcf664cffd070543910c4870161cd1b5ef87c0c79bf7c3adf786129c716eb898ab0db20add6f80ee81f51ce2c05741f8e409179f17c1efe7807
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Temp\rvhbc0wl.ysf\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 257B
SHA256 fa57e7414ded87d097da37a10d7bf1333ed4dbc741bd37374b4e5f3dc1064ddb
MD5 0ed66f6e001287cc3e5b29a848f3f558
SHA1 3af7a8f9bb610156feacbbad162242e4ccd9f35f
SHA512 2cd740a5dea5bd6cd8b62b33ac294ccd0e81a3e8866709f07964f42a9161f2c3e6dd07a65dd43f9f778a2b0f1e5f6a7157445a70a5397996c4cc92bd1842a07d
MD5 SHA1 SHA512

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Temp\rvhbc0wl.ysf\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt.tmp
Size 119B
SHA256 dc4fc979703a6f189be84f1109fb0bd9f760a383803efc1f519e864208214d87
MD5 8672f49a69cb3d153221182af3168d69
SHA1 03594e41114a44ac3cc238ba7a16da8cefe79ec9
SHA512 f85a5bba6acdafca867d154e86178027afdea0d8f9bab38ef02bc92b23934f45edd7b05c0186afda04afdf01436e54d8c6880aef9677e57e7522b591000b3eca
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\rvhbc0wl.ysf\Local State
Size 3KB
SHA256 e6cd2e4d461f8206f553ce885fd8017f4cc9d23c36ea0d3c308e6758fad83f2b
MD5 f713b18ea5d1bfa701cee3bf86c91e8e
SHA1 d007daf15fe20a8f8c8450d6fd5875c4fe1b00ed
SHA512 8736f296a1baf51312ef4973919f098f005ce9329b80bbaa74be82c38b452ceef00a77c868ab3f28f35e67990a66d9e0b563d1997240a7d9230d9389a386a2f0
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\rvhbc0wl.ysf\Local State
Size 4KB
SHA256 c8a0365dea30af70c99dbd55310e7d7e25f55ec589fc55789340c6be67e593ae
MD5 5fa8fe6b4ec50d228f6512a2da372932
SHA1 c36eca18f7016e9833a971f1ea8fc9d34670567a
SHA512 4cea52dfc4f44bbb7b8200754c3c18eba2e0d2dab290dc84a4680b97178e179185424a2881e180cd17c3a2dc26fbaf5181f0acee20413226dd6fb4f8f400ba6a
SSDEEP 96:qqGNkCufXIfZDB58Frh/cInURoDotov3N4D7BYPRvIzgw3JgaCU9BJa:hGNbYq0ooDUw0FqhwZgXUE
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State~RFe582e6e.TMP

Path C:\Users\Admin\AppData\Local\Temp\rvhbc0wl.ysf\Local State~RFe582e6e.TMP
Size 1KB
SHA256 d6af5af0858fcf787d125b9bde35c7af2bdffa6d92484a6954da456294af2506
MD5 90f76a4e1edf50ce7f898fd3c855e780
SHA1 0dc07b2639dda023352eb547ade14ffe84249e03
SHA512 4db9c30e1bc46f7a0f80416dff00726686076dc384c59793b9b217531fe35def4003f12ec02457a9eb5734edb76cc9ebc66fbf7737b306df336207a9434ef2aa
MD5 SHA1 SHA512

Submit Download

09d0350a-998e-4559-a9f0-79528ba6db8f.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2364_278121214\09d0350a-998e-4559-a9f0-79528ba6db8f.tmp
Size 161KB
SHA256 8db781cdf6d05cbf452dfaf7eaec6c4818e2c979fbe876c2178a449681374b09
MD5 f4e4a2ec27084ae8e2d291b22cfba16a
SHA1 75ef323d2573847b366647019ac6486362fc40b5
SHA512 606ff1219382c3e4367ec8e929928b21031a3c9340c9e2064e1297a879f22ccc4f9289b59db7c35cf78c5b97d8827a3a2c37c62ed40aceea29d1c59bd0d90692
SSDEEP 3072:SBBV1VTKa0F/TnqOK7CcvlUsUc7/3fDN4UKzCGLr8Xqjj6iI+onWr+SZuTF8YB:S/V3mbZrqOUpUgPbN4UXGLqqjGiIXWGB
MD5 SHA1 SHA512 SSDEEP

Submit Download

Google Chrome (2).lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome (2).lnk
Size 2KB
SHA256 76bbfa1f1d03a43fd21a260b0354a049b02076374eaff31a5029196a235c5689
MD5 da3b98701ea2a2803719d5218f895f68
SHA1 2ada7f5af24e807225e7359e45e39b01716ed65d
SHA512 954c06aa7b64125f75557659bd05c68f53e10956703e96ec9c9388867c700cf582957390a3ba316aa832756c386928f387ac2facaad19932c2dd22858f06ed3f
MD5 SHA1 SHA512

Submit Download

7HGHVF6XUTBZH77TACCZ.temp

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\7HGHVF6XUTBZH77TACCZ.temp
Size 4KB
SHA256 c0c6648966f17d5cd46c91131b68d45fff8e965e85940f993f485fa3273a7089
MD5 8c9442d1e84d70533aefffc7b52df78c
SHA1 2c195e64fbb8c90e29227034a8ebedf07427f43c
SHA512 3f786e7a826d5c8116be87115b4b441eb4460ec6e20a501da2128b48487f0343a21201fe5eb5b18af04cef909ab4ecc0b48261d51467873d477a32329f966223
SSDEEP 48:klNdOUw6bQmYbJ9zUoYZdLXuHPpKYlNdOUw6bQmYbJ9zvYMgdLXuHS2KU:LJUoOuv4XJvDIuwU
MD5 SHA1 SHA512 SSDEEP

Submit Download

ccba5a5986c77e43.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Size 4KB
SHA256 7e389729dd5f6e9c7642c2591857a6d88f6bf9ef44d6c2ff9ac1cb470eaae457
MD5 5c36b22e2e2f5206f957951d4fa91592
SHA1 dfa87657e06ebeadbb78b9c8ea913faac2f73ef7
SHA512 c4f3196cafb05d646876ade9090089734a2e2a24e5c312e1b9cdf076e62946ff23a2df7f04e128f78c8de30606198f1d5bb16f2bf22650de192c52f6a13ca18f
SSDEEP 48:plNdOUw6bQmYbJ9zUoYedLXuHPpKZlNdOUw6bQmYbJ9zvYLgdLXuHS2KU:6JUonuv4qJvEIuwU
MD5 SHA1 SHA512 SSDEEP

Submit Download

178bd046-6f43-42e7-b7c8-a795eabe70bb.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\178bd046-6f43-42e7-b7c8-a795eabe70bb.dmp
Size 64KB
SHA256 8932a16930625e3350ad1d848719e3e5d1b6d1a718ffdcd3117d22a0fb7a9474
MD5 bc263f1a119b94eec46255d3ddfbe78e
SHA1 623635f839553088c746b3ba5b2cc1f8511c0022
SHA512 9655811226b62354b4bfb9c89e26a7de2102997920855913e4f4b440072a129fc3c39b167f387cad641e0ede4d4fb28cdee9767a64f4aff1b2bf27c7c31b71b7
SSDEEP 768:Zc/AoVEP01Vi7NSHpuEZ7EYvsI4KsqIM:YVC01VIw4EZ7EYEKsqI
MD5 SHA1 SHA512 SSDEEP

Submit Download

178bd046-6f43-42e7-b7c8-a795eabe70bb.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\178bd046-6f43-42e7-b7c8-a795eabe70bb.extra
Size 1KB
SHA256 399328a53888d1e9b2df6ed953d1477e3a85425a0a7805e06c164e8ff85bd006
MD5 751a15328cea7ecfb6afb1a7490c19cf
SHA1 6b8ef1ab2ee258738728284ebec68e69131e7841
SHA512 ba0b9168b9b302f87f0189cb539a159d8d4bb3fc6ebce20cd2afce0f782b81ceb09bcda9cfc8f99c4167db475a79e0e219431d26620b102a004ac63e22a18b6e
MD5 SHA1 SHA512

Submit Download

178bd046-6f43-42e7-b7c8-a795eabe70bb.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\178bd046-6f43-42e7-b7c8-a795eabe70bb.extra
Size 3KB
SHA256 1162f1f97e3cb72bc474645fbe0aa98a8e2ada2a4c681c7bb748b567839b1990
MD5 2521bfa77e4cb3a9e1b4ea4a00132ffc
SHA1 aa09bf9721221b74680741cb6484d603b5c65ea1
SHA512 511f7e65836c9069e0b3a48530e05d78a4e275a0566500fb31d223c1535d43bd3f65c3676e8631fee55aa489002da93d8386395077fb0714e1d58e5bb0d9f80d
MD5 SHA1 SHA512

Submit Download

1aa689fc-375f-4e2b-a45c-b03c35acb4c3.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\1aa689fc-375f-4e2b-a45c-b03c35acb4c3.dmp
Size 64KB
SHA256 264af9bf61b3acb35f231fb3db715e2044d94b671cac3331dfe4b7c318b6a85e
MD5 a6d3cc1a415c0eb1ef120f57ee9e501b
SHA1 d720348f7265dd871a43d7374b0ec205d6fd1666
SHA512 c778650ded2cd3ee9d7a0ca42cd70959da03db65c0312b7dd7df5841fd13530895a01e30172c0262159b29c946ea3aca35ab35771794405d21c52b84ca032001
SSDEEP 384:QvVB9/A4Dt2JoA7mAUq9SjXjEjxUOKTm00rEEAZ3Dt2JoA7mAUq92GuYILPiOzmT:Q9/TCz+Eg4GPiO+nh/Z4KsqIM
MD5 SHA1 SHA512 SSDEEP

Submit Download

1aa689fc-375f-4e2b-a45c-b03c35acb4c3.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\1aa689fc-375f-4e2b-a45c-b03c35acb4c3.extra
Size 10KB
SHA256 6e31f31f847112b6d5bef855388de72effa4161a3427e4d831a175d52a2ac5b1
MD5 110db985d93ef5e4887396b4d19d48cd
SHA1 100a3856876332547f4fe81fb19e59433aecf7f2
SHA512 7509d6cd4834f04325c1de84fcfb8147385d34fcd0cc328056c66211bfccc50ea335fa22913d056b4afad905e153199ae2ec312bb025fdd7de3a09e40ffd21dc
SSDEEP 96:S7WCYTRFY6pw6FF29dW640Rh7CsevBb1d0pjMLlIrLlhTLlaXv7abcBvtILI5qwv:ShkTYL/7uvZ8FLIxsPpwlhpfoi
MD5 SHA1 SHA512 SSDEEP

Submit Download

1aa689fc-375f-4e2b-a45c-b03c35acb4c3.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\1aa689fc-375f-4e2b-a45c-b03c35acb4c3.extra
Size 10KB
SHA256 0b0c2735af97048803ad9e14a36420fc2b09f1dce3ff0db091be04cf02d9ee4c
MD5 e69933ea396c3bb4bfce91b4d331cb8e
SHA1 46bde90551bd3b9b08ae4b05ae2e18026fb9e149
SHA512 2f37fed3d7e0b20147feac3df1203bcc77a5f0d0288f8c4be31b469555f28bce5e56429e86bd7397d2fcd9233e56255d410a954ce0f4c488affd3072363e1394
SSDEEP 192:ShkcFaiR4MmnQYapdVxzPPWBHX4TofKNdalppfoSbLP5Yx:ekcFaiSI13WBHX4T3a5ASPs
MD5 SHA1 SHA512 SSDEEP

Submit Download

77586556-3b78-469e-a88a-d1f70b222760.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\77586556-3b78-469e-a88a-d1f70b222760.dmp
Size 64KB
SHA256 9300f1b28beb90fcfa618dc4064d2dea8c9d40345f4b97ff6c95d3e81feab449
MD5 419e62db861aa519ff7604e733f6ce57
SHA1 ed439b249af5b62cab7f93df866fbb99458fa03f
SHA512 3388b3d4546262685194edd3bd81f50995a7f74dea29d83a89527b0d59944e22b0000952a688d2951a94c867660895b82048668891120a68d9642b7fd03fcd0d
SSDEEP 384:81VB9/UI/Sj1BSjVGSjxUmgybvedKgI6Q83jZS/2DUEyEuzKsqI7fqb9:8H/UI/00GaZbv4yc3F4KsqIM
MD5 SHA1 SHA512 SSDEEP

Submit Download

77586556-3b78-469e-a88a-d1f70b222760.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\77586556-3b78-469e-a88a-d1f70b222760.extra
Size 10KB
SHA256 8aedf0406ce88c4a5079e414f3523879771492a03e6755c78719b97c8dc6148c
MD5 d661504daa508e3659c41b3ff186212f
SHA1 a104181ce43e5b6aa48743785f34574d9043efd8
SHA512 3100aa9349ab547bec7349197260fe4b188655749e2a036d81c5c832ee858ad47045c008198a104e62a9e37436ec133b9d4813eb989c8919159a62cd81ef6240
SSDEEP 96:S7WCpTRFY6pw6FF29dW640Rh7CTvBb1d0pjMLlIrLlhTLlaXv7a1cBvtILI5qwvc:ShZTYL/7WvZ8FLmxsPpwlc1fo4
MD5 SHA1 SHA512 SSDEEP

Submit Download

77586556-3b78-469e-a88a-d1f70b222760.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\77586556-3b78-469e-a88a-d1f70b222760.extra
Size 10KB
SHA256 c9aadbbcf159fe4d22491abd1885328c778b03dcfc1d8e4274c8e46aeb495c2d
MD5 d89d30fd1d9e9a32f7dd9712c117e527
SHA1 f76e384da5834765be36c1291fe02481cc1de3ee
SHA512 a23b8641f67997d6f947182439c675d1780f846616ba813c1731016392d0294b73e7136865f9b105ee9430096595a5a260cb5b483fba93519dfc9ef474c89f9a
SSDEEP 192:ShLcFaiR4MmnQYaVdVxzPPWBHd4TofKNdalE1foIbLP5Yx:eLcFaiSW13WBHd4T3aGAIPs
MD5 SHA1 SHA512 SSDEEP

Submit Download

d9b69427-c333-473b-80b2-fc42bb7ec4ad.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\d9b69427-c333-473b-80b2-fc42bb7ec4ad.dmp
Size 62KB
SHA256 39a3837613c9b68d8e5e5f9bab033f8bbf0b3d4b42d95c4e8cbd43fa16f12e12
MD5 ddc582b6ba0e39ac06b8ffa8606f11bf
SHA1 cff03ea9a5842c7bae653200885236b50bd186ac
SHA512 397090587814aaa646d43718f25df522d09237beb0c051a7b7601d7fa196d4c1ceb4d8553784a2448af2f931aa32fdfeaee24cedd1cf723e1b0d5c8a05ee0671
SSDEEP 384:P8QoVB9/zqlwXjJjpjJUX+FIBg/8AvFlwcP4nncemiO1swL94S/2DUEyEuzKsqIM:U//zNcBopkO1VW4KsqIM
MD5 SHA1 SHA512 SSDEEP

Submit Download

d9b69427-c333-473b-80b2-fc42bb7ec4ad.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\d9b69427-c333-473b-80b2-fc42bb7ec4ad.extra
Size 10KB
SHA256 c937c08d212544affb6135f79fe0003b7c36b98fb8a1cb53cf72f841c1fb035a
MD5 fb3cebf5831a50d98bcefac22e15fdef
SHA1 4d8bdbf1f53e3d0e29453d06bdfe6d349dd0e1c3
SHA512 9e69605bea9f0ed96d90d327bf551a080ce8ee7d024de4f6aca33302f6da5b8f085ee59c7f9bd3662be4e2cae8f1476ee072ba9d1140ddf512837c676e797c80
SSDEEP 96:S7WCMOTRFY6pw6FF29dW640Rh7CsevBb1d0pjMLlIrLlhTLlaXv7aPcBvtILI5qP:ShM2TYL/7uvZ8FL0xsPpwltUfoo
MD5 SHA1 SHA512 SSDEEP

Submit Download

d9b69427-c333-473b-80b2-fc42bb7ec4ad.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\d9b69427-c333-473b-80b2-fc42bb7ec4ad.extra
Size 10KB
SHA256 daa527bbbc0533cb0929b3944b91e0aa26fe95ac522b103d54c255ed8b40317b
MD5 90d868451fe13594eb0ea35f1ab41bd0
SHA1 d1068f06485b467e73054b858d9a672cbceb2c05
SHA512 61dfebda25f16b0b5d9093673315e7929a4fd8f4891d9110dd0765ea613dfaa41812b02b9464b47b7de9d6fffd4aec63443122f899162c430709d302b1a8361d
SSDEEP 192:ShMOcFaiR4MmnQYapdVxzPPWBHV4TofKNdallUfoYbLP5Yx:ezcFaiSI13WBHV4T3a8AYPs
MD5 SHA1 SHA512 SSDEEP

Submit Download

compatibility.ini

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1w73z9rk.default-release\compatibility.ini
Size 198B
SHA256 252b7fff962848c61092e82a3d87adca163849767713a93ab533bb397f1f53bb
MD5 ce9ef13caa8a74c25157b184aa038475
SHA1 db03a9935d8bb3ce6b120aca98feade536805160
SHA512 0f6f5053e78167ef5cc5fa70ed3a87dd116df0671a590299277a197341bed983e3d77e37ad2c33cd4afe880fab9ed1c7f7502210040617a01f97a81c1e1d4f29
MD5 SHA1 SHA512

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1w73z9rk.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 c49b151d4d4fd0363f3d44c32be5885a24a72365753a37a02094f5edd61acf5e
MD5 cf057f7b67628a475003892391b89be6
SHA1 04d8f4b20067deb9ade77d74a0d727edd5672cdf
SHA512 9a65919b404a38b1e1dee25aebb4f5941ca8a8f74b083d8686c53bb4a47b30a19417390f27bddb0af437ea370a85c3c9fb3036f11e720a4d0d2d75b2af9ee03d
SSDEEP 192:mvg1/66JozGzgCl6mSSdcOv5zboP8Z+0yjzWJ:Oa/66JozGzgC1b1boEZ+0yjo
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1w73z9rk.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 25cf5bfa11b3fef112f832961dfab3696c4a9d62fb5552d3921bbff49937f5df
MD5 8ca664d435928f7f3ab77fca4fc7eecd
SHA1 cd7ad00893bc4b9978e40a9088eb9af4510fe0f1
SHA512 cf7b127992af3225aef012627aaa7359a99fb0067922ac9c75b8b86c0899cb2a18533cd74d2e1110b83536f655d0c80e6b6221f9769323940f94ae3454212221
SSDEEP 192:z41/66JozGzgCl6mSSdVOv5zbovJb+0yjzQ8:O/66JozGzgC1bQboxb+0yjv
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1w73z9rk.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 feab3b2bad6d13d3d048901ec45e999b7c1cb805cc3de3d73063f8ec8038af2e
MD5 c8e58e6e90ed4426d140e2a83965a998
SHA1 8c30b2dc43ab6be5e10f36864ee864f644009913
SHA512 5748bc9ccc9f8903b635b3d9578bc8350054091aa9ce4c679980c258dc48d54709d6b4719c079db58d2efd0fd6f277372495a95a85f123e7423eb1b0874fa9be
SSDEEP 192:YOv5zboPOJZ+0yjzQGt41/66JozGzgCl6mSSdz:jbo4Z+0yjr8/66JozGzgC1bd
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1w73z9rk.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 2d85f12ab7a0dd6fd6f6d7fe282c95e6b3de1f5e19700372739e1a3af32eaeb1
MD5 3377f0a6e295b92ebe493304a728728f
SHA1 86d88a683dc3d218a31fdf8da772c0e2f7a3b01c
SHA512 957c552a8e0957388e083329562779b57b2c113cfe74fd2fdd783425581ae3720b401b4f5a5e1182db22a870c55591d3e7a7ecca6654d021108f9ae6bbb799f8
SSDEEP 192:XOv5zbopb+0yjzWxvA1/66JozGzgCl6mSSdz:obopb+0yjQ6/66JozGzgC1bd
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1w73z9rk.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 5dcf10689bccd91de876fcf73da7b28c4c41d608f08cbf70e7a8b749981a158e
MD5 1553e4f68534425a4da65ccf0dfe5f19
SHA1 42e9c0a5692952175b3635bc2678807800926cb9
SHA512 c4c229dfcc81c0d1b935e99b5689d57001706d2b8969fc7bca83f9c93b276f69263ddf32777ebaa508cd2a4bbd439efa253353e1e185979afc2527c6c1c6f781
SSDEEP 192:xOv5zboP8Z+0yjzWxv4s1/66JozGzgCl6mSSdz:uboEZ+0yjQN/66JozGzgC1bd
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1w73z9rk.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 c5d7b23737b4e213a38356b41656b1d1556f31eadec899e05cb0cdb0b6bcaabc
MD5 090dd1136601ead6c59c3e22d8e2fe3b
SHA1 448e576808ae92fccd078ec86813b48722625ebd
SHA512 7e0b581e9154e226c63702efcdcf3aa2531a4cb69c0e5dd6f57142d38b40a423c6d055e2b56eda33d4fec605b24c9ca02882eecc1fe7a729e5c92c62105b4e67
SSDEEP 192:xOv5zboPOJZ+0yjzQG1x41/66JozGzgCl6mSSd:ubo4Z+0yjrC/66JozGzgC1b
MD5 SHA1 SHA512 SSDEEP

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1w73z9rk.default-release\datareporting\glean\events\events
Size 1KB
SHA256 a2e625c652835b8c78a11dcb4e217bc70733b503e4802b773490c1cd8458251a
MD5 0896281032fa59f452c55d6fe8669a5c
SHA1 6252e13ec048004af7700048d400ae10267b80d8
SHA512 fa71f3b8b6c48816fc5674fa4b07c7e21c832519d787d0babd80a1f4e861a3081733c217199f6ad2b6e39a08dcab603f9cb289a6c6e381e0a419ef386abefa6e
MD5 SHA1 SHA512

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1w73z9rk.default-release\datareporting\glean\events\events
Size 1KB
SHA256 d1216732d8299e986d3648c8d6f6db274c237bde3890b6358b81db94b0ff7370
MD5 ea0351b3dc9734abdc172fe29dce0c0d
SHA1 4691991500d0cf7dd77f7b3b0ccfeaed755729a0
SHA512 b4f9cc66337e291315418d39b3f4a3b70eba67ebffd88df40dbb0e278151a8ffe129ce7d928067166312f6730740fb6a3dffe94c6a6c0d820c673c37d8527680
MD5 SHA1 SHA512

Submit Download

08749a8e-5ca0-4740-bbd1-e948d4adeb6f

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1w73z9rk.default-release\datareporting\glean\pending_pings\08749a8e-5ca0-4740-bbd1-e948d4adeb6f
Size 3KB
SHA256 70ee6f526dbfa1c2950771ac7bda62005e1d9d4d0c7210675e80277926a2b8a8
MD5 cb7f864b4bf2c86c740adfea743417f5
SHA1 0aa866226c8e7aa7cc37e098a0f711f6dc046a79
SHA512 3f98d1d6f1aa3ba8d403f8182091d7c62428e71a3fadc816f1ea2bd3b84d99dabc9577ac0965204176499ac66bae476b026eedd0f3f4c70d1a8674d51c51e58b
MD5 SHA1 SHA512

Submit Download

114a5488-00e1-4edb-acb7-9e54d45fc7e3

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1w73z9rk.default-release\datareporting\glean\pending_pings\114a5488-00e1-4edb-acb7-9e54d45fc7e3
Size 3KB
SHA256 b678054ebf15133e22ef355391eb3ce250fb801010e6951aea9291a5a3f676f8
MD5 04585e8cc1a1b7d4e167b04d8fd3aacd
SHA1 20496e837d0fdda7ecd6dfe5b57fc4026d56e5d5
SHA512 7a084e20e7b8c24c031795c85796fba2ae24655f46af83976b360fe771f643db0f9026eb7777283b616462e8ceef4affb0ee9834f1e213061ce67f3fe763ba84
MD5 SHA1 SHA512

Submit Download

1185311f-0909-4a8b-a149-ca2e367382a8

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1w73z9rk.default-release\datareporting\glean\pending_pings\1185311f-0909-4a8b-a149-ca2e367382a8
Size 3KB
SHA256 410e8a4a050b029ba9ff616704af610073899d6c0bb9ce553694c4586142117b
MD5 dac04935759a58bb914602671a307f7e
SHA1 a057b02c8291b6bf567515878306777ee8b47e65
SHA512 8a61a3cda1a13c322cc5063f9e68ee8947434434bd6426b2a7d2daa2a8294eabac1aefa37c617ab09abee3caa02c0cc7eca6c553f88096da39e40db5a47e4f96
MD5 SHA1 SHA512

Submit Download

1dc0231d-cb5f-4afe-8f82-9ed0634ddefa

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1w73z9rk.default-release\datareporting\glean\pending_pings\1dc0231d-cb5f-4afe-8f82-9ed0634ddefa
Size 2KB
SHA256 eb2cb1d1c6353220196d83c376986de204bcb3f323f09b360a0518514d057677
MD5 6fb4b20c400bf18a8a367e28b534fc5f
SHA1 3373d5e22516687d3597f2dedd4c3f1a5a855622
SHA512 8577534d5a709d2be2ae7680975c32e82ac0638840e63f0faafb361c06825a80e3bcd80253f1ea47baef8563087714b8b66489b75a7eefbf5b83e7398c9f20d8
MD5 SHA1 SHA512

Submit Download

23b9be4e-183e-4a10-b0fc-76d7ff450394

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1w73z9rk.default-release\datareporting\glean\pending_pings\23b9be4e-183e-4a10-b0fc-76d7ff450394
Size 16KB
SHA256 692188ccdc3a33ddf857256bdbe477b564250f7f8aa6e9118444fd49b0a09c0d
MD5 6147588c7ef7c76127e25088d67579ce
SHA1 4757268f30481c8d330d589f24b5909b34c4c5d7
SHA512 c7ebefd654902a79c9bf552bbbd02ca0f10421fae07e3eebac9f07af9c1cf1c8ba42ff0a0bd3a5d93ab672b8e6ca187cbafb96b87e6074bd673611e9f58cec2c
SSDEEP 192:EslXzkmUZJ9AnUQm72xVky5MgbComiFLthPyY0zcM13DyBm5vgFdX7Kczxr+FYGh:XaLVAnhfr0Xyg1ydX7KclrCVxz
MD5 SHA1 SHA512 SSDEEP

Submit Download

324557df-bec3-4787-99a4-2be774069952

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1w73z9rk.default-release\datareporting\glean\pending_pings\324557df-bec3-4787-99a4-2be774069952
Size 3KB
SHA256 091fc204ee7d26922412cfa0890744176a3345ba3c9e96fdea7fb2e12731df75
MD5 aa239a477332d7b090349b65e6129fcf
SHA1 750eac2241a37e17f56e6afed2189f1ae42106db
SHA512 8140399f8ab418be21276ef294c16069dfced042ae947a7686aafe331fb3bef26dce8aaafb247435c2bc5e7df66aa8781e859bb269e55709e2e1a508a37836f1
MD5 SHA1 SHA512

Submit Download

34b55e3d-334f-4769-8e4a-bb0df569aa1c

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1w73z9rk.default-release\datareporting\glean\pending_pings\34b55e3d-334f-4769-8e4a-bb0df569aa1c
Size 3KB
SHA256 7504fd6647ddac49c69ce3e0d2e6ae7956d65a8dcf3c2ae1690b17ae53721bb5
MD5 32201994d8b6a730a1c9c3c0947eb292
SHA1 eb49b99c5271199a0443c3d342e7929129a85f80
SHA512 0be5f272ba2c8de12d5158b11da1f93b2aaf17b4c7de22a5f2ee1134da457ba62ce224454047caa87743136bc5c034c858dc9a13adf9e20e199839bad90d0b1b
MD5 SHA1 SHA512

Submit Download

36c5e033-ba8f-43fd-8243-905b118fb040

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1w73z9rk.default-release\datareporting\glean\pending_pings\36c5e033-ba8f-43fd-8243-905b118fb040
Size 871B
SHA256 3d376e464b41bc516f4c1320b699c426c68a823bf4272f95789468c58f40e7fa
MD5 d1093fd3700bf1afa9152592fb1def6e
SHA1 545076c973dc01d268ec9eb3a87dd2283832d0e2
SHA512 c50ec1c905782ac15fe1d42b8e831fa600265f6dbc75fbb33fb2bf1a73f09494dd97040f48a86629e1d81fbe04945c9b491e10983cb7a60637253d9080425c0b
MD5 SHA1 SHA512

Submit Download

3ab77661-a7bb-41d5-9787-d1aaaf768a10

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1w73z9rk.default-release\datareporting\glean\pending_pings\3ab77661-a7bb-41d5-9787-d1aaaf768a10
Size 3KB
SHA256 b26602eac3a5122aeaeed335ca27b3f5476187cb9a9707094ac76df077c241d7
MD5 9cdfd223a242f4a485e74d8cfd4ab08e
SHA1 d0cd17d459f30dfd09b2dd536e48d36cf4e6455c
SHA512 afcb1259fa5b5937b554edfe9a5c7d2b2e8daee6c2a4bf1391d0ca727862a337de64184395c1bfa3278501c3c7c0020211dad5e05fee07a5c6910fb2fa8e0a7d
MD5 SHA1 SHA512

Submit Download

71ba9134-3416-4e3f-8332-9f47f35ce5fd

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1w73z9rk.default-release\datareporting\glean\pending_pings\71ba9134-3416-4e3f-8332-9f47f35ce5fd
Size 2KB
SHA256 1900188896d20cecb4267a602909e0e2f0782e5f25cbeea2ea9203454e892fc9
MD5 809a00421174f5bb5102dab3600249f3
SHA1 3141f0801f8bf4eb50bbf917ebeda675cfb161a2
SHA512 9c6b7fdc67c46a85beb02d570a82c10e9a6ec19f91966f8dba44d160d9f8ac29b4e6e2ae972977fa05a964ff43291e47f486c6ecb791bf53c1f68907afd21356
MD5 SHA1 SHA512

Submit Download

7326ed32-9469-44c7-b8ac-e5bab3247aca

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1w73z9rk.default-release\datareporting\glean\pending_pings\7326ed32-9469-44c7-b8ac-e5bab3247aca
Size 235B
SHA256 934cbc6e95d8a56df676c4b6f88ed11429227c0c37d394503fada0222f299c24
MD5 70bc66ff43dd2c140c172480d9ed6f38
SHA1 f5c60b4de1f315db900d79734ff6553639094b0e
SHA512 42b7e390d9e3d2dc00ed4ecf6cefbf56947b71b766e3197ded2c9feb09e6a26319c6b3afbf706bc341b98f3ae30d541ec06d92ee1212df3d618e36de3bb1b288
MD5 SHA1 SHA512

Submit Download

7f2641d9-5fa8-45ee-850c-177b7d08c9ba

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1w73z9rk.default-release\datareporting\glean\pending_pings\7f2641d9-5fa8-45ee-850c-177b7d08c9ba
Size 235B
SHA256 1a7baf53c00e2d55bb29e9a180f04fc27b8d6b4e55983b05ed2d0b490beee004
MD5 a7bf81becf453dd2fe6860a7985bc8b7
SHA1 16ebf0b0ba1f1350c40aa1e94847fc236bac5c89
SHA512 ce30f93bd9ff16c865d00d1201746442c5dd719b6238fbfe58600e63e1b91f9f27d0722df8ebb74d2254b53c11679abe06c0e6bae15f5b1a21c2978017ccb1b5
MD5 SHA1 SHA512

Submit Download

809fc4e7-0914-49d9-99da-bfb0147dd99d

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1w73z9rk.default-release\datareporting\glean\pending_pings\809fc4e7-0914-49d9-99da-bfb0147dd99d
Size 3KB
SHA256 153ddbb3c02970a40984d598d6c2a602f563df6c7ad0e8dca958cbc306dc7b17
MD5 216197989e1c7b37f144dce6e5275db6
SHA1 d0ba6b4f4ac2f98fe6aa09c386b363ac0673bcfa
SHA512 822aaec9aec4edb483f289c05f679c602c215717ad346565ea70fdc9119bdd286b49f15acddd2c8191f62770d03c0b927486c6a2b8150ee647d90742f45d39b7
MD5 SHA1 SHA512

Submit Download

899ccd41-9212-418b-94cf-9c8f95de2fef

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1w73z9rk.default-release\datareporting\glean\pending_pings\899ccd41-9212-418b-94cf-9c8f95de2fef
Size 3KB
SHA256 b28206ebccc8abc64e65d2f0dbd65c60f3ee354a2c1931c9c60092b39e24a5a7
MD5 28f96fa7632597f12fed1e1f1d50fa7e
SHA1 9bb235a8fbdbcae8c2ee44f6f756c7870ba2c9b7
SHA512 54f4f9d864451876e29fd97d3aba9b754b52496e48f26d76d01aa46ae8ef4dd38e70f29b8e663021584997f6e79e540be8b0d4dea873c625664a172fe0d8dabb
MD5 SHA1 SHA512

Submit Download

9c6795ae-4bd4-41e7-8c60-838d9171c255

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1w73z9rk.default-release\datareporting\glean\pending_pings\9c6795ae-4bd4-41e7-8c60-838d9171c255
Size 235B
SHA256 c85258ab439c0c1871ab4a537431c10914a6309998afcac5ff48cea74b50fa77
MD5 6e7b69a3edec5e54fe04a3bb9fb6fb3d
SHA1 76d2aa1fce32a797de774affd8796e6424601121
SHA512 3fe9cb4fe6fefed023c74fb2a44aaa69048aeeeb16afa327c325f1e2bb5a2026b0b4436e66a72d3970209904a8d87f82478eca0617f409a3bfc069eb072e5a91
MD5 SHA1 SHA512

Submit Download

a5c68f5b-2b03-45b9-bb52-bed174c55f98

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1w73z9rk.default-release\datareporting\glean\pending_pings\a5c68f5b-2b03-45b9-bb52-bed174c55f98
Size 886B
SHA256 bf420d3429805498226c1e40dfc8c7712064219f6c7a66d81ef97e3da52611e6
MD5 1f693d4d3b49af6a2e088f44d51e4e6d
SHA1 3fc6d12546ca8a83f40b7cc52235b7a4a61fbe83
SHA512 a500f35b7c1b83d7817a0651ea681b12b9db88b0055623709acfbc63d11418a144faf8ed812b6304a826e145e828cae38cfd3058237fa25324da116386426256
MD5 SHA1 SHA512

Submit Download

e9d0081d-ba89-4e97-8bd1-f610652de019

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1w73z9rk.default-release\datareporting\glean\pending_pings\e9d0081d-ba89-4e97-8bd1-f610652de019
Size 896B
SHA256 17357fdb1bd58a37b8de2a8f002be1b8d0111e4f59a1148923aeb8a771af64dd
MD5 23ff0250acd7f63b952dfadd61db8988
SHA1 68def542b7c164267e9a455588c5253a10d0a000
SHA512 ce62346e3f86f2d5772d406c86ed931aee86317c32163fc09fef7abb63e7bd4a780cbe7cf8cdbb9290db87d1a47406ef1e40997b3794bb360406a4bc7f3dfd4e
MD5 SHA1 SHA512

Submit Download

ed5e8e16-316d-4484-8739-c6bf86721261

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1w73z9rk.default-release\datareporting\glean\pending_pings\ed5e8e16-316d-4484-8739-c6bf86721261
Size 883B
SHA256 702d0642233826806ddb2bca762af4f9101914594cc44ed94318b7bfe9a439f3
MD5 4a68c37b5a3579782ae9e75cf41f89ea
SHA1 773d069e5e4e75895a648081a82bc284dbbd9520
SHA512 68ce3535ce72688ab6023d9ac66c9020a12f2e9e104d9cfdbd3b6499da1fb942321c92522a1cb9b061e364dcb533e73a772da75024d9b063f82e6b9f939855d8
MD5 SHA1 SHA512

Submit Download

f7443bf0-f4ec-4693-803a-813cb6a421e4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1w73z9rk.default-release\datareporting\glean\pending_pings\f7443bf0-f4ec-4693-803a-813cb6a421e4
Size 3KB
SHA256 978df679d578faee236e43d136c42e6151ee7015de27ae071599731ddecf2dfb
MD5 d440dc3bc265603c08c57b55658b0601
SHA1 032e7101b7d5af69335732ef15ee569b2a9104b4
SHA512 05103fad772a7cf9aab6fc308cb65787a2d91cf8553e765c7a16c5ee69408e6dc7e6c51c28758f5792abad53187dd66440c7cb5700b88867695941f4cd8eb28e
MD5 SHA1 SHA512

Submit Download

fbfc392a-e429-4a87-904d-b8ad822514c4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1w73z9rk.default-release\datareporting\glean\pending_pings\fbfc392a-e429-4a87-904d-b8ad822514c4
Size 235B
SHA256 353ed5b8408a6c84c7bab17c157edb545d452324e0384472b17a32df12056513
MD5 6cf87c3aaac9eeaca2af938096333b6e
SHA1 ceeb1d0a1a5d2553965bdc50d5b295d17297a842
SHA512 d099b5b344e74462aa43bc310737f98cb35980a4305336a8d9f40655d7cabd1fa1082ffdd2aca3159493554b47a63d2e25ba8b4b649da7a9d89d3bac3aa9f3a5
MD5 SHA1 SHA512

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1w73z9rk.default-release\prefs-1.js
Size 6KB
SHA256 b807ea8e65109a0adc3ff642d8b36b89343e08d2a596c54fd6cd932ce5c0abe9
MD5 49636a4c50abaf74adbcc2d931f8c0b6
SHA1 2b59f366caeec49098e62d67c68b637f2e8322a9
SHA512 0f026a2bf1a74e2b01c345a3a3718f0844dc336c5adcae32cbe5f14272881638e2cf55906a807ab006ae222681cf6633fab703b95a18be0b614cfecefe8ef6aa
SSDEEP 96:xHZIUTUTvqGqRfpK2nl1zS4SSlDsdv9jcEndHLdBw88n8L4cncd4s:TIjiRRfpplxSStULdBw88t
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1w73z9rk.default-release\prefs.js
Size 6KB
SHA256 b8c5af36c35e0ca936965cef20b152b00c2d3d75026189ed171214f6bdac9b75
MD5 1cd208149520ec72d8833a82b3a86a41
SHA1 6cd7e2eefde213d10cb3c72fb4488b2516af4cb7
SHA512 6a491aff231a1d7a4b6d2b51439fa76e071dee5eaa189e1b7f9d62c81f8c40b8b3aaa8eede8d244476a5a05410c4e317d758da9fbc7f9200ca02035b62a53039
SSDEEP 96:xHZIUTUTvqGqRfpK3n/1zSZuSSlDsdv9jSYEfndHLdBw88n8L4cncDs:TIjiRRfpY/dSStnBpLdBw88C
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1w73z9rk.default-release\prefs.js
Size 6KB
SHA256 b50f9c7c072856760ef33bc8cb53245039488d02157fa50cefdbefaabccd1819
MD5 f48d916366edb351e86d83b2a80dbc0f
SHA1 19c274c8dbaac3d8c1665b6e8ac8c8d6559b72e9
SHA512 e3b79736283098ac0ed5330a7dba691aca2e4aea0d6a52d0086025a30adc4ab5349219f539d5a3ecae7f33631f8f5456e3ccae37fc3f7c4d80b01ee03e59e0b5
SSDEEP 96:xHZIUTUTvqGqRfpK2nl1zSHSSlDsdv9jcEndHLdBw88n8L4cncd4s:TIjiRRfpplaSStULdBw88t
MD5 SHA1 SHA512 SSDEEP

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1w73z9rk.default-release\sessionCheckpoints.json
Size 53B
SHA256 792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da
MD5 ea8b62857dfdbd3d0be7d7e4a954ec9a
SHA1 b43bc4b3ea206a02ef8f63d5bfad0c96bf2a3b2a
SHA512 076ee83534f42563046d25086166f82e1a3ec61840c113aec67abe2d8195daa247d827d0c54e7e8f8a1bbf2d082a3763577587e84342ec160ff97905243e6d19
MD5 SHA1 SHA512

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1w73z9rk.default-release\sessionCheckpoints.json
Size 90B
SHA256 00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2
MD5 c4ab2ee59ca41b6d6a6ea911f35bdc00
SHA1 5942cd6505fc8a9daba403b082067e1cdefdfbc4
SHA512 71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2
MD5 SHA1 SHA512

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1w73z9rk.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 3.3MB
SHA256 20f2697aed1b3cb771f4d838288bc2153efca4ca86bc69e2245d10c097bc0909
MD5 0de35069c3977d433c34652e8a84c92f
SHA1 0b6f8c4d636d713f330d21dca94e3e0b0d4488bb
SHA512 21f4724c18aeb6c030a841bbcb2f58406e005ce596723b584b8ca8e8028a778547d96ba052c8352b07c80a924a63f99c9384eb9800c2486556ce02af456c257d
SSDEEP 12288:tEBaP32nfvuYywYHJ/3w5QtZLOcwXIpd73uCdjbeo5ul7QfnJuphdTP2nNiK0Qz:+gu37/MZLOcjaCIoslkfnU5TPao
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1444-553-0x00000000005C0000-0x00000000005C1000-memory.dmp

Download

memory/2152-8-0x00000000072D0000-0x00000000073CA000-memory.dmp

Download

memory/2152-7-0x0000000005820000-0x0000000005830000-memory.dmp

Download

memory/2152-0-0x0000000000E50000-0x0000000000F84000-memory.dmp

Download

memory/2152-6-0x0000000005DE0000-0x0000000005DEE000-memory.dmp

Download

memory/2152-5-0x0000000005B40000-0x0000000005BDC000-memory.dmp

Download

memory/2152-4-0x0000000005840000-0x000000000584A000-memory.dmp

Download

memory/2152-3-0x0000000005820000-0x0000000005830000-memory.dmp

Download

memory/2152-2-0x0000000005870000-0x0000000005902000-memory.dmp

Download

memory/2152-1-0x0000000005E20000-0x00000000063C4000-memory.dmp

Download

memory/4384-187-0x0000000001660000-0x0000000001760000-memory.dmp

Download

memory/4384-236-0x0000000006620000-0x0000000006720000-memory.dmp

Download

memory/4384-237-0x0000000001660000-0x0000000001760000-memory.dmp

Download

memory/4384-238-0x0000000001660000-0x0000000001760000-memory.dmp

Download

memory/4384-241-0x0000000001660000-0x0000000001760000-memory.dmp

Download

memory/4384-242-0x0000000006620000-0x0000000006720000-memory.dmp

Download

memory/4384-243-0x0000000001660000-0x0000000001760000-memory.dmp

Download

memory/4384-244-0x0000000001660000-0x0000000001760000-memory.dmp

Download

memory/4384-245-0x0000000006620000-0x0000000006720000-memory.dmp

Download

memory/4384-247-0x0000000001660000-0x0000000001760000-memory.dmp

Download

memory/4384-248-0x0000000006620000-0x0000000006720000-memory.dmp

Download

memory/4384-249-0x0000000001660000-0x0000000001760000-memory.dmp

Download

memory/4384-250-0x0000000001660000-0x0000000001760000-memory.dmp

Download

memory/4384-251-0x0000000001660000-0x0000000001760000-memory.dmp

Download

memory/4384-256-0x0000000001660000-0x0000000001760000-memory.dmp

Download

memory/4384-257-0x0000000006620000-0x0000000006720000-memory.dmp

Download

memory/4384-259-0x0000000001660000-0x0000000001760000-memory.dmp

Download

memory/4384-260-0x0000000006620000-0x0000000006720000-memory.dmp

Download

memory/4384-261-0x0000000006620000-0x0000000006720000-memory.dmp

Download

memory/4384-265-0x0000000001660000-0x0000000001760000-memory.dmp

Download

memory/4384-266-0x0000000001660000-0x0000000001760000-memory.dmp

Download

memory/4384-267-0x0000000006620000-0x0000000006720000-memory.dmp

Download

memory/4384-269-0x0000000001660000-0x0000000001760000-memory.dmp

Download

memory/4384-270-0x0000000001660000-0x0000000001760000-memory.dmp

Download

memory/4384-271-0x0000000006620000-0x0000000006720000-memory.dmp

Download

memory/4384-272-0x0000000001660000-0x0000000001760000-memory.dmp

Download

memory/4384-273-0x0000000001660000-0x0000000001760000-memory.dmp

Download

memory/4384-274-0x0000000006620000-0x0000000006720000-memory.dmp

Download

memory/4384-279-0x0000000006620000-0x0000000006720000-memory.dmp

Download

memory/4384-275-0x0000000001660000-0x0000000001760000-memory.dmp

Download

memory/4384-268-0x0000000001660000-0x0000000001760000-memory.dmp

Download

memory/4384-258-0x0000000001660000-0x0000000001760000-memory.dmp

Download

memory/4384-252-0x0000000006620000-0x0000000006720000-memory.dmp

Download

memory/4384-253-0x0000000001660000-0x0000000001760000-memory.dmp

Download

memory/4384-246-0x0000000001660000-0x0000000001760000-memory.dmp

Download

memory/4384-240-0x0000000001660000-0x0000000001760000-memory.dmp

Download

memory/4384-239-0x0000000006620000-0x0000000006720000-memory.dmp

Download

memory/4384-235-0x0000000001660000-0x0000000001760000-memory.dmp

Download

memory/4384-194-0x0000000001660000-0x0000000001760000-memory.dmp

Download

memory/4384-197-0x0000000006620000-0x0000000006720000-memory.dmp

Download

memory/4384-198-0x0000000006620000-0x0000000006720000-memory.dmp

Download

memory/4384-200-0x0000000001660000-0x0000000001760000-memory.dmp

Download

memory/4384-201-0x0000000001660000-0x0000000001760000-memory.dmp

Download

memory/4384-206-0x0000000006620000-0x0000000006720000-memory.dmp

Download

memory/4384-207-0x0000000001660000-0x0000000001760000-memory.dmp

Download

memory/4384-208-0x0000000001660000-0x0000000001760000-memory.dmp

Download

memory/4384-215-0x0000000001660000-0x0000000001760000-memory.dmp

Download

memory/4384-216-0x0000000006620000-0x0000000006720000-memory.dmp

Download

memory/4384-217-0x0000000001660000-0x0000000001760000-memory.dmp

Download

memory/4384-218-0x0000000001660000-0x0000000001760000-memory.dmp

Download

memory/4384-220-0x0000000006620000-0x0000000006720000-memory.dmp

Download

memory/4384-209-0x0000000001660000-0x0000000001760000-memory.dmp

Download

memory/4384-210-0x0000000006620000-0x0000000006720000-memory.dmp

Download

memory/4384-202-0x0000000001660000-0x0000000001760000-memory.dmp

Download

memory/4384-199-0x0000000001660000-0x0000000001760000-memory.dmp

Download

memory/4384-181-0x0000000006620000-0x0000000006720000-memory.dmp

Download

memory/4384-188-0x0000000001660000-0x0000000001760000-memory.dmp

Download

memory/4384-189-0x0000000001660000-0x0000000001760000-memory.dmp

Download

memory/4384-190-0x0000000001660000-0x0000000001760000-memory.dmp

Download

memory/4384-191-0x0000000006620000-0x0000000006720000-memory.dmp

Download

memory/4384-183-0x0000000006620000-0x0000000006720000-memory.dmp

Download

memory/4384-182-0x0000000001660000-0x0000000001760000-memory.dmp

Download

memory/4384-178-0x0000000001660000-0x0000000001760000-memory.dmp

Download

memory/4384-158-0x00000000059D0000-0x00000000059E0000-memory.dmp

Download

memory/4384-152-0x0000000001660000-0x0000000001760000-memory.dmp

Download

memory/4384-153-0x0000000001660000-0x0000000001760000-memory.dmp

Download

memory/4384-164-0x0000000001660000-0x0000000001760000-memory.dmp

Download

memory/4384-171-0x0000000001660000-0x0000000001760000-memory.dmp

Download

memory/4384-172-0x0000000006620000-0x0000000006720000-memory.dmp

Download

memory/4384-170-0x0000000001660000-0x0000000001760000-memory.dmp

Download

memory/4384-165-0x0000000001660000-0x0000000001760000-memory.dmp

Download

memory/4384-166-0x0000000006620000-0x0000000006720000-memory.dmp

Download

memory/4384-154-0x0000000006620000-0x0000000006720000-memory.dmp

Download

memory/4384-159-0x0000000001660000-0x0000000001760000-memory.dmp

Download

memory/4384-160-0x0000000006620000-0x0000000006720000-memory.dmp

Download

memory/4384-155-0x0000000001660000-0x0000000001760000-memory.dmp

Download

memory/4384-134-0x0000000001660000-0x0000000001760000-memory.dmp

Download

memory/4384-135-0x0000000006620000-0x0000000006720000-memory.dmp

Download

memory/4384-18-0x0000000005E10000-0x0000000005E2E000-memory.dmp

Download

memory/4384-17-0x00000000070B0000-0x00000000075DC000-memory.dmp

Download

memory/4384-16-0x00000000068E0000-0x0000000006930000-memory.dmp

Download

memory/4384-15-0x0000000006860000-0x00000000068D6000-memory.dmp

Download

memory/4384-14-0x00000000069B0000-0x0000000006B72000-memory.dmp

Download

memory/4384-13-0x0000000006720000-0x00000000067D2000-memory.dmp

Download

memory/4384-12-0x00000000065B0000-0x0000000006616000-memory.dmp

Download

memory/4384-11-0x00000000059D0000-0x00000000059E0000-memory.dmp

Download

memory/4384-9-0x0000000000400000-0x00000000004BE000-memory.dmp

Download

memory/4888-543-0x0000000000220000-0x0000000000221000-memory.dmp

Download

memory/5476-147-0x0000018553360000-0x000001855336E000-memory.dmp

Download