phantom_stealer | c0b1fa407b6f1c7a2c0636febc35adf5494f887dd5001be9bd5fab0870ad2ecd

Analysis

max time kernel
148s
max time network
134s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/02/2026, 10:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ENCRYPTED.ps1
Size 3.6MB
Sample260204-mk2hqsd17f
SHA256 c0b1fa407b6f1c7a2c0636febc35adf5494f887dd5001be9bd5fab0870ad2ecd
MD5 e3db684c7e87dd0ea46c7207bbcd84d9
SHA1 b1c9a334b89d1c48e92d0dfb553e81ab4305f9c0
SHA512 3712ac2d0f7b07cc90bfa095134743e938c6de48cacad968c58f47e383f041f94e48b5bed1c1262e544f85d72add98179b7f4cee8cfa8532ff42d5ddcf34119e
SSDEEP 49152:Hi+wnr/Z9fvKP07wqth2hGCN9o2Fby4eZ1zAA/QMOPL:n
TLSH
T11A061100D962DEA4065C912424AA1E8A25510EBB0C583B793F9F5F9E1F9F20FD0797FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

collection discovery execution phantom_stealer persistence stealer

Malware Config

Extracted

Credentials

Protocol
smtp
Host
uzgidro.fun
Port
587
Username
[email protected]
Password
=)[0GsTA+$N-

Extracted

Family

phantom_stealer

Version

v3.5.0

Credentials

Protocol
smtp
Host
uzgidro.fun
Port
587
Username
[email protected]
Password
=)[0GsTA+$N-
Email to
[email protected]

Mutex

KS38GTLV16DL0YZZ5I9F

Attributes

anti_analysis
0
cb_enables_ssl
1
debug
0
keylogger
1
start_delay
0
startup
0

Signatures

Detects PhantomStealer payload 1 IoCs

resource	yara_rule
behavioral2/memory/2560-15-0x0000000000400000-0x00000000004BE000-memory.dmp	family_phantomstealer

PhantomStealer
Phantom Stealer is a stealer written in C#, forked from the Stealerium family.
stealer phantom_stealer
Phantom_stealer family
phantom_stealer

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Aspnet_compiler.exe
Key opened	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Aspnet_compiler.exe
Key opened	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Aspnet_compiler.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	icanhazip.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4700 set thread context of 2560	4700	PowerShell.exe	84

Drops file in Windows directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp\Crashpad\metadata	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp\chrome_installer.log	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\settings.dat	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\settings.dat	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File opened for modification	C:\Windows\SystemTemp	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\metadata	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\chrome_installer.log	chrmstp.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4700	PowerShell.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aspnet_compiler.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4896	chrome.exe
5984	msedge.exe

Checks processor information in registry 2 TTPs 20 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	Aspnet_compiler.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	Aspnet_compiler.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134146747576851735"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	chrmstp.exe
Key created	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4700	PowerShell.exe
4700	PowerShell.exe
4700	PowerShell.exe
4700	PowerShell.exe
2560	Aspnet_compiler.exe
2560	Aspnet_compiler.exe
1528	chrome.exe
1528	chrome.exe
4700	PowerShell.exe
4700	PowerShell.exe
2560	Aspnet_compiler.exe
2560	Aspnet_compiler.exe
2560	Aspnet_compiler.exe
2560	Aspnet_compiler.exe
2560	Aspnet_compiler.exe
2560	Aspnet_compiler.exe
4700	PowerShell.exe
4700	PowerShell.exe
2560	Aspnet_compiler.exe
2560	Aspnet_compiler.exe
2560	Aspnet_compiler.exe
5612	firefox.exe
5612	firefox.exe
5612	firefox.exe
5612	firefox.exe
5612	firefox.exe
5612	firefox.exe
5612	firefox.exe
5612	firefox.exe
5612	firefox.exe
5612	firefox.exe
5612	firefox.exe
5612	firefox.exe
5612	firefox.exe
5612	firefox.exe
5612	firefox.exe
5612	firefox.exe
4700	PowerShell.exe
5612	firefox.exe
5612	firefox.exe
5612	firefox.exe
5612	firefox.exe
4700	PowerShell.exe
2560	Aspnet_compiler.exe
2560	Aspnet_compiler.exe
2560	Aspnet_compiler.exe
2560	Aspnet_compiler.exe
2560	Aspnet_compiler.exe
2560	Aspnet_compiler.exe
4700	PowerShell.exe
2560	Aspnet_compiler.exe
2560	Aspnet_compiler.exe
2560	Aspnet_compiler.exe
4700	PowerShell.exe
4700	PowerShell.exe
4700	PowerShell.exe
4700	PowerShell.exe
4700	PowerShell.exe
4700	PowerShell.exe
4700	PowerShell.exe
4700	PowerShell.exe
4700	PowerShell.exe
4700	PowerShell.exe
4700	PowerShell.exe

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeDebugPrivilege	4700	PowerShell.exe
Token: SeDebugPrivilege	2560	Aspnet_compiler.exe
Token: SeShutdownPrivilege	1528	chrome.exe
Token: SeCreatePagefilePrivilege	1528	chrome.exe
Token: SeShutdownPrivilege	1528	chrome.exe
Token: SeCreatePagefilePrivilege	1528	chrome.exe
Token: SeShutdownPrivilege	1528	chrome.exe
Token: SeCreatePagefilePrivilege	1528	chrome.exe
Token: SeShutdownPrivilege	1528	chrome.exe
Token: SeCreatePagefilePrivilege	1528	chrome.exe
Token: SeShutdownPrivilege	1528	chrome.exe
Token: SeCreatePagefilePrivilege	1528	chrome.exe
Token: SeShutdownPrivilege	1528	chrome.exe
Token: SeCreatePagefilePrivilege	1528	chrome.exe
Token: SeShutdownPrivilege	1528	chrome.exe
Token: SeCreatePagefilePrivilege	1528	chrome.exe
Token: SeShutdownPrivilege	1528	chrome.exe
Token: SeCreatePagefilePrivilege	1528	chrome.exe

Suspicious use of FindShellTrayWindow 12 IoCs

pid	Process
1528	chrome.exe
1528	chrome.exe
2736	chrmstp.exe
5612	firefox.exe
5612	firefox.exe
5612	firefox.exe
5612	firefox.exe
5612	firefox.exe
5612	firefox.exe
5612	firefox.exe
5612	firefox.exe
5824	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5612	firefox.exe
2560	Aspnet_compiler.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4700 wrote to memory of 2560	4700	PowerShell.exe	84
PID 4700 wrote to memory of 2560	4700	PowerShell.exe	84
PID 4700 wrote to memory of 2560	4700	PowerShell.exe	84
PID 4700 wrote to memory of 2560	4700	PowerShell.exe	84
PID 4700 wrote to memory of 2560	4700	PowerShell.exe	84
PID 2560 wrote to memory of 1528	2560	Aspnet_compiler.exe	86
PID 1528 wrote to memory of 1380	1528	chrome.exe	87
PID 1528 wrote to memory of 4756	1528	chrome.exe	88
PID 1528 wrote to memory of 4896	1528	chrome.exe	89
PID 1528 wrote to memory of 944	1528	chrome.exe	90
PID 1528 wrote to memory of 5308	1528	chrome.exe	117
PID 1528 wrote to memory of 5348	1528	chrome.exe	92
PID 1528 wrote to memory of 5376	1528	chrome.exe	93
PID 1528 wrote to memory of 5484	1528	chrome.exe	94
PID 1528 wrote to memory of 2852	1528	chrome.exe	95
PID 2560 wrote to memory of 4896	2560	Aspnet_compiler.exe	89
PID 2560 wrote to memory of 4896	2560	Aspnet_compiler.exe	89
PID 1528 wrote to memory of 5956	1528	chrome.exe	96
PID 2560 wrote to memory of 944	2560	Aspnet_compiler.exe	90
PID 2560 wrote to memory of 944	2560	Aspnet_compiler.exe	90
PID 2560 wrote to memory of 1528	2560	Aspnet_compiler.exe	86
PID 2560 wrote to memory of 1528	2560	Aspnet_compiler.exe	86
PID 1528 wrote to memory of 4972	1528	chrome.exe	97
PID 1528 wrote to memory of 2440	1528	chrome.exe	98
PID 2560 wrote to memory of 4756	2560	Aspnet_compiler.exe	88
PID 2560 wrote to memory of 4756	2560	Aspnet_compiler.exe	88
PID 1528 wrote to memory of 4392	1528	chrome.exe	99
PID 2560 wrote to memory of 1380	2560	Aspnet_compiler.exe	87
PID 2560 wrote to memory of 1380	2560	Aspnet_compiler.exe	87
PID 2560 wrote to memory of 4896	2560	Aspnet_compiler.exe	89
PID 2560 wrote to memory of 4896	2560	Aspnet_compiler.exe	89
PID 2560 wrote to memory of 5484	2560	Aspnet_compiler.exe	94
PID 2560 wrote to memory of 5484	2560	Aspnet_compiler.exe	94
PID 2560 wrote to memory of 5348	2560	Aspnet_compiler.exe	92
PID 2560 wrote to memory of 5348	2560	Aspnet_compiler.exe	92
PID 2560 wrote to memory of 944	2560	Aspnet_compiler.exe	90
PID 2560 wrote to memory of 944	2560	Aspnet_compiler.exe	90
PID 2560 wrote to memory of 2852	2560	Aspnet_compiler.exe	95
PID 2560 wrote to memory of 2852	2560	Aspnet_compiler.exe	95
PID 2560 wrote to memory of 5376	2560	Aspnet_compiler.exe	93
PID 2560 wrote to memory of 5376	2560	Aspnet_compiler.exe	93
PID 2560 wrote to memory of 5956	2560	Aspnet_compiler.exe	96
PID 2560 wrote to memory of 5956	2560	Aspnet_compiler.exe	96
PID 2560 wrote to memory of 1528	2560	Aspnet_compiler.exe	86
PID 2560 wrote to memory of 1528	2560	Aspnet_compiler.exe	86
PID 2560 wrote to memory of 4756	2560	Aspnet_compiler.exe	88
PID 2560 wrote to memory of 4756	2560	Aspnet_compiler.exe	88
PID 2560 wrote to memory of 1380	2560	Aspnet_compiler.exe	87
PID 2560 wrote to memory of 1380	2560	Aspnet_compiler.exe	87
PID 2560 wrote to memory of 4896	2560	Aspnet_compiler.exe	89
PID 2560 wrote to memory of 4896	2560	Aspnet_compiler.exe	89
PID 2560 wrote to memory of 5484	2560	Aspnet_compiler.exe	94
PID 2560 wrote to memory of 5484	2560	Aspnet_compiler.exe	94
PID 2560 wrote to memory of 5348	2560	Aspnet_compiler.exe	92
PID 2560 wrote to memory of 5348	2560	Aspnet_compiler.exe	92
PID 2560 wrote to memory of 944	2560	Aspnet_compiler.exe	90
PID 2560 wrote to memory of 944	2560	Aspnet_compiler.exe	90
PID 2560 wrote to memory of 2852	2560	Aspnet_compiler.exe	95
PID 2560 wrote to memory of 2852	2560	Aspnet_compiler.exe	95
PID 2560 wrote to memory of 5376	2560	Aspnet_compiler.exe	93
PID 2560 wrote to memory of 5376	2560	Aspnet_compiler.exe	93
PID 2560 wrote to memory of 5956	2560	Aspnet_compiler.exe	96
PID 2560 wrote to memory of 5956	2560	Aspnet_compiler.exe	96
PID 2560 wrote to memory of 1528	2560	Aspnet_compiler.exe	86

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Aspnet_compiler.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Aspnet_compiler.exe

C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\ENCRYPTED.ps1
1⤵
- Suspicious use of SetThreadContext
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4700
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\Aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Aspnet_compiler.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - outlook_office_path
  - outlook_win_path
  PID:2560
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\i3vizyzx.suk"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1528
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\i3vizyzx.suk /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\i3vizyzx.suk\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\i3vizyzx.suk --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ff93f82c728,0x7ff93f82c734,0x7ff93f82c740
      4⤵
      PID:1380
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\i3vizyzx.suk" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1620,i,3941922396583730555,7161550371693119407,262144 --field-trial-handle=1928,i,12024868353020575731,176002816966161040,262144 --variations-seed-version --mojo-platform-channel-handle=1924 /prefetch:2
      4⤵
      PID:4756
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\i3vizyzx.suk" --force-high-res-timeticks=disabled --metrics-shmem-handle=2020,i,13390696734815429179,6519846449743163611,524288 --field-trial-handle=1928,i,12024868353020575731,176002816966161040,262144 --variations-seed-version --mojo-platform-channel-handle=2016 /prefetch:11
      4⤵
      System Time Discovery
      PID:4896
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\i3vizyzx.suk" --force-high-res-timeticks=disabled --metrics-shmem-handle=2156,i,16971448270583228106,703245061923904512,524288 --field-trial-handle=1928,i,12024868353020575731,176002816966161040,262144 --variations-seed-version --mojo-platform-channel-handle=2364 /prefetch:13
      4⤵
      PID:944
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\i3vizyzx.suk" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2896,i,14556766990283632968,11840464437608564864,2097152 --field-trial-handle=1928,i,12024868353020575731,176002816966161040,262144 --variations-seed-version --mojo-platform-channel-handle=2904 /prefetch:1
      4⤵
      PID:5308
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\i3vizyzx.suk" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2920,i,14899110289375862688,6291100992591337673,2097152 --field-trial-handle=1928,i,12024868353020575731,176002816966161040,262144 --variations-seed-version --mojo-platform-channel-handle=2852 /prefetch:1
      4⤵
      PID:5348
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\i3vizyzx.suk" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3064,i,6536938691166298763,16978616041613876677,2097152 --field-trial-handle=1928,i,12024868353020575731,176002816966161040,262144 --variations-seed-version --mojo-platform-channel-handle=2860 /prefetch:1
      4⤵
      PID:5376
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\i3vizyzx.suk" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3140,i,4247587649374286683,10758148989741571266,2097152 --field-trial-handle=1928,i,12024868353020575731,176002816966161040,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:9
      4⤵
      PID:5484
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\i3vizyzx.suk" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=3668,i,13564635598781969409,8181200034967161500,2097152 --field-trial-handle=1928,i,12024868353020575731,176002816966161040,262144 --variations-seed-version --mojo-platform-channel-handle=3808 /prefetch:9
      4⤵
      PID:2852
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\i3vizyzx.suk" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4196,i,5759585112811695385,10044686254117815472,2097152 --field-trial-handle=1928,i,12024868353020575731,176002816966161040,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:1
      4⤵
      PID:5956
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\i3vizyzx.suk" --force-high-res-timeticks=disabled --metrics-shmem-handle=4176,i,13551153831232961403,14533719971542615956,524288 --field-trial-handle=1928,i,12024868353020575731,176002816966161040,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:14
      4⤵
      PID:4972
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\i3vizyzx.suk" --force-high-res-timeticks=disabled --metrics-shmem-handle=4292,i,4685270638281515695,10795750331444065551,524288 --field-trial-handle=1928,i,12024868353020575731,176002816966161040,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:14
      4⤵
      PID:2440
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\i3vizyzx.suk" --force-high-res-timeticks=disabled --metrics-shmem-handle=4596,i,14011664935159963725,5801854316222059667,524288 --field-trial-handle=1928,i,12024868353020575731,176002816966161040,262144 --variations-seed-version --mojo-platform-channel-handle=4608 /prefetch:14
      4⤵
      PID:4392
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\i3vizyzx.suk" --force-high-res-timeticks=disabled --metrics-shmem-handle=5052,i,270347588180645589,15541340182248816030,524288 --field-trial-handle=1928,i,12024868353020575731,176002816966161040,262144 --variations-seed-version --mojo-platform-channel-handle=5056 /prefetch:14
      4⤵
      PID:2968
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\i3vizyzx.suk" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5156,i,991969857179148307,18124391606072869729,2097152 --field-trial-handle=1928,i,12024868353020575731,176002816966161040,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:1
      4⤵
      PID:1808
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\i3vizyzx.suk" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5168,i,15423523882197965414,14278313390627739266,2097152 --field-trial-handle=1928,i,12024868353020575731,176002816966161040,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:1
      4⤵
      PID:3760
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\i3vizyzx.suk" --force-high-res-timeticks=disabled --metrics-shmem-handle=5244,i,9394629713065632288,12907196929140451315,524288 --field-trial-handle=1928,i,12024868353020575731,176002816966161040,262144 --variations-seed-version --mojo-platform-channel-handle=5252 /prefetch:14
      4⤵
      PID:2548
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\i3vizyzx.suk" --force-high-res-timeticks=disabled --metrics-shmem-handle=5300,i,972265545133926475,16158581508599521561,524288 --field-trial-handle=1928,i,12024868353020575731,176002816966161040,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:14
      4⤵
      PID:2148
  - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
      4⤵
      Drops file in Windows directory
      PID:3676
    - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x244,0x248,0x24c,0x220,0x250,0x7ff778e655a0,0x7ff778e655ac,0x7ff778e655b8
        5⤵
        Drops file in Windows directory
        
        PID:228
    - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\initial_preferences" --create-shortcuts=1 --install-level=0
        5⤵
        Drops file in Windows directory
        Modifies registry class
        Suspicious use of FindShellTrayWindow
        
        PID:2736
      - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x244,0x248,0x24c,0x220,0x250,0x7ff778e655a0,0x7ff778e655ac,0x7ff778e655b8
        6⤵
        Drops file in Windows directory
        
        PID:4916
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\i3vizyzx.suk" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=5148,i,11285038911548985101,5393430087527359630,2097152 --field-trial-handle=1928,i,12024868353020575731,176002816966161040,262144 --variations-seed-version --mojo-platform-channel-handle=5320 /prefetch:1
      4⤵
      PID:6012
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\i3vizyzx.suk" --force-high-res-timeticks=disabled --metrics-shmem-handle=5416,i,10885290715403288636,14200209582481609667,524288 --field-trial-handle=1928,i,12024868353020575731,176002816966161040,262144 --variations-seed-version --mojo-platform-channel-handle=5328 /prefetch:14
      4⤵
      PID:1552
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\i3vizyzx.suk" --force-high-res-timeticks=disabled --metrics-shmem-handle=5456,i,9105947807881784175,1795853730475581756,524288 --field-trial-handle=1928,i,12024868353020575731,176002816966161040,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:14
      4⤵
      PID:2136
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\i3vizyzx.suk" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=5232,i,15096752119440144753,7522736522820764809,2097152 --field-trial-handle=1928,i,12024868353020575731,176002816966161040,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:1
      4⤵
      PID:6044
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\i3vizyzx.suk" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=5592,i,13482744883003027722,8289971052506823783,2097152 --field-trial-handle=1928,i,12024868353020575731,176002816966161040,262144 --variations-seed-version --mojo-platform-channel-handle=5560 /prefetch:1
      4⤵
      PID:5524
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\i3vizyzx.suk" --force-high-res-timeticks=disabled --metrics-shmem-handle=5444,i,13032600976631829207,1005932245730129485,524288 --field-trial-handle=1928,i,12024868353020575731,176002816966161040,262144 --variations-seed-version --mojo-platform-channel-handle=5320 /prefetch:14
      4⤵
      PID:5364
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\i3vizyzx.suk" --force-high-res-timeticks=disabled --metrics-shmem-handle=5460,i,6098794084678484534,6055333017950432452,524288 --field-trial-handle=1928,i,12024868353020575731,176002816966161040,262144 --variations-seed-version --mojo-platform-channel-handle=5276 /prefetch:14
      4⤵
      PID:3912
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\i3vizyzx.suk" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=5192,i,459922458821204892,7582572182731141030,2097152 --field-trial-handle=1928,i,12024868353020575731,176002816966161040,262144 --variations-seed-version --mojo-platform-channel-handle=5232 /prefetch:1
      4⤵
      PID:5308
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\i3vizyzx.suk" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=5068,i,8439082740369331255,9996389676637304107,2097152 --field-trial-handle=1928,i,12024868353020575731,176002816966161040,262144 --variations-seed-version --mojo-platform-channel-handle=5288 /prefetch:1
      4⤵
      PID:5340
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\i3vizyzx.suk" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=5556,i,14546091232516942067,1834920609902418436,2097152 --field-trial-handle=1928,i,12024868353020575731,176002816966161040,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:1
      4⤵
      PID:5400
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\i3vizyzx.suk" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=5504,i,870177992284498928,5751441208299949096,2097152 --field-trial-handle=1928,i,12024868353020575731,176002816966161040,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:1
      4⤵
      PID:5752
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\i3vizyzx.suk" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --metrics-shmem-handle=5052,i,11433735258737712461,8801315607753208710,2097152 --field-trial-handle=1928,i,12024868353020575731,176002816966161040,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:9
      4⤵
      PID:404
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\i3vizyzx.suk" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --metrics-shmem-handle=5592,i,3780682418609002192,10644644855444766774,2097152 --field-trial-handle=1928,i,12024868353020575731,176002816966161040,262144 --variations-seed-version --mojo-platform-channel-handle=4204 /prefetch:9
      4⤵
      PID:1552
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\h5o1mgvh.zoa"
    3⤵
    PID:2184
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir=C:\Users\Admin\AppData\Local\Temp\h5o1mgvh.zoa
      4⤵
      Checks processor information in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:5612
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1968 -prefsLen 27097 -prefMapHandle 1972 -prefMapSize 270279 -ipcHandle 2044 -initialChannelId {48a25988-a440-45a6-bd18-76a470a0ca78} -parentPid 5612 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5612" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
        5⤵
        
        PID:3428
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2476 -prefsLen 27133 -prefMapHandle 2480 -prefMapSize 270279 -ipcHandle 2208 -initialChannelId {e8b412c5-3b3c-430b-b68c-90c43046672d} -parentPid 5612 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5612" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
        5⤵
        
        PID:4172
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\2abc0a39-7561-4568-af26-6ffc4c639152.dmp"
        5⤵
        
        PID:1772
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2252 -prefsLen 27133 -prefMapHandle 2748 -prefMapSize 270279 -ipcHandle 2788 -initialChannelId {9ebb4d0d-715e-4677-aa80-a64c33de5dca} -parentPid 5612 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5612" -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 gpu
        5⤵
        
        PID:1688
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\228f1768-6aea-4395-8f54-9df44229d40e.dmp"
        5⤵
        
        PID:5692
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2816 -prefsLen 27133 -prefMapHandle 2852 -prefMapSize 270279 -ipcHandle 2796 -initialChannelId {165cfe46-08e0-4cfb-a0af-a09d28f9ee77} -parentPid 5612 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5612" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 gpu
        5⤵
        
        PID:5508
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\ad07f3bf-c92e-4ee1-b6f7-6a8f80cd140e.dmp"
        5⤵
        
        PID:5528
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3544 -prefsLen 27247 -prefMapHandle 3548 -prefMapSize 270279 -ipcHandle 3600 -initialChannelId {afb9aba3-03f6-441f-bb60-648c113b991f} -parentPid 5612 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5612" -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 gpu
        5⤵
        
        PID:5000
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3724 -prefsLen 27323 -prefMapHandle 3728 -prefMapSize 270279 -jsInitHandle 3732 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3796 -initialChannelId {0229b042-82e3-41fa-952b-a70a19d3d62d} -parentPid 5612 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5612" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 tab
        5⤵
        Checks processor information in registry
        
        PID:4972
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\54cc1edd-d0ed-4e5a-be6a-61b846507655.dmp"
        5⤵
        
        PID:1480
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3228 -prefsLen 27323 -prefMapHandle 3864 -prefMapSize 270279 -ipcHandle 3216 -initialChannelId {eb6da8c4-b8d7-40b3-a3af-b75bf6693535} -parentPid 5612 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5612" -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 gpu
        5⤵
        
        PID:4616
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\5d0a9f93-4382-4bd0-9da8-eb654264a3f6.dmp"
        5⤵
        
        PID:5264
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4088 -prefsLen 27323 -prefMapHandle 4092 -prefMapSize 270279 -ipcHandle 3612 -initialChannelId {b93e1fb7-ca03-4b97-8037-4e77954910fa} -parentPid 5612 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5612" -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 rdd
        5⤵
        
        PID:4464
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4496 -prefsLen 34822 -prefMapHandle 4364 -prefMapSize 270279 -jsInitHandle 4484 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4472 -initialChannelId {82b56353-2f80-4b2b-a09b-52ab3434179f} -parentPid 5612 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5612" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
        5⤵
        Checks processor information in registry
        
        PID:3092
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 1400 -prefsLen 35010 -prefMapHandle 2624 -prefMapSize 270279 -ipcHandle 5084 -initialChannelId {1ab14239-8112-4f28-9afe-86e0ec64e849} -parentPid 5612 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5612" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 utility
        5⤵
        Checks processor information in registry
        
        PID:5672
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4572 -prefsLen 32900 -prefMapHandle 4576 -prefMapSize 270279 -jsInitHandle 1948 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2624 -initialChannelId {45bdcf79-73c4-4397-9334-a1faba5e4bc0} -parentPid 5612 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5612" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
        5⤵
        Checks processor information in registry
        
        PID:2364
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2824 -prefsLen 32900 -prefMapHandle 3504 -prefMapSize 270279 -jsInitHandle 4872 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5100 -initialChannelId {89b898b6-09f2-4578-9eba-2d03066da7f3} -parentPid 5612 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5612" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
        5⤵
        Checks processor information in registry
        
        PID:5680
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5540 -prefsLen 32900 -prefMapHandle 5544 -prefMapSize 270279 -jsInitHandle 5548 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5552 -initialChannelId {7bd5e577-e736-42f6-90b4-129dce70fbab} -parentPid 5612 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5612" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab
        5⤵
        Checks processor information in registry
        
        PID:5216
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\llwmp1vk.dbc"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious use of FindShellTrayWindow
    PID:5824
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\llwmp1vk.dbc /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\llwmp1vk.dbc\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ff93c98c188,0x7ff93c98c194,0x7ff93c98c1a0
      4⤵
      PID:4564
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\llwmp1vk.dbc" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --metrics-shmem-handle=1640,i,883903516813646013,1921167365838575112,262144 --field-trial-handle=2184,i,1362171128774073427,17579237138538420139,262144 --variations-seed-version --mojo-platform-channel-handle=2180 /prefetch:2
      4⤵
      PID:3372
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\llwmp1vk.dbc" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1780,i,11811802449720226819,1644352194628007070,524288 --field-trial-handle=2184,i,1362171128774073427,17579237138538420139,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:11
      4⤵
      System Time Discovery
      PID:5984
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\llwmp1vk.dbc" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2348,i,10150649759017157655,1626718409579128546,524288 --field-trial-handle=2184,i,1362171128774073427,17579237138538420139,262144 --variations-seed-version --mojo-platform-channel-handle=2888 /prefetch:13
      4⤵
      PID:1940
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\llwmp1vk.dbc" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3136,i,16017665862071432818,4003873690585806967,2097152 --field-trial-handle=2184,i,1362171128774073427,17579237138538420139,262144 --variations-seed-version --mojo-platform-channel-handle=3144 /prefetch:1
      4⤵
      PID:4124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\llwmp1vk.dbc" --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3156,i,14504203986715797204,22605463228163523,2097152 --field-trial-handle=2184,i,1362171128774073427,17579237138538420139,262144 --variations-seed-version --mojo-platform-channel-handle=3244 /prefetch:1
      4⤵
      PID:5508
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\llwmp1vk.dbc" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3516,i,13690552978129671693,4743566839582185248,524288 --field-trial-handle=2184,i,1362171128774073427,17579237138538420139,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:14
      4⤵
      PID:4772
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\llwmp1vk.dbc" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3524,i,10413882044559339096,1700879829834096940,524288 --field-trial-handle=2184,i,1362171128774073427,17579237138538420139,262144 --variations-seed-version --mojo-platform-channel-handle=3224 /prefetch:14
      4⤵
      PID:3204
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\llwmp1vk.dbc" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3528,i,18317468626234531640,9273892570100130148,524288 --field-trial-handle=2184,i,1362171128774073427,17579237138538420139,262144 --variations-seed-version --mojo-platform-channel-handle=4660 /prefetch:14
      4⤵
      PID:2936
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\llwmp1vk.dbc" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=3556,i,15143736805591310539,17964016908608855676,2097152 --field-trial-handle=2184,i,1362171128774073427,17579237138538420139,262144 --variations-seed-version --mojo-platform-channel-handle=4692 /prefetch:1
      4⤵
      PID:3112
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\llwmp1vk.dbc" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=3576,i,2962226143050762801,13385150455027180403,2097152 --field-trial-handle=2184,i,1362171128774073427,17579237138538420139,262144 --variations-seed-version --mojo-platform-channel-handle=4724 /prefetch:9
      4⤵
      PID:2840
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\llwmp1vk.dbc" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=3620,i,9505800466363365055,11615343670393872682,2097152 --field-trial-handle=2184,i,1362171128774073427,17579237138538420139,262144 --variations-seed-version --mojo-platform-channel-handle=4756 /prefetch:1
      4⤵
      PID:5276
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\llwmp1vk.dbc" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3652,i,16117591448964790256,17145016146467101682,2097152 --field-trial-handle=2184,i,1362171128774073427,17579237138538420139,262144 --variations-seed-version --mojo-platform-channel-handle=4808 /prefetch:9
      4⤵
      PID:1508
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\llwmp1vk.dbc" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=3672,i,3048279959352108545,3956737429499494433,2097152 --field-trial-handle=2184,i,1362171128774073427,17579237138538420139,262144 --variations-seed-version --mojo-platform-channel-handle=4836 /prefetch:1
      4⤵
      PID:6088
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\llwmp1vk.dbc" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=3692,i,18104513178192003401,10501952013502142892,2097152 --field-trial-handle=2184,i,1362171128774073427,17579237138538420139,262144 --variations-seed-version --mojo-platform-channel-handle=4856 /prefetch:9
      4⤵
      PID:6092
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\llwmp1vk.dbc" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=3716,i,12400649128948684803,16101588820432546893,2097152 --field-trial-handle=2184,i,1362171128774073427,17579237138538420139,262144 --variations-seed-version --mojo-platform-channel-handle=4860 /prefetch:1
      4⤵
      PID:4672
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\llwmp1vk.dbc" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=3732,i,17138213219441769766,5097783787263747541,2097152 --field-trial-handle=2184,i,1362171128774073427,17579237138538420139,262144 --variations-seed-version --mojo-platform-channel-handle=4896 /prefetch:9
      4⤵
      PID:4576
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\llwmp1vk.dbc" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=3748,i,10951037241275773214,8980474883243674526,2097152 --field-trial-handle=2184,i,1362171128774073427,17579237138538420139,262144 --variations-seed-version --mojo-platform-channel-handle=4912 /prefetch:1
      4⤵
      PID:3296
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\llwmp1vk.dbc" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=3772,i,9393651923482841294,7280704914902794344,2097152 --field-trial-handle=2184,i,1362171128774073427,17579237138538420139,262144 --variations-seed-version --mojo-platform-channel-handle=3804 /prefetch:9
      4⤵
      PID:4464
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\llwmp1vk.dbc" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3852,i,10279096338389866693,8659921333982237978,524288 --field-trial-handle=2184,i,1362171128774073427,17579237138538420139,262144 --variations-seed-version --mojo-platform-channel-handle=4960 /prefetch:14
      4⤵
      PID:4260
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=1128
        5⤵
        
        PID:4136
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\llwmp1vk.dbc" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5380,i,335662601982703140,17074655075814221533,524288 --field-trial-handle=2184,i,1362171128774073427,17579237138538420139,262144 --variations-seed-version --mojo-platform-channel-handle=4828 /prefetch:14
      4⤵
      PID:3396
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\llwmp1vk.dbc" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5260,i,13603507027494740451,11051309128206900771,524288 --field-trial-handle=2184,i,1362171128774073427,17579237138538420139,262144 --variations-seed-version --mojo-platform-channel-handle=4624 /prefetch:14
      4⤵
      PID:2172
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=592
        5⤵
        
        PID:5728
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\llwmp1vk.dbc" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5380,i,17375681403379802091,13024577863985213756,524288 --field-trial-handle=2184,i,1362171128774073427,17579237138538420139,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:14
      4⤵
      PID:2688
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --no-sandbox --mute-audio --onnx-enabled-for-ee --user-data-dir="C:\Users\Admin\AppData\Local\Temp\llwmp1vk.dbc" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4460,i,2815988676686613087,18328443904559578519,524288 --field-trial-handle=2184,i,1362171128774073427,17579237138538420139,262144 --variations-seed-version --mojo-platform-channel-handle=4652 /prefetch:14
      4⤵
      PID:3116

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5144

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2736_13414674757472480.pma

Path C:\Program Files\Google\Chrome\Application\SetupMetrics\2736_13414674757472480.pma
Size 696B
SHA256 d96540a423630a67c693e3e3957157d37c7f418e377961480fee06edea20ec65
MD5 4c6f251fbc21038f959edbd64daf0cff
SHA1 c803d4df732caa3174d4c61485670b75f1b189c9
SHA512 43431bef50c90427c1b218a0e7906ace1e8572488fb04ffc78d545c5d28e0a717389546487c1e4d5fd86e777e67e95bed16d6bc8be105dd247d3f0c19670cf21
TLSH
T1B6010E46A3184F77CC428E3984FE27512BB1FA501B821BBF7B20724F2E021C89E99168
MD5 SHA1 SHA512 TLSH

Submit Download

3676_13414674757551652.pma

Path C:\Program Files\Google\Chrome\Application\SetupMetrics\3676_13414674757551652.pma
Size 344B
SHA256 fd668d6edcf6b6cc176edd9bf7b0d7f1881fe2f0d94ebae656127c27a359550e
MD5 1b7cdddfb06152ae01f12d9f253237d6
SHA1 1ef358781a086a0727f4fa95cd53510eb328bc52
SHA512 4705c93b233be92dd2d04649d404b538bc76607bbe655d5e35a739653ac1af776ecdd12ec1cbf81476070ec5bae633f891817155014730a06939efb21bd132ea
TLSH
T159E0A79677648B7BD446CD31457B03523F6AF8501F81176F4740758F1E522D88E06420
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_ho1w4gl1.spe.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ho1w4gl1.spe.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

c0b840bb-fe09-4c08-86fd-01d946876ba4.tmp

Path C:\Users\Admin\AppData\Local\Temp\c0b840bb-fe09-4c08-86fd-01d946876ba4.tmp
Size 242KB
SHA256 81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82
MD5 541f52e24fe1ef9f8e12377a6ccae0c0
SHA1 189898bb2dcae7d5a6057bc2d98b8b450afaebb6
SHA512 d779d78a15c5efca51ebd6b96a7ccb6d718741bdf7d9a37f53b2eb4b98aa1a78bc4cfa57d6e763aab97276c8f9088940ac0476690d4d46023ff4bf52f3326c88
SSDEEP 3072:r+nmRykNgoldZ8GjJCiUXZSk+QSVh85PxEalRVHmcld9R6yYfEp4ABUGDcaKklrv:k3oF4Z4h45P99Fld9RBQYBVcaxlnfL
TLSH
T1F63402BD7D8AE686D006A17676C0B48BE1199F4E41CB7C0F668A89010D70F8C57B9DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\i3vizyzx.suk\Crashpad\settings.dat
Size 40B
SHA256 cbc44672a6d1e6bf321ed8dbb5348e9e580990f97a998e229e257b696e1edebb
MD5 ea18589f6279fa3f0d727087e0119644
SHA1 cbe247826fa6a28cc579ce959d260903d1c154b0
SHA512 529dce8832d1c87c58e7b5166a6d08b24255230142a0996cca8ee084d79c2b402f9eab472fe00f5e734445b2988b28bd0dd14d48c0e772e6264e0e1122c42985
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Temp\i3vizyzx.suk\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Temp\i3vizyzx.suk\Default\BrowsingTopicsState
Size 414B
SHA256 b361a8e1fd5cce04f1b350f93fcf74ce703234a4bd71083edece73f3df10a537
MD5 44b9585603453a1c82748316c2b1910c
SHA1 fc54082614433ff46405ecf5c80374f4d545f003
SHA512 bfc6fd303345b4d449e5585a80f0efcd3221280ba118202d7c06ffdf504d4efdd1ba73339a8d4f523baf06b3f3c9e343f8372ab04ce931ee36f22490a21c38ed
TLSH
T1F0E02BA6CC26EDA708FC0B2990545606F750035B1B818A1F3E3CC20D8FF0A36858589C
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\i3vizyzx.suk\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 1df5f8d153b7adeeeb6759e5ecadb72d85d888295f19ef3e6e35a9ad0fdeb5e7
MD5 06861cb53d6b1c9c099d1ba3be57b40b
SHA1 f1a977c73ebf761636d8d6721a5dd2cd00c18aea
SHA512 ceacd95597972f7ff0d04ad5f035b82c550adc8965d7b4191b27428f2895c1ec6d3d6dbd34b6bc77a47d4b7974c73f1cc5b044891f0051de59c7b0f232166bc0
SSDEEP 6:/FC9l1NSgy2YtglY00dTUXB4BukAhspNttPIhrqaI+d9GjkFOfvLlP:dwl1NS52YyY00IHk0rqaDXF2l
TLSH
T1C613127F9D4C0E0FDBD1147C5D671B70AF74A455DA809E5355B0B12AA30930E344E129
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\i3vizyzx.suk\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 f228ea3b7cc8826e56569abef2ec2f1e4ede82a520f0cad8cbf327e977165191
MD5 7bbf11f60a27ae9bc86b60962c77c852
SHA1 237e2c4a2ac509e404fedc0987f2d61d3dde7350
SHA512 5f5adf2452be4b120020f65cfb71fccfe55f526b24f24bc550b70ed094c5523c464999614989039e3ce92636af882e128b4a543733c83bfa0f614512b053757d
SSDEEP 48:xNlPrsPYYRMCXgar3MiXWuvWvNaB8W0ARGxoyCqS8aBCy:x3PogU/gajDWEaNaBF0sPDqSCy
TLSH
T1A94475EB6D09D5CAEB288AF01C50113CCD33511A6C9EAC77F56804724755BF73168A66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\i3vizyzx.suk\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 53ac11b56fd0e8fecb82a53722c105a4da24ac9e3e69aa5367a2d858eb08e3f0
MD5 7db20c5884471c08fe742935bb22f20d
SHA1 ad7172feae27ccd43c4cb5250420cdd6f1f3b4b4
SHA512 8229d925969d175cc2915ee893dd617de2b48c4d508d61b9bc53f518e83f3e83172b134584596b1eaec7428027693066902ee68a46af105bddf25bcef3245edf
SSDEEP 24:WTqkGCDOj2NIRqBXQ8XloJc0C/PuhPgg1eA3uRxbagzu3XO7mlOji2n:NkGaGZRqRdoJVCehPgBADHHGmlYVn
TLSH
T15A25E656DC4BEE41D4FC1638AF10DA42BAA44CBB71DA60D628B805DA2694672988D0A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\i3vizyzx.suk\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 64ff7144aba04b99d2e9b49e9089cfd57d31d872be7200f15a4b464d7fc7e8dd
MD5 2c96cc77026607e710ba289705e73dfb
SHA1 76ee0c84fccd66e4ceeef529a36d995929b2636e
SHA512 662fef9349a648f34134a9b94f6e49156dcf148cdbb8aec87b143ed7c954b1b4410c741a1f4c4bcbb46ee4a5410b481e93d010b49f43d6fd31530c55908e0619
SSDEEP 768:fUfDPLSgcRUv+Ls4Nk5fDPLSgcRUv+ts4cUfDPLSgcRUv+ms4lUfDPLSgcRUv+Bp:CoyPfJDb9
TLSH
T184164CA74F286486EA85EFB0BBCDED1C7C7122D5A8D25CC1F122927A4AF1FC41B8505D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000001

Path C:\Users\Admin\AppData\Local\Temp\i3vizyzx.suk\Default\Cache\Cache_Data\f_000001
Size 32KB
SHA256 da6ee98161ada7e9bafdd8414953ac23e50a57dbfd33d6032a9b6c493e896ef9
MD5 48fa84b3abde34765f15c5290dacd685
SHA1 4818ee72012e8639b91673d2ccddee0a12851366
SHA512 3f5549485a4ebc1674404e668ac15fc80f6091acd6228eccd488c86d780ced9267509246db7775778a668b44bbc826e1fcc41aac109670c1e60832be508bbc23
SSDEEP 768:XQ4C+Lu8fRfh8SVAc/yt8RuSow9QFh0eZlkoMsriqV:XDC+TfRfh8SyB8RJowuFhdlf
TLSH
T1E8E2F19AFDBD6390E46D5E819B858A6FC36FF49743AFA01A80EF4D874240F624DD010D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000002

Path C:\Users\Admin\AppData\Local\Temp\i3vizyzx.suk\Default\Cache\Cache_Data\f_000002
Size 35KB
SHA256 ab1ddc0db8ed493908769f426b8fc1151f8ae1bdedc158e5a4467ba9410e1042
MD5 1b1680c4aeb4da59bc144cf56c76f4a4
SHA1 c68820ee312aa24ea3e6051adaeb88aeed468215
SHA512 ff47663b9b2abd5b9188a8d7837cb271c071d7452d6d4c8f8425dd7db5801b32b44c5d5c32dcff2e2661810c3e8715e8bc0d5068d7ed7274c33de0bbf92947de
SSDEEP 768:tDI+1xSirv1wrpxgDhhgzPVL5KuU3s4fc70GqVJ:tDBvSUQxgkVL5KuUtfG4J
TLSH
T153F201CE800D50A6B1C93B5C2130A708343581835E71BCA98B580FEFF95B7E61E1E6A0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000003

Path C:\Users\Admin\AppData\Local\Temp\i3vizyzx.suk\Default\Cache\Cache_Data\f_000003
Size 69KB
SHA256 70c1265b74332aa49acb0695a587b6cb18bc3cc698d7699106316358a940f5e9
MD5 2337e52453da079589a1c68c77ffe84d
SHA1 e837aae6f90df109c4b35b405ffd6dece109ed56
SHA512 d8bc4be6bcdb2f4ae24ed28ab903fc31a8174b2ad2d880cd418126ace21b1f7f1da1b77054166c89b9e18219ac5cc53b4cb54b2c7446609f234b61355deb3a38
SSDEEP 1536:Yor+MYgZu+Kwdf5oVgUThTCqkTpjL8gtxRFL8vh9QXaWiOaE:Yok2KwPoVlToqWpZhQvbQXbTx
TLSH
T11A6302B3AE987C3D2E6960EF75F9FB2A6024DFC4A26B5742C25122AAD40B8C90005D81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000004

Path C:\Users\Admin\AppData\Local\Temp\i3vizyzx.suk\Default\Cache\Cache_Data\f_000004
Size 38KB
SHA256 1d39335bcc92df6017b3a1b2c0ee549a3cbde2d3ced0b09519a043d38a8bec30
MD5 356eb2db86a3c20d9f12ab52423b7030
SHA1 2faedf35f5b49a4d4a15316641990498c2358c6b
SHA512 caa693ae790cb8298723e113709d3f8bbd7ede64ccfaf25c445f9092040dfb61e14796ba5c983a801b05502763a33c030c1a6494d0e79fe351708879f68e1fb2
SSDEEP 768:gEpDNzk8U9Yip1z6CK+fMSqYc4l5q+GrMV1H/1d37gkVKIY1JCEeDP3396d5dIyZ:TpDOzB1z6CDfMLYugV1x5RY1JCEeD/S/
TLSH
T1DB03F1877A25AB2E99FC4EEA1C9FA04F5821C5DEC3EDA5CB0C07F54241A123654DAA03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\i3vizyzx.suk\Default\Cache\Cache_Data\index
Size 256KB
SHA256 24ffd87a2c490b3be6c970f9161261d60cade7b618ecfd403f402d32abaaf20d
MD5 8b28640795c79b952819c88aa17fc378
SHA1 93dbdb153353ba703a88a8f1be1927ce557fb43b
SHA512 8aa9e169450930af945da296f1f9d978dc9edc02c250f411fb886867aed5d5e3f3fc9832e17052988df07880d46848b07e1d74043ec6cc409eb85f0b5fc8ca67
SSDEEP 3:Ls0lAltlNllklkXlYQyFlSll/ngl/pNtlmNtlIlXlcE/r/AlNlXl:LscAlX3lPYQyuGlxkN4EEz
TLSH
T19344012F4B85AE1DCBE006FC88838F712325C5A5D99B97530384552029C6BA50F2F1D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ba678a2fbd8c358c_0

Path C:\Users\Admin\AppData\Local\Temp\i3vizyzx.suk\Default\Code Cache\js\ba678a2fbd8c358c_0
Size 298B
SHA256 149361d9edc8b2193a648ef66bea57e82dce6b6e731349649981f4d8f9aaeacb
MD5 115a2e95aefa2e05bb5a5acb80f64873
SHA1 9374cf6ce9b990f85f85625bda5e2ae79f830161
SHA512 cef6ea2f4b4e641f62f0255ce187f8ec200c4409019d96aef689ac07da7551eec287b623c47bb0f48586fd8e11f0a271a7385ac2b77ef823d97bc30287470c81
TLSH
T1FCE02B81828C1F0DD32D96F7CEA603084A0E43D42ABE3603A880C2C133125381258222
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\i3vizyzx.suk\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 ce8337d001f2139324d1813ad6ed54952828f70bb60105f46fb80b6651fc55e0
MD5 f769e213cd2336c4d022518bcbf7b7c1
SHA1 876f50d2800a7c34c8dc14969ae4635574a4f008
SHA512 d5212b18359223e2a3bffa9ef922325cde9e8396c8e0712db9f5a627f14772c371e68c27eaa420733b5de314d9ed6cf2999f346a0d7255f324edbcfa1d0e7e6a
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\i3vizyzx.suk\Default\Code Cache\wasm\index-dir\the-real-index
Size 48B
SHA256 09b48094e04b5c4022d8d42af22b668068640ee1f0ea2d0f7d98ca83f21ce315
MD5 7446e26ec7f1ffbbbb1fab181a4ef1f4
SHA1 50aef0ea5519356de028086bf93d859207f4cca1
SHA512 dc1fbbcffb0527cb13f8b5c9524d1a892278940caf96926117d1a38dbf0fbe770c4bc3343a05df2f8d6e9b6671a0d9903539607910d507b84bf1e44f5b8f7237
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\i3vizyzx.suk\Default\DawnGraphiteCache\index
Size 256KB
SHA256 e5237c11ce05823ad5150e0a070ec3d96481beb557237002d7ec361d53475621
MD5 4b2ef65f8420f1c171cfd5c6182d6b57
SHA1 5c7b0ad35c65b570ea667209f59fa76c74006f69
SHA512 9548f94f608ffb411857df912adab7ea4777b640e1293270da009663c49a7fc9812a2a312fae46ca3fda22d4cb8e185edc52b08c9ec679bf90a2972283728cf3
SSDEEP 3:LstlNllklkXl2+j/:LsX3lP
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\i3vizyzx.suk\Default\DawnWebGPUCache\index
Size 256KB
SHA256 413d27b2be2b44edd9f381adaaa8edb1e15d82a304d6ea52774a7d71f5c302ef
MD5 95f73777718df1cab7b27c8f73f4db87
SHA1 8a8191b09547912153ae0a6686f5ff77b1af5598
SHA512 de14de765d5be57ebbbe1872b68ce2d14e652c90b7c47c175cbb503aa5d22677fbdbae38b554d5b2a8ff73e1ad0c0fa2025f1bc0ac474c51adb19e634d42a4f1
SSDEEP 3:LstlNllklkXlHYt:LsX3lPHY
MD5 SHA1 SHA512 SSDEEP

Submit Download

128.png

Path C:\Users\Admin\AppData\Local\Temp\i3vizyzx.suk\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.100.1_0\128.png
Size 4KB
SHA256 41b21cd721317759a1391ec66ec4606b1f1b0a66fc6542ec3e69f9a6ba9a60d3
MD5 a6e517fba00c44d26f516d2bc473042f
SHA1 bcedbf549056bfacff8820cac38713a1eacd95b9
SHA512 8c58b58a05b60420ff187c2dc8b71e019fc36cd6bcec050257b5532f131ba50ecd00fe2ca734805753a39f6911125d2d8684286207b1d1d039e862904279a145
SSDEEP 96:4niq7dWteEb8MsIhE+bf+rgEPQCGJxc4bOdpI0xeblJpzSkLqdsQ4pXnW3P:e97kteEnJEu+rxoi4b3RJpfhQ45nGP
TLSH
T14AA1AFFA12E3DA94303E91711B20659B4D7909385624364DDBB2AC7140C7A0D9B7CF63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Temp\i3vizyzx.suk\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.100.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

service_worker_bin_prod.js

Path C:\Users\Admin\AppData\Local\Temp\i3vizyzx.suk\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.100.1_0\service_worker_bin_prod.js
Size 119KB
SHA256 dbc4678e51e79bf4ff3133568e2cb425ab0757aa3c62a9f5df976ba9c01973c6
MD5 0b1499f3fe47f316a96f57238009d253
SHA1 017ef3ccecd691cc1773f477ce5f6ec340798d82
SHA512 7c1b70e4f2bdec5fe4ce573f8bebcd7a7b2a3f975e6e4942240e887c15dd001957ce9be726b8a4b3d730b08194240081de989bd3073819a483258532d75d7246
SSDEEP 3072:HAYGntD+6KcN6TNOEE+ucAQhPbkIWgn2Rp:HuCCN6x1ZbkIWJp
TLSH
T11DC3E8CDB7A57462436365F5002F000FB23AB8AAE44C85A8F188D9E97DB446D8377F79
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\i3vizyzx.suk\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Temp\i3vizyzx.suk\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\i3vizyzx.suk\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\i3vizyzx.suk\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\i3vizyzx.suk\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

000001.dbtmp

Path C:\Users\Admin\AppData\Local\Temp\i3vizyzx.suk\Default\Sync Data\LevelDB\000001.dbtmp
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\i3vizyzx.suk\Default\Sync Data\LevelDB\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

32.png

Path C:\Users\Admin\AppData\Local\Temp\i3vizyzx.suk\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\32.png
Size 1KB
SHA256 bff3a19327fd09a24c1aa4e7f34c508d7e668a8eb32f2cc7c33bcaa7e9ee2319
MD5 2f1881da261cfaea89605ee7a5e33e40
SHA1 fe61ed428aa3636adcfbeb66162f43f0ee091d25
SHA512 a9d8a4172c83030bf4472e900540b2ef3bbbb5e565c39f278cb8aae355354f063a4723c5ed8c3b32dcea45c70903271d170e56879a096b169697fc28dc768494
TLSH
T1FC413B2333F81ABFD81CD69BE465C8A50F395483DA39060706031CE8116343B19DDAF9
MD5 SHA1 SHA512 TLSH

Submit Download

48.png

Path C:\Users\Admin\AppData\Local\Temp\i3vizyzx.suk\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\48.png
Size 2KB
SHA256 afbfdd55b59a6385a28bfe27ef81ffae07f9d77b8c073dc299c6060b5d964a89
MD5 4d5d17c7e7c06b887bb383077131f50e
SHA1 8b29cf29af8358672e31bee5472025b7b07e7df8
SHA512 ccb20424ba2566e11a359bd04cbcb54bc21947bc254f4939c334f7db8c784a1da35461f60a1fc559ab5bde5cda443c82b633b8cc5bda89f5019b391148050be3
TLSH
T179515DED0389C698FB6F764206866917621D39F824EC51E09AE816A3EB101AC1CC1FD2
MD5 SHA1 SHA512 TLSH

Submit Download

64.png

Path C:\Users\Admin\AppData\Local\Temp\i3vizyzx.suk\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\64.png
Size 3KB
SHA256 02bd0f5d045eb5247e576d8151da19d36dc0eee7746c9a426d4dc92ee83125c8
MD5 aceb6eccca82014c9472e49e8b4b6eb4
SHA1 91d2c703fe33ea1867dd3d87b760aa2e5e68a55a
SHA512 b18d0edf51fb6245dc730b5aca21601dc40c762d6c3d96c950b38312406bce16fe7165e786bd0d6ee106d95c90139094bfc4fca08b0f37eb88c086606821ade4
TLSH
T111814D53467373A8BC788965CBCDD0EA8D732D594E4244F884CAD93429D54049825BDF
MD5 SHA1 SHA512 TLSH

Submit Download

32.png

Path C:\Users\Admin\AppData\Local\Temp\i3vizyzx.suk\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\32.png
Size 1KB
SHA256 ccefdc2d816137b5954b591e8954c392e0cf27388fef2e437991e3999d9ad3d8
MD5 efa437b6fe5031994d5917a91c19990f
SHA1 d46a1115227ead4e92346b600c28e9ac72cce96f
SHA512 ab52261f15a3f21728b41b4765da5ec6c9e71051b720204ee2decf6f09ac8a0c9a5c12313d921f232f1e698a7425d34415eca8db21a37f423535806bcdf238bb
TLSH
T1F3310AC7644047BA52EDDAF37F6B0C57DC12210107D4A440599F56E17FEEEC86015478
MD5 SHA1 SHA512 TLSH

Submit Download

48.png

Path C:\Users\Admin\AppData\Local\Temp\i3vizyzx.suk\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\48.png
Size 2KB
SHA256 bff87e21fa845d8ce3c266db6d904e9c7a3bf9fc2b95a1f1a5ca375f3fdb045a
MD5 097f67b0d583db3f8487ac27379c7eae
SHA1 18acf62fb9bc4e95899c4597cd72de66b6bef763
SHA512 0b6b323fa14e5b0dd6bb87fce791bbd0b7a867988d8332385ba76a35d93d4dd5b67f6be9be5a69fbdcd5da68c30bc840712daa83b9a0187b727d963dc9a9a045
TLSH
T15E514C54BEF34CB2EBC67C7254E65BF5A564C1E62D407A0C86B9CA1245BDD410CCD003
MD5 SHA1 SHA512 TLSH

Submit Download

64.png

Path C:\Users\Admin\AppData\Local\Temp\i3vizyzx.suk\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\64.png
Size 3KB
SHA256 abe4eaa1a6fa423bcef61b423dc72386a9cf1968b1041de5270c56a7780254ad
MD5 8e589c60e0ba95ca1b178bad0a8298db
SHA1 d981cd3f9eb63636471e3bd4c0fd7585460ad6fd
SHA512 e8c7b5d340e698f3b1b42d6c3b7653b666e0add095611c00f502782928eb788070ca977b54b42f9515127861e55138a3cc0f02540f0bc2e44694fb0ea595ee34
TLSH
T196517D1B4B8AC56A0E53770E02E57ED454996C569EF383CC2106E7C0081A99F43EBBE7
MD5 SHA1 SHA512 TLSH

Submit Download

32.png

Path C:\Users\Admin\AppData\Local\Temp\i3vizyzx.suk\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\32.png
Size 952B
SHA256 e566796c18517e7084e3a892b3291cc189b85e7830800503c256998ab697a507
MD5 bf7aa030f9cbc7aba123d10adb3ab321
SHA1 d210f3194a494a65d1e32ade703e24fbbef7b444
SHA512 3be8123811222e1d5aa92e7144d41a8ace20ea1d5b082aa51d11df8f573c17f294ead72ee9e94b31259035ebd0eecb904686cf4bb22f0e5313a02756e210b8a6
TLSH
T1E311889E6EAA8CBDD1C3AE4FBD2D22904F13CE54C534BA1B4C4759573A26E54704B501
MD5 SHA1 SHA512 TLSH

Submit Download

48.png

Path C:\Users\Admin\AppData\Local\Temp\i3vizyzx.suk\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\48.png
Size 1KB
SHA256 6a379d8e9545ee7885dcff4c53f1ca553dc9fb0cbaa18a0c71c0b75c8883d044
MD5 c053b2219c4c9e7e7080cbe4e6e3981e
SHA1 0470cf45babbbe1fad32b4dec3593e8ab7a8ac39
SHA512 1271ac3ef670f3b7104c3f4e678ef4bc9990d9427826b104bfa8d31f904895da50ed0f1b673727d39355428f6270d015c0953521b26d8f10f842854b79ec5525
TLSH
T1E021B7BE5B25DE1B97EEA61F72DA9900D89221E27183A6052ECFCB6057145A33C24172
MD5 SHA1 SHA512 TLSH

Submit Download

64.png

Path C:\Users\Admin\AppData\Local\Temp\i3vizyzx.suk\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\64.png
Size 1KB
SHA256 3772d9c9a6fabba60ac0c7b9c93bf230e3c99ebac9af480efc6c778d9881dd85
MD5 cf9a569f60db18903e86e6612cf90efc
SHA1 379dccdc92399b0e4e658ad8f04276bf99501836
SHA512 58f0b5130318069511452b11b1fbdfd898577c714150f5f88a4a4ff80320b33c287c103e464ef24c8543d90de71713f2ee293f538fb078ec2099f9871cef2caa
TLSH
T132210853AFCF4AAE5834129F565C460FFBA3623E2952D409DB2A41AB08CDC14E8462C3
MD5 SHA1 SHA512 TLSH

Submit Download

32.png

Path C:\Users\Admin\AppData\Local\Temp\i3vizyzx.suk\Default\Web Applications\Manifest Resources\mdpkiolbdkhdjpekfbkbmhigcaggjagi\Icons\32.png
Size 1KB
SHA256 06c00fa3cb29713aa4317b352fc1e1e035c0c7720a42f107cf758fbb21eaed0c
MD5 247675501d3cf1f7987fe8e20dc4a994
SHA1 c0630fbc0c9c7c2aec627667b21b5b9add1d7925
SHA512 6b6f5e0feb15ecde82191178df36fcf9cebb762289116b88a466ab31152d6f8e769e97252e3a41f7f538867920866ce12bd60c9c87fbb5019783de0c5158bfd8
TLSH
T1C721DB9786803C5AE71F76BD5402AE9BF92060197254970E1A560A15C93C5D3FD873A0
MD5 SHA1 SHA512 TLSH

Submit Download

48.png

Path C:\Users\Admin\AppData\Local\Temp\i3vizyzx.suk\Default\Web Applications\Manifest Resources\mdpkiolbdkhdjpekfbkbmhigcaggjagi\Icons\48.png
Size 1KB
SHA256 bebe7c8f23573efeedb8259fd9e866662dfad2c8e974d2715bb5aebdac870f6d
MD5 93f26885517b76f003062053ad718275
SHA1 eb97bbd3de38ad8efd87e112ad76d6a6d78ffda9
SHA512 34f8a81113a9ca950a07c5f5c3511e3f11f8f9e9a2a1040872015064e2146154d4eb31b33d8ee291434535881f82685c0e90c52e76ea731ecafde73771595520
TLSH
T10031F95284AF0C128406F5E5CD57910B7F37ACBA9AC2A589023B7E7A105824D7B6C449
MD5 SHA1 SHA512 TLSH

Submit Download

64.png

Path C:\Users\Admin\AppData\Local\Temp\i3vizyzx.suk\Default\Web Applications\Manifest Resources\mdpkiolbdkhdjpekfbkbmhigcaggjagi\Icons\64.png
Size 2KB
SHA256 f5fcedc00655f8a9b63b379feb04ef904a64328e9ef79e7a411de5139d398ebe
MD5 18b13f82a338cf91ce3ec3ad9702622f
SHA1 403a48626de0cb33ddea61e6de7c895eb7482bca
SHA512 08a6fac277ffdbbc18c5166032b426e7d8a7856f7dd03ab01938000b28a869d80476017164a6728643ae8908616c574fddd8fabf946bd66b841ef13f5906969b
TLSH
T1F7413AD73E887CDDACB22A746A6175C1F0E846B24687DF44E60D6918CF61C43001638C
MD5 SHA1 SHA512 TLSH

Submit Download

32.png

Path C:\Users\Admin\AppData\Local\Temp\i3vizyzx.suk\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\32.png
Size 960B
SHA256 c6fa451ecd1a8a9533801028bc70cf82ef48eba11bb835e53e6c530b43018938
MD5 8fc407c5a96f560cfbb46503741dd11f
SHA1 31eb59362b3c99abd75bdf605bdf46d793ef99b9
SHA512 7ed6d7c679ab5928427095beef9ae476e8bc57a5c81cb633bce1b646a896557b5b49112d489b2112ac2749e1adaf6b1a7544be36c570696fff80725352eac68a
TLSH
T1BC11CC5290BD5338C4D16953E04223E10E566CFCE4EE91366B8FC80D893EA5D9CCC621
MD5 SHA1 SHA512 TLSH

Submit Download

48.png

Path C:\Users\Admin\AppData\Local\Temp\i3vizyzx.suk\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\48.png
Size 1KB
SHA256 3fc8b8392989fb26381f0a14bb356cae5f998a4dde004c06a51e974034f9ccfa
MD5 b75ce0c6ffcbdcc1066a2e6c8c3aa5fc
SHA1 2ca49f0080b985a68692eee2582298a9353c7916
SHA512 a3ac3a8cb7de26b7e4fa126497dcc228462b04da9a99a0b4647c1d8f877131f6597af80c3d7e834b50938a6c1349ccb14e9e0dd0b06673fa789d78e3e499bf7d
TLSH
T15C2196C3239DF6E5E54D50A745CF1B12F7BF375829B4A058A08E42C502B77C192CA534
MD5 SHA1 SHA512 TLSH

Submit Download

64.png

Path C:\Users\Admin\AppData\Local\Temp\i3vizyzx.suk\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\64.png
Size 1KB
SHA256 f6ff978b0f4c0d28e96b27b6242565480a73615b03a4b95640f8d20136fc2a91
MD5 518326c327ce412aff2d0f63700b372e
SHA1 24b69d3fb978c36bd349b516cbb5720addcac515
SHA512 fa4c22a9c51cb75ef04984ac10ee068fc9d262b7cc2f969f537784bd71240359cb3c34d9789b043f43e7109e7028b17da50074cba2b8759ea31e5ef2898b0707
TLSH
T16E21E79532856E7C8FA21F4BE0642A1DF2761D0423258DA603B12CF10CE040829AD2A1
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\i3vizyzx.suk\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\i3vizyzx.suk\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\i3vizyzx.suk\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\llwmp1vk.dbc\Crashpad\settings.dat
Size 280B
SHA256 53dd5561bd7d5225789ad8841d4077984c34244c2788832ca00417d9cc1aabc5
MD5 03d862415aa0ec5d6e8149022da06897
SHA1 81a643c57a97c33b7650c992a9c33d1985c7ec15
SHA512 463d29eeb03fddd0cdb67ff4b476122c5a4ec7e6d0045c881a4976d1a1674935fc96ea5cda8318aeba445058579ecd3cc50e67a666dc086af0a0b44e4fad0d8c
TLSH
T145D022BEBF00002EC8303AB3A0308F82038CC0208222C280A222023008F300E008228E
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Temp\llwmp1vk.dbc\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 375B
SHA256 b99a897312a464e39181e2c5e9e9a988f56cb40dd78d6be809757bb113707d5e
MD5 30236f817053a9a84c4134bbf7e7604d
SHA1 62ba4a607876ae1bfffa1a9f1e246b17c57a5ff7
SHA512 2e7117db3902256eb582b9d71c7d8e076db1336f32ef0d002c81a58b96f68c41b1ac6f24a0123506f7e0483fd64d5395d2567837c8449b93f3a2e10b555bfac5
TLSH
T1E5E068B72DEB2824E8AB83C35431888140087C448848ED8E641AB2976071345389AC67
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Temp\llwmp1vk.dbc\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 279B
SHA256 f454b4b2838b4466aa90a04967acf0a84c10ebc8e6e6edace725414c1a2c5a77
MD5 672cc1f1e1ee14cf215a870e0894f582
SHA1 4b4cbf43679d7e8917dd1ce511098cea151eed61
SHA512 c181f84ba7fcf7c0d6e7bd499bc6c17f04e1915de9108625d97345c02ab4c4cef47f5f8641b0a4a7291bfe21a9314bbcc5d3534bb73b127b061a4d27ce7264d6
TLSH
T156D02BBB18AB1474C9FB47D394314CC100067C549958EC8E105D718714713163996C63
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe588354.TMP

Path C:\Users\Admin\AppData\Local\Temp\llwmp1vk.dbc\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt~RFe588354.TMP
Size 153B
SHA256 e8b94e48a586dd3bfb4662c969f79d0d4fdd287ad3d987278a26d4b407cbc24c
MD5 cbc8c273d01a5b6d9b4cd6023c32a5b4
SHA1 e4238ef646d08075053bac8e58246e29091a5856
SHA512 16382295916051595fb78179818ad324afd1759e5edfff09e8b2bbf9d93543acf8c32506ca71fd1565b769550c45c6b74591bcb3613bad7154172d12261ded12
TLSH
T11CC02BFB1CAD2410CD1752C380318CD6826A3C88C940ED8D806DB0CB3030322361AC33
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\llwmp1vk.dbc\Local State
Size 3KB
SHA256 2cbe1755f9b5fe68fd396ac5275b7212e1ad0ae1e6e214fa93b4b7a4d480961e
MD5 68ac253c71db6982fe2a105a5bf926b5
SHA1 f59f151fd1b15a81e5d081ac823d39f1657c7534
SHA512 6119f0b363af1b46dfbfb755a65854e7965991ae70f22d0e1123f5e2dc1c3b4af3dc817af9cb53d6325a0ab16ad584a18befb2e8050e6482cf0ea74624854528
TLSH
T10081B5B12428EC7755F56589B48A37938E782073DD01AF5AE9D8630800FB3483B0A83B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\llwmp1vk.dbc\Local State
Size 4KB
SHA256 67fbcabdced02c251ccfe2838b5bc76e13b214d51690da47c4d94dd123926146
MD5 e8b55a7097885ef30cf537b51c15f0df
SHA1 dca97016e6a9e6097340c873372fa4db84a74e88
SHA512 eede751a59147a315aee26d69bcb5f69ad61f70a1afbb4b6aa3edcc143f474dca4d1da139060eda80079760874032f62d9a9d918840e27be366b3523dc944dbd
SSDEEP 96:5qGNkpQsFfuMeIKY9TbO58Frh/cInURoDotovE5D+Bo+vFoiroo620eUn242q4a:AGNJDMep2/NooDUwo+Vroo62q2a
TLSH
T166A1B6716538EC674DF5A985B48A3752AFA82133EC45BF9ED9E81B0C00F73982706827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe58756a.TMP

Path C:\Users\Admin\AppData\Local\Temp\llwmp1vk.dbc\Local State~RFe58756a.TMP
Size 1KB
SHA256 0365aca772e4a5f3d1e1721bc54627ed417469d3a038ac618f860834eae40c22
MD5 a88fb027810e7815c248bf4a25079c87
SHA1 2155e7808e8d2a3921f3d1eec1a7c078f1a05840
SHA512 b3ee0484e27240116504907e4f12c3b14e651d8b00bb0d5e6ca76eb8179cf2b6698896f30617962de88d23124dbd0a5dee0a28b6ae0fae8806bcaca200dff41e
TLSH
T1F831B5B075686CF7E8F046CAA20E7B674F385232C251AE9D95DC120905F77DCB20A83B
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1528_1067679938\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

4ffc2046-6224-4ffd-b475-5deb11c52102.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1528_937766902\4ffc2046-6224-4ffd-b475-5deb11c52102.tmp
Size 145KB
SHA256 88fd3339202fdf79ed79bfe483fcc57f322156f40cd75c47ee78efc5b203893a
MD5 fabbe8fb069e32ff7d1048cdd8871e5e
SHA1 d065636701c0c71037f44df340f4fa10c32e5ace
SHA512 8e0dc40c6afdf5bf250da1d401d9abcaf06db0577e0ad3b0ba15adc1600433dd5c354fcf54806554cfde8c1872d6a066c17313cc6da273c7b6e6b1d9d7e6d270
SSDEEP 3072:f1/GuTrhcnKXFmnvTtb44wLWklhluSMCRqVph3Wvlf9XXo:9/p5OKXcnJc4MrHRCpQVXXo
TLSH
T151E3D06C6FEACC26D51754797E54F0CBDB064F2F460A672F210A841C9A70A8D0BE19FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\769walom.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 79248d78cead12ca100954328792b6f52843e1126d9224435fc368a19cbb8aff
MD5 6f391ba23d6abb0599918942fba72735
SHA1 ae49d44461280e6b8316d11fd1d48400a9912a00
SHA512 195b4b66cf3e445bb469a2534ed901311e07247980fde1c03c954fc05124a7387539c7683536eaf261a9110cfda8cdf2c7557ba417ea9289261702b119d61a79
SSDEEP 192:/61d66Joz0dzgCl6mc0dIjOv5zboGbH/yj5S:/kd66JozQzgC1jTboGbH/yj
TLSH
T167E10E64E628467FC418423BCCE62F411E35384B984E7F2936ED650C2D5B2DE7A8D17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\769walom.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 1115e9cd7288a5e2a27238073b4710be30c842b2f5611a547151f7666d7cee53
MD5 7309756e219a4e5e42b844a444e75885
SHA1 3385a05b200771378c46d3fd426346804087f9c1
SHA512 677833ac5443c2b8d3871ac99f9f1c26fe00a668569d0f63dd8360d14a2840ccb5533f62377c439cb3ef333586224bd9fa91e378fd7fe2ac41505509ec20260a
SSDEEP 192:RjOv5zboH/ZH/yj5SSG1d66Joz0dzgCl6mc0d:2bofZH/yj3gd66JozQzgC1j
TLSH
T170E10D64E628867FC418427BCCA62F410F35388B984E7F2935ED640C2D5B2DD7A8E07E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\769walom.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 28b9c13f39d6b197063037de3da822ea6ae4750a14c38576d02ec6bda97cab58
MD5 fbf286eeae9e6e873ef7dc19e3b57d5a
SHA1 32a72337762e50550b50976aeca8f0b6a5cf61fb
SHA512 e59f9beb136c4eac80cad2a5f076bb3577b9fd1207bc98aac41ca0e3e771fa3b198940abcc8d4c338f3032c8526df329b39728b87ce6d8fb441dc787b378216c
SSDEEP 192:cjOv5zboobH/yj5Sfm1d66Joz0dzgCl6mc0dz:FboobH/yjgAd66JozQzgC1jd
TLSH
T174E10D64E628467FC408423BCCE61F411E35384B988E7F2935ED65082E5B2DD7A8D17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\769walom.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 53fb1084e154d53a3fde50998676b5ecf015e35b91a8b494f3907a619a4102f9
MD5 f641fb4749be474ca171ad867b586ed4
SHA1 fb2f16cf18d4de8f9d811bf723be5c9ce604258e
SHA512 36e85d46526975aa55488f6e33d6ee2b466842e6f56a77a0011f1d43acf4a10241e143e35e06b0aa37830b0c7c9e6e4fd832c45acc414071ffbb7eb9994a4d2e
SSDEEP 192:/61d66Joz0dzgCl6mc0dRjOv5zboGZH/yj5S+:/kd66JozQzgC1joboGZH/yjX
TLSH
T10BE11E64E628467FC418423BCCE62F411E35389B984E3F2936ED650C2D9B2DD3A8D17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\769walom.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 9fdfc311ff6c2d6485b0630bc0b080fdc8c6453a398d513d7ac8528cdcb7d1ba
MD5 33d0c301b81e54c11a2ee55b63802488
SHA1 8c2f74dacd022ca46ad65515c3fd5a7ac63754d7
SHA512 7a651ebb6cf9a0340875f7490005937b952ad7812f42a1667822f71a7ef7a4d3f719ed1eebf64ad9778ce112c52d0cbed47dbb757a866dcfcf752687c1f88f6f
SSDEEP 192:YKk1d66Joz0dzgCl6mc0dqjOv5zboH/ZH/yj5SV:Yfd66JozQzgC1j5bofZH/yja
TLSH
T19CE10D64E628867FC418427BCCE62F410F35388B984E2F2935AD650C2D5B2DD7A8E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\769walom.default-release\datareporting\glean\events\events
Size 1KB
SHA256 bb365f9c8187a10e0bc4ec077e03029888724a7859de4f380f3cf598e8f4d798
MD5 88bfc54bd0d7492c867c5a4f1797973b
SHA1 db5680d7fb6f9307d39ad938d8460f3b93979e78
SHA512 e784e367fee02a8c71e852f03def18d1aa82904dea2a2221386f0cd02875c5c796b53a96fac3c712648457d9d2b0130c74273ae3add031d2fc41dabf5dac6408
TLSH
T1B211A26E39FA4D6A99DBE29C7441068E53224A1304C71D430D22DF8DCEE5BFD326943D
MD5 SHA1 SHA512 TLSH

Submit Download

1224f09b-1d1c-48f1-ba38-908ee06baedd

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\769walom.default-release\datareporting\glean\pending_pings\1224f09b-1d1c-48f1-ba38-908ee06baedd
Size 3KB
SHA256 21b78e4229d9da002e2041b5ee6c60139b7299216064759717c2374a67d493f0
MD5 584743dfed1f72ad884b5786a4ad1649
SHA1 0d06c771bbef3744e4afe50d4fdd0226cb88cf9c
SHA512 e8daacfaf73798651e66cc34a4449e5e9e0c5abd337f5ecaa34b8aef4c4c05e93d466159b1effdd5458edfeccc9de94461fd795007df4ee3a71b379660bfe0ec
TLSH
T174615631455869738EF8A140E377BE548DDE338F58571B8A25AE8D2852F8424578F24B
MD5 SHA1 SHA512 TLSH

Submit Download

18c3dbf8-02e5-43ee-acb3-c8d38cbc8342

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\769walom.default-release\datareporting\glean\pending_pings\18c3dbf8-02e5-43ee-acb3-c8d38cbc8342
Size 16KB
SHA256 4c0a9f266bcfc0d8566a56666701773bde115b275bab0d83be87cf43c35f291b
MD5 044d5521a77f659a3827364c09004148
SHA1 8949072bbc373519606ad5fd458d517afdd21914
SHA512 279cdf82d7e6652f26d6d80c1521340b44a83b0b23a199feee37dc7bb92a4d3c00abea484664e3a6405628ead141e5a5e614e029bf8d1606872a0560ec84d074
SSDEEP 384:tiMd8kibEbr0+7oJva7VHMyECAs0bJqbhcyYz:taBvoMy8s0bghcp
TLSH
T1C272C9162820457A8251E3A995FCBFC3E5F538CF4C419FCA9BE4BD486EDE09E112784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

458ea093-d7b9-4218-87e6-3fe4a91a5a6a

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\769walom.default-release\datareporting\glean\pending_pings\458ea093-d7b9-4218-87e6-3fe4a91a5a6a
Size 3KB
SHA256 fc4ca1bf454655d0b27058c9df8e6b8af3db95a29bac403b8af7811ff7fa1ddf
MD5 ed9b3b7277a77d412ff9d29f65fe615f
SHA1 53d7a27a57faf777dee2eee4f4b846500ab5944b
SHA512 1f6a305db8dfae5ebb2cd8c91df310ce861b58db1dc0e080563feee11a08b0aed79588c77dc5dbad8ac5104fad0da99bacc4dd03bdfc8ae990b93f20cbdae50c
TLSH
T1306164314558A9739BFCA104A37BBE548DDA339F48531B8A269D8D2842FC4245B8F34B
MD5 SHA1 SHA512 TLSH

Submit Download

70bb5155-5503-46a7-b437-e77250b9e132

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\769walom.default-release\datareporting\glean\pending_pings\70bb5155-5503-46a7-b437-e77250b9e132
Size 2KB
SHA256 d2a98b23716bd34af9ae8d5c889ba768684c09e2f179da0997408731716ae4d2
MD5 bcb1b519fac68122e4923598f6617130
SHA1 04cca5aeaa9d200795bffa99fc6a2c362d6c25dd
SHA512 6902a5913fc07462220d29cedb9736ff702a65c365d61ebd1354001c38771361e45dc73d5d430987e1f404e652d2dc3636b71d33cf2e0426ffe5d45407690ee6
TLSH
T14541235835744D7A8CDAF65D9492378E57A0590310C61C832EA1DF0CCD9A6DF736E82E
MD5 SHA1 SHA512 TLSH

Submit Download

72ff21f8-3981-41e3-ab86-0690af4064b0

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\769walom.default-release\datareporting\glean\pending_pings\72ff21f8-3981-41e3-ab86-0690af4064b0
Size 3KB
SHA256 a21ee6562b54e11ac22a2268b8767abe037950d4a7f34e10d556c505810f0a02
MD5 3077a5c2f26dea5e306546237995adb6
SHA1 8821916809727eb5ef2e875bb111e3056f3f28da
SHA512 9b71a8eb699746afdca6ca137913259704d8b1160637fcc1caa324c44294e18ba176df719e0d8622118ba79f54ae28d01b2c55c43c3f3d5cc028944378c861b0
TLSH
T156617471455879739FF8A141A37B7A4089DA339F48971ACA21AE8E2852FC4345B8F24B
MD5 SHA1 SHA512 TLSH

Submit Download

8909308f-902e-490f-8d83-f3b84b9a282d

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\769walom.default-release\datareporting\glean\pending_pings\8909308f-902e-490f-8d83-f3b84b9a282d
Size 883B
SHA256 d6cc7c63ed26a67415092b63578224ad3fde7856ba309fdd1b93ad92f5add441
MD5 70be136742f4640905e7588d1692955f
SHA1 28bf44d2ff8a2b980db99578f076c5b68ef16a74
SHA512 ecb1259f931159faee686416508165f26f1dc7643f173f806eb5ffeae2785f601e64c6a471154dffd5d22d5ee9c62be8b21929357724690890896dc3c3ed51f1
TLSH
T1BA11C082D63079F2CD7CD35F89967B419AE43413D0CB84243EB58A144EBE52DA76A607
MD5 SHA1 SHA512 TLSH

Submit Download

8ffd5771-e742-415a-b8b5-f05dde1c9ca4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\769walom.default-release\datareporting\glean\pending_pings\8ffd5771-e742-415a-b8b5-f05dde1c9ca4
Size 3KB
SHA256 03439841b46040b71deb8ee497aa427db5faf0ff7eea5dc6fe688119727127a1
MD5 45a2b778052d35e815ccdb95f4967d5c
SHA1 5851841921e1685b7099477548795ddfc921e50c
SHA512 e0d13b3b222a4ac69a62fef85da2070221f459bbfb61b1ed8a9dfa11751cf3bf8138b038b4e49e29834d270420cda340fe5ae693b11ae015d97427081ffa7ca0
TLSH
T1A2617231455879739EFCA144A37B7A948DDE338F58931B8E226E8D2852BC4345B8F24F
MD5 SHA1 SHA512 TLSH

Submit Download

a3026efc-483e-4d79-aa7d-76182504d13d

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\769walom.default-release\datareporting\glean\pending_pings\a3026efc-483e-4d79-aa7d-76182504d13d
Size 235B
SHA256 8574e37478c8dbd685dc4d5a9bb264c50d159cc71317cf8c2099fc70f09939cf
MD5 2a98ca2140f894439250f27b15ed3bfa
SHA1 02fe8d78f21efcab6799bfd087038969bd73e8ed
SHA512 926dea58110935d8a4560a8e9bb88451d7b5dd1215af6f18f8b7dcfe933fe92514b10c3571bc86b22a881f0cf9319a718fe9d3df786174f7c1604fd4879df3ab
TLSH
T190D097C01C88277D48040F06F0E82CC330888C3330B89820EA928434ADBDED4529290A
MD5 SHA1 SHA512 TLSH

Submit Download

c5e68d02-dc12-4c4f-8f99-fd82835b30fd

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\769walom.default-release\datareporting\glean\pending_pings\c5e68d02-dc12-4c4f-8f99-fd82835b30fd
Size 235B
SHA256 7d5073aa09a932f328ce2e88481b5b49063c48a2299bca536f5db9558c7162e9
MD5 3a635bddb314ae42c2cf182f6a4ba083
SHA1 a34f128e452178102515bf1c28844625fbb6d897
SHA512 c3da4594aac225f1cf6f5642b23e0fc8cf4eebf957366c962fa956a49b3922e711a147101074a26c3d5767d7c03e47f795979393a5918e6cc5cbf92ad0e3e491
TLSH
T167D0A78464987B6D4D244F06F0E169D634588E371475E820DA9145749AFDEC9415285B
MD5 SHA1 SHA512 TLSH

Submit Download

e57f65be-2501-4add-bdad-117252fade00

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\769walom.default-release\datareporting\glean\pending_pings\e57f65be-2501-4add-bdad-117252fade00
Size 3KB
SHA256 ba30f96a4091f96284c1c214deb5adb443dfa3007e7d04cb201737475ddeb7b1
MD5 cfb70fe78a7c030d006fbf5cada9dd06
SHA1 dea830eb2d7487b9de5a3a7b4f3207a110da9cdb
SHA512 560767ee80b3ba4456526b9b6fdc1fae1feac41f7e0353783bb87adbe3eff467f1ca85f5426a7b6d01835b2121884b79a2b42c646a4408f7a97202c454213004
TLSH
T176617531455879739FF8A144A377BA448DEE338F58930A8E25AE8D2843FC4245B8F35B
MD5 SHA1 SHA512 TLSH

Submit Download

eec4e0e2-33ef-4e34-aed8-66bff6ed36da

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\769walom.default-release\datareporting\glean\pending_pings\eec4e0e2-33ef-4e34-aed8-66bff6ed36da
Size 886B
SHA256 864e0f7896c4a890a09473487bdf275868342758e36e6a7a570172fb482b5a44
MD5 75534dfb767ab2d99e1592dfb7d11f1d
SHA1 b49c41a65e378a057441a52f6ff7be3635804edc
SHA512 a0688e15095931d94b0d05d96ba1f4eb052d40bb204faa3503dd7dbe6fd4404474bf1b0157ed85936c3488eb0bb5d97e6832e1526c2916981347ec0777afe1dc
TLSH
T17511C091C53479F2CDB8D28B89D17B429AD4742380CB49143EB48B184EFE11EAB5A60B
MD5 SHA1 SHA512 TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\769walom.default-release\prefs.js
Size 6KB
SHA256 d93162bb4a6c2bffe792df57dadc000ce1580455e38bb96a218ec84ae7b3af25
MD5 c9006822b212d8c9c4f7f9c98e1814db
SHA1 9e6eb91f042d1fe41bb646c76e8559a7338f4692
SHA512 888e54ab8a5d7446c6a3bf990246398e765a1760c6fefe9e5ca8a69fac60e117a0706886247c357dd5548f637fe078051954c8e3aa05d906942d60daeb2f2fb1
SSDEEP 96:xHvUTU2qGqsf0KjJnj01zSo+SSlldv9jGnBRHFIGVkSw88H8L4cnLTU+:xxRsf06oN+SSi9FIjSw88E
TLSH
T11DE1207855088B7F74B677AC6C6888316AB2013BB7BF68D750B554C5011CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Windows\SystemTemp\Crashpad\settings.dat
Size 40B
SHA256 b9575f7c168505fe2f0e8973e39cce80cd3a7f04693ff8252b9088ea7201e3f0
MD5 2d3a08ff1931c8ac124c1ba3bf701295
SHA1 25ce383235ad3b39410a00c35e04d8b30f0a8dc1
SHA512 8328a3298a9815b3ce5e1ebc912388c06ba41233968592a6626c475e599cc707b2ce8edc88c579607c3812f29219da2e054acf767d72ed2f182c616d694268b7
MD5 SHA1 SHA512

Submit Download

chrome_installer.log

Path C:\Windows\SystemTemp\chrome_installer.log
Size 9KB
SHA256 b4ad3684b58de30cfd2b0df4873cc75a74278c38c1fef967ef4ed8d51daaf317
MD5 f68f4deb42da5bb6941be278739a6cac
SHA1 52f1756e9ef30bc67c890e3affac820e348ce7cc
SHA512 98c5c727204aa723eb1b534fce98ed52bbf6612553191af05ec95a0b53d869baab6973ffc064c6d412e23b9cc26f295cac971f73ceb305780f97b635a7b136c9
SSDEEP 192:PwvjAMgANgAZgAUgA8RJWArPOLOOpsbmA/mHAmoH2S/ldfaA9c7K//uxESeNAW6k:PwvjAM3N3Z3U38RJWArPOLOOpsbz/MAz
TLSH
T1071280D68E0244AF7B82DB2B335331515DAB140BCBF454B23BEB9506B4CEA65052F2B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/228-437-0x0000000000310000-0x0000000000311000-memory.dmp

Download

memory/2560-210-0x0000000001460000-0x0000000001560000-memory.dmp

Download

memory/2560-172-0x0000000001460000-0x0000000001560000-memory.dmp

Download

memory/2560-413-0x0000000001460000-0x0000000001560000-memory.dmp

Download

memory/2560-414-0x0000000001460000-0x0000000001560000-memory.dmp

Download

memory/2560-212-0x0000000001460000-0x0000000001560000-memory.dmp

Download

memory/2560-215-0x0000000001460000-0x0000000001560000-memory.dmp

Download

memory/2560-216-0x0000000001460000-0x0000000001560000-memory.dmp

Download

memory/2560-311-0x0000000001460000-0x0000000001560000-memory.dmp

Download

memory/2560-225-0x0000000001460000-0x0000000001560000-memory.dmp

Download

memory/2560-15-0x0000000000400000-0x00000000004BE000-memory.dmp

Download

memory/2560-320-0x0000000001460000-0x0000000001560000-memory.dmp

Download

memory/2560-319-0x0000000001460000-0x0000000001560000-memory.dmp

Download

memory/2560-318-0x0000000001460000-0x0000000001560000-memory.dmp

Download

memory/2560-317-0x0000000001460000-0x0000000001560000-memory.dmp

Download

memory/2560-316-0x0000000001460000-0x0000000001560000-memory.dmp

Download

memory/2560-315-0x0000000001460000-0x0000000001560000-memory.dmp

Download

memory/2560-314-0x0000000001460000-0x0000000001560000-memory.dmp

Download

memory/2560-313-0x0000000001460000-0x0000000001560000-memory.dmp

Download

memory/2560-312-0x0000000001460000-0x0000000001560000-memory.dmp

Download

memory/2560-308-0x0000000001460000-0x0000000001560000-memory.dmp

Download

memory/2560-307-0x0000000001460000-0x0000000001560000-memory.dmp

Download

memory/2560-306-0x0000000001460000-0x0000000001560000-memory.dmp

Download

memory/2560-305-0x0000000001460000-0x0000000001560000-memory.dmp

Download

memory/2560-304-0x0000000001460000-0x0000000001560000-memory.dmp

Download

memory/2560-303-0x0000000001460000-0x0000000001560000-memory.dmp

Download

memory/2560-300-0x0000000001460000-0x0000000001560000-memory.dmp

Download

memory/2560-299-0x0000000001460000-0x0000000001560000-memory.dmp

Download

memory/2560-298-0x0000000001460000-0x0000000001560000-memory.dmp

Download

memory/2560-297-0x0000000001460000-0x0000000001560000-memory.dmp

Download

memory/2560-295-0x0000000001460000-0x0000000001560000-memory.dmp

Download

memory/2560-250-0x0000000001460000-0x0000000001560000-memory.dmp

Download

memory/2560-309-0x0000000001460000-0x0000000001560000-memory.dmp

Download

memory/2560-226-0x0000000001460000-0x0000000001560000-memory.dmp

Download

memory/2560-220-0x0000000001460000-0x0000000001560000-memory.dmp

Download

memory/2560-222-0x0000000001460000-0x0000000001560000-memory.dmp

Download

memory/2560-221-0x0000000001460000-0x0000000001560000-memory.dmp

Download

memory/2560-217-0x0000000001460000-0x0000000001560000-memory.dmp

Download

memory/2560-213-0x0000000001460000-0x0000000001560000-memory.dmp

Download

memory/2560-211-0x0000000001460000-0x0000000001560000-memory.dmp

Download

memory/2560-207-0x0000000001460000-0x0000000001560000-memory.dmp

Download

memory/2560-170-0x0000000001460000-0x0000000001560000-memory.dmp

Download

memory/2560-171-0x0000000001460000-0x0000000001560000-memory.dmp

Download

memory/2560-174-0x0000000001460000-0x0000000001560000-memory.dmp

Download

memory/2560-177-0x0000000001460000-0x0000000001560000-memory.dmp

Download

memory/2560-185-0x0000000001460000-0x0000000001560000-memory.dmp

Download

memory/2560-186-0x0000000001460000-0x0000000001560000-memory.dmp

Download

memory/2560-178-0x0000000001460000-0x0000000001560000-memory.dmp

Download

memory/2560-179-0x0000000001460000-0x0000000001560000-memory.dmp

Download

memory/2560-180-0x0000000001460000-0x0000000001560000-memory.dmp

Download

memory/2560-379-0x0000000001460000-0x0000000001560000-memory.dmp

Download

memory/2560-155-0x0000000001460000-0x0000000001560000-memory.dmp

Download

memory/2560-165-0x0000000001460000-0x0000000001560000-memory.dmp

Download

memory/2560-166-0x0000000001460000-0x0000000001560000-memory.dmp

Download

memory/2560-1183-0x0000000001460000-0x0000000001560000-memory.dmp

Download

memory/2560-1182-0x0000000001460000-0x0000000001560000-memory.dmp

Download

memory/2560-158-0x0000000001460000-0x0000000001560000-memory.dmp

Download

memory/2560-156-0x0000000005890000-0x00000000058A0000-memory.dmp

Download

memory/2560-154-0x0000000001460000-0x0000000001560000-memory.dmp

Download

memory/2560-151-0x0000000001460000-0x0000000001560000-memory.dmp

Download

memory/2560-253-0x0000000001460000-0x0000000001560000-memory.dmp

Download

memory/2560-147-0x0000000001460000-0x0000000001560000-memory.dmp

Download

memory/2560-148-0x0000000001460000-0x0000000001560000-memory.dmp

Download

memory/2560-310-0x0000000001460000-0x0000000001560000-memory.dmp

Download

memory/2560-26-0x0000000005CE0000-0x0000000005CFE000-memory.dmp

Download

memory/2560-24-0x0000000006EF0000-0x000000000741C000-memory.dmp

Download

memory/2560-23-0x0000000006720000-0x0000000006770000-memory.dmp

Download

memory/2560-22-0x00000000066A0000-0x0000000006716000-memory.dmp

Download

memory/2560-21-0x00000000067F0000-0x00000000069B2000-memory.dmp

Download

memory/2560-20-0x0000000006570000-0x0000000006622000-memory.dmp

Download

memory/2560-19-0x0000000005DE0000-0x0000000005E46000-memory.dmp

Download

memory/2560-18-0x0000000005890000-0x00000000058A0000-memory.dmp

Download

memory/2560-264-0x0000000001460000-0x0000000001560000-memory.dmp

Download

memory/2560-16-0x0000000005E50000-0x00000000063F6000-memory.dmp

Download

memory/2560-301-0x0000000001460000-0x0000000001560000-memory.dmp

Download

memory/2560-302-0x0000000001460000-0x0000000001560000-memory.dmp

Download

memory/2560-296-0x0000000001460000-0x0000000001560000-memory.dmp

Download

memory/2560-257-0x0000000001460000-0x0000000001560000-memory.dmp

Download

memory/2560-258-0x0000000001460000-0x0000000001560000-memory.dmp

Download

memory/2560-259-0x0000000001460000-0x0000000001560000-memory.dmp

Download

memory/2560-260-0x0000000001460000-0x0000000001560000-memory.dmp

Download

memory/2560-293-0x0000000001460000-0x0000000001560000-memory.dmp

Download

memory/2560-261-0x0000000001460000-0x0000000001560000-memory.dmp

Download

memory/2560-262-0x0000000001460000-0x0000000001560000-memory.dmp

Download

memory/2560-263-0x0000000001460000-0x0000000001560000-memory.dmp

Download

memory/2560-265-0x0000000001460000-0x0000000001560000-memory.dmp

Download

memory/2560-268-0x0000000001460000-0x0000000001560000-memory.dmp

Download

memory/2560-269-0x0000000001460000-0x0000000001560000-memory.dmp

Download

memory/2560-266-0x0000000001460000-0x0000000001560000-memory.dmp

Download

memory/4700-17-0x000001427A160000-0x000001427A170000-memory.dmp

Download

memory/4700-0-0x000001427A160000-0x000001427A170000-memory.dmp

Download

memory/4700-14-0x000001427A160000-0x000001427A170000-memory.dmp

Download

memory/4700-13-0x000001427A160000-0x000001427A170000-memory.dmp

Download

memory/4700-12-0x000001427A320000-0x000001427A34A000-memory.dmp

Download

memory/4700-9-0x000001427A160000-0x000001427A170000-memory.dmp

Download

memory/4700-7-0x000001427A290000-0x000001427A2B2000-memory.dmp

Download

memory/4700-1-0x000001427A160000-0x000001427A170000-memory.dmp

Download

memory/4896-149-0x00000204ECA50000-0x00000204ECA60000-memory.dmp

Download

memory/4916-419-0x0000000000AD0000-0x0000000000AD1000-memory.dmp

Download