guloader | 12db648c3d516bb4210f37388077273757ea792168a6c32a9c0210cbfc7c01f9

Analysis

max time kernel
149s
max time network
130s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
17/02/2026, 07:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PaymentAdviseSwift0285.exe
Size 260KB
Sample260217-h71shabs9d
SHA256 12db648c3d516bb4210f37388077273757ea792168a6c32a9c0210cbfc7c01f9
MD5 c0214c5ac40753c905e4ecf9c4a8b48e
SHA1 8cbb0796cce9e55c5ad359ec5a9628a06908d627
SHA512 c0a4871de1c06b72d86a8eb51e5d6cd5f7daff21e1c4e16f20e866625f7b9ae2a2e6157ac5025817c7a0a6ee100aa9de7c09e4f0239b9c940e577db116b7133e
SSDEEP 6144:kcBvWb00fuvQJqjJ0VCbUG2wdSU8kjVHHT:tO0ouYJqjJSCbUdwdDjx
TLSH
T1D344121876E4D4A3C13102700F7A437B5BF25B240AF54B5B3B60EFAD7843A919E27A67
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

collection discovery downloader guloader phantom_stealer installer persistence spyware stealer

Malware Config

Extracted

Family

phantom_stealer

Version

v3.5.0

Mutex

3Z6XGDF0AC12SPZPN6BJ

Attributes

anti_analysis
0
cb_enables_ssl
0
debug
0
keylogger
0
start_delay
1
startup
1

Signatures

Detects PhantomStealer payload 2 IoCs

resource	yara_rule
behavioral2/memory/5108-27-0x0000000000440000-0x0000000001757000-memory.dmp	family_phantomstealer
behavioral2/memory/5108-28-0x0000000000440000-0x00000000004FE000-memory.dmp	family_phantomstealer

Guloader family
guloader
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader
PhantomStealer
Phantom Stealer is a stealer written in C#, forked from the Stealerium family.
stealer phantom_stealer
Phantom_stealer family
phantom_stealer

Executes dropped EXE 3 IoCs

pid	Process
5248	PaymentAdviseSwift0285.exe
3508	PaymentAdviseSwift0285.exe
4492	PaymentAdviseSwift0285.exe

Loads dropped DLL 3 IoCs

pid	Process
764	PaymentAdviseSwift0285.exe
5248	PaymentAdviseSwift0285.exe
5940	PaymentAdviseSwift0285.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	PaymentAdviseSwift0285.exe
Key opened	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	PaymentAdviseSwift0285.exe
Key opened	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	PaymentAdviseSwift0285.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000\Software\Microsoft\Windows\CurrentVersion\Run\PaymentAdviseSwift0285 = "C:\\Users\\Admin\\AppData\\Roaming\\PaymentAdviseSwift0285.exe"	PaymentAdviseSwift0285.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
2	drive.google.com
1	drive.google.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
8	icanhazip.com

Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs

pid	Process
5108	PaymentAdviseSwift0285.exe
5940	PaymentAdviseSwift0285.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

pid	Process
764	PaymentAdviseSwift0285.exe
5108	PaymentAdviseSwift0285.exe
5248	PaymentAdviseSwift0285.exe
5940	PaymentAdviseSwift0285.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PaymentAdviseSwift0285.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PaymentAdviseSwift0285.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PaymentAdviseSwift0285.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PaymentAdviseSwift0285.exe

System Time Discovery 1 TTPs 4 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
6388	chrome.exe
3872	chrome.exe
1272	msedge.exe
6404	msedge.exe

NSIS installer 2 IoCs

installer

resource	yara_rule
behavioral2/files/0x001900000002b3b3-39.dat	nsis_installer_1
behavioral2/files/0x001900000002b3b3-39.dat	nsis_installer_2

Checks processor information in registry 2 TTPs 32 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	PaymentAdviseSwift0285.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	PaymentAdviseSwift0285.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Enumerates system info in registry 2 TTPs 12 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5108	PaymentAdviseSwift0285.exe
4700	chrome.exe
4700	chrome.exe
5108	PaymentAdviseSwift0285.exe
5108	PaymentAdviseSwift0285.exe
5108	PaymentAdviseSwift0285.exe
5108	PaymentAdviseSwift0285.exe
5108	PaymentAdviseSwift0285.exe
5108	PaymentAdviseSwift0285.exe
5108	PaymentAdviseSwift0285.exe
5108	PaymentAdviseSwift0285.exe
5108	PaymentAdviseSwift0285.exe
5108	PaymentAdviseSwift0285.exe
2388	firefox.exe
2388	firefox.exe
2388	firefox.exe
2388	firefox.exe
2388	firefox.exe
2388	firefox.exe
2388	firefox.exe
2388	firefox.exe
2388	firefox.exe
2388	firefox.exe
2388	firefox.exe
2388	firefox.exe
2388	firefox.exe
2388	firefox.exe
2388	firefox.exe
2388	firefox.exe
2388	firefox.exe
2388	firefox.exe
2388	firefox.exe
2388	firefox.exe
5108	PaymentAdviseSwift0285.exe
5108	PaymentAdviseSwift0285.exe
5108	PaymentAdviseSwift0285.exe
5108	PaymentAdviseSwift0285.exe
5108	PaymentAdviseSwift0285.exe
5108	PaymentAdviseSwift0285.exe
5108	PaymentAdviseSwift0285.exe
5108	PaymentAdviseSwift0285.exe
5108	PaymentAdviseSwift0285.exe
5108	PaymentAdviseSwift0285.exe
5108	PaymentAdviseSwift0285.exe
5108	PaymentAdviseSwift0285.exe
5108	PaymentAdviseSwift0285.exe
5108	PaymentAdviseSwift0285.exe
5108	PaymentAdviseSwift0285.exe
5108	PaymentAdviseSwift0285.exe
5108	PaymentAdviseSwift0285.exe
5108	PaymentAdviseSwift0285.exe
5108	PaymentAdviseSwift0285.exe
4544	firefox.exe
4544	firefox.exe
4544	firefox.exe
4544	firefox.exe
4544	firefox.exe
4544	firefox.exe
4544	firefox.exe
4544	firefox.exe
4544	firefox.exe
4544	firefox.exe
4544	firefox.exe
4544	firefox.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
764	PaymentAdviseSwift0285.exe
5248	PaymentAdviseSwift0285.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeDebugPrivilege	5108	PaymentAdviseSwift0285.exe
Token: SeShutdownPrivilege	4700	chrome.exe
Token: SeCreatePagefilePrivilege	4700	chrome.exe
Token: SeShutdownPrivilege	4700	chrome.exe
Token: SeCreatePagefilePrivilege	4700	chrome.exe
Token: SeShutdownPrivilege	4700	chrome.exe
Token: SeCreatePagefilePrivilege	4700	chrome.exe
Token: SeDebugPrivilege	5940	PaymentAdviseSwift0285.exe
Token: SeShutdownPrivilege	6176	chrome.exe
Token: SeCreatePagefilePrivilege	6176	chrome.exe
Token: SeShutdownPrivilege	6176	chrome.exe
Token: SeCreatePagefilePrivilege	6176	chrome.exe

Suspicious use of FindShellTrayWindow 22 IoCs

pid	Process
4700	chrome.exe
4700	chrome.exe
2388	firefox.exe
2388	firefox.exe
2388	firefox.exe
2388	firefox.exe
2388	firefox.exe
2388	firefox.exe
2388	firefox.exe
2388	firefox.exe
3196	msedge.exe
2188	msedge.exe
4544	firefox.exe
4544	firefox.exe
4544	firefox.exe
4544	firefox.exe
4544	firefox.exe
4544	firefox.exe
4544	firefox.exe
4544	firefox.exe
6176	chrome.exe
6176	chrome.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2388	firefox.exe
4544	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 764 wrote to memory of 5104	764	PaymentAdviseSwift0285.exe	78
PID 764 wrote to memory of 5108	764	PaymentAdviseSwift0285.exe	79
PID 764 wrote to memory of 5108	764	PaymentAdviseSwift0285.exe	79
PID 5108 wrote to memory of 4680	5108	PaymentAdviseSwift0285.exe	80
PID 5108 wrote to memory of 4700	5108	PaymentAdviseSwift0285.exe	84
PID 4700 wrote to memory of 5308	4700	chrome.exe	85
PID 4700 wrote to memory of 3652	4700	chrome.exe	86
PID 4700 wrote to memory of 3872	4700	chrome.exe	87
PID 4700 wrote to memory of 2724	4700	chrome.exe	88
PID 4700 wrote to memory of 4228	4700	chrome.exe	89
PID 4700 wrote to memory of 236	4700	chrome.exe	90
PID 4700 wrote to memory of 5320	4700	chrome.exe	91
PID 4700 wrote to memory of 4720	4700	chrome.exe	92
PID 4700 wrote to memory of 5268	4700	chrome.exe	93
PID 4700 wrote to memory of 1312	4700	chrome.exe	94
PID 5108 wrote to memory of 5308	5108	PaymentAdviseSwift0285.exe	85
PID 5108 wrote to memory of 5308	5108	PaymentAdviseSwift0285.exe	85
PID 5108 wrote to memory of 4700	5108	PaymentAdviseSwift0285.exe	84
PID 5108 wrote to memory of 4700	5108	PaymentAdviseSwift0285.exe	84
PID 5108 wrote to memory of 3652	5108	PaymentAdviseSwift0285.exe	86
PID 5108 wrote to memory of 3652	5108	PaymentAdviseSwift0285.exe	86
PID 5108 wrote to memory of 3872	5108	PaymentAdviseSwift0285.exe	87
PID 5108 wrote to memory of 3872	5108	PaymentAdviseSwift0285.exe	87
PID 4700 wrote to memory of 2948	4700	chrome.exe	95
PID 4700 wrote to memory of 3276	4700	chrome.exe	96
PID 4700 wrote to memory of 5180	4700	chrome.exe	97
PID 5108 wrote to memory of 2948	5108	PaymentAdviseSwift0285.exe	95
PID 5108 wrote to memory of 2948	5108	PaymentAdviseSwift0285.exe	95
PID 5108 wrote to memory of 5308	5108	PaymentAdviseSwift0285.exe	85
PID 5108 wrote to memory of 5308	5108	PaymentAdviseSwift0285.exe	85
PID 5108 wrote to memory of 4700	5108	PaymentAdviseSwift0285.exe	84
PID 5108 wrote to memory of 4700	5108	PaymentAdviseSwift0285.exe	84
PID 5108 wrote to memory of 2724	5108	PaymentAdviseSwift0285.exe	88
PID 5108 wrote to memory of 2724	5108	PaymentAdviseSwift0285.exe	88
PID 5108 wrote to memory of 5268	5108	PaymentAdviseSwift0285.exe	93
PID 5108 wrote to memory of 1312	5108	PaymentAdviseSwift0285.exe	94
PID 5108 wrote to memory of 3276	5108	PaymentAdviseSwift0285.exe	96
PID 5108 wrote to memory of 3276	5108	PaymentAdviseSwift0285.exe	96
PID 5108 wrote to memory of 5180	5108	PaymentAdviseSwift0285.exe	97
PID 5108 wrote to memory of 5180	5108	PaymentAdviseSwift0285.exe	97
PID 5108 wrote to memory of 3652	5108	PaymentAdviseSwift0285.exe	86
PID 5108 wrote to memory of 3652	5108	PaymentAdviseSwift0285.exe	86
PID 5108 wrote to memory of 4720	5108	PaymentAdviseSwift0285.exe	92
PID 5108 wrote to memory of 4720	5108	PaymentAdviseSwift0285.exe	92
PID 5108 wrote to memory of 236	5108	PaymentAdviseSwift0285.exe	90
PID 5108 wrote to memory of 236	5108	PaymentAdviseSwift0285.exe	90
PID 5108 wrote to memory of 3872	5108	PaymentAdviseSwift0285.exe	87
PID 5108 wrote to memory of 3872	5108	PaymentAdviseSwift0285.exe	87
PID 5108 wrote to memory of 5320	5108	PaymentAdviseSwift0285.exe	91
PID 5108 wrote to memory of 5320	5108	PaymentAdviseSwift0285.exe	91
PID 5108 wrote to memory of 2948	5108	PaymentAdviseSwift0285.exe	95
PID 5108 wrote to memory of 2948	5108	PaymentAdviseSwift0285.exe	95
PID 5108 wrote to memory of 5308	5108	PaymentAdviseSwift0285.exe	85
PID 5108 wrote to memory of 5308	5108	PaymentAdviseSwift0285.exe	85
PID 5108 wrote to memory of 4700	5108	PaymentAdviseSwift0285.exe	84
PID 5108 wrote to memory of 4700	5108	PaymentAdviseSwift0285.exe	84
PID 5108 wrote to memory of 2724	5108	PaymentAdviseSwift0285.exe	88
PID 5108 wrote to memory of 2724	5108	PaymentAdviseSwift0285.exe	88
PID 5108 wrote to memory of 5268	5108	PaymentAdviseSwift0285.exe	93
PID 5108 wrote to memory of 5268	5108	PaymentAdviseSwift0285.exe	93
PID 5108 wrote to memory of 1312	5108	PaymentAdviseSwift0285.exe	94
PID 5108 wrote to memory of 1312	5108	PaymentAdviseSwift0285.exe	94
PID 5108 wrote to memory of 3652	5108	PaymentAdviseSwift0285.exe	86
PID 5108 wrote to memory of 3652	5108	PaymentAdviseSwift0285.exe	86

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	PaymentAdviseSwift0285.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	PaymentAdviseSwift0285.exe

C:\Users\Admin\AppData\Local\Temp\PaymentAdviseSwift0285.exe
"C:\Users\Admin\AppData\Local\Temp\PaymentAdviseSwift0285.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:764
- C:\Users\Admin\AppData\Local\Temp\PaymentAdviseSwift0285.exe
  "C:\Users\Admin\AppData\Local\Temp\PaymentAdviseSwift0285.exe"
  2⤵
  PID:5104
- C:\Users\Admin\AppData\Local\Temp\PaymentAdviseSwift0285.exe
  "C:\Users\Admin\AppData\Local\Temp\PaymentAdviseSwift0285.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - Adds Run key to start application
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - outlook_office_path
  - outlook_win_path
  PID:5108
- - C:\Users\Admin\AppData\Local\Temp\PaymentAdviseSwift0285.exe
    "C:\Users\Admin\AppData\Local\Temp\PaymentAdviseSwift0285.exe"
    3⤵
    PID:4680
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\gi4wxmk0.3um"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4700
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\gi4wxmk0.3um /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\gi4wxmk0.3um\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\gi4wxmk0.3um --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7fffb14ac728,0x7fffb14ac734,0x7fffb14ac740
      4⤵
      PID:5308
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\gi4wxmk0.3um" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1592,i,6456272527828079336,16652255884482571245,262144 --field-trial-handle=1916,i,5183243458313785716,16774883776201024122,262144 --variations-seed-version --mojo-platform-channel-handle=1912 /prefetch:2
      4⤵
      PID:3652
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\gi4wxmk0.3um" --force-high-res-timeticks=disabled --metrics-shmem-handle=1952,i,10818958696029120416,14657404016735449368,524288 --field-trial-handle=1916,i,5183243458313785716,16774883776201024122,262144 --variations-seed-version --mojo-platform-channel-handle=2740 /prefetch:11
      4⤵
      System Time Discovery
      PID:3872
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\gi4wxmk0.3um" --force-high-res-timeticks=disabled --metrics-shmem-handle=2088,i,16112087314697317923,4827232089263221929,524288 --field-trial-handle=1916,i,5183243458313785716,16774883776201024122,262144 --variations-seed-version --mojo-platform-channel-handle=3288 /prefetch:13
      4⤵
      PID:2724
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\gi4wxmk0.3um" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2668,i,16282065362786272466,10539814675093416544,2097152 --field-trial-handle=1916,i,5183243458313785716,16774883776201024122,262144 --variations-seed-version --mojo-platform-channel-handle=3384 /prefetch:1
      4⤵
      PID:4228
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\gi4wxmk0.3um" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2672,i,10595603276780226651,12636035680302566424,2097152 --field-trial-handle=1916,i,5183243458313785716,16774883776201024122,262144 --variations-seed-version --mojo-platform-channel-handle=3452 /prefetch:1
      4⤵
      PID:236
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\gi4wxmk0.3um" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=2928,i,12548667689020444497,8448181814851613002,2097152 --field-trial-handle=1916,i,5183243458313785716,16774883776201024122,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
      4⤵
      PID:5320
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\gi4wxmk0.3um" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=2980,i,14222391344601385404,4787917581151785990,2097152 --field-trial-handle=1916,i,5183243458313785716,16774883776201024122,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:9
      4⤵
      PID:4720
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\gi4wxmk0.3um" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4032,i,15609438995605918811,3106038250356076617,2097152 --field-trial-handle=1916,i,5183243458313785716,16774883776201024122,262144 --variations-seed-version --mojo-platform-channel-handle=4000 /prefetch:9
      4⤵
      PID:5268
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\gi4wxmk0.3um" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4152,i,4104539325345449671,8517443155689494641,2097152 --field-trial-handle=1916,i,5183243458313785716,16774883776201024122,262144 --variations-seed-version --mojo-platform-channel-handle=4164 /prefetch:1
      4⤵
      PID:1312
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\gi4wxmk0.3um" --force-high-res-timeticks=disabled --metrics-shmem-handle=3564,i,7265057199308735459,15910736703809291965,524288 --field-trial-handle=1916,i,5183243458313785716,16774883776201024122,262144 --variations-seed-version --mojo-platform-channel-handle=4464 /prefetch:14
      4⤵
      PID:2948
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\gi4wxmk0.3um" --force-high-res-timeticks=disabled --metrics-shmem-handle=4524,i,11591916087227246297,1182172844219934628,524288 --field-trial-handle=1916,i,5183243458313785716,16774883776201024122,262144 --variations-seed-version --mojo-platform-channel-handle=4528 /prefetch:14
      4⤵
      PID:3276
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\gi4wxmk0.3um" --force-high-res-timeticks=disabled --metrics-shmem-handle=4572,i,13398854411550629498,3556968988529446268,524288 --field-trial-handle=1916,i,5183243458313785716,16774883776201024122,262144 --variations-seed-version --mojo-platform-channel-handle=4584 /prefetch:14
      4⤵
      PID:5180
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\dbly0ikh.b02"
    3⤵
    PID:5528
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir=C:\Users\Admin\AppData\Local\Temp\dbly0ikh.b02
      4⤵
      Checks processor information in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:2388
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1952 -prefsLen 27097 -prefMapHandle 1956 -prefMapSize 270279 -ipcHandle 2040 -initialChannelId {688b2817-fa3c-4221-827f-cf7229a19e87} -parentPid 2388 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2388" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
        5⤵
        
        PID:5552
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2496 -prefsLen 27133 -prefMapHandle 2500 -prefMapSize 270279 -ipcHandle 2508 -initialChannelId {8c7ce5f4-fcd5-4e01-bbe9-5229c2f5e2e4} -parentPid 2388 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2388" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
        5⤵
        
        PID:1392
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\bb532cee-8a60-4859-b7b4-d7d40065f02c.dmp"
        5⤵
        
        PID:3088
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2316 -prefsLen 27133 -prefMapHandle 2796 -prefMapSize 270279 -ipcHandle 2836 -initialChannelId {ecf420aa-96ea-4e65-aba4-e9aad0414417} -parentPid 2388 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2388" -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 gpu
        5⤵
        
        PID:1192
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\6c652f39-a156-4541-bc6b-658248d5c01b.dmp"
        5⤵
        
        PID:5036
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2836 -prefsLen 27133 -prefMapHandle 3136 -prefMapSize 270279 -ipcHandle 2872 -initialChannelId {c2a076fe-e731-4cfe-b386-df1dc0335bf7} -parentPid 2388 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2388" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 gpu
        5⤵
        
        PID:2088
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\249a70cd-2f93-46bb-b5e3-7ad86b265cc2.dmp"
        5⤵
        
        PID:2252
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2864 -prefsLen 27198 -prefMapHandle 3652 -prefMapSize 270279 -ipcHandle 3724 -initialChannelId {4d1d39e4-8d52-4da5-a768-2d5bdaf1d5a7} -parentPid 2388 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2388" -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 gpu
        5⤵
        
        PID:2820
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3336 -prefsLen 27274 -prefMapHandle 3320 -prefMapSize 270279 -jsInitHandle 3324 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3312 -initialChannelId {ff7cf6a6-04ee-43b4-b5fb-74f3d27a3651} -parentPid 2388 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2388" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 tab
        5⤵
        Checks processor information in registry
        
        PID:2200
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\91fcd3b2-4414-4600-a290-773bd80a06b6.dmp"
        5⤵
        
        PID:5068
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3724 -prefsLen 27274 -prefMapHandle 3340 -prefMapSize 270279 -ipcHandle 4036 -initialChannelId {dac72429-dce1-46f1-8a93-ba1dc4ee3b31} -parentPid 2388 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2388" -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 gpu
        5⤵
        
        PID:1840
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\45a5373c-bc15-40b7-8869-7e0dc8636637.dmp"
        5⤵
        
        PID:1564
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3352 -prefsLen 27274 -prefMapHandle 3824 -prefMapSize 270279 -ipcHandle 4248 -initialChannelId {983187cd-d495-4705-948a-e630e8a12eda} -parentPid 2388 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2388" -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 rdd
        5⤵
        
        PID:932
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3036 -prefsLen 34773 -prefMapHandle 2236 -prefMapSize 270279 -jsInitHandle 2240 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4544 -initialChannelId {3c4b0f00-82d6-4969-965e-4450296dcbd7} -parentPid 2388 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2388" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
        5⤵
        Checks processor information in registry
        
        PID:4848
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 1660 -prefsLen 35010 -prefMapHandle 3796 -prefMapSize 270279 -ipcHandle 5020 -initialChannelId {bc5470fb-d831-4171-89b1-4e9e5a8c8656} -parentPid 2388 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2388" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 utility
        5⤵
        Checks processor information in registry
        
        PID:6704
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3668 -prefsLen 32900 -prefMapHandle 3128 -prefMapSize 270279 -jsInitHandle 4952 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4976 -initialChannelId {773c41ef-f45f-48c6-b250-211eee513894} -parentPid 2388 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2388" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
        5⤵
        Checks processor information in registry
        
        PID:6900
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4244 -prefsLen 32900 -prefMapHandle 2348 -prefMapSize 270279 -jsInitHandle 2496 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5056 -initialChannelId {7d3e21e9-ed4e-433f-a9c9-08630bb937ee} -parentPid 2388 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2388" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
        5⤵
        Checks processor information in registry
        
        PID:6908
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5456 -prefsLen 32900 -prefMapHandle 5460 -prefMapSize 270279 -jsInitHandle 5464 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5476 -initialChannelId {cff16815-eb7d-4843-bc48-ec7cfb8d503b} -parentPid 2388 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2388" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab
        5⤵
        Checks processor information in registry
        
        PID:6984
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\qdugsin1.r2p"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious use of FindShellTrayWindow
    PID:3196
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\qdugsin1.r2p /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\qdugsin1.r2p\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7fffb148c188,0x7fffb148c194,0x7fffb148c1a0
      4⤵
      PID:4304
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\qdugsin1.r2p" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --metrics-shmem-handle=1632,i,1938606553245523553,8643117646242697626,262144 --field-trial-handle=2108,i,3402453209343860938,11773336436204352943,262144 --variations-seed-version --mojo-platform-channel-handle=2104 /prefetch:2
      4⤵
      PID:2820
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\qdugsin1.r2p" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1716,i,3938586800295618958,8513879494976770611,524288 --field-trial-handle=2108,i,3402453209343860938,11773336436204352943,262144 --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:11
      4⤵
      System Time Discovery
      PID:1272
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\qdugsin1.r2p" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2324,i,15772515559471325714,3387605399591793195,524288 --field-trial-handle=2108,i,3402453209343860938,11773336436204352943,262144 --variations-seed-version --mojo-platform-channel-handle=2344 /prefetch:13
      4⤵
      PID:5848
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\qdugsin1.r2p" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3112,i,10338160417501670564,18028400045329275496,2097152 --field-trial-handle=2108,i,3402453209343860938,11773336436204352943,262144 --variations-seed-version --mojo-platform-channel-handle=3116 /prefetch:1
      4⤵
      PID:4188
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\qdugsin1.r2p" --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3124,i,16418039282128479857,13974445505531443523,2097152 --field-trial-handle=2108,i,3402453209343860938,11773336436204352943,262144 --variations-seed-version --mojo-platform-channel-handle=2692 /prefetch:1
      4⤵
      PID:5876
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\qdugsin1.r2p" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3512,i,14418463430547257654,10544089383955455524,524288 --field-trial-handle=2108,i,3402453209343860938,11773336436204352943,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:14
      4⤵
      PID:1644
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\qdugsin1.r2p" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3520,i,7774627219273225078,9988565823654836298,524288 --field-trial-handle=2108,i,3402453209343860938,11773336436204352943,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:14
      4⤵
      PID:6536
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\qdugsin1.r2p" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3532,i,10904298919180405683,6674290085486224995,524288 --field-trial-handle=2108,i,3402453209343860938,11773336436204352943,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:14
      4⤵
      PID:6700
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\qdugsin1.r2p" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=3620,i,7212160486856220198,18285188447867931090,2097152 --field-trial-handle=2108,i,3402453209343860938,11773336436204352943,262144 --variations-seed-version --mojo-platform-channel-handle=3924 /prefetch:1
      4⤵
      PID:6844
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\qdugsin1.r2p" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=3656,i,17882590370065970556,17073740610025499987,2097152 --field-trial-handle=2108,i,3402453209343860938,11773336436204352943,262144 --variations-seed-version --mojo-platform-channel-handle=4780 /prefetch:9
      4⤵
      PID:6856
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\qdugsin1.r2p" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=3672,i,15957661383239177542,14725386968706720368,2097152 --field-trial-handle=2108,i,3402453209343860938,11773336436204352943,262144 --variations-seed-version --mojo-platform-channel-handle=4792 /prefetch:1
      4⤵
      PID:6864
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\qdugsin1.r2p" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3700,i,17337555399096113192,8449837436973718174,2097152 --field-trial-handle=2108,i,3402453209343860938,11773336436204352943,262144 --variations-seed-version --mojo-platform-channel-handle=4816 /prefetch:9
      4⤵
      PID:6588
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\qdugsin1.r2p" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=3724,i,1177415249855213550,2275696247544170247,2097152 --field-trial-handle=2108,i,3402453209343860938,11773336436204352943,262144 --variations-seed-version --mojo-platform-channel-handle=4832 /prefetch:1
      4⤵
      PID:7056
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\qdugsin1.r2p" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=3740,i,3382201709660626307,2667438480031536349,2097152 --field-trial-handle=2108,i,3402453209343860938,11773336436204352943,262144 --variations-seed-version --mojo-platform-channel-handle=5116 /prefetch:9
      4⤵
      PID:5292
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\qdugsin1.r2p" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=3752,i,9301246293238941484,13089248251306165898,2097152 --field-trial-handle=2108,i,3402453209343860938,11773336436204352943,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:1
      4⤵
      PID:5244
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\qdugsin1.r2p" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=3780,i,2151399489632290021,12141022805345777301,2097152 --field-trial-handle=2108,i,3402453209343860938,11773336436204352943,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:9
      4⤵
      PID:4144
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\qdugsin1.r2p" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=3804,i,5284260129719476986,14156912461822665279,2097152 --field-trial-handle=2108,i,3402453209343860938,11773336436204352943,262144 --variations-seed-version --mojo-platform-channel-handle=5104 /prefetch:1
      4⤵
      PID:3108
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\qdugsin1.r2p" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=3832,i,1166348991669624428,5263165769492818941,2097152 --field-trial-handle=2108,i,3402453209343860938,11773336436204352943,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:9
      4⤵
      PID:2076
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\qdugsin1.r2p" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3900,i,17770559772776109652,9099375307184321698,524288 --field-trial-handle=2108,i,3402453209343860938,11773336436204352943,262144 --variations-seed-version --mojo-platform-channel-handle=5240 /prefetch:14
      4⤵
      PID:2536
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=1128
        5⤵
        
        PID:6388
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\qdugsin1.r2p" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5296,i,2721620850224261846,1507521921971998882,524288 --field-trial-handle=2108,i,3402453209343860938,11773336436204352943,262144 --variations-seed-version --mojo-platform-channel-handle=3764 /prefetch:14
      4⤵
      PID:2044
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\qdugsin1.r2p" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5220,i,17207326357342325055,10406572407863842132,524288 --field-trial-handle=2108,i,3402453209343860938,11773336436204352943,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:14
      4⤵
      PID:3892
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=596
        5⤵
        
        PID:1692
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\qdugsin1.r2p" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4284,i,4291975736843914992,6276817191507880809,524288 --field-trial-handle=2108,i,3402453209343860938,11773336436204352943,262144 --variations-seed-version --mojo-platform-channel-handle=3076 /prefetch:14
      4⤵
      PID:3996
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --no-sandbox --mute-audio --onnx-enabled-for-ee --user-data-dir="C:\Users\Admin\AppData\Local\Temp\qdugsin1.r2p" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5356,i,5414462509044570168,8381332765077127913,524288 --field-trial-handle=2108,i,3402453209343860938,11773336436204352943,262144 --variations-seed-version --mojo-platform-channel-handle=5448 /prefetch:14
      4⤵
      PID:4628
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\e1zujtko.gqg"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious use of FindShellTrayWindow
    PID:2188
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\e1zujtko.gqg /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\e1zujtko.gqg\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7fffb148c188,0x7fffb148c194,0x7fffb148c1a0
      4⤵
      PID:2284
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\e1zujtko.gqg" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --metrics-shmem-handle=1632,i,6169313359194322747,14086259023570211354,262144 --field-trial-handle=2032,i,9096556200548820541,4422363132498096824,262144 --variations-seed-version --mojo-platform-channel-handle=2004 /prefetch:2
      4⤵
      PID:6304
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\e1zujtko.gqg" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1660,i,1631628374319783369,13497420165940926528,524288 --field-trial-handle=2032,i,9096556200548820541,4422363132498096824,262144 --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:11
      4⤵
      System Time Discovery
      PID:6404
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\e1zujtko.gqg" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2320,i,3302369782800770467,302279021194373752,524288 --field-trial-handle=2032,i,9096556200548820541,4422363132498096824,262144 --variations-seed-version --mojo-platform-channel-handle=2620 /prefetch:13
      4⤵
      PID:3952
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\e1zujtko.gqg" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3060,i,15793660021724438060,14521502426156769925,2097152 --field-trial-handle=2032,i,9096556200548820541,4422363132498096824,262144 --variations-seed-version --mojo-platform-channel-handle=3068 /prefetch:1
      4⤵
      PID:6572
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\e1zujtko.gqg" --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3076,i,8750858604634918302,17133336077463412247,2097152 --field-trial-handle=2032,i,9096556200548820541,4422363132498096824,262144 --variations-seed-version --mojo-platform-channel-handle=3084 /prefetch:1
      4⤵
      PID:6552
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\e1zujtko.gqg" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3276,i,4128138879090288390,18121620539536161441,524288 --field-trial-handle=2032,i,9096556200548820541,4422363132498096824,262144 --variations-seed-version --mojo-platform-channel-handle=3416 /prefetch:14
      4⤵
      PID:4488
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\e1zujtko.gqg" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3284,i,18005499965515991450,6140359029197815906,524288 --field-trial-handle=2032,i,9096556200548820541,4422363132498096824,262144 --variations-seed-version --mojo-platform-channel-handle=3752 /prefetch:14
      4⤵
      PID:6924
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\e1zujtko.gqg" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3312,i,5312726257839081346,7701120565553852580,524288 --field-trial-handle=2032,i,9096556200548820541,4422363132498096824,262144 --variations-seed-version --mojo-platform-channel-handle=3060 /prefetch:14
      4⤵
      PID:3572
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\e1zujtko.gqg" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=3384,i,8940734037563099091,18211505616057585717,2097152 --field-trial-handle=2032,i,9096556200548820541,4422363132498096824,262144 --variations-seed-version --mojo-platform-channel-handle=3956 /prefetch:1
      4⤵
      PID:6660
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\e1zujtko.gqg" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=3396,i,419524893094450167,1465467708710465242,2097152 --field-trial-handle=2032,i,9096556200548820541,4422363132498096824,262144 --variations-seed-version --mojo-platform-channel-handle=3980 /prefetch:9
      4⤵
      PID:1212
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\e1zujtko.gqg" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=3000,i,13814749702498351992,4035993756245285229,2097152 --field-trial-handle=2032,i,9096556200548820541,4422363132498096824,262144 --variations-seed-version --mojo-platform-channel-handle=3984 /prefetch:1
      4⤵
      PID:3360
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\e1zujtko.gqg" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3456,i,18270752791409878709,17379792362669016840,2097152 --field-trial-handle=2032,i,9096556200548820541,4422363132498096824,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:9
      4⤵
      PID:6116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\e1zujtko.gqg" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=3476,i,7772811341381731911,16459595025761828298,2097152 --field-trial-handle=2032,i,9096556200548820541,4422363132498096824,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:1
      4⤵
      PID:5508
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\e1zujtko.gqg" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=3508,i,2071082583338122960,10467662883834024587,2097152 --field-trial-handle=2032,i,9096556200548820541,4422363132498096824,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:9
      4⤵
      PID:4452
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\e1zujtko.gqg" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=3520,i,3850380355531030138,12184751157403605066,2097152 --field-trial-handle=2032,i,9096556200548820541,4422363132498096824,262144 --variations-seed-version --mojo-platform-channel-handle=4352 /prefetch:1
      4⤵
      PID:2620
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\e1zujtko.gqg" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=3532,i,10288224522699065775,4093492752118283323,2097152 --field-trial-handle=2032,i,9096556200548820541,4422363132498096824,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:9
      4⤵
      PID:5900
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\e1zujtko.gqg" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=3544,i,12242134858498320722,2162787996067082446,2097152 --field-trial-handle=2032,i,9096556200548820541,4422363132498096824,262144 --variations-seed-version --mojo-platform-channel-handle=4364 /prefetch:1
      4⤵
      PID:3880
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\e1zujtko.gqg" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=3556,i,9714807390884552728,10398060508511854647,2097152 --field-trial-handle=2032,i,9096556200548820541,4422363132498096824,262144 --variations-seed-version --mojo-platform-channel-handle=4420 /prefetch:9
      4⤵
      PID:3192
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\e1zujtko.gqg" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5284,i,14558109327130548470,15676918397882559406,524288 --field-trial-handle=2032,i,9096556200548820541,4422363132498096824,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:14
      4⤵
      PID:4208
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=1144
        5⤵
        
        PID:4040
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\e1zujtko.gqg" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3820,i,10415225041223965633,3407785218429177054,524288 --field-trial-handle=2032,i,9096556200548820541,4422363132498096824,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:14
      4⤵
      PID:4276
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=592
        5⤵
        
        PID:5552
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\e1zujtko.gqg" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3436,i,17780517440704932664,14784642353243994038,524288 --field-trial-handle=2032,i,9096556200548820541,4422363132498096824,262144 --variations-seed-version --mojo-platform-channel-handle=3420 /prefetch:14
      4⤵
      PID:3324
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\e1zujtko.gqg" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4812,i,7790209520441262806,9232212886065765658,524288 --field-trial-handle=2032,i,9096556200548820541,4422363132498096824,262144 --variations-seed-version --mojo-platform-channel-handle=3832 /prefetch:14
      4⤵
      PID:3408
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\e1zujtko.gqg" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3668,i,5755302290185345814,4714555996762917310,524288 --field-trial-handle=2032,i,9096556200548820541,4422363132498096824,262144 --variations-seed-version --mojo-platform-channel-handle=3724 /prefetch:14
      4⤵
      PID:4900
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --no-sandbox --mute-audio --onnx-enabled-for-ee --user-data-dir="C:\Users\Admin\AppData\Local\Temp\e1zujtko.gqg" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5264,i,12395743883540954126,9992069977559878325,524288 --field-trial-handle=2032,i,9096556200548820541,4422363132498096824,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:14
      4⤵
      PID:7024
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\xpappfrx.jev"
    3⤵
    PID:4060
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir=C:\Users\Admin\AppData\Local\Temp\xpappfrx.jev
      4⤵
      Checks processor information in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:4544
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1972 -prefsLen 27097 -prefMapHandle 1976 -prefMapSize 270331 -ipcHandle 2052 -initialChannelId {e2731f6f-06b1-4777-8808-5432c682ea94} -parentPid 4544 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4544" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
        5⤵
        
        PID:1300
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2316 -prefsLen 27133 -prefMapHandle 2336 -prefMapSize 270331 -ipcHandle 2172 -initialChannelId {f9e811d7-95f4-4af1-aba3-be9464df93f1} -parentPid 4544 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4544" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
        5⤵
        
        PID:1696
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\5bf128da-58ff-4404-ad79-8d1ca49416b0.dmp"
        5⤵
        
        PID:5468
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2276 -prefsLen 27133 -prefMapHandle 2772 -prefMapSize 270331 -ipcHandle 2868 -initialChannelId {9b029576-c8e9-418a-bddb-2f1ee4856980} -parentPid 4544 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4544" -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 gpu
        5⤵
        
        PID:4916
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\f6a89b39-70a6-48e0-a917-b9877201f735.dmp"
        5⤵
        
        PID:3672
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2868 -prefsLen 27198 -prefMapHandle 3032 -prefMapSize 270331 -ipcHandle 3024 -initialChannelId {eb056948-6f1c-482a-a871-3e23ece588f0} -parentPid 4544 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4544" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 gpu
        5⤵
        
        PID:6164
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3668 -prefsLen 27274 -prefMapHandle 3672 -prefMapSize 270331 -jsInitHandle 3676 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3724 -initialChannelId {c5cd16be-a9d0-4829-802d-e202216bb5d4} -parentPid 4544 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4544" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
        5⤵
        Checks processor information in registry
        
        PID:6196
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\333a4d43-d1f7-472b-9344-72bd615f9142.dmp"
        5⤵
        
        PID:2088
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3024 -prefsLen 27274 -prefMapHandle 3936 -prefMapSize 270331 -ipcHandle 3688 -initialChannelId {d884771c-4edc-4473-a202-a9ae93f8dbce} -parentPid 4544 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4544" -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 gpu
        5⤵
        
        PID:4880
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\7f3a6953-3bf2-48f7-90df-1a056024ae69.dmp"
        5⤵
        
        PID:2000
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4100 -prefsLen 27274 -prefMapHandle 4104 -prefMapSize 270331 -ipcHandle 4112 -initialChannelId {7818ffdc-9640-4f3d-b833-6c037da78dea} -parentPid 4544 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4544" -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 rdd
        5⤵
        
        PID:2128
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4444 -prefsLen 34773 -prefMapHandle 4448 -prefMapSize 270331 -jsInitHandle 4452 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4460 -initialChannelId {372b68a2-3ba9-45cb-9b66-6553249a4b74} -parentPid 4544 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4544" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
        5⤵
        Checks processor information in registry
        
        PID:4672
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4904 -prefsLen 34876 -prefMapHandle 4908 -prefMapSize 270331 -ipcHandle 4868 -initialChannelId {88489237-baa0-4f27-84be-d02ea37d4d53} -parentPid 4544 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4544" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 utility
        5⤵
        Checks processor information in registry
        
        PID:2960
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4384 -prefsLen 32818 -prefMapHandle 4688 -prefMapSize 270331 -jsInitHandle 4672 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4604 -initialChannelId {c6739bf4-63f3-4acc-a123-d655b5ba1da8} -parentPid 4544 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4544" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
        5⤵
        
        PID:7016
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2868 -prefsLen 32818 -prefMapHandle 3308 -prefMapSize 270331 -jsInitHandle 2664 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4788 -initialChannelId {417e8551-658f-48ed-a363-179bf2574e3b} -parentPid 4544 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4544" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
        5⤵
        
        PID:988
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5676 -prefsLen 32818 -prefMapHandle 5680 -prefMapSize 270331 -jsInitHandle 5684 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3308 -initialChannelId {43ddfa1c-5977-4ee0-a1a0-cad0cab0acec} -parentPid 4544 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4544" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
        5⤵
        
        PID:6884
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cqm0kdba.pex"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    PID:6176
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\cqm0kdba.pex /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\cqm0kdba.pex\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\cqm0kdba.pex --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7fffaf89c728,0x7fffaf89c734,0x7fffaf89c740
      4⤵
      PID:2348
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cqm0kdba.pex" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1596,i,7554033780468927830,5418697883585032911,262144 --field-trial-handle=2240,i,10911025008259216562,2844096544394040394,262144 --variations-seed-version --mojo-platform-channel-handle=2236 /prefetch:2
      4⤵
      PID:3000
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cqm0kdba.pex" --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1904,i,5211282224066414929,9386486830962639997,524288 --field-trial-handle=2240,i,10911025008259216562,2844096544394040394,262144 --variations-seed-version --mojo-platform-channel-handle=2580 /prefetch:11
      4⤵
      System Time Discovery
      PID:6388
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cqm0kdba.pex" --force-high-res-timeticks=disabled --metrics-shmem-handle=2040,i,17611633265563655507,9210153698930887340,524288 --field-trial-handle=2240,i,10911025008259216562,2844096544394040394,262144 --variations-seed-version --mojo-platform-channel-handle=2600 /prefetch:13
      4⤵
      PID:5316
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cqm0kdba.pex" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3008,i,9493689826531710023,17720434319117737235,2097152 --field-trial-handle=2240,i,10911025008259216562,2844096544394040394,262144 --variations-seed-version --mojo-platform-channel-handle=3024 /prefetch:1
      4⤵
      PID:6068
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cqm0kdba.pex" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3068,i,14296227577517622182,1404604789409487233,2097152 --field-trial-handle=2240,i,10911025008259216562,2844096544394040394,262144 --variations-seed-version --mojo-platform-channel-handle=3112 /prefetch:1
      4⤵
      PID:3704
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cqm0kdba.pex" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3372,i,17102832451756757576,18242416047658943481,2097152 --field-trial-handle=2240,i,10911025008259216562,2844096544394040394,262144 --variations-seed-version --mojo-platform-channel-handle=3396 /prefetch:1
      4⤵
      PID:2240
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cqm0kdba.pex" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3420,i,5465032643008451499,11053180633754225231,2097152 --field-trial-handle=2240,i,10911025008259216562,2844096544394040394,262144 --variations-seed-version --mojo-platform-channel-handle=3932 /prefetch:9
      4⤵
      PID:6340
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cqm0kdba.pex" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4100,i,10516136243624473083,15279563185820315003,2097152 --field-trial-handle=2240,i,10911025008259216562,2844096544394040394,262144 --variations-seed-version --mojo-platform-channel-handle=4120 /prefetch:9
      4⤵
      PID:6512
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cqm0kdba.pex" --force-high-res-timeticks=disabled --metrics-shmem-handle=3588,i,694823755289448341,11905820156088320377,524288 --field-trial-handle=2240,i,10911025008259216562,2844096544394040394,262144 --variations-seed-version --mojo-platform-channel-handle=4196 /prefetch:14
      4⤵
      PID:1652
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cqm0kdba.pex" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3572,i,16989142877758251961,16437393854320097701,2097152 --field-trial-handle=2240,i,10911025008259216562,2844096544394040394,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:1
      4⤵
      PID:3984
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cqm0kdba.pex" --force-high-res-timeticks=disabled --metrics-shmem-handle=3408,i,12978634469865534956,1910532889837999853,524288 --field-trial-handle=2240,i,10911025008259216562,2844096544394040394,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:14
      4⤵
      PID:3564
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cqm0kdba.pex" --force-high-res-timeticks=disabled --metrics-shmem-handle=4572,i,8562429852262030948,18104031780022811170,524288 --field-trial-handle=2240,i,10911025008259216562,2844096544394040394,262144 --variations-seed-version --mojo-platform-channel-handle=4584 /prefetch:14
      4⤵
      PID:6408

C:\Users\Admin\AppData\Roaming\PaymentAdviseSwift0285.exe
C:\Users\Admin\AppData\Roaming\PaymentAdviseSwift0285.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
PID:5248
- C:\Users\Admin\AppData\Roaming\PaymentAdviseSwift0285.exe
  C:\Users\Admin\AppData\Roaming\PaymentAdviseSwift0285.exe
  2⤵
  - Executes dropped EXE
  PID:3508
- C:\Users\Admin\AppData\Roaming\PaymentAdviseSwift0285.exe
  C:\Users\Admin\AppData\Roaming\PaymentAdviseSwift0285.exe
  2⤵
  - Loads dropped DLL
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:5940
- - C:\Users\Admin\AppData\Roaming\PaymentAdviseSwift0285.exe
    C:\Users\Admin\AppData\Roaming\PaymentAdviseSwift0285.exe
    3⤵
    - Executes dropped EXE
    PID:4492

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Size 1KB
SHA256 7159a3eec199cfac30b813f16c3f217676bbae75ca73db1cb441b28163fafb01
MD5 82b7339edbb1723e8e524f57749f2f6b
SHA1 ecedc99f9ffa37ececb9b06575bc25fda6fc8ced
SHA512 051a11856c28a50de0b82360454a18eaf88d6dfd916d7b3b7f0f448355a2a740779f4ea2fe646ce135dd8c4032534b027566aacf25d32ca21e351c25f617f4d6
TLSH
T16631C6874F0719809F2A4CCBD9E4C6152EF0B2D0B9AD7917A39EC45B3F183B21B2100B
MD5 SHA1 SHA512 TLSH

Submit Download

C02877841121CC45139CB51404116B25_9FB3B79D7D8B4EC5857835BA3284FAED

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C02877841121CC45139CB51404116B25_9FB3B79D7D8B4EC5857835BA3284FAED
Size 471B
SHA256 ac82050cd3dd95ec6dcdeea717bd3ce77ca06821e535efd468b8746d8a057afa
MD5 d844c68ffe8747443fea985c347a015e
SHA1 474e0036738c887a3b4228bc6bdeb2efc4ecc732
SHA512 04f158ddbfde84080b13c9c64f47b081ad0277683f09c7c28bb3f6272b17f9db0e47b7365c989f9c762600b6a649b52f03738c5652fa3d2d1492f718c2e32f7d
TLSH
T103F0D4536A7D5D931C405838D6DCF4FCF001CC0874491507717D92C9260B6AD01212A8
MD5 SHA1 SHA512 TLSH

Submit Download

DDE8B1B7E253A9758EC380BD648952AF_5A34E69659727C97EF2340147E58ECF2

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DDE8B1B7E253A9758EC380BD648952AF_5A34E69659727C97EF2340147E58ECF2
Size 471B
SHA256 392949bcf79c14af29188f655e386e8d0358abbd11a0227f08d34a3d290c8652
MD5 ac01f263cd6ffac03c764ef05e94cadc
SHA1 04bbe7b8eb9933877502aeae04aecfada396c44d
SHA512 71d83aba02313c4b7c3063232687ac3767b4553c9d683d3a2da8b3dff8326743dffe219fa30c68214414020de29d8aabdf4a7950f80adcd0b64c241de371f592
TLSH
T128F05C842A6E28689F01D89C21ECA1442426C92A24AC122AA2F8C44228068FC40227BF
MD5 SHA1 SHA512 TLSH

Submit Download

24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Size 410B
SHA256 69888ff315fb8717404a198003eca7f8ddf6cc6b203c144bd428847891ddd15c
MD5 f91b71933af39b6731a60505e68e764f
SHA1 8a68b8b2031dd6461f08ebc09292447729bf34c8
SHA512 bb0e4596d87500b4801ba73ca85c1e9e9bfcb4b95c1d179cc79ba082d10c4695fb88e4724d638d6b6043c55ac076aa2b562974020bfabcc426477d53540e5628
TLSH
T13FE0C6082AB9412CF470DA3D4ACEB867077EE202302202F001B44B08F702F012D568F1
MD5 SHA1 SHA512 TLSH

Submit Download

C02877841121CC45139CB51404116B25_9FB3B79D7D8B4EC5857835BA3284FAED

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C02877841121CC45139CB51404116B25_9FB3B79D7D8B4EC5857835BA3284FAED
Size 402B
SHA256 4eb7048737db86554ffd5f9f83f9771ec998f8943247febdc63ede175266d91f
MD5 1db271f8e8ea493001791b64270c254e
SHA1 924900597ae900b506eef184c583d9f3e09f911b
SHA512 6445653912bdb4f42aeb4ca7cf0444295be8d6a8e121395725bde02a959505ee933c8eb63131c5abc1554a0fba676d700b876b3c294ade89b90b1733d3dbb83c
TLSH
T157E020640ABB420DF494A87A5FD5F132E1B7D213589C27F111A0820AF6125419860779
MD5 SHA1 SHA512 TLSH

Submit Download

DDE8B1B7E253A9758EC380BD648952AF_5A34E69659727C97EF2340147E58ECF2

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DDE8B1B7E253A9758EC380BD648952AF_5A34E69659727C97EF2340147E58ECF2
Size 402B
SHA256 77a897ee0da74a02f4f11084d4ab6cac09c5bf2f899403f5a626f8bc6328a89a
MD5 e2743ffea0969054ce092d4eb9053b5a
SHA1 b4fdf58e34c51144a14d581daacb846cc995cca0
SHA512 88afef7821eac6fdc0f83c4b916120cc64ece54b18f739950a1b000fdd3159501a2d1d8d0c9894c60b8435b76636cf6babb6789b949cb27f5aca9a82947832db
TLSH
T194E0207416FA505CF494E4B98ED5F131C557E212889817F111E04209BE126037860639
MD5 SHA1 SHA512 TLSH

Submit Download

activity-stream.contile.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\pu854q2a.default-release\activity-stream.contile.json
Size 4KB
SHA256 6e3d9399ca5c04eccf1032266481831720efb96f8ff296e1d496efcc5f12c947
MD5 3e8ec77b665011d0352bd8626c4fddc8
SHA1 2fb80f467472121cd7d23aa2b38318ab1331f187
SHA512 e207a6360ef3c9406f818468f2d69c32ff22d1e7e25c710eb82ebdb680eca620de27d6eda88237ae645fe11c70d89b86eb7328f05591e8e7c640f7bb49ffd56a
SSDEEP 96:KW3ztEQwXdLWt8Dl0KvKtMzGzqspc6EvezGqjtCl:KW3ztEQKdialDKtMSzq4lzGqjtCl
TLSH
T1C8A11AEBAC3CA45F0B3657F46C2F326DE007A04FABE1DC89F5898C03D59514680EAA48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\pu854q2a.default-release\activity-stream.discovery_stream.json
Size 74KB
SHA256 48436c3ceebc8e4aaf6a24d9b0f8699a38be1bba88cd096a46ca01f30551c0ac
MD5 a42a8f8a7545dbf285dc15ee6d4499bf
SHA1 12dbb141d98b552a2d47adc43ad93d54fb318fe7
SHA512 1115c9e36b3b2cb5a36d32bef32e88c29625b363d32c90adeba5632536db83748d4d600fb913962a1a36b0a74555132315c01d977eb1bd4f46b41d08c5abd81e
SSDEEP 1536:bNjP2Z6em+mNDvLIzfjfzfmEwFGRrQNVv4t:bNjP2Z6F+maKEwMtQ3v4t
TLSH
T1D77309A397A9B2FF1B9137DB1C0B754757E64146F38A01C9ECE9CA1C808D794023B6AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\e1zujtko.gqg\Crashpad\settings.dat
Size 280B
SHA256 cfdafc86d7f1962ebd56984db0a703a7df933e71e01ea73fedb75c737a1b60af
MD5 273e99428830acf863c14a28758646bd
SHA1 df56a9c2cacf9b6255ab75213a0062831ef680fa
SHA512 ef560a977bde6d5e0d0fadb44077f4da52fc0776900437299c0a9c5fced68fd5591c35b2f48616e2646d448b2700027902fb50baa2d3228d7f0652b6bed19ec7
TLSH
T1AED02232BA003C03F2088A320833CBEE82C0CC3230A032C0E020CB0BAC800C000C32FC
MD5 SHA1 SHA512 TLSH

Submit Download

f_000002

Path C:\Users\Admin\AppData\Local\Temp\e1zujtko.gqg\Default\Cache\Cache_Data\f_000002
Size 99KB
SHA256 cad25cfcc108f11e81cf1a339916e956b5ccd3ab3da38a3bd7a3a7a01adcd3f4
MD5 86e9c0ad8befdb46f1ecda1d3f2c70ad
SHA1 cf9520c235db04ac02e98a7f7c9f3d5d631d4199
SHA512 30a1265891f03df0c46d4f310d97ffa312b84d485a214d895a1c5e260474260d6637592b20d9cf4efa507c131694f63253577fdb352e8e0c46505e02183e0ab4
SSDEEP 1536:GAqrSnLU5BxYE4bP9zel9rbvjJvNCLtY25wJ0qPKldrT6LTMyT2ItH3RHTZ:GAqrSLSvYEwsVbrTfUPdqL4S2iTZ
TLSH
T1AFA312D04BFD43FAB569BAC3256ED48352C0B330AF12B835501ACD9F61D0FBAAC65265
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000003

Path C:\Users\Admin\AppData\Local\Temp\e1zujtko.gqg\Default\Cache\Cache_Data\f_000003
Size 65KB
SHA256 8db71abd0b5541f9d30722f7c232d23a7863f13f777e83cdd8544fba95fd1075
MD5 2e607917e9da258aff4e22f6aed6a5a6
SHA1 98cc32b90a8747fe64cdc60870aca2a55548f630
SHA512 a5b2663b77baa31542d0f793e695f5a081c0cd2c02367c4edde804659f630384d7e326cd52c1233f1766cac4ef3a0c499eda25c3e56d54616c49f54aa2385426
SSDEEP 1536:D/GZJ5x4CiJMu4/uSCFYKK/GNYN3UsH0qOjpVFQ:D/Gbf4CApg0FYONQjH05FQ
TLSH
T1C26302BD782712F51D3D1BB07872DF2BDE6AAA19878E417D81740C61C673CDCB2A0869
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000004

Path C:\Users\Admin\AppData\Local\Temp\e1zujtko.gqg\Default\Cache\Cache_Data\f_000004
Size 398KB
SHA256 57e9aed1c997188543970c884b0c1bc649939549aee648633441947bd2a7f201
MD5 c4c27eeba2a1ffc8549ea349b710d6ff
SHA1 258283c72e9375c4506d92c28243ae1e641637bc
SHA512 91fa97ac15317f8f439d29ae2c07747706043c056bb3bf1f2c9580dea9fee9566610bf981fc1e49c602a11927374c6bf44257641ab97992eb2d606424a45496f
SSDEEP 12288:EeyvUHw46qhBXI8eh4LQ6mV6rUapAPZcCv2SdC:7mUQ46gpIduc6mVkf6ZNv2SdC
TLSH
T1179423A627665C2B1C04E35D99FEF4EDB3B946B44D302BC0F83794982D3C9A8DF64912
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000b

Path C:\Users\Admin\AppData\Local\Temp\e1zujtko.gqg\Default\Cache\Cache_Data\f_00000b
Size 28KB
SHA256 b421c05a340e40d4d4bd1831521268b6f0afd0461ec3991cfa8d5314bf3207b4
MD5 57f9a7c7e2be49102533a2ceb7a05e51
SHA1 850ab0a80577b7f7effe196cba037899e71594c5
SHA512 66406d54a1d1a44f30e19a9bff1242b50fdcfbf66c33e4c23daaa756c06f50a2e39c991e7a8dfd9a81184cc37c2062d0406070be132e28a22307896e63b55447
SSDEEP 768:dT+CJ4QL+F8S4bApn9Ua0ndjCaixJ/fVW2/AGYnS:TJ45F8SgjXnNCa4fVWVnS
TLSH
T19BD2F1FF1E208D43082F37459DDE71D688A00325635BAE3964A09F59DD9BCBC8D90B38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000c

Path C:\Users\Admin\AppData\Local\Temp\e1zujtko.gqg\Default\Cache\Cache_Data\f_00000c
Size 76KB
SHA256 480fffa9257dfbac3f0a7336ed20c8c7914829f66cd0409408ff2583942088ba
MD5 fff4e4c5c9dd7b42059c09cbee860e86
SHA1 2e3e372afd92cbf8b42ccb025aa02eaf2f565dfe
SHA512 b98f937910b7df26c9c985ce13fe13c171eb786aa86b83bb7b3dc4598fffc3058cfb8811801d7c62c10efed8fa13ea06c5a29adb75aefed5575b179251ea2240
SSDEEP 1536:fUuwi5DUdpXh3obfx8wOek7mkHn8CTKIYRX7w9b5WZ:cHKgp3IxtQqEnnl84b8
TLSH
T1EA731247C9B3945EC22BE9ED25FEFB4595B42441391B681602323F7F4AACCF4E38A485
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000e

Path C:\Users\Admin\AppData\Local\Temp\e1zujtko.gqg\Default\Cache\Cache_Data\f_00000e
Size 18KB
SHA256 71c11f017e1afd1824decaac1f3f0d545a0a1381344a76a6fbbc83a7564cdeb3
MD5 086974352dc85d2bfc46caf03f91210a
SHA1 6be2cb8b3fea31acca3c38684b21052323b6d325
SHA512 9fe8405059c844c98841ed568b5711ab71f0d159e0d595548500826e2d12f3dd48f09afb96b86b5f1b93756875ec7bec1ccef0ea715c41a5808c8f2675cd8d2a
SSDEEP 384:/ruMCPkasjYUC+0na4U/62ES/vMR+kuOAjfl3uqjMr4w5:/KTPkaYYjnbppJU9+p4w5
TLSH
T12882D04BEF0160873D24A8568660D2D5F4097A1A3736091CEB3F1A49923FCDF176BCDA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000012

Path C:\Users\Admin\AppData\Local\Temp\e1zujtko.gqg\Default\Cache\Cache_Data\f_000012
Size 70KB
SHA256 21724bd3c48f76d7a44977aec4b69d0d7855c789e89136117d8ebf052d547364
MD5 34a3223212688ad49ef71ca1cfdd22d8
SHA1 ec618405fbfc575962d0a394170b11da61d80544
SHA512 3188147bfdf2d748e5c3d499bacf65d8eb128a5fcf3fa3c9bed9deb7695e542e282c247a29e99b9fef5d91f1a46b3c9c60718cffc7c5357aa7f7281e59031e54
SSDEEP 1536:w/+hAZX3YAkuzD1VOLkKbPjWBYk5XCXEHqkFw1H6aBFD:E2AFoALhVMfbjCN5S0HNFaj
TLSH
T1E96312649EE8E1DDE2FAD4DD5883950AB0BA44F147BDB3ED3AA47D024675C8D07C6130
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00001e

Path C:\Users\Admin\AppData\Local\Temp\e1zujtko.gqg\Default\Cache\Cache_Data\f_00001e
Size 34KB
SHA256 a3d046140b0090086cecee19280790ce82ed894d4e6e8751a8658d8a21555569
MD5 1e17080bc38565e28401d5f061658b68
SHA1 413aab1b9aa41b7735a1647a4bcf17eaad2fea72
SHA512 ac90f9335a703d48e022d6419c4553c0db322200fc543ab91962a985e33f7b399626e529ef892f7c382d9380de370272cedac1b81b9155fd07f2de0eb8d5bbd8
SSDEEP 768:KUL7yxo5dNDsFVwNl+BqQTM3Zzrm2S/t5IKAk:KULnlsNBqQTM3Zz6ZtS4
TLSH
T1CEF202C9F9C41D00F52B6115303CAA58E59DAE74B39F22EBD5D9A2F7A48D2CD0F88613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00001f

Path C:\Users\Admin\AppData\Local\Temp\e1zujtko.gqg\Default\Cache\Cache_Data\f_00001f
Size 16KB
SHA256 ea5b658e470a98a8628375ec4a700938330e9c0cb45d08e4b89e5698b200f2df
MD5 9628ed30a3cb6f6ca5ec1faa75b3d9be
SHA1 696611cb9d9cfa5f2ccccfb6f4cdc1a816bfc908
SHA512 8fa833b989f417cd0c780963e01e1db654c03adcca85ce0231857c07042052db3fc563f9abdf3047ec7b2fef099b2e70e699464041bda55ca0778ce4ed9c28bf
SSDEEP 384:FfktxDpLOpGRWSVKzyxNl31A0vH/56J8L52FRTL+2QC:9ktZp6wRpKkl3fpeiyR/+y
TLSH
T1A272D0429E1B0F29D3607209C36574DF15F99A6B0AD9A0B4CF6DC43C8807AB76D7B239
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Temp\e1zujtko.gqg\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 279B
SHA256 c43dbac5413c35b093fcbf35e1d9407f6b71674f879c164bc10d3da8fe6978a6
MD5 fb21dba5357d4ec25d805374be8a7532
SHA1 697d2425d548d7e4ee0f5c7e15a0cfd700b8338f
SHA512 738b95efb1c13d2f5f05d18bf35ae6e4cc8f23328f73437030e60140f7ba269d663dd2a3912fce53a377cb58a3eabf6cf5381f81b9f509595ea3c6a44506ec01
TLSH
T154D02BB71EA608109C6F83E3503100E14556BC609A44AC8E502AA68B50B131BB856C31
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Temp\e1zujtko.gqg\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 375B
SHA256 036a9aa65cc7018e9d46f3fa87119803a1e3487ce5319bd7c358ec452e439923
MD5 d193df442d61fe94518a5da129abfb74
SHA1 9390c48310e8fa27babe793ea32a836861c0bf5c
SHA512 af4d81a6c20592bb8b4c8dbd2ac0ed816e395b40a27641e096778cbc0cfc062cb8bdcc2a82963f84ab663e008a1b873f6f0a0ec217dd66305760db6aac344cbb
TLSH
T1B2E0D8772EE72810AC5B83D7643240F54559BC64C544ED8E9427BA8750B271AA459C21
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe585add.TMP

Path C:\Users\Admin\AppData\Local\Temp\e1zujtko.gqg\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt~RFe585add.TMP
Size 153B
SHA256 e52a0c24525fbd785a3f4c98cf3691a05162ed592eea5882315a6df0e703297b
MD5 28c32ed6fd9dd273f68aed90f062158c
SHA1 261ff285096d0b23b4c4664acc26358fb27e3044
SHA512 ff0d2b0ce696225e38b703b874eab2774623dcd3844e2ad51c12656763820f0810b3b49b951d26797bc61b8b674a5578020d1714a221a37cacafcb0f768547aa
TLSH
T11FC08CB72C691800DD4A13C3403218E682226C948A44AC8A942EB18760702223412C31
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Temp\e1zujtko.gqg\Default\Sync Data\Logs\sync_diagnostic.log
Size 668B
SHA256 dd5dbc27dab9d2eaec07fc82934dfe828f80e53af1b17b22f100c876ffa40110
MD5 a62547b0d239be9e0b0884d0f089b8cf
SHA1 80e638bb999b62b5a747e8048d4d9796e83c2110
SHA512 87ffac775e3773176e86ed3e37cd031d3a6e638901395e2a5f36781863051c40464376132479d2dd67ccc05b292f0a859d9f997305591c56731eea9ed9b76cce
TLSH
T14F0188E0223AE2842C7F6E8488D8C72E124575933A14667A3BF443D10997F00D9FF5B9
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\e1zujtko.gqg\Local State
Size 4KB
SHA256 1919bc17e1d53a5b95e01b788cad8bfa4371ea089dafad4fd5dd83350ad07a9c
MD5 125c822d619d265626e028b23635afdd
SHA1 3732d322c392261eba6d856cc36d3cfa75802ed3
SHA512 2d2b5d9467260d8d3b3df81507dc8fade31ae8025c9297780d1ecf006cad75fec83b5f5cbd6e8f07402b13764cab23e65ca4ab8d931554e5c32da6badb8d9479
SSDEEP 96:qqGNkFsFfXz+SB4Sq12jRPDzBTPKvBBGznqJ0eUnQ8T2q4a:hGNaGz6etjnzqJqQ8X
TLSH
T1E681B5B27824EC3348E55A44B48B3AA39E7431B3E862AF58E5D4530C04D775C3B0AC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\e1zujtko.gqg\Local State
Size 5KB
SHA256 99612423c57abb9ecdd65e03aff296e02173fc2dd32de9c305ec038bcbbb5512
MD5 578163f14d5dc831e32e72200b6cd32e
SHA1 4ad0bd2b0bb07d4bb4f80d9bcd8429b044515874
SHA512 d293f5dd1e8ac7658db873f2937eef99016671bc7d91232f936fa4e0b876a1bc3ef5fd70152892fecbc1748649d7db20ae77de1465fa7ca0c0c97d16f9909330
SSDEEP 96:qqGNkqQsFfXz+SB4Sq58Frh/cInURoDotov2uqR2D8BTPKvBBGznqJ0eUnQ8T2q7:hGN6Gz3ooDUw5QjnzqJqQ8X
TLSH
T115B1B7B27835EC774DE6AA04B4C73B53AEA42177E895BF9CD6D81A0C04D7398270AC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe584dec.TMP

Path C:\Users\Admin\AppData\Local\Temp\e1zujtko.gqg\Local State~RFe584dec.TMP
Size 1KB
SHA256 65907fee21931d352eabc4a97c3d88ec86c5ad0299cfa636a97741f5c6d0c14d
MD5 94071cc5a6284decc821d17f6f609ed0
SHA1 c6f75fa9a51842e98e9d7954ff7b7037b5544164
SHA512 32872019d78b85d9db6def893fabbb211f17e7e40e5d2179d4bdae616584564f9c4a0fa0fd06d2ec22b9b4ce31df0f75f4178605443e40042c9cc92243570e64
TLSH
T1773176B17C746D73ACA14A45A24B7BA79D702537D0B25E8C51DC0A0C05D379C620AC3B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\gi4wxmk0.3um\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\gi4wxmk0.3um\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\gi4wxmk0.3um\Default\shared_proto_db\metadata\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\gi4wxmk0.3um\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\gi4wxmk0.3um\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\gi4wxmk0.3um\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\gi4wxmk0.3um\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsyCE0F.tmp\System.dll
Size 12KB
SHA256 014f1dfeb842cf7265a3644bc6903c592abe9049bfc7396829172d3d72c4d042
MD5 12b140583e3273ee1f65016becea58c4
SHA1 92df24d11797fefd2e1f8d29be9dfd67c56c1ada
SHA512 49ffdfa1941361430b6acb3555fd3aa05e4120f28cbdf7ceaa2af5937d0b8cccd84471cf63f06f97cf203b4aa20f226bdad082e9421b8e6b62ab6e1e9fc1e68a
SSDEEP 192:gFiQJ77pJp17C8F1A5xjGNxrgFOgb7lrT/nC93:E7pJp48F2exrg5F/C
TLSH
T15D425B0583618EF3F5965E3C00667E2F2B79BE3416F100A39FE34481A99A1CF99B5392
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\qdugsin1.r2p\Crashpad\settings.dat
Size 280B
SHA256 58ecf824da099fa73f8aa22d0cbedfce0d7deb77e245e0e09fad6c7cdc0bc951
MD5 149da2c32964c4bfefdcb21e5bae95ad
SHA1 881eb246dadeaea95e1d1587fcdc8d288980f808
SHA512 579f5363b1837c30eee3c57ee98c916dac9e609237f4df8ae12efbe9e0376a2e6822665d5b43aea8c65811602175b6bb84def1622def3e63fdc6350554dba142
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\qdugsin1.r2p\Crashpad\settings.dat
Size 280B
SHA256 0ece0b6895d774b765bf4bfb1488149774bad938496f20473cad4728b05a7bde
MD5 b9dac92c4e4532a0ae1c8ff85ab6d71c
SHA1 da4e65ac991a63cd19521adfbc8ffd45e1d75c84
SHA512 723d709f77c2bc33bcf6564a97b4601dd9a27a41e581108b3a26d1a5f2f58bd3fb4eb122bcf63007e78fa2b2539e3e9f9b23de1a78ab31aa8176818fc6e4f811
TLSH
T102D02238B30000ACFC08303303ACABC30A0AEC2B08EB02002008F0080CE00F00802238
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Temp\qdugsin1.r2p\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\qdugsin1.r2p\Default\Code Cache\js\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Temp\qdugsin1.r2p\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 279B
SHA256 6540964aeccb1cffe531fd6f92934f1324a8973a8fec91df5f3678cfccf5847c
MD5 309ffb7e2a50fc5eb92f509f73c8f80c
SHA1 8200a96adab138f3070fc5e315fec3ab47b1c7ba
SHA512 72313b8b2012274e85bbe7980a7992e78a2f28fc647ff986f502deb65d8939a8918b1202278445634f5104327cc092a111f571010732e2afbd195f9e93c36602
TLSH
T19ED02BBB2CE60C209DBF83D61432859045573C54EA8CED4E0118728752F03263E12D61
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Temp\qdugsin1.r2p\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 375B
SHA256 eb23a2f002b68a758f7f0bbc264953240312b890de03dd8522264187cfab6875
MD5 39956b41f8d1bc55bc0948c5e613a963
SHA1 dee12ac4a0ec474eff8513535d06a96219938e86
SHA512 50a3ae99a257665346c857cda20664f1321515f5c71121690148168d0311a9cf86201faf3811031b87c594ccfcb801fd82d2961bc31f65da682376d46efea35a
TLSH
T1B3E06FB72CE36C34BEAF83CA187284A04A563C49D648AD8F0016728322F13A42A56C22
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe584570.TMP

Path C:\Users\Admin\AppData\Local\Temp\qdugsin1.r2p\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt~RFe584570.TMP
Size 153B
SHA256 1fd8bf4628c358a46d124c1e893d470b218649ff144a6af6e38ece844cbbdaee
MD5 ce83fb00e3b4bd4c6bf2fc0fafc60578
SHA1 f85d9a356c9c0f797e77bc3beef3251fad16847e
SHA512 a44e45be6363e956e1b1a34c4fc891598e4a2f5cf40710875dae047a6998e32be53c7ee7c4b79ee3c6ee68d1c32a8ac216edea406946471b35dbc6578ca39aa2
TLSH
T116C08CF70C960C00AE2A92E20032C8A882173C88CA8CAD49011D72C372B02323512E21
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Temp\qdugsin1.r2p\Default\Sync Data\Logs\sync_diagnostic.log
Size 1KB
SHA256 c9974aa46a3fb37f61b2cb92989c6f43bdc6450d6b16b6b2dd025e7ca74bf36f
MD5 77078afcba57eed97b570fcaa45ea0b8
SHA1 9c76dd3d117ce312d7f1504ced06e55d3624d04a
SHA512 20f8311f45faf67566e5de3544119574684320ee8fb2278dcb70b93c67200aabd746f94e6cffbc78a833bc65a9073aa1e136358bedcbc1cec347ae367cb2d76a
TLSH
T114216EA032B722113CBD260C81D6A71E818130673214657B7FF9076B1A77E846DBADDE
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\qdugsin1.r2p\Local State
Size 4KB
SHA256 23c6ebd550e55eccc97f4cc77d5657a4a313fc554bdb0f04a4ba45b79768241d
MD5 1dd8793d498ad61979cdc016f42c34f3
SHA1 d009e467d0503e92a840faee67abcd60fa5ce83f
SHA512 b0992b22ee243d15de1ecf7a28d0028fb31240593eaa48d5e26f36d5f6b42cf50024e53de7015af7d11d71b5f450c257a13dd373c40fc96dc0e0b16066590328
SSDEEP 96:hqGNkdsFfXtyY1kWWDZBFPNvlv2tYb0eUnQCT0q4a:IGNSGz7Q/lT2tYbqQC1
TLSH
T1E78194B26828FC3714E51944B59736939E7871B3EC51DF58E9EA530C00EB3593B0A827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\qdugsin1.r2p\Local State
Size 5KB
SHA256 c05b265e4515c8438352f46aaf96c60116678fb86eed7a10ab5b983d95304317
MD5 4ba14bca2fcde3f281b8c08040aa0648
SHA1 e3c8fba85f5850b9f1d13e8511a46ab24ed55f1e
SHA512 5dddfe519161662c6482ff6f0bfd8577ffe5b3bcabbd1d5176363f92daccae281d7a41799799c469b9b00fd0d05aa727166f0571bdfde142a3e1feb0883bd94a
SSDEEP 96:hqGNkCQsFfXtyY58Frh/cInURoDotovjDyDKBFPNvlv2tYb0eUnQCT0q4a:IGNyGwooDUw/0alT2tYbqQC1
TLSH
T178B1B6B26838FC3709E15D04B5C63653AEA83173FC85EF9CD9E91A0C00EB389270A817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe5838de.TMP

Path C:\Users\Admin\AppData\Local\Temp\qdugsin1.r2p\Local State~RFe5838de.TMP
Size 1KB
SHA256 d203d9263d0718052ccb43355d8a259cbb264022476af4c19285da508c0137f5
MD5 69f2c6e7486c72540e8be52ffe3c799b
SHA1 4a10050d84e2d212c966a9404f9b7d7351d9e44d
SHA512 c45a8c2c8481666da2c25c51e8deabb01b1ed324d7317684308baac166b79c34f92e6b994e1345d016c51b9957a384d22a3338412891f0c425777d66bad8bb3c
TLSH
T1303174F1BC687C73A8910A44A38BB9539E346262E0919A4C55FD0A0C01F779E760AC3B
MD5 SHA1 SHA512 TLSH

Submit Download

N5CH8LKPLFCXM69B8ZUO.temp

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\N5CH8LKPLFCXM69B8ZUO.temp
Size 4KB
SHA256 6038cd19539e177a3d8adfa40962a4fe961ab3f100b1df2befd658bda7a4de6c
MD5 a389185eb191da861a9517eb2b58912c
SHA1 353fee86164495e8a1f56f7d569774b337229483
SHA512 8816bbffed612ca6c6892331e59038754dbebbe2cfdcadaa7fd3829738d3f0d87584db216f290fa329a904f8a09a566d41f69123d49b5dc1b333ab3780aaf4ed
SSDEEP 48:zvw1dOBcFSVWJ9zCNYddLXuH0p1uw1dOBcFSVWJ9zvYmgdLXuHP2F:zCJoSuUXvJvZIug
TLSH
T1E591E05197E61696F3F3EB7155B3A7209F3BF9484B048A5D0041420C1C727088A7DFB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ccba5a5986c77e43.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Size 4KB
SHA256 3defbd8777c5d10a838e0bf82d4ea71b9b19cdaa3196b8d1b388d7d93ad5ab58
MD5 ef21a2bca73095aaf139ff56126f61f3
SHA1 eb98a205d7c11212b24fb743ff6fdd3ae6d19b20
SHA512 343715a89e5d13c65710810489053cc485757f0da832d0afab2d69cb0f50a3f853b5797c800f8059995f254770f2b073b0c4f4378adb69d2aa7e464fff8b641f
SSDEEP 48:+vw1dOBcFSVWJ9zCNYPdLXuH0pAuw1dOBcFSVWJ9zvYEgdLXuHP2F:+CJoAuU6vJvbIug
TLSH
T1CB91DE519BE61696F3F3EAB25573A720AF3BF8494F188A5D0081410D1C72B098A7DFB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

249a70cd-2f93-46bb-b5e3-7ad86b265cc2.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\249a70cd-2f93-46bb-b5e3-7ad86b265cc2.dmp
Size 64KB
SHA256 3bf95e40ef810e020be21753745b1ebd2a8c934019947e649e0ddd16f9b5f52e
MD5 f016cee8dde4cd72ba239769324ffa7a
SHA1 504ef6d2c7e56f25f4a0eb726dd9f0628b3bb199
SHA512 586598865baead2c51ecc7066b34ed0ac77369f5458ec69514bae696d0c1fba02897697f8c335c07af10c0f5ebec0f2399406853f4f0d48fb5891ca9ed370be3
SSDEEP 384:AQMnlR0xVUsjUoDUfpEQmWj88qVaQwvzkCAXd25zZ5if7OQMUkVP:AQqR9EQxR/QRCA8Pif76Uk
TLSH
T14353B855B7831725D166423868E7E3613BF6F838176383BB62405AAE7CA23486D70F37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

249a70cd-2f93-46bb-b5e3-7ad86b265cc2.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\249a70cd-2f93-46bb-b5e3-7ad86b265cc2.extra
Size 10KB
SHA256 154aac5996cbe011186123249a68bf8741b25448ee9eac7df93a5719dd604044
MD5 0eee097831e312d0f24619803d30e8f7
SHA1 0d3efc3e2aae82859eb5747b564e9ee8743224e7
SHA512 4e325cac3002af541c2f986255492f23f65d57fe0076adbfe5f4efd10d18d88011c43b7eb0997eaec91add90704cfa7c03246efa5df80be825166b408d519847
SSDEEP 96:STWCmDTjdIY6pw6lFFdtH0Rh7CsevBb1d0FjMLlIrLlhTLlaXv7aSutILfcBCqwL:S5CJ8FbG7uvZ8RLwxsP5wlb4fojJ
TLSH
T1A0228313879724B7AD4198C4BC30AE7C45EC6FAA61F958A802CD4D47FA468F81FB44F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

249a70cd-2f93-46bb-b5e3-7ad86b265cc2.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\249a70cd-2f93-46bb-b5e3-7ad86b265cc2.extra
Size 10KB
SHA256 2227ea593772b1bc3b4c7bfc2830de83166ae8e2bf781fa349b2782982f8f08b
MD5 d367bd661a94bd28ae243d8ac29a518d
SHA1 ddb058ec9526ef852d97764bd2badbd3754e5a48
SHA512 8f2e22677d2f198d7e079b63c199d0c3e86ac5b3eeacfdb187e4e3273b1bd4902b87aeb2c1169b908b3f6c2af645fd920b730a33340d18069cff02fad69db4b1
SSDEEP 192:S5cicFQiR4p4DnTYapdVxzPjWBHK4T/fKNtalD4fojFbLEJ/:icicFQi5Dz1LWBHK4TmaKAJa
TLSH
T17522F821481CD837E7D7AC8DBB3A3E3A966D7B1A10E2789C40CDCA49C1A5878A779503
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

45a5373c-bc15-40b7-8869-7e0dc8636637.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\45a5373c-bc15-40b7-8869-7e0dc8636637.dmp
Size 64KB
SHA256 ea9691bae37ee1816aafa52ec481797c27cdd9aacbc275e5b0416d4e51c2adbe
MD5 ec7a6e8e6bdc29848398851b8914da7e
SHA1 f29479db7549459785286a4fd138627e649d7163
SHA512 8c8722625b22d81b5dc1d0e0004e5c22ae3ffeba7252b5a4bf076502a3492b6e1ff322239672ff7444fd43b58a1fb10e4a5ce19dc9f8eeee284b84d877f48c40
SSDEEP 384:fQFnW/hHg647GeCytHQE5Hqrx62kwhsog59EN3GLCHFdmYrLkVP:fQoA6iRZCrg2kL5YnHFgSLk
TLSH
T1DE53CB9A77950525E435063868E7F3713BF6FC2007A383AB3E5149BA1CE63485DB8E27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

45a5373c-bc15-40b7-8869-7e0dc8636637.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\45a5373c-bc15-40b7-8869-7e0dc8636637.extra
Size 10KB
SHA256 9d11054fa38e54b255879fa232e2f49524ad018dd613e1d584a15fa7e53ac30d
MD5 5937ccc9d7d6132a2486984bfab86e17
SHA1 ed13c929f7125f0fb970d4b98a4df1673ea7d99f
SHA512 86a08f64d2fe613e01cec408ffd676904f8244a354c9ad259dd7796f1e70461c0870015b9c3369c3a0e1f7469512ebe57de91a6c299c27bf7875e31886941f74
SSDEEP 96:STWCKODTjdIY6pw6lFFdtH0Rh7CsevBb1d0FjMLlIrLlhTLlaXv7aUutILfcBCqL:S5K6J8FbG7uvZ8RLSxsP5wlqbofo3
TLSH
T1C5229313874724B7AD5198C4BC30AE7C45EC2FAA61F958A802CC4D47FA468F41FB84F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

45a5373c-bc15-40b7-8869-7e0dc8636637.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\45a5373c-bc15-40b7-8869-7e0dc8636637.extra
Size 10KB
SHA256 d8cc52e3c79f4c310782cbc9eba6230da00881469c69f960dcb44563b35e25e3
MD5 568f8991f4d7fb11f4378b8f5dbd6f61
SHA1 82dd106cd5241a065242b2b3a687782dafc17c09
SHA512 0d17da46bf040ed1427ffda911bd84302d3774f5ab2ddaf498c1a3886b4096c968b4afec2a9087445286faf2d9f29ab29d21155208c1f7d114a2235d2a40cbbd
SSDEEP 192:S5KUicFQiR4p4DnTYapdVxzPjWBH+4T/fKNtalybofo7bLEJ/:iNicFQi5Dz1LWBH+4TmaocA7a
TLSH
T1D732F821481CD837E7D6AC8DFB3A3E3A966D7B1A10E2789C40CDCA49C1A9474A779513
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6c652f39-a156-4541-bc6b-658248d5c01b.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\6c652f39-a156-4541-bc6b-658248d5c01b.dmp
Size 65KB
SHA256 4a8a37e01ebf45cbe860744d1f89f5938c071bc9b9837e558e3083ed89229cb0
MD5 b7c81c026fe59407143d9538562bc7f9
SHA1 59134da28efe7df8232e5f1c2c3a1577cfa51586
SHA512 c03f075f1e55906805862aa99db4052603bc43ec0b7669b454cfa8b48c1c2039f218b8e1c2c0d286dcc261ea279998e9aadee6493d0a8bf67e1df03859bdca33
SSDEEP 384:uQHnz1nfggNsNeWNPkMv/KTtigGMGJgbIH4dqBvyKQt6kVP:uQhDGFq+KTtgOIaqBKKfk
TLSH
T13E63BA5A73991565E422463958DBFB723BF6F811077BC3AB235142BA1C63B88AC30F17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6c652f39-a156-4541-bc6b-658248d5c01b.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\6c652f39-a156-4541-bc6b-658248d5c01b.extra
Size 10KB
SHA256 699ff459d328b0530d9a5fb1198b1f623b45a5c5e022eabc9901d28bb03e4aca
MD5 8240ac37cc8d0bbd6bb25c257843b7ac
SHA1 e1c15c09d2ce2a6dfa94c100e7e11d7a950fc0b1
SHA512 baba95e0d7399b9c227275d5919e18108eb3f1c73bf85f944d6a3e239330714eaedbf93df0d6cf3f8339043bbdcf3383997edd480120e6ac7737ddac17ed1de3
SSDEEP 96:STWCFDTjdIY6pw6lFFdtH0Rh7CTvBb1d0FjMLlIrLlhTLlaXv7ak8utILfcBCqwv:S51J8FbG7WvZ8RLlxsP5wlBrQfon
TLSH
T1BB227213878724B79D4198C4BC30AE7C45EC6FAA61F958A802CC4D47FA468F81FB84F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6c652f39-a156-4541-bc6b-658248d5c01b.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\6c652f39-a156-4541-bc6b-658248d5c01b.extra
Size 10KB
SHA256 e62dcf5b8766fda039b6ff99eb73f9d13506b0f3ad791b833240b5540776327e
MD5 a207a0432dba33695aadfc9c8a4609f4
SHA1 81bdfa05d67faf02650ada78be00ea0a26e3d105
SHA512 e84f7f6553cdfe895a1d1a41c52d72a3dcb2535f5c37f15bc4e60dddd8ac06812b17b3537f8b1682cca748070e02de79f6edecd8b994cf2ce48b7099a97726d3
SSDEEP 192:S5DicFQiR4p4DnTYaVdVxzPjWBH14T/fKNtalZrQfoLbLEJ/:iDicFQi5D/1LWBH14Tma4ALa
TLSH
T1AB22F821481CD837E7D7AC8DBB3A3E3A966D7B1A10E2789C40CCCA49C1A5878A779513
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

91fcd3b2-4414-4600-a290-773bd80a06b6.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\91fcd3b2-4414-4600-a290-773bd80a06b6.dmp
Size 64KB
SHA256 1a342728bf0b207b7d3681f08bf4b53910552ecd1e3c05d26cc9821e4e1cfc04
MD5 92c35e86bdbb1fcaee271703ab6697db
SHA1 0d468d054ac7d2a91a16385a0e9d1992b42a9d17
SHA512 ebca4610b99c96b83525855dd8dff374847daf89b7cd0c422890638deeff1086260e30b7a6fe731ece540d2b8c6e0eada5c27a2f3957f888fe3b6073d56e4b9c
SSDEEP 384:jQqpnxvah2Jpmu4aQ98pfv6DqhDQBBpvVAjFooEGaKN0d7Jz+UBkVP:jQqPwu4aQ98zhspVIFooEbdEUBk
TLSH
T15453BD1AB39419AAE436423A9CD7E3B13BF7F525075343ABA24082BE1C17398DD71E17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

91fcd3b2-4414-4600-a290-773bd80a06b6.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\91fcd3b2-4414-4600-a290-773bd80a06b6.extra
Size 10KB
SHA256 645b2820bde619514d6a02554ab85c095d90e96f18e614e55a1cc71a31a66298
MD5 85013efe975fea78b053fcb0e1fd33a2
SHA1 910c1c87faeecbc1de9613f1684fc93297560620
SHA512 0c1e4eefb96a9bf3101538d5f18623b361f81bc6d928c7791f26766dcfd3869d41d035d6c99757188cc7de34968516d979da63ad0f0d1d3a088d97effc33b110
SSDEEP 96:STWCAJDTjdIY6pw6lFFdtH0Rh7CsevBb1d0FjMLlIrLlhTLlaXv7aMutILfcBCq7:S5ABJ8FbG7uvZ8RL6xsP5wlqxsfoZ
TLSH
T137228353875724B79D5198C4BC30AE7C45EC6FAA61F958A802CC4D47FA468F81FB44F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

91fcd3b2-4414-4600-a290-773bd80a06b6.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\91fcd3b2-4414-4600-a290-773bd80a06b6.extra
Size 10KB
SHA256 5761432f89619aa417cf70dfc41e20e2230a8b84f7c3ff90eba1ecf8bf00005a
MD5 6d3788187fd0b49208fb1f80e4b84a5b
SHA1 dae422484b5606744670c6a98cc4f13f313b5843
SHA512 51691f2eb10b756fce4c4f6260aa3910688c18f9b615bb716e04a47609c2544698c4a57e4128e9ad70ee95884aeb60af13c51de0f5e3a2ef200523837657cb46
SSDEEP 192:S5AvicFQiR4p4DnTYapdVxzPjWBHu4T/fKNtalyxsfo1bLEJ/:iAvicFQi5Dz1LWBHu4Tmao+A1a
TLSH
T14122F821481CD837E7D6AC8DFB3A3E3A966D7B1A10E6789C40CCCA49C1A5878A779513
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bb532cee-8a60-4859-b7b4-d7d40065f02c.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\bb532cee-8a60-4859-b7b4-d7d40065f02c.dmp
Size 65KB
SHA256 fb9291e1fe07dbbb268a4749072a4c427b0b6c726cbe0bc648aa6d4a8f42158f
MD5 4d5aae53d615b63ad88508b546a90577
SHA1 b2379014b3a75a027ce6879b8e8806188ec4f9b9
SHA512 eb0d2110ff170ae00d12f80be3f1948f333d2d6ab9a0727bf604fffbcf03281741c4570df8077cdbd09ef9a0150e875cfc0e72b559d6e19efdccc164337fb1f1
SSDEEP 384:7QvnsfYpwkAhuCGxjaUS2vqmHptuQGFLcpwkAhugd7nZLmVUkVP:7Q0thoxjaUSJ+uQGRhhvdzZiUk
TLSH
T17D63971A73D1E9B5E475467858E7F3713BF6F81607638BAB225082BA1C633486C70E23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bb532cee-8a60-4859-b7b4-d7d40065f02c.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\bb532cee-8a60-4859-b7b4-d7d40065f02c.extra
Size 8KB
SHA256 5c72cad8c52839c0d927d1995347f023d16705dc454b94e4e3d39d14ae464dd3
MD5 b59d1e4a646107daa7ae62b60b1358e8
SHA1 858b121d49fa3b2b339ea2c81b193a12139f8951
SHA512 ce43d0b65a13cb23be97edc2bbeff988b7230b57b67fb1bf6e50709652c7adb9189b9261d645fe732c48c939641f969f91c05221eef69cedbe9af950f0f7e449
SSDEEP 96:STWC7DTjdIY6pw6lFFdtH0Rh7CTvBb1dfutILfcBCqwvEYYjdjqPlKHGfo5:S5TJ8FbG7WvZ3xsP5wlWGfo5
TLSH
T1180285538B4B24B7AE4258D87C30AE7D41EC2EAB40F954A802CC4D47FA4A4F85FB44F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bb532cee-8a60-4859-b7b4-d7d40065f02c.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\bb532cee-8a60-4859-b7b4-d7d40065f02c.extra
Size 9KB
SHA256 729d1ab9d52296045abaa51019e805952f2bc4fbdcd9c1b72dc0b769df3f32fd
MD5 e4a044e2c40176ee00ad2c069ecc1a24
SHA1 59072b2ec4cd0c0819732879b541617591dd0980
SHA512 1dfd88fa390fdc3f83c553e77d7069e84ddeb789836d77a29834ac9551c4d70740158b88ed2ac7a192ab68c0f863fb25772b7017d7c1c9512051d953a69663a7
SSDEEP 192:S5NicFQiR4p4DnTYaVdX4T/fKNtal+GfoVbLEJ/:iNicFQi5DZ4TmaDAVa
TLSH
T14512F831485CD833A7D36C8DAA363D3A956D7F1B00E6789C41CDCB89C1AA878A77A413
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

compatibility.ini

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pu854q2a.default-release\compatibility.ini
Size 198B
SHA256 252b7fff962848c61092e82a3d87adca163849767713a93ab533bb397f1f53bb
MD5 ce9ef13caa8a74c25157b184aa038475
SHA1 db03a9935d8bb3ce6b120aca98feade536805160
SHA512 0f6f5053e78167ef5cc5fa70ed3a87dd116df0671a590299277a197341bed983e3d77e37ad2c33cd4afe880fab9ed1c7f7502210040617a01f97a81c1e1d4f29
TLSH
T1C1D022818BC7848C9D4AA8E4537C38086BF2EE0E0604492A32827F0B4164F09023C3F9
MD5 SHA1 SHA512 TLSH

Submit Download

store.json.mozlz4.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pu854q2a.default-release\crashes\store.json.mozlz4.tmp
Size 6KB
SHA256 7614ab8c7d5238b5eeffdd3282d5b80354e04a0b1e7de7bed663236e3ce473cb
MD5 27555e79bba0efa1a764f24e71919a08
SHA1 61c6038fdce3ab06a9f1788c8c9e3c823ee57815
SHA512 d2ca02efa01c9037db54428d0d3bc58a03bce72cc2e94378b42bb5e49d0ec93d3a10de531a5b63e7f4fe30d93fd2c97142a190ce65376e018bedcd046c83017e
SSDEEP 192:DudW/2f9Hn3K59DAsEqSbDSyQSVIrEpun4:KU2f9H6vEqWbIXn4
TLSH
T137E19E7BCE14A8E016D15834B045BF9D23D22D0EA095D6ED5CD9B3DA1CB4E60AF24B86
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pu854q2a.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 11cce0ee634ba1aefcc8b41c7c6201576cfc2d788456ef73d115074c081ae817
MD5 03a6a2bfb50b438c06f8eb3cc7cb11ae
SHA1 577ad63093775b8b5afa8ea2a26ad29595b32abb
SHA512 cd87a1619c196f75c8e1beef247e518c14b839c6ff20bc2cead4c830b133a6fb6187877331a4704e5d3a6a5057dafa2b6e9802923b61fc9ef58cdbaf45037bd8
SSDEEP 192:wOv5zboHJZ4myjHdqDj1d66Joz0dzgCl6mc0dz:7bopZ4myj9gBd66JozQzgC1jd
TLSH
T17BE10164F628827FC418427BDCA61B404F39389A988F3F1935DD610C2D572DE7A9E17D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pu854q2a.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 c188a99911f2beedf7f9212f99156d849c63495bfd1a407538644dddf9aa4344
MD5 40cd8be1d15a8a2757c8627d0791b689
SHA1 756ae93dcd599481e3bea8ba04e32570d633f8b8
SHA512 f55e262f971c8b686e6d495a4a3dcf56f92f4155c27d046fcc6000b26b226dc507b74572d3e2dacfdfb87574fb156cc02df568f769ef86a9a67f6dcf222ce3f8
SSDEEP 192:N+gU1d66Joz0dzgCl6mc0d2Ov5zbooM4myjHdqh:ted66JozQzgC1jnbooM4myj9o
TLSH
T14EE11064F638827FC408427BCCA61F414F36389A988E3F29359D650C2D572DE7A9D17D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pu854q2a.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 0a616b32624758008f271e37fe8c735ab252c0cab37d19a47071ca80202e6db7
MD5 c777bf90c50f84bf56e15d8b006a347c
SHA1 5713e9f61df63f9a98ac5255cac071c97891269a
SHA512 dc60533309d0b16d490a3e933c7411f2ddb6c564d6842b41c0dfd3da0965f162d20244eff25650cd5540fc79eae4fa6a31beef4ca118334355d10577057b04fc
SSDEEP 192:0Ov5zbopZ4myjHdqf+gU1d66Joz0dzgCl6mc0d:XbopZ4myj9ked66JozQzgC1j
TLSH
T11DE11164F638827FC418427BCCA61B400F3A389A988F3F29359D650C2D572DE7A9D17D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pu854q2a.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 3e6ae72b4b703ccb7e2a70ab196808e8f4d5a546aaaa4f5149787c4166a760c3
MD5 b3b81bcbdf7d584486df8081e06145ea
SHA1 5ea066813bef7e2dcaa4f01efceff944b4e14c91
SHA512 e35e9b8f2b804a777bf23c3992bbd1161f73902c5c55f21c6312b6a7b9b339eab9fbbff725157d57977581aaacd56b238fe1cba56e1bc666b2610315745cc917
SSDEEP 192:N+gub1d66Joz0dzgCl6mc0d5Ov5zbopZ4myjHdqh:tuZd66JozQzgC1jobopZ4myj9o
TLSH
T17DE12164F638827FC418427BCCA61B400F3A389A988F3F29359D650C2D572DE7A9D17D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pu854q2a.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 d631cd2d54a2fabe578228184c232cbe72789de54e5d9b970c8352eb73059d41
MD5 424fa2b2e5004573697961ddc58c474b
SHA1 03caf525870b152ec04a5ebce0ba3d117dbc5107
SHA512 491ad4572a28b8e4df1d8a3a3e59832dfbb180cb873dae5d3f9878e8522908441afe23b3af4da3639dd2d53bf1ad3a3b68a70035072da37f89592bd8d8c72e84
SSDEEP 192:y+g3O1d66Joz0dzgCl6mc0dzOv5zboHMZ4myjHdqh:OYd66JozQzgC1jubosZ4myj9o
TLSH
T161E11164F638827FC418427BCCA61B410F3A389A988F3F29359D650C2D572DE7A9E17D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pu854q2a.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 d712920001ae0bbb8c8a9db78fbfce9b81391056acd83c83b4161d4bc39beda2
MD5 8b7e6ff02d0521b07a5341e5cb16a845
SHA1 67b2246646f290d9dd5a89461d9d51ef6cfa2326
SHA512 b87e2b121e56f9ee79dc34f2c94afbf5a2f6c6cabea7750b1e72202f413410c99de50cf794cbce0c8e1ec0f2d13e829f213508a3c05195eb1d794794ba432d97
SSDEEP 96:jFG2FfFeFYFN/dd66Joz0dzgClKtmc0d/UQSdF95/7bkW6QXjrcE4gjyUR6tx2WI:J1d66Joz0dzgCl6mc0dLOv5zboob4myK
TLSH
T108C1D064F638863FC408423BCCA65B400E763956D88E3F2935EC650D2D972DE7A9D17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pu854q2a.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 f52050f2f9fb21f5bdac888513a1db32c34cb4470e1b15ad061f212034918cce
MD5 5fd2349d75d782e10148fc2ed837ff62
SHA1 1b78319772f38cec4efd2cdc08b2bfaa786a9529
SHA512 50586d6b07d39569ba63e0aa01cc49fab743dab1f695e95ea8c36daf832361d27cf9ae65b28ac85374f9b3271039d5443c98a395212ef24ef56e7d8c7f622577
SSDEEP 192:0Ov5zboHJZ4myjfxK1d66Joz0dzgCl6mc0dz:XbopZ4myj2d66JozQzgC1jd
TLSH
T132D1D064F638967FC418427BCCA65B400F36389A988F2F2935DC610C2D572DE7A9E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pu854q2a.default-release\datareporting\glean\events\events
Size 1KB
SHA256 64a1ebcf0de15ce1eb240848d387cedd3d9444b006c6612afa9b6a8177e3ff99
MD5 61848f0ea6190c38a1c9e1886c64fa85
SHA1 128a29f937d9fff505ba4be1d92b31a5dc254397
SHA512 d98e38d84b77c0f97e67f70cbae36769893b1ef42d842523c8ffa6d760dee7de089dc2752726e59d01f36758d1a16625e5e1c3376f1b99b5b35271570b1c468a
TLSH
T159216A9C39BC4D3A9C9BE29C7441028E57518A0614873D874D42EE8DCD89AD9326F93D
MD5 SHA1 SHA512 TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pu854q2a.default-release\datareporting\glean\events\events
Size 1KB
SHA256 49a564ec02b3886fffa1e7bf191a3e48771413c049b6c3b5b19bac45deddf167
MD5 ffc6d3cb8a141a82454c4aeb2df9be2b
SHA1 609a157d59bc499de245a4c92bc36581c689c2ec
SHA512 6d1522b95bb55c4dcd61239e2f12e12c2bd6c0ef9c109b58aeff8f96a3fd78f6ac9f2ade99f7d11325b451609f32bef32934b8adc59f6c1181828b3d4dd8713a
TLSH
T16D21285C3ABC4D2E589AF29CB481028E57924A46158B2D870D12EFCDCD85AD9316B53E
MD5 SHA1 SHA512 TLSH

Submit Download

03c39832-1fb8-41d3-90b1-859d983ae2e2

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pu854q2a.default-release\datareporting\glean\pending_pings\03c39832-1fb8-41d3-90b1-859d983ae2e2
Size 896B
SHA256 6ac02476f0b3a049b527feb965fb58a4ea4552cea16b5193ecf08f399ade04fa
MD5 51c192fc64243744914a26b9fd5e3296
SHA1 103377dd41b4f90c2f2b4acecaf4eed4ca18982b
SHA512 02b860b0ca4ab45a69b70a653d83a61fa6bb87f63dee52e990cc534a26a2d9dd56c9dd45badfd1e1fe58c90ac3b21743bec807ad71eac707e81203bd525ca217
TLSH
T18F11D050A634F5F5CC38D28BC9D1774257A9B423C0CB09187DB04B084EAA45BE77A20B
MD5 SHA1 SHA512 TLSH

Submit Download

03f11cd4-1f2e-4810-b20e-86487f846746

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pu854q2a.default-release\datareporting\glean\pending_pings\03f11cd4-1f2e-4810-b20e-86487f846746
Size 3KB
SHA256 df1280dabcdd18b56521bca8469f604e67d6b959ef4fb7dc3922e4e596332f5e
MD5 6ce1c76a039b931a7464e356efcfdf49
SHA1 651c21538886e9fecc00dabd678e66c9ac251a9c
SHA512 0a2eeb317dcc943aafc0c9ba47a4b2cf25a13d27db0ac3c257e2390612fa902f16b1d769d739a6705e3c5fa81d670be5a085511ea780558ddc68e0ddd407e760
TLSH
T19F6175A18518A5B3CAE86104E3777A548DEE339F58471BCD21AA8E2882F8474578B25B
MD5 SHA1 SHA512 TLSH

Submit Download

08d7d56f-dfe2-4e91-a87b-0734cf8a12d5

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pu854q2a.default-release\datareporting\glean\pending_pings\08d7d56f-dfe2-4e91-a87b-0734cf8a12d5
Size 3KB
SHA256 b115ee1cc2ae01d8f536b0f6be875554025dadf1f1cd4ee65bef094390e99915
MD5 89091b298185a949393497e45a735523
SHA1 749a92b35ab71f438ad474cff7fff63fcb9c4396
SHA512 7196df8bb5c6881b47ca8ac1965b7c251ee7368cd027c98a076ccf6d1b1a929b944bb11831d7e48ec62d0d835be93c6ce801bf80742e3142a0e50265458c85b2
TLSH
T1466199618518A5B3DFECB140E3677E548DDF33CF68430BCA655A8E2442F8438578B25B
MD5 SHA1 SHA512 TLSH

Submit Download

1fa3fb19-2b96-4f0e-881d-bfee4174d6eb

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pu854q2a.default-release\datareporting\glean\pending_pings\1fa3fb19-2b96-4f0e-881d-bfee4174d6eb
Size 3KB
SHA256 37051e1bb8c9931744c87d2ae28b6db34d32a6501f9a9e01d9d014ae1d66a54d
MD5 ff55df779ecc19e236433ab0db765511
SHA1 05f459e9920f1000fd15253747cca8e1de690de6
SHA512 0004d80b82ae3f489f9c8f8e65d3099bc7cb276a5234cdd5cafc6a1f64bf1fea6b0e8e9252b866690027558161e60948eea9ffb58e27bc7d5da805aae7e2856a
TLSH
T1956166714528B5738EE8B144E3777E458EEF338B58870BCD25AA8E2442F9824578F35B
MD5 SHA1 SHA512 TLSH

Submit Download

203094e4-cc74-42d2-946b-c24dcd6b4fb4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pu854q2a.default-release\datareporting\glean\pending_pings\203094e4-cc74-42d2-946b-c24dcd6b4fb4
Size 3KB
SHA256 57b25024eb50555690e03291447764bf2f1e84a2fae248e21ad71938d76cca43
MD5 6950dd1fffbc658fdc38f4e93d8a9e8f
SHA1 e0e39d84e7ca2d40f5d912a8223c65d8b718455d
SHA512 748f258a98475e3189204ad7e81510610e0d5ffcce91628f2c23dfc7788904f20d713d0cb95b3b43186a3e0691ca01c908cf887c6a3504e8a91a8c3fb1c83b1d
TLSH
T1B86188708558E973CFECA044A3777E548DDE339F58530BCD259A8E2442F8474578B25B
MD5 SHA1 SHA512 TLSH

Submit Download

45807439-0ae5-4c53-94b8-863d30a58c1a

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pu854q2a.default-release\datareporting\glean\pending_pings\45807439-0ae5-4c53-94b8-863d30a58c1a
Size 3KB
SHA256 2b4284738fbf6b9fba95ea8400b544daa02c07d06dfe755a38a9581d2e1d21e8
MD5 12f87fcf9ba46a9cdc8b162f31a66fbd
SHA1 9f8677fc5a92597ce6b7d62f6d3194f5e89778d9
SHA512 8921fb0a0385d375ad6d6cae62d9df69471064b57bcc4054bc7ef21b18da5df55d6b1c6dc357fb1eef53d771f331e6ff29dd5612035346f2b33bd951afa38c5b
TLSH
T1536156714568B9738AE8B145E3377A458DEF33CB48430ACD25AACE2842F882457CF24B
MD5 SHA1 SHA512 TLSH

Submit Download

4cd96070-83e9-441c-ac91-2585193180fd

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pu854q2a.default-release\datareporting\glean\pending_pings\4cd96070-83e9-441c-ac91-2585193180fd
Size 871B
SHA256 fd82beda26a268c31da2b755edef2732e8f1f0eb98e0643b154c7ecc5284be33
MD5 979d1fd4891e8fc69a46b7deb887493c
SHA1 26fbe823a447e77774dd560fcb27ee956f1537f4
SHA512 eb91cd721761a11a85276bd23c9ee8d9e71955538d3208bd72874d31d8f27f9af6138c5d48f95dbec2f9529e642163f6c5ca7ce6bcbcdc0aecb1566c10157f84
TLSH
T13311C0909634F5F1CD68D29AC9D677054BB4B52380CB14183DB59B084EAE92AE77A30B
MD5 SHA1 SHA512 TLSH

Submit Download

4fa80893-ed87-44a9-b166-fe322299cdc6

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pu854q2a.default-release\datareporting\glean\pending_pings\4fa80893-ed87-44a9-b166-fe322299cdc6
Size 2KB
SHA256 eb69d6396df019c8e88271d052d50acc4082243672d417ff27aa0a42fc0c270d
MD5 cd95ae0552dcfdd6409453f285c776d6
SHA1 1c06b0d9baadf99655ed6e70080ff4bc46fbfd4a
SHA512 5f388e409862eb7625597973e8383aa13f3bd35b09735cb06a88ab1b1f56130ca471187e73c44131c45b25da6aecdbf6204a88960c765c1b33c2b2084bd2b45c
TLSH
T13A41346836785CBB8CDAF15DD481378E93649A0340C61D836E52CF0C8D8A6DE726E42B
MD5 SHA1 SHA512 TLSH

Submit Download

56348f82-229e-4985-b7e1-18c772fab441

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pu854q2a.default-release\datareporting\glean\pending_pings\56348f82-229e-4985-b7e1-18c772fab441
Size 886B
SHA256 d4f55e94d657ec4073ba919ef33a285f50238b5ab58509685102238b34cce71d
MD5 01c2c9094a7acd97736a32c7593ef730
SHA1 20cd658569d8311231f8ce2ec271e1e621665ca7
SHA512 9604f2576c69a75e1940ea72297b18aaef110d87f11369fda8da8227e7a056ac272bec2a5bb8b8ccd1ca678801e7dcbd485d1932febf969811b706a17fa400d8
TLSH
T1F611D0609634B5F1CD28D29BD4D277454AE8752380CE09187DA197080EBE45F926A70B
MD5 SHA1 SHA512 TLSH

Submit Download

5cad0714-dd7c-494e-9bca-ce38853bd457

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pu854q2a.default-release\datareporting\glean\pending_pings\5cad0714-dd7c-494e-9bca-ce38853bd457
Size 3KB
SHA256 a52b3b9ecfee6e7a11fb626adfecc9392d04c13ca6585382b0ab93897265194d
MD5 96cca57951871eefbffe58a9eb9b05ae
SHA1 67773142e071b74ad099f73620c6add7ac47372a
SHA512 963bedfe3d1bd3f17e584f3d8aea04ee8ecd963f283ee221101236a788b08105b16efb62e546327a1b475fd0d2c90df1aa45ed8d261bf20558034d7272d0996c
TLSH
T1636189618558B9739AE86044E3777E548DDE339F58430BCE21AA8D2483F8474578B31B
MD5 SHA1 SHA512 TLSH

Submit Download

63eec552-b840-430b-8789-a68addef5037

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pu854q2a.default-release\datareporting\glean\pending_pings\63eec552-b840-430b-8789-a68addef5037
Size 235B
SHA256 44057ddb07d5e61511ffa30c7fe84d067cf2411f9659c9255790453eb9844f78
MD5 576ddf8576d11ec43df3e7ceefc724a9
SHA1 e4aaecbab4d591426d3213c48abf76677bf8d30e
SHA512 28f1b249aad7468fb5ea936c1152b7db1e3648003bd7f11f28bb70c181bc981078b94520d9be73d6e5fe3cd54fb455a9174c4df8a16532903a71e3b3e08c74e1
TLSH
T1A2D097C024DC232D48180F0AB0E17AC231844C3795B5A820C661857499B9DC9A252807
MD5 SHA1 SHA512 TLSH

Submit Download

6cddb689-2fe2-4f19-8f75-cb333745c23b

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pu854q2a.default-release\datareporting\glean\pending_pings\6cddb689-2fe2-4f19-8f75-cb333745c23b
Size 883B
SHA256 12a7303c37b58b6d262fe2e2236ea5c67d1a9a0a4e6f028e45185c7f80a484fb
MD5 68fdf0b94cc029c8ee6dc6a917764d6b
SHA1 123901dcfa97a457a26949cfaf364c6986defe72
SHA512 a898c584257c4ba1ff4e0ee4d9a6cc941e8d1325f41f68a290bac3417c14089776bede15115aabaa2532a3ef4823afb6951712947d0f945e2ec164faae1f5cdc
TLSH
T19011D050A634B5F5CC28D18AC992770247F8752380CA49143EB14B080EAE55FD66A70B
MD5 SHA1 SHA512 TLSH

Submit Download

6d1f422f-108e-4e83-b5ac-d50c7f67966a

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pu854q2a.default-release\datareporting\glean\pending_pings\6d1f422f-108e-4e83-b5ac-d50c7f67966a
Size 235B
SHA256 c7d752340157511c86ceecf928c10b84312172cdcd264219dfe873f0286c6f86
MD5 aee57165bb7ad113cd11a90433377f30
SHA1 4422f65cc686584ffa70393becd3a9c5cb06f684
SHA512 e4ff355250182ac1189609389ebc25d768e765bf5703f5a3cd0f3523a3e0c2bcf9c17419f963384a00468e214ce5acfcbe7897b884f81f7b71352624ebbe18a3
TLSH
T170D0978024882B9D08080F0AF0E06EC2B0488C33A4789820DE5147789BBD9C4426580A
MD5 SHA1 SHA512 TLSH

Submit Download

6e3e0783-6c4e-462b-a4d5-01992ecf987b

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pu854q2a.default-release\datareporting\glean\pending_pings\6e3e0783-6c4e-462b-a4d5-01992ecf987b
Size 3KB
SHA256 1a24c8b83476b742473fce212d4b1cfcd59c0e970b7b201e458c07741507494b
MD5 236444cc5588a1f8a7022319522a5b6c
SHA1 facd43751a9b25b2077c30d7b88563d3ebf981cb
SHA512 7750fd3dfdd670455ed84b73d8fbca84340c7518bed8eeaf8112dbc428a46db672d1ceecb4b52c28abdf49bb203dde141740e0a2f8efc41211bff6b11679739f
TLSH
T1C56166714518E9B3CFECB144E3777A548DDE339F58570BCD11AA8E2442B84344B8B20B
MD5 SHA1 SHA512 TLSH

Submit Download

91777901-ddd0-4542-97be-aabd32430306

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pu854q2a.default-release\datareporting\glean\pending_pings\91777901-ddd0-4542-97be-aabd32430306
Size 235B
SHA256 9b3de3b038d7c8ced4fa7dbcc664b8584b59f1a301e2fd6d9d6497a057feaa6c
MD5 585655d854584b88ac3083406e8b367c
SHA1 911df8ae974e375a7591a0d397d27ba69fd4e2ca
SHA512 9cfa4ab22edee521475c009be3907c1431ab17225a4986eb5fe7cc8f6438e6aeaa7a9ac8ea75ad5294840d2d5c3abdf54c52a5ff3b1c56161583ba3b475bee79
TLSH
T1B7D0978018E82B6D08100F07B0A069C732844C3324B8A8A896A641B48AFDDC86251C26
MD5 SHA1 SHA512 TLSH

Submit Download

9ff382e5-4e72-40a8-b20c-8e803b2db5da

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pu854q2a.default-release\datareporting\glean\pending_pings\9ff382e5-4e72-40a8-b20c-8e803b2db5da
Size 16KB
SHA256 c0688ed2a72bb44f80a6bf04dffcdab3c143208b59b793ace6da35e4a5c6699f
MD5 a067a67e9e1595b8f3b8328704ea3602
SHA1 02207f39b03edfa969169034f6d376d9ee9d2b98
SHA512 9f695ebe0e581b6ff4660cbaa0b51dc9b33486c344acc02d2ad1a26a0743401d6e5e3d0014f26c4a2ea50113149f68c118896f4f9b2259550e62331e203f4381
SSDEEP 384:GHsLtv7xZEZSZxxil7fo9/lqpNtqfl2j1j:GHI7xZ1lqpPq+1j
TLSH
T14B72EA56282045BAC251E36894F8BFC3E6F528CF4C425FC99BE47E085DDE0AE502798F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c9584025-3964-4a6d-a229-259fef891f5f

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pu854q2a.default-release\datareporting\glean\pending_pings\c9584025-3964-4a6d-a229-259fef891f5f
Size 3KB
SHA256 a859cdecc777eef4d305b4c24afe4d9dba6abd8536a97b32f4e22d7c25884869
MD5 3fd97205c0404b951b69ee6e35010ebe
SHA1 597e3aaebe87514dd404667d32b96d7860b75f67
SHA512 1fe7b240a9261e4f2e4589f17616a369f68a40b32a035ba3dfe69c6302c9b55c9b47d4402a755c8a9552e675158cd9c35458062f0746d97e57ac7eb0e7490b69
TLSH
T19F6167714558B5738EE8B140E3777A448DEB339B54430ACE15AADE2842F8834578B24B
MD5 SHA1 SHA512 TLSH

Submit Download

dc02d349-b53f-43d6-bfb3-c9a2ec1afca0

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pu854q2a.default-release\datareporting\glean\pending_pings\dc02d349-b53f-43d6-bfb3-c9a2ec1afca0
Size 3KB
SHA256 e9ec8ac2366e64ace8d948c3f972269465db7f4ccc3d405c0a84a64ed6ff53d2
MD5 9445e523b6ca86ef631ea89d7cbcf186
SHA1 063c9d934b770adba2404415272c297e9d7ab6d6
SHA512 c38c3f4c53a369c88de8894c4bf61a1cc63ad3a4e94bc10a620d3f7c4928a7e3e2e0f5e98824bda8c0285a2b7511d429a356f2d6dee365750a971e0c8863854f
TLSH
T1796156714568B5B39FF8B041E3777E448DDE338F58570ACD25AA9E2882F8824578F24B
MD5 SHA1 SHA512 TLSH

Submit Download

eb276feb-05db-47d7-93aa-214e4cf6244a

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pu854q2a.default-release\datareporting\glean\pending_pings\eb276feb-05db-47d7-93aa-214e4cf6244a
Size 2KB
SHA256 99553d72b4ec999fbf91797226d5c4616405f3bb0d70c14ab1dc86b526f0cf82
MD5 7cf6af591aeb8072ee39da6ec601150d
SHA1 8d639b551cc3633b0ebff516c0f97fca3383f1ff
SHA512 e1974b2c3325d5931dbb38b455ac220be2e7d875a3c10b5caacd381cf40d4db334ef91bd8ad38ee1928acf37da196470fda540bac12ca7b558cdc526b97d0a36
TLSH
T14C41615C357C9CBA8CAAF15DD482334D47658A5310C62C872E52DF0C8D8AADE637B62B
MD5 SHA1 SHA512 TLSH

Submit Download

f424ac10-e789-4bf3-b93a-7638cb95c4c8

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pu854q2a.default-release\datareporting\glean\pending_pings\f424ac10-e789-4bf3-b93a-7638cb95c4c8
Size 235B
SHA256 0469e561ea4e1c0f97fad632aa60690cc48ff2e076e0646395bd39a4b9b4c724
MD5 ee7483b20632f9c439353efb4b7af2fc
SHA1 c3205b4c06b2e9b9144cf2e834275de331a12e93
SHA512 36383b0e26cc4789dae326a3244584ca4fb1d13f1b48c61756616eaa581b396e3b46757a680aec1b1886ce963d7e200417c5d6eef7847b69419ebd7b488adffa
TLSH
T1D3D09780149C7B1D48180F43F0E12CCA318D8C3390649810CA9000B889FAEE4412A867
MD5 SHA1 SHA512 TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pu854q2a.default-release\prefs-1.js
Size 6KB
SHA256 422861b4aa59ad5c1f75d043641dbfc5f731f7eb70defc22366ef4b8fd687d61
MD5 2df6086af14d4792f89d69e1283da604
SHA1 65793d65b9fcb2ee00563f35088d4d576e9bf234
SHA512 29036b68904fb12e90dac852f4d4d9db8e52a846b82e639dd86653d3c134e8d3dbc3deba891f18f28f229b039ec86156ca46a55d162c7523fa91af452ca2835f
SSDEEP 96:xHtjUTUubqGqV9fdO61zSVSSlldv9jl5ncHJRL9I17Bw88H8L4cnfVSuO:Pj+2RV9fdO6gSSVUn5uBw88qS
TLSH
T165E110789548CB7F74B677AC6C6888315AB2013B77BF68C710B95484050CF3482FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pu854q2a.default-release\prefs.js
Size 6KB
SHA256 a3e8a2ef56e9b8920f5c25509ef19bb4ed80e687760c4a881f5a3302daec97ab
MD5 b2271ccf339e465bef7f0250681ca530
SHA1 74e3bccaaa30f5ae7852df6086515a6a1c4fdcbf
SHA512 6a59262d80957ea3ec60a6670b5be0e02185d96073725fc72b58fa713696e066526cb546256f20bb34fd97bdd96c6bc03fd375715d6a37669a255333f4bf5bd3
SSDEEP 96:xHtjUTUubqGqV9fdKjYnj+1zSJSSlldv9jEncHJRL9I17Bw88H8L4cnfV+O:Pj+2RV9fd7yUSSln5uBw88qT
TLSH
T1A5E120789548CB7F74B677AC6C6888315AB2013BB7BF68C750BA5484054CF3482F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pu854q2a.default-release\prefs.js
Size 6KB
SHA256 0a192f989e866ee2daf1e168f83fc5e90421931d08d9bf39c207a70587ee8086
MD5 aa4ab4c330daa91d5d8b65d7c361f42b
SHA1 82ee2287e85befde8b56a5ae0a77538cd821d38c
SHA512 aefaa30df5a37900d4ddb64d9ce0188bfef08c18df7d1be829ed1d035126596bdca21c130a5ba37ce59e2a7ebeceb6c64093246840b7091d677047acc00226f3
SSDEEP 96:xHtjUTUubqGqV9fdO61zS9SSlldv9jl5ncHJRL9I17Bw88H8L4cnfVSuO:Pj+2RV9fdO6sSSVUn5uBw88qS
TLSH
T174E120789548CBBF74B677AC6C6888315AB2013B77BF68C710B95484050CF3482FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pu854q2a.default-release\sessionCheckpoints.json
Size 53B
SHA256 792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da
MD5 ea8b62857dfdbd3d0be7d7e4a954ec9a
SHA1 b43bc4b3ea206a02ef8f63d5bfad0c96bf2a3b2a
SHA512 076ee83534f42563046d25086166f82e1a3ec61840c113aec67abe2d8195daa247d827d0c54e7e8f8a1bbf2d082a3763577587e84342ec160ff97905243e6d19
TLSH
T10190024AC8590431DE42251823647B90A61E04A254250101526CBC88046B0155486483
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pu854q2a.default-release\sessionCheckpoints.json
Size 90B
SHA256 00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2
MD5 c4ab2ee59ca41b6d6a6ea911f35bdc00
SHA1 5942cd6505fc8a9daba403b082067e1cdefdfbc4
SHA512 71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2
TLSH
T1D4B01205C8181030CD43140873743B429B2E00B231500100317CF88C203B0134556883
MD5 SHA1 SHA512 TLSH

Submit Download

PaymentAdviseSwift0285.exe

Path C:\Users\Admin\AppData\Roaming\PaymentAdviseSwift0285.exe
Size 260KB
SHA256 12db648c3d516bb4210f37388077273757ea792168a6c32a9c0210cbfc7c01f9
MD5 c0214c5ac40753c905e4ecf9c4a8b48e
SHA1 8cbb0796cce9e55c5ad359ec5a9628a06908d627
SHA512 c0a4871de1c06b72d86a8eb51e5d6cd5f7daff21e1c4e16f20e866625f7b9ae2a2e6157ac5025817c7a0a6ee100aa9de7c09e4f0239b9c940e577db116b7133e
SSDEEP 6144:kcBvWb00fuvQJqjJ0VCbUG2wdSU8kjVHHT:tO0ouYJqjJSCbUdwdDjx
TLSH
T1D344121876E4D4A3C13102700F7A437B5BF25B240AF54B5B3B60EFAD7843A919E27A67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

markrens.sal

Path C:\Users\Admin\folkeviserne\markrens.sal
Size 62KB
SHA256 34ec84085f2016f4a128164de6444e34097cd49f3e1e55419ea7b4e831091321
MD5 29b1948f527f0e80a50ba378845400a2
SHA1 07c2fb30922922a8f1f808a907ca238cf0175767
SHA512 3878d679d2258f247dd41e9bf20300db076646c4e8365b8d2bf8367eb80d2fb8e24a93ec03b861a1bc685359f140f2a939967d3f00d72d47c9971f094d333f3b
SSDEEP 48:MiHploGM7pWawcQup00SpfXOb2mHhKLuhV/sBK7lkL2wxol:vpihVWaJpKEvhKLwlsgZkLZI
TLSH
T1A953091BBCF21639C1F3D606032F9004F30E34EB6817BC18261A0A9107DB28647F9CE5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/764-13-0x00000000009B0000-0x00000000009D5000-memory.dmp

Download

memory/764-11-0x00000000056F0000-0x000000000861D000-memory.dmp

Download

memory/764-12-0x0000000073CF5000-0x0000000073CF6000-memory.dmp

Download

memory/764-14-0x00000000056F0000-0x000000000861D000-memory.dmp

Download

memory/1692-1087-0x00000189292D0000-0x000001892933F000-memory.dmp

Download

memory/4040-1859-0x00000179F2ED0000-0x00000179F2F3F000-memory.dmp

Download

memory/5108-37-0x0000000037FE0000-0x0000000038092000-memory.dmp

Download

memory/5108-3153-0x0000000038D10000-0x0000000038DA2000-memory.dmp

Download

memory/5108-28-0x0000000000440000-0x00000000004FE000-memory.dmp

Download

memory/5108-3154-0x0000000038DC0000-0x0000000038DCA000-memory.dmp

Download

memory/5108-32-0x0000000004AC0000-0x0000000004AE5000-memory.dmp

Download

memory/5108-30-0x0000000037EE0000-0x0000000037F46000-memory.dmp

Download

memory/5108-29-0x0000000037730000-0x0000000037CD6000-memory.dmp

Download

memory/5108-15-0x0000000001760000-0x000000000468D000-memory.dmp

Download

memory/5108-27-0x0000000000440000-0x0000000001757000-memory.dmp

Download

memory/5108-60-0x0000000038260000-0x00000000382B0000-memory.dmp

Download

memory/5108-59-0x00000000382E0000-0x0000000038356000-memory.dmp

Download

memory/5108-3144-0x0000000038DD0000-0x0000000039127000-memory.dmp

Download

memory/5108-3143-0x0000000034E10000-0x0000000034E32000-memory.dmp

Download

memory/5108-38-0x0000000001760000-0x000000000468D000-memory.dmp

Download

memory/5108-62-0x00000000389F0000-0x0000000038A0E000-memory.dmp

Download

memory/5108-58-0x0000000038090000-0x0000000038252000-memory.dmp

Download

memory/5108-61-0x0000000038360000-0x000000003888C000-memory.dmp

Download

memory/5248-301-0x00000000006B0000-0x00000000006D5000-memory.dmp

Download

memory/5308-183-0x000002224B1F0000-0x000002224B22F000-memory.dmp

Download

memory/5552-1868-0x0000020C84DF0000-0x0000020C84E5F000-memory.dmp

Download

memory/5940-1028-0x0000000034D70000-0x0000000034D92000-memory.dmp

Download

memory/5940-1029-0x0000000034DA0000-0x0000000034DB9000-memory.dmp

Download

memory/5940-1030-0x0000000034DC0000-0x0000000034DE0000-memory.dmp

Download

memory/5940-1027-0x00000000048C0000-0x00000000048E5000-memory.dmp

Download

memory/6388-1050-0x0000013F60D60000-0x0000013F60DCF000-memory.dmp

Download